text: The costs to eliminate or address the foregoing security threats and vulnerabilities before or after a cyber incident could be significant. Our remediation efforts may not be successful and could result in interruptions, delays or cessation of service, and the loss of existing or potential suppliers or customers. In addition, breaches of our security measures and the unauthorized dissemination of sensitive personal, proprietary or confidential information about the Company, our business partners or other third parties could expose us to significant potential liability and reputational harm. As threats related to cyber-attacks develop and grow, we may also find it necessary to make further investments to protect our data and infrastructure, which may impact the Company's results of operations. In case of a cyber-attack, the Company may suffer losses that could have a material adverse effect on its business. As a global enterprise, we could also be negatively impacted by existing and proposed laws and regulations, and government policies and practices related to cybersecurity, data privacy, data localization and data protection. In addition, our customers may encourage, or require, compliance with certain security standards, such as the voluntary cybersecurity framework released by the National Institute of Standards and Technology (NIST), which consists of controls designed to identify and manage Cybersecurity risks, and we could be negatively impacted to the extent we are unable to comply with such standards. Our business is subject to cybersecurity risks.


text: Our operations are increasingly dependent on information technologies and services. Threats to information technology systems associated with cybersecurity risks and cyber incidents or attacks continue to grow, and include, among other things, storms and natural disasters, terrorist attacks, utility outages, theft, viruses, phishing, malware, design defects, human error, or complications encountered as existing systems are maintained, repaired, replaced, or upgraded. Risks associated with these threats include, among other things: • Theft or misappropriation of funds; • loss, corruption, or misappropriation of intellectual property, or other proprietary or confidential information (including customer, supplier, or employee data); • disruption or impairment of our and our customers' business operations and safety procedures; • damage to our reputation with our customers and the market; • exposure to litigation; • loss or damage to our worksite data delivery systems; and • increased costs to prevent, respond to or mitigate cybersecurity events.

companyName: Omnitek Engineering Corp

ticker: OMTK

secItem: Item 1C


text: Although we utilize various procedures and controls to mitigate our exposure to such risk, cybersecurity attacks and other cyber events are evolving and unpredictable. Moreover, we have no control over the information technology systems of our customers, suppliers, and others with which our systems may connect and communicate. As a result, the occurrence of a cyber incident could go unnoticed for a period of time.


text: We do not presently maintain insurance coverage to protect against cybersecurity risks. If we procure such coverage in the future, we cannot ensure that it will be sufficient to cover any particular losses we may experience as a result of such cyber-attacks. Any cyber incident could have a material adverse effect on our business, financial condition and results of operations. A cybersecurity incident could negatively impact our business and our relationships with customers and expose us to litigation risk.


text: We use computers in substantially all aspects of our business operations. We also use mobile devices, social networking and other online activities to connect with our employees and our customers. Such uses give rise to cybersecurity risks, including security breach, espionage, system disruption, theft and inadvertent release of information. Our business involves the storage and transmission of numerous classes of sensitive and/or confidential information and intellectual property, including customers' personal information, private information about employees, and financial and strategic information about the Company and its business partners. We also rely on a Payment Card Industry compliant third party to protect our customers' credit card information. While we have implemented measures to prevent security breaches and cyber incidents, our preventative measures and incident response efforts may not be entirely effective. The theft, destruction, loss, misappropriation, or release of sensitive and/or confidential information or intellectual property, or interference with our information technology systems or the technology systems of third parties on which we rely, could result in business disruption, negative publicity, brand damage, violation of privacy laws, loss of customers, potential litigation and liability and competitive disadvantage.


text: Risk Assessment and Management We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: AXIM BIOTECHNOLOGIES, INC.

ticker: AXIM


text: The company has an ERM program to identify, evaluate, and manage risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program to align cybersecurity efforts with the company's broader business goals and objectives. We believe that integrating cybersecurity risks into our ERM program fosters a proactive and holistic approach to cybersecurity, which helps safeguard the company's operations, financial condition, and reputation in an ever-evolving threat landscape.


text: The company maintain a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems. Keep in mind we are a small company with limited exposures. As such we rely on traditional bookkeeping and reconciliations to discover any cybersecurity issues.


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, had not materially affected the company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our company. Our systems, infrastructure or data, or those used by our CROs, CMOs, clinical sites or other contractors or consultants, may or may be perceived to fail or suffer a cyberattack, security breach or other incident, including a breakdown or compromise of the confidentiality, integrity and availability of our systems, networks or data, which could adversely affect the operation of our business and reputation.


text: Incident Response The company does not have a dedicated incident management team responsible for managing and coordinating its cybersecurity incident response efforts. We have limited exposure to cybersecurity risks. We are a small company.


text: Board Oversight Role Our Board of Directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The Audit Committee (the Committee) of the Board of Directors oversees our cybersecurity and data privacy. The Committee meets periodically to review and discuss with management risks relating to significant cybersecurity matters and concerns involving the company, including information security, data privacy, backup of information systems and related regulatory matters and compliance. The Committee regularly reports to the Board of Directors with respect to the Committee's activities and recommendations, including those relating to cybersecurity matters and concerns. The company provides reports to the Committee on information security matters, including the adequacy and effectiveness of the company's information security policies and practices and the internal controls regarding information security, and notifies the chairperson of the Committee as soon as practicable of significant information security matters and concerns as they arise on a periodic basis.


text: Management's Role The company does not have a dedicated cybersecurity organization within its technology department that focuses on current and emerging cybersecurity matters.


text: Use of Third Parties Oversight of Third-Party Service Providers The company uses third-party service providers to support its operations and many of its technology initiatives, and evaluates its third-party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture or a recommendation of specific mitigation controls. Following such evaluation, the company determines and prioritizes service provider risk based on the potential threat impact and likelihood, and such risk determination drives the level of due diligence and ongoing compliance monitoring required for each service provider.


text: The safeguarding of our digital and physical assets against cybersecurity threats is a cornerstone of our operational integrity and reliability. Recognizing the sophisticated and ever-evolving nature of cyber threats, we have instituted a robust cybersecurity framework that not only aims to protect our systems and data but also ensures the resilience of our operations against potential cyber-attacks.

companyName: AIBOTICS, INC.

ticker: AIBT


text: Cybersecurity Protocols and Practices AIBotics employs a multi-layered cybersecurity strategy that encompasses various protocols and best practices, designed to defend against a wide array of cyber threats:


text: Multifactor Authentication (MFA): To ensure the security of user accounts, we implement MFA across our digital platforms. This approach adds an additional layer of security by requiring two or more verification factors, significantly reducing the risk of unauthorized access.


text: Limited Physical Access to Local Servers and Company's NAS: We enforce strict physical security measures to safeguard our local servers and Network Attached Storage (NAS) devices. Access to these critical assets is restricted to authorized personnel only, thereby mitigating the risk of physical tampering or data theft.


text: Employee Training for Cybersecurity: Recognizing that human error can often be a cybersecurity vulnerability, we provide comprehensive cybersecurity training to our employees. This training covers essential practices such as recognizing phishing attempts, securing sensitive information, and adhering to our internal cybersecurity policies.


text: Credential Management and Rotation: To prevent unauthorized access stemming from compromised credentials, we implement rigorous credential management and rotation policies. These measures include regularly updating passwords and access keys, ensuring that former employees' access rights are promptly revoked, and employing advanced credential management systems.


text: Anti-Phishing Training: Our employees undergo targeted anti-phishing training to identify and respond appropriately to phishing attempts. This training is crucial in cultivating a vigilant and informed workforce capable of recognizing and thwarting phishing attacks.


text: Periodical Viruses Analysis: We conduct regular scans and analyses for viruses and malware across our network. This proactive approach enables us to detect and neutralize potential threats before they can inflict harm.


text: Software with Latest Security Updates: Our IT infrastructure is maintained with up-to-date software, including the latest security patches. This policy helps protect against vulnerabilities that could be exploited by cybercriminals.


text: Avoid Sharing Confidential Files Outside the Organization: We enforce strict data handling policies to prevent the sharing of confidential files outside the organization. This includes the use of encrypted communication channels and secure data storage solutions.


text: Scanning Third-Party Emails and Attachments: To mitigate the risk of email-based threats, all incoming emails and attachments from third parties are scanned for malicious content. This ensures that potentially harmful materials are identified and quarantined before they can reach the end user.


text: IT Staff Authorization for Software Installations and Updates: To maintain the integrity of our IT environment, only authorized IT staff are permitted to install or update software on the company's computers. This control prevents the introduction of unauthorized or potentially malicious software.


text: Additional Measures and Good Practices In addition to the aforementioned protocols, we are committed to continuous improvement and adaptation of our cybersecurity measures to counter new threats. This includes engaging in threat intelligence sharing with industry partners, conducting regular cybersecurity risk assessments, and implementing a comprehensive incident response plan to quickly address and mitigate the impact of any cybersecurity incidents.


text: Governance and Oversight Our cybersecurity strategy is governed by a dedicated cybersecurity team, under the leadership of the Chief Information Security Officer (CISO). This team is responsible for the continuous monitoring and improvement of our cybersecurity posture. Furthermore, our Board of Directors regularly reviews our cybersecurity strategies and policies, ensuring they align with our overall business objectives and the evolving cybersecurity landscape.


text: Our company prioritizes cybersecurity to safeguard our systems, networks, and data. Despite our efforts, we recognize the evolving nature of cyber threats and remain vigilant in addressing potential risks.

companyName: Glidelogic Corp.

ticker: GDLG


text: 1). Network and Data Security: We employ firewalls and access controls to protect our infrastructure and sensitive information from unauthorized access. 2). Regular Security Assessments: We conduct security reviews to identify and resolve potential system weaknesses. 3). Employee Awareness: Our employees are constantly reminded to keep full awareness of cybersecurity risks and best practices. 1). Cyber Attacks: Our systems could be compromised by cyber-attacks, potentially leading to data loss or operational disruption. 2). Data Breaches: There is a risk of unauthorized access to confidential customer and employee data. 1). Incident Response: We maintain an incident response plan to quickly address and minimize cybersecurity incidents.


text: 2). Safeguard of Information: Our business communication and document sharing are mainly conducted via online platforms such as Amazon Web Service (AWS) and various Google Services, which each has its only cybersecurity measurements. All the important business information and documents have offline backup storage as well for safekeeping.


text: Cybersecurity Risk Management and Strategy The cybersecurity risk management program, processes and strategy described in this section are limited to the personal and business information belonging to or maintained by the Company (collectively, "Confidential Information"), our own third-party critical systems and services supporting or used by the Company (collectively, "Critical Systems"), and service providers.

companyName: New Asia Holdings, Inc.

ticker: NAHD


text: We expect to develop and implement a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our Confidential Information and Critical Systems. Our cybersecurity risk management program will be integrated into our overall enterprise risk management program and is expected to include a cybersecurity incident response plan.


text: Our cybersecurity risk management program is expected to include: risk assessments designed to help identify material cybersecurity risks to our Confidential Information, Critical Systems and the broader enterprise IT environment;


text: a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; cybersecurity awareness and spear-phishing resistance training of our employees, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a vendor management policy for service providers.


text: Cybersecurity Governance Our executive management team, along with our managed information technology service provider, is responsible for assessing and managing risks from cybersecurity threats to the Company, including our Confidential Information and Critical Systems.


text: Our Board considers cybersecurity risk as part of its risk oversight function and oversight of cybersecurity and other information technology risks. Our Board oversees management's implementation of our planned cybersecurity risk management program. Our executive management team is responsible for updating the Board, as necessary, regarding significant cybersecurity incidents. Our Board shall also receive periodic reports from management on our cybersecurity risks and cybersecurity risk management program.


text: The Company recognizes the importance of developing, implementing and maintaining cybersecurity measures to better safeguard our information systems and protect the confidentiality, integrity and availability of our data. Our management team will work to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have not been subject to cybersecurity challenges that have materially impaired our operations or financial standing. In the future, the Company will require the Board and employees to complete cybersecurity training related to the physical security of assets, data privacy and other information security policies and procedures.

companyName: Mexus Gold US


text: The Company implemented commercially available defenses against cybersecurity threats when it began relying on the internet 30 years ago. The Company does not have formal processes for identifying cybersecurity risks associated with third-party service providers. A successful attack on the Company could result in a delay in required filings with the SEC and in financial losses from attacks on bank accounts. The board of directors relies on the Company's president to identify material risks and to implement reasonable defenses. The president informs the board about such risks. The president receives direct and immediate notification of cybersecurity incidents and personally monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. The president does not have formal training in cybersecurity.

companyName: ALTEX INDUSTRIES INC

ticker: ALTX


text: Risk Management and Strategy The Company considers cybersecurity to be an important part of its overall business strategy and risk management. UTMD continuously monitors its information systems to assess, identify and manage risks from both inside and outside forces. Functional modules are fully-integrated, which provides for transaction checks and balances. Software systems have been validated for effectiveness of intended uses. Policies and procedures have been implemented which all employees acknowledge in writing, and agree to follow as a condition of employment. Access is documented and controlled by business function. Regular employee user training is conducted to promote awareness of outside threats and the importance of following procedures.

companyName: UTAH MEDICAL PRODUCTS INC

ticker: UTMD


text: UTMD utilizes state-of-art cybersecurity devices and software to timely identify and prevent intrusion from external actors. The corporate information systems operations manager continuously monitors activity, and reports weekly to the CEO. Additional sources for assessing security effectiveness are annual outside audits of the information technology environment, risk and performance assessments provided by vendors of the routers and firewalls used by the Company and the news media.


text: There have been no events in at least the last thirty-two years that have been considered material enough to warrant changes to systems, processes or controls.


text: The Governance Committee of the Board of Directors maintains overall responsibility to oversee and assess the effectiveness of the Company's cybersecurity strategy. The Board meets quarterly and any potential threats are reviewed and discussed at that time, unless the information systems team and/or the CEO decide earlier notification is warranted.


text: During the year ended December 31, 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. See "Item 1A. Risk Factors" for more information regarding the Company's cybersecurity-related risks.

companyName: LFTD PARTNERS INC.

ticker: LIFD


text: Risk management and strategy We have limited exposure to cybersecurity threats. We have established policies and processes, identifying and managing material risk from cyber security threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Free Flow USA, Inc.

ticker: FFLO


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably Address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. The primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our Chief Executive Officer will employ the expertise of an IT consultant in the event that risk management assessment warrants.


text: As part of our overall risk management system, our CEO will monitor and test our safeguards in collaboration with outside IT consultants.


text: We will engage consultants or other third parties in connection with our risk assessment processes. These service providers will assist us in designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to IA, "Risk Factors", in the annual report on Form 10–K.


text: We maintain informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors and chief executive officer are responsible for monitoring and assessing strategic risk exposure, the day-to-day management of the material risks we face. Our board of directors and executive officer administer our cybersecurity risk oversight regarding third-party providers.


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and reasonably address any identified gaps in existing safeguards. IT leadership reports to our CEO and CFO to manage the risk assessment and mitigation process. We monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. We promote a company-wide culture of cybersecurity risk management. This ensures that the senior management are kept abreast of the cybersecurity posture and potential risks faced by the Company. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing during the financial year ended December 31, 2024.

companyName: CFN Enterprises Inc.

ticker: CNFN


text: Spectral maintains a comprehensive cybersecurity risk management program designed to identify, protect against, detect, respond to, and mitigate reasonably foreseeable cybersecurity threats to the Company's operations. This program incorporates internal controls and safeguards aligned with industry standards – including access controls, data encryption, network monitoring, and employee cybersecurity training – to protect the confidentiality, integrity, and availability of the Company's information assets. We utilize a range of security tools and procedures to continuously monitor our systems and prevent unauthorized access or data loss. In addition, the Company has implemented a formal incident response plan that outlines procedures for promptly addressing and containing cybersecurity incidents. This incident response plan is tested and updated periodically (e.g., through tabletop simulations and third-party penetration testing) to ensure preparedness and effective remediation of any identified security events.

companyName: SPECTRAL CAPITAL Corp

ticker: FCCN


text: Oversight and Governance: Cybersecurity risk management is overseen at the highest levels of the Company's leadership. The Board of Directors, through its Audit Committee, is responsible for monitoring the Company's cybersecurity risks and related risk management practices. The Audit Committee receives regular reports from management on cybersecurity matters, including updates on risk assessments, security improvements, and any relevant threat developments or incidents. Senior management has designated personnel (including information technology and security officers) to manage day-to-day cybersecurity operations and to implement cybersecurity policies, controls, and procedures. These personnel regularly brief the Audit Committee and the Board on the status of the Company's cybersecurity posture and risk mitigation activities. The Company also provides periodic cybersecurity training to all employees to reinforce security awareness and protocol compliance as part of its internal control framework.


text: Risk Management Processes: Spectral conducts regular assessments of cybersecurity vulnerabilities and emerging threats across its systems and products. Our risk management approach draws on widely accepted frameworks (such as the NIST Cybersecurity Framework) to prioritize risks and guide the implementation of appropriate security measures. We engage independent security experts to perform evaluations of our cybersecurity program – including periodic third-party security audits and penetration testing – in order to test the effectiveness of our safeguards and to identify areas for improvement. Additionally, the Company maintains a third-party risk management program that assesses and monitors the cybersecurity practices of critical vendors and partners, helping ensure that our service providers uphold robust data security standards. Findings from these ongoing risk assessments and tests are used to continually enhance our internal controls and cybersecurity defenses.


text: As of the date of this Annual Report, the Company has not experienced any known cybersecurity incidents that had a material effect on our business, operations, or financial condition. During the reporting period, no cybersecurity breach or attack has been identified that resulted in significant data loss, financial costs, or operational disruptions for Spectral. Nevertheless, cybersecurity threats continue to evolve rapidly, and no security program can guarantee absolute protection against all attacks. A significant cybersecurity incident in the future could potentially cause substantial harm to the Company, including business interruptions, remediation costs, reputational damage, loss of sensitive information, or legal and regulatory consequences. Spectral remains proactive in updating and strengthening its cybersecurity measures in light of new threats and technological changes. For further information on the risks associated with cybersecurity and data protection, refer to the "Risk Factors" section of this Annual Report (Item 1A) which discusses these risks in more detail.


text: Our board of directors and senior management recognize the critical importance of maintaining the trust and confidence of our clients, business partners and employees. Our management, led by our Chief Executive Officer, is actively involved in oversight of our risk management efforts, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). Our cybersecurity processes and practices are fully integrated into the Company's ERM efforts. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: APPlife Digital Solutions Inc

ticker: ALDS


text: Risk Management and Strategy As one of the critical elements of our overall ERM approach, our cybersecurity efforts are focused on the following key areas: Governance: Management oversees cybersecurity risk mitigation and reports to the board of directors any cybersecurity incidents.


text: Collaborative Approach: We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-virus and anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: We have not engaged third-party service providers to conduct evaluations of our security controls, independent audits or consulting on best practices to address new challenges.


text: While we have not experienced any cybersecurity threats in the past in the normal course of business, in the future, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.


text: To date, due to our limited financial resources, we have not adopted any special processes for assessing, identifying, and managing material risks from cybersecurity threats to the Company or through our use of any third-party service provider, and we have not engaged any assessors, consultants, auditors, or other third parties in connection with such risks. We are not aware of any previous cybersecurity incidents involving the Company and we do not believe cybersecurity risks have materially affected us or our strategy, results of operations or financial condition. Our president, who is also our sole director and sole employee, is responsible for the oversight of risks from cybersecurity threats and is informed about such risks because of his direct participation in the Company's operations, transactions, and relationships. Our president has no prior work experience in cybersecurity and no relevant degrees, certifications, knowledge, skills, or other background in cybersecurity. Although we face cybersecurity risks, we believe such risks are reduced by the nature of our operations in which our product sales are made and payments are received through eBay and our website and email systems are maintained by third parties. We do not independently maintain any servers or other extensive information systems and correspondence and other business information is stored on our president's computer system, which is not on a network and is protected by a third-party virus protection program. We may be unable to successfully identify threats, prevent attacks, satisfactorily resolve cybersecurity incidents, or implement adequate mitigating controls. Any breach of our or our providers information systems or other cybersecurity-related incidents that results in, or may result in, the loss, theft or unauthorized disclosure of data, or any delay in determining the full extent of a potential breach, could have a material adverse impact on our business, results of operations, and financial condition, including harm to our reputation and brand, reduced demand for our products, time-consuming and expensive litigation, fines, penalties, and other damages.

companyName: Outdoor Specialty Products, Inc.

ticker: ODRS


text: Our operations and other aspects of our business rely heavily on various information technology systems which are largely managed by third parties. We face significant cybersecurity threats, which are continuously increasing in sophistication, including computer viruses, internal and external security breaches, and other cyber-attacks. These threats could disrupt our operations, lead to the loss of confidential information, and hinder our ability to accurately report our financial results in a timely manner. We have adopted a Cybersecurity Policy to create effective administrative, technical, electronic, and physical protections to safeguard the personal information of Company personnel, confidential information concerning our portfolio investments and the integrity of the Company's information systems.

companyName: EQUUS TOTAL RETURN, INC.

ticker: EQS


text: We have created an Information Security Team, consisting of our Chief Financial Officer and our Chief Compliance Officer, to implement and administer our Cybersecurity Policy. Among the duties and responsibility of our Information Security Team are the following: Ensuring that all Equus personnel are aware of the Cybersecurity Policy and agree to adhere to its requirements; Establishing that information concerning the Fund is stored on encrypted cloud-based servers accessible only by authorized Equus personnel;


text: Providing that all of the Company's information systems are backed up daily, with offline copies available in the event that a major security issue arises; Testing and evaluating cybersecurity safeguards via the use of third-party information technology service providers;


text: Reviewing the security measures in the Company's Cybersecurity Policy annually or when there is a change in applicable laws or regulations or in business activities of Equus; and Conducting training as necessary for all Equus personnel; and Reporting cybersecurity matters to our Board of Directors who provide oversight of our Information Security Team.


text: We utilize third-party services and tools for identifying, protecting against, and detecting cyber incidents, and also partner with external vendors to augment our internal security capabilities. Additionally, we engage third-parties to conduct independent assessments of our cybersecurity infrastructure to evaluate the efficiency and effectiveness of our detection capabilities, along with our response mechanisms, and overall risk management.


text: Our approach to managing cybersecurity risks is part of a continuous improvement process, both in the context of cybersecurity and broader operational risk management. This ongoing process, which includes personnel training, is aimed at routinely reviewing and, as necessary, improving, our oversight processes and tools to ensure they remain effective and resilient in their management of cybersecurity risk.


text: Material Impact of Cybersecurity Threats While we have yet to experience a material cybersecurity event, we acknowledge the persistent and evolving nature of these threats, which have the potential to materially impact our business strategy, operations, and financial results adversely. We maintain robust policies and procedures focused on cybersecurity incident management, ensuring timely communication and escalation to all relevant stakeholders. This enables faster response and effective communication, including public disclosure if a material cybersecurity event were to occur.


text: Board of Directors Oversight Our Board of Directors oversees risks related to cybersecurity, including the security of our corporate, financial, and portfolio investment information and the steps management is taking to monitor and control these risks. Our Chief Compliance Officer conducts regular meetings with our independent directors to discuss various compliance matters, including any cybersecurity issues, and also delivers a comprehensive Annual Compliance Report to the Board, which report also addresses cybersecurity matters.


text: We have implemented a cross-departmental approach to managing cybersecurity risk, which includes seeking input from our employees, management, third-party vendors, the Audit Committee of the Board of Directors (the "Audit Committee"), and the Board of Directors. We devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and response. To more effectively address cybersecurity threats, we have a dedicated Chief Information Security Officer ("CISO") who is responsible for leading enterprise-wide information security strategy, policy, process, and technology. Our current CISO has 20+ years of information security and risk management experience and holds a Certified Information Systems Security Professional (CISSP) certification. Our CISO regularly briefs our Audit Committee on our cybersecurity and information security program and cybersecurity incidents deemed to pose a risk of a critical business impact or reputational harm. Our cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. Our information security team, comprised of employees with an expertise in cybersecurity and information technology, regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection, and response.

companyName: ALIGN TECHNOLOGY INC

ticker: ALGN


text: Our information security program includes, among other things, cybersecurity incident response, vulnerability management, antivirus and malware protection, technology compliance and risk management, encryption, identity and access management, application security, and security monitoring. The program also has an information security awareness program, which includes annual training regarding our acceptable use and information classification and handling policies, regular phishing campaigns complemented by additional employee training as appropriate, and communications and companion trainings to keep our users informed on current events.


text: The information security program's ultimate goal is preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience to minimize the business impact should an incident occur. In the event of an identified cybersecurity incident, we have developed a detailed cybersecurity incident response process, which outlines the steps to be followed from incident detection, analysis, containment, eradication, recovery, and notification, including notifying functional areas (e.g. information technology, legal, finance, operations, privacy), as well as senior leadership and the Audit Committee, as appropriate. For critical cybersecurity incidents, processes have been established for our legal team to determine the materiality of each incident.


text: Our information security team engages third-party services to conduct evaluations of our security controls, including penetration testing and independent audits. Annually, an external auditor conducts a System and Organization Controls ("SOC") type 2 audit covering the security principle for systems supporting our products.


text: Our assessment of risks associated with the use of third-party vendors is part of our overall cybersecurity risk management framework. If a third-party vendor is unable to provide a SOC 1 or SOC 2 report, our information security team takes additional steps to assess their cybersecurity preparedness and our initiation or continued engagement with them. Additionally, third-party vendors are required to include security and privacy addendums to our contracts where applicable and are reassessed periodically as necessary depending on the risk level that has been assigned to the third-party vendor. Our legal team also requires that our third-party vendors report cybersecurity incidents to us so the impact of the incident on us can be assessed.


text: Our Audit Committee is responsible for reviewing cybersecurity risks and our cybersecurity program. It oversees and reviews our cybersecurity and other information technology risks, controls, policies, and procedures. Our information security team annually performs a cybersecurity enterprise risk assessment and presents the results to management and the Audit Committee. The Audit Committee periodically reports on its review of cybersecurity risks and our cybersecurity program to our Board of Directors. In 2023, our CISO or his team met with the Audit Committee four times to discuss cybersecurity risks and threats.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Notwithstanding the approach we take to cybersecurity, we may not successfully prevent or mitigate cybersecurity incidents that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be covered or, if covered, fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: We have implemented a cross-functional information security program to assess, identify and manage material risks from cybersecurity risk, which includes seeking input from our employees, management, third-party vendors, the Audit Committee of the Board of Directors ("Audit Committee") and the Board of Directors.


text: Our information security program's ultimate goal is preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience to minimize the business impact should an incident occur. In the event of an identified cybersecurity incident, we have developed a detailed cybersecurity incident response process, which outlines the steps to be followed from incident detection, analysis, containment, eradication, recovery and notification, including notifying functional areas (e.g. information technology, legal, finance, operations, privacy), as well as senior leadership and the Audit Committee, as appropriate. In certain instances, incidents are escalated to certain members of our legal team who are responsible for, among other things, the accurate and timely disclosure of material cybersecurity incidents required under federal securities laws, including making the materiality determination and approving related securities disclosures.


text: Risk Management and Strategy Our information security program devotes significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and response. Our information security program leverages the National Institute of Standards and Technology (NIST) and International Organization for Standardization (ISO) 27001 frameworks choosing to organize our cybersecurity risks into five categories: identify, protect, detect, respond and recover. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST and ISO frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our information security program is integrated into our overall enterprise risk management program. Our information security program includes, among other things: • cybersecurity incident response; • vulnerability management; • antivirus and malware protection; • technology compliance and risk management; • encryption; • identity and access management; • application security; and • security monitoring.


text: Our information security program also includes an information security awareness program, which includes annual training regarding our acceptable use and information classification and handling policies, regular phishing campaigns complemented by additional employee training as appropriate, and communications and companion trainings to keep users informed on current events.


text: Our assessment of risks associated with the use of third-party vendors is part of our overall cybersecurity risk management framework. If a third-party vendor is unable to provide a SOC 1 or SOC 2 report, our information security team takes additional steps to assess its cybersecurity preparedness and our initiation or continued engagement with it. Additionally, third-party vendors are required to include security and privacy addenda to our contracts where determined applicable and are reassessed periodically as necessary depending on the risk level that has been assigned to the third-party vendor. Our legal team also requires that our third-party vendors report cybersecurity incidents to us so the impact of the incident on us can be assessed.


text: As of the date of this Annual Report on Form 10-K, we have not identified any risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Notwithstanding the approach we take to cybersecurity, we may not successfully prevent or mitigate cybersecurity incidents that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be covered or, if covered, fully insured.


text: For a discussion of our cybersecurity-related risks, see Part I, Item 1A of this Annual Report on Form 10-K under the heading "Risk Factors."


text: Role of Management To more effectively assess and manage cybersecurity threats, we have a dedicated Chief Information Security Officer ("CISO") who is responsible for leading enterprise-wide information security strategy, policy, process, and technology. Our current CISO has 20+ years of information security and risk management experience and holds a Certified Information Systems Security Professional (CISSP) certification. Our CISO regularly briefs our Audit Committee on our cybersecurity and information security program and cybersecurity incidents deemed to pose a risk of a critical business impact or reputational harm.


text: Our information security team, comprised of employees with an expertise in cybersecurity and information technology, regularly assesses the threat landscape and takes a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and response. Our information security team annually performs a cybersecurity enterprise risk assessment and presents the results to management and the Audit Committee. In addition, our internal audit team conducts periodic audits of the Company's systems and cybersecurity processes, with findings reported to the Audit Committee and senior management.


text: Role of the Board of Directors and the Audit Committee Our Audit Committee has responsibility for overseeing and reviewing our cybersecurity, data privacy, and other information technology risks, controls and procedures, including our plans to mitigate cybersecurity risks and to respond to data breaches. Our Audit Committee also reviews with management any specific cybersecurity issues that could affect the adequacy of our internal controls and disclosure procedures and any public disclosures about our cybersecurity controls and procedures, the Board of Directors' cybersecurity expertise, and its oversight of cybersecurity risk. The Audit Committee periodically reports on its review of cybersecurity risks and our cybersecurity program to our Board of Directors. In 2024, our CISO or his team met with the Audit Committee four times to discuss cybersecurity risks and threats.


text: Cybersecurity Management & Strategy We manage information security risk through, and as part of, MetLife's Information Security Program (the "Program"), which institutes and maintains controls for the systems, applications, and databases of the Company and of its third-party providers. The primary goal of the Program is to protect the confidentiality, integrity and availability of all data MetLife owns or possesses, as well as its technology assets, through physical, technical, and administrative safeguards. This includes controls and procedures for monitoring, detecting, reporting, containing, managing, and remediating cyber threats. The Program aims to prevent data exfiltration, manipulation, and destruction, as well as system and transactional disruption. The Program's threat-centric and risk-based approach for securing the MetLife environment takes into consideration applicable guidelines from the cybersecurity framework developed by the U.S. Government's National Institute of Standards and Technology, and is managed by MetLife's CISO, in collaboration across lines of business and corporate functions. Our Board of Directors oversees the Program.

companyName: METLIFE INC

ticker: MET


text: The key features of the Program include: • A cybersecurity incident response team under the CISO's direction, which is responsible for monitoring and responding to threats, vulnerabilities, and incidents. • An incident response plan that is managed by the CISO and our Privacy Office and tested through cross-functional annual exercises in various geographical regions of the Company, many of which include participation from senior executives and the Board of Directors. • Information security policies and procedures that are reviewed at least annually and updated to reflect applicable changes in law, technology, practice and emerging threats. • Regular network and application testing and surveillance. • Periodic review of threats, vulnerabilities and other cybersecurity risks, internal and external. • Risk mitigation strategies, including annual internal and third-party risk assessments, as well as cybersecurity and privacy liability insurance intended to defray costs associated with an information security breach. • Vendor management procedures designed to identify and address potential risks associated with the use of third-party service providers. • Employee training programs on information security, data security, and cybersecurity practices and protection of data against cyber threats, at least annually. • A cross-functional approach to addressing cybersecurity risk, with participation from Global Technology & Operations, Risk, Compliance, Legal, Privacy and Internal Audit functions.


text: We also work with third parties, such as independent assessors (for example, for industry maturity assessments, penetration testing, application security reviews, and independent audits), external legal counsel and other consultants as part of the design and implementation of the Program. The Program is periodically evaluated by external experts, and the results of those reviews are reported to the Board of Directors.


text: During the period covered by this report, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect MetLife, including its business strategy, results of operations or financial condition. For further discussion of MetLife's risks related to cybersecurity, see "Risk Factors — Operational Risks — We May Fail to Protect the Confidentiality and Integrity of Our Data, Including As a Result of a Failure in Our Cybersecurity or Other Information Security Systems or Our Disaster Recovery Plans or Those of Our Vendors."


text: Cybersecurity Governance The CISO is a senior-level executive responsible for establishing and executing the Company's information security strategy. Management provides regular reports to the CISO detailing on-going cybersecurity risk management. The CISO and the head of Global Technology & Operations present updates to the Audit Committee quarterly and, as necessary, to our full Board of Directors. These regular reports include updates on our performance preparing for, preventing, detecting, responding to and recovering from cyber incidents. The Audit Committee also reviews with management, as necessary, but at least annually, the adequacy and effectiveness of the Company's policies and internal controls regarding information security and cybersecurity. Additionally, the CISO periodically and on an event-driven basis informs and updates the Board of Directors about information security incidents and the related risks posed to the Company.


text: The CISO, who oversees an organization that supports the day-to-day operation of the Program, is qualified in the areas of data protection and cybersecurity, having more than twenty years of professional IT experience in financial services. Prior to his current role, the CISO previously served as MetLife's Global Chief Technology Officer with accountability for the Company's global infrastructure, engineering, service operations, quality assurance, application maintenance, and production management functions; he also served variously as the chief technology officer, CISO, chief information officer and global head of telecommunications engineering at other financial institutions prior to joining MetLife in 2012.


text: Cybersecurity Management & Strategy We manage information security risk through, and as part of, MetLife's Information Security Program (the "Program"), instituted to maintain controls for the systems, applications, and databases of the Company and of its third-party providers. The primary goal of the Program is to protect the confidentiality, integrity and availability of all data MetLife owns or possesses, as well as its technology assets, through physical, technical, and administrative safeguards. This includes controls and procedures across business units and at the enterprise level for monitoring, detecting, reporting, containing, managing, and remediating cyber threats. The Program aims to prevent data exfiltration, manipulation, and destruction, as well as system and transactional disruption. The Program's threat-centric and risk-based approach for securing the MetLife environment takes into consideration applicable guidelines from the cybersecurity framework developed by the U.S. Government's National Institute of Standards and Technology along with the sensitivity of the systems and the potential severity of the associated risks to MetLife and its relevant lines of business, and is managed by MetLife's CISO, collaborating with lines of business and corporate functions. Our Board of Directors oversees the Program.


text: The key features of the Program include: • A cybersecurity incident response team under the CISO's direction, which is responsible for monitoring and responding to threats, vulnerabilities, and incidents. • An incident response plan that is managed by the CISO and the Chief Privacy Officer and tested through cross-functional annual exercises in various geographical regions of the Company, many of which include participation from senior executives and the Board of Directors. • Information security policies and procedures that are reviewed at least annually and updated to reflect applicable changes in law, technology, practice and emerging threats. • Regular network and application testing and surveillance. • Periodic review of threats, vulnerabilities and other cybersecurity risks, internal and external. • Risk mitigation strategies, including annual internal and third-party risk assessments, as well as cybersecurity and privacy liability insurance intended to defray costs associated with an information security breach. • Vendor management procedures designed to identify and address potential risks associated with the use of third-party service providers. • Employee training programs on information security, data security, and cybersecurity practices and protection of data against cyber threats, at least annually. • A cross-functional approach to addressing cybersecurity risk, with participation from Global Technology & Operations, Risk, Compliance, Legal, Privacy and Internal Audit functions.


text: During the period covered by this report, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect MetLife, including its business strategy, results of operations or financial condition. For further discussion of MetLife's risks related to cybersecurity, see "Risk Factors — Operational Risks — We May Fail to Protect the Confidentiality, Integrity or Availability of Our Systems or Data, Including As a Result of a Failure in Our Cybersecurity or Other Information Security Systems or Our Disaster Recovery Plans or Those of Our Vendors."


text: Cybersecurity Governance The CISO is a senior-level executive responsible for establishing and executing the Company's information security strategy. Management provides regular reports to the CISO detailing on-going cybersecurity risk management. The CISO and the head of Global Technology & Operations present updates to the Audit Committee quarterly and, as necessary, to the full Board of Directors. These regular reports include updates on our performance preparing for, preventing, detecting, responding to and recovering from cyber incidents. The Audit Committee also reviews with management, as necessary, but at least annually, the adequacy and effectiveness of the Company's policies and internal controls regarding information security and cybersecurity. Additionally, the CISO periodically and on an event-driven basis informs and updates the Board of Directors about information security incidents and the related risks posed to the Company.


text: Risk Management and Strategy Our Information Security team manages Edwards' Information Security Program, which is focused on assessing, identifying, and managing cyber risk and information security threats. We evaluate cybersecurity risk on an ongoing basis, and it is a risk monitored through our overall enterprise risk management program, including by the executive leadership and the board of directors, described below under "Governance."

companyName: Edwards Lifesciences Corp

ticker: EW


text: To proactively manage cybersecurity risk in our organization, our management team has instituted an Edwards Information Technology Security Policy that is available to all employees through the employee handbook and on our intranet. We also conduct regular cybersecurity awareness and training campaigns for existing employees. Internal and external stakeholders can access the Edwards Integrity Helpline 24/7 online or by phone, to report any security incidents for escalation. We also disclose information about our product security and provide relevant contact information for our stakeholders to report any product vulnerabilities.


text: To proactively identify, mitigate, and prepare for potential cybersecurity incidents, we maintain both a business continuity plan and cyber incident response plan with formalized workflows and playbooks. We periodically conduct simulation exercises involving employees at various levels of the organization. We also periodically engage external partners to conduct annual audits of our systems, and test our IT infrastructure. Through these channels and others, we work to proactively identify potential vulnerabilities in our information security system. We recognize that we are exposed to cybersecurity threats associated with our use of third-party service providers. To minimize the risk and vulnerabilities to our own systems stemming from such use, our Information Security team identifies and addresses known cybersecurity threats and incidents at third-party service providers on a continuous basis. In addition, we strive to minimize cybersecurity risks when we first select or renew a vendor by including cybersecurity risk as part of our overall vendor evaluation and due diligence process.


text: We have not had previous cybersecurity incidents that have materially affected us. Our risks associated with cybersecurity threats are set forth under "Risk Factors" in Part I, Item 1A in this report.


text: Our Board of Directors and our Audit Committee oversee our enterprise-wide risk management, including with respect to cybersecurity. Our Chief Financial Officer presents information on our enterprise-wide risks to the Board of Directors at each of its regularly scheduled meetings. Our SVP, Enterprise Risk Management presents to our Board of Directors and our Audit Committee at least once a year on our significant enterprise-wide risks as well as our enterprise-wide risk program. In addition, our Chief Information Officer ("CIO") and our Chief Information Security Officer ("CISO") present to the Audit Committee at each regularly scheduled Audit Committee meeting on information technology infrastructure as well as risks related to cybersecurity and information security.


text: The oversight of our cybersecurity program at the management level rests with the Executive Leadership Team ("ELT") who has designated the CISO to lead and execute on the cybersecurity program. The CISO provides regular updates to the executive leadership team, including the CEO, on our cybersecurity program and cybersecurity risks. Our cybersecurity leaders have extensive experience in cybersecurity, including in consulting and corporate roles at Forbes 100 companies and experience leading security incident detection and response, security architecture, and strategy programs.


text: Finally, management has instituted our Information Security Council and Enterprise Risk Management Council both of which are made up of senior leaders of the Company. The Information Security Council is tasked with overseeing information security matters at Edwards, including cybersecurity. This council serves as an escalation point for issues requiring concerted action, and in turn, informs executive management regarding information security and cybersecurity risks and issues. The Enterprise Risk Management Council is tasked with proactive management of our enterprise-wide risks, including information security risks that also include cybersecurity. This council is responsible for assessing, and providing input into, the enterprise risks that are presented to the Board of Directors.


text: Risk Management and Strategy Our Information Security team manages Edwards' Information Security Program, which is focused on assessing, identifying, and managing cybersecurity risk and information security threats. We evaluate cybersecurity risk on an ongoing basis, and it is a risk monitored through our overall enterprise risk management program, including by the executive leadership and the Board of Directors, described below under Governance.


text: To proactively identify, mitigate, and prepare for potential cybersecurity incidents, we maintain both a business continuity plan and cyber incident response plan with formalized workflows and playbooks. We periodically conduct simulation exercises involving employees at various levels of the organization. We also periodically engage external partners to conduct annual audits of our systems and test our IT infrastructure. Through these channels and others, we work to proactively identify potential vulnerabilities in our information security system. We recognize that we are exposed to cybersecurity threats associated with our use of third-party service providers. To minimize the risk and vulnerabilities to our own systems stemming from such use, our Information Security team identifies and addresses known cybersecurity threats and incidents at third-party service providers on a continuous basis. In addition, we strive to minimize cybersecurity risks when we first select or renew a vendor by including cybersecurity risk as part of our overall vendor evaluation and due diligence process.


text: Based on information known to us, we do not believe any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Our risks associated with cybersecurity threats are set forth under "Risk Factors" in Part I, Item 1A in this report.


text: Our Board of Directors and our Audit Committee oversee our enterprise-wide risk management, including with respect to cybersecurity. Our Chief Financial Officer presents information on our enterprise-wide risks to the Board of Directors at each of its regularly scheduled meetings. Our Senior Vice President ("SVP"), Enterprise Risk Management presents to our Board of Directors and our Audit Committee at least once a year on our significant enterprise-wide risks as well as our enterprise-wide risk program. In addition, our Chief Information Security Officer ("CISO") meets regularly with the Audit Committee on risks related to cybersecurity and information security.


text: Finally, management has instituted our Information Security Council and Enterprise Risk Management Council both of which are made up of senior leaders of the Company. The Information Security Council is tasked with overseeing information security matters at Edwards, including cybersecurity. This council serves as an escalation point for issues requiring concerted action, and in turn, informs executive management regarding information security and cybersecurity risks and issues. The Enterprise Risk Management Council is tasked with proactive management of our enterprise-wide risks, including information security risks that also include cybersecurity. This council is responsible for assessing and providing input into the enterprise risks that are presented to the Board of Directors.


text: Cybersecurity Risk Management and Strategy Charles River places high importance on identifying and eliminating potential cybersecurity threats to its employees, customers, IT infrastructure, proprietary technologies and confidential information.

companyName: CHARLES RIVER LABORATORIES INTERNATIONAL, INC.

ticker: CRL


text: Our cybersecurity risk management is based on recognized industry governance frameworks, including the International Organization for Standardization (ISO), the National Institute of Standards and Technology (NIST), the Center for Internet Security Controls (CIS), and the Cloud Security Alliance (CSA). We use these frameworks together with information collected from internal and 3rd party assessments to develop policies such as our technology acceptable use policy for information assets, our access requirements for data, systems, or technologies, and policies for the protection and use of personal information of our employees and customers. We protect our IT assets through industry-standard techniques such as multifactor authentication, malware defenses, network and endpoint monitoring, and access review processes. We also work with our business units to leverage and implement foundational cybersecurity principles, such as security by design, defense-in-depth, least privilege, and resilience-focused backups, throughout our organization. We deliver cybersecurity awareness and confidential information protection training to our employees, and we send our employees ethical simulated phishing and spear-phishing emails to test their compliance with our policies.


text: We engage third parties to conduct annual penetration testing, and we use external risk assessors to measure our program to industry standard frameworks. Our information security management system is certified to the ISO/IEC 27001:2013 standard by the British Standards Institution (BSI); certificate IS 780367. We also collaborate with experts and industry partners to exchange information about threats, best practices, and trends.


text: Our cybersecurity risk management extends to risks associated with our use of third-party service and technology providers as well as partnerships with third parties we may enter into. For instance, we conduct risk and compliance assessments of third parties that request access to our IT resources and information or who provide technology products to Charles River.


text: Our cybersecurity risk management is an important part of our comprehensive business continuity program and enterprise risk management. Our global information security team periodically engages with a cross-functional group of Charles River subject-matter experts and leaders to assess and refine Charles River's cybersecurity risk posture and preparedness. For example, we regularly evaluate and update contingency strategies for our business in the event that a portion of our IT systems were to be unavailable due to a cybersecurity incident. We practice our response to potential cybersecurity incidents through regular tabletop exercises. We also perform threat hunting and red team exercises.


text: Through these processes, during our fiscal year 2023 and through the date of this filing we did not identify risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see the section titled "Item 1A. Risk Factors – Business and Operational Risk Factors - We have in the past experienced and in the future could experience unauthorized access into our information systems."


text: Governance of Cybersecurity Risk Management Our board of directors, as a whole, has oversight responsibility for Charles River's strategic and operational risks. The Audit Committee of the Board of Directors has been delegated by the Board responsibility by reviewing and discussing Charles River's risk assessment and risk management practices, including cybersecurity risks, with members of management. The Audit Committee, in turn, periodically discusses its review and assessment with the board of directors.


text: Our management team is responsible for day-to-day assessment and management of cybersecurity risks. On our management team, our Chief Information Officer has primary oversight of material risks from cybersecurity threats. The Chief Information Officer is Charles River's Senior Vice President responsible for the Global Technology organization and for information protection at Charles River. The Chief Information Officer has more than 25 years of experience in the field, including serving as the Senior Vice President of Charles River's Digital Transformation organization, leading the development and implementation of information technology strategies and roadmaps for digital and automation solutions.


text: Our Chief Information Security Officer reports to our Chief Information Officer. Our Chief Information Security Officer has more than 25 years of experience working in information technology-related roles, of which 10 years has been in information security leadership, and holds degrees in bio-medical engineering and computer science. CHARLES RIVER LABORATORIES INTERNATIONAL, INC.


text: Our Chief Information Officer and Chief Information Security Officer assess our cybersecurity readiness through internal assessment tools as well as third-party control tests, vulnerability assessments, audits, and evaluation against industry standards. We have governance and compliance structures that are designed to elevate issues relating to cybersecurity to our Chief Information Officer and Chief Information Security Officer, such as potential threats or vulnerabilities. We also employ various defensive and monitoring techniques based on industry frameworks and cybersecurity standards.


text: Our Chief Information Officer and our Chief Information Security Officer meet annually with the full Board, and periodically, but generally at least quarterly, with the Chief Executive Officer, Chief Operations Officer, and Audit Committee to review the company's information technology systems and discuss key cybersecurity risks. Our Chief Information Security Officer has direct access to the Chair of our Audit Committee and keeps the Audit Committee apprised of any developments that may emerge in between regularly scheduled meetings that require its attention. Additionally, our Incident Response Plan includes escalation protocols to raise occurrences that require attention from the Audit Committee or the board of directors as a whole.


text: Cybersecurity Risk Management and Strategy Charles River places high importance on identifying and mitigating potential cybersecurity threats to its employees, customers, IT infrastructure, proprietary technologies and confidential information.


text: We engage third parties to conduct annual penetration testing, and we use external risk assessors to measure our program to industry standard frameworks. Our information security management system is certified to the ISO/IEC 27001:2013 and 27017:2018 standards by the British Standards Institution (BSI); certificates IS 780367 and CLOUD 806141,respectively. We also collaborate with experts and industry partners to exchange information about threats, best practices, and trends.


text: Our cybersecurity risk management extends to risks associated with our use of third-party service and technology providers as well as partnerships with third parties we may enter into. For instance, we conduct risk and compliance assessments of third parties that request access to our IT resources and information or who provide technology products or services to Charles River.


text: Through these processes, during our fiscal year 2024 and through the date of this filing we did not identify risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see the section titled "Item 1A. Risk Factors – Business and Operational Risk Factors - We have in the past experienced and in the future could experience unauthorized access into our information systems."


text: Our Chief Information Security Officer reports to our Chief Information Officer. Our Chief Information Security Officer has more than 25 years of experience working in information technology-related roles, of which more than 10 years has been in information security leadership, and holds degrees in bio-medical engineering and computer science.


text: Our Chief Information Officer and our Chief Information Security Officer meet regularly with the full Board, and periodically, but generally at least quarterly, with the Chief Executive Officer, Chief Operations Officer, and Audit Committee to review the company's information technology systems and discuss key cybersecurity risks. Our Chief Information Security Officer has direct access to the Chair of our Audit Committee and keeps the Audit Committee apprised of any developments that may emerge in between regularly scheduled meetings that require its attention. Additionally, our Incident Response Plan includes escalation protocols to raise occurrences that require attention from the Audit Committee or the board of directors as a whole.


text: Cybersecurity Risk Management and Strategy As noted above under "Risk Management", we maintain an information and cybersecurity risk management program, which is led by our CISO and is designed to protect the confidentiality, integrity and availability of critical information and information systems.

companyName: BREAD FINANCIAL HOLDINGS, INC.

ticker: BFH


text: The program is designed based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF); provided that this does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, train or otherwise assist with aspects of our security controls; • security tools deployed in the IT environment for protection against and monitoring for suspicious activity; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. We face certain ongoing risks from cybersecurity threats such as loss or theft of data, ransomware or other disruptive attacks from financially motivated bad actors, and third party supply chain issues that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For further discussion, see "Item 1A. Risk Factors – Risk Management".


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk to be a critical part of its risk oversight function and has delegated to the Risk & Technology Committee primary oversight of cybersecurity and other information technology risks. The Audit Committee also reviews cybersecurity matters are part of its oversight of major financial risk exposures. The Risk & Technology Committee oversees management's implementation of our cybersecurity risk management program.


text: The Risk & Technology Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Risk & Technology Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Risk & Technology Committee periodically reports to the Board of Directors regarding its activities, including those related to cybersecurity. As part of its oversight of major financial risk exposures, the Audit Committee also reviews with management and the Company's internal and independent auditors the Company's risk assessments and risk management program, including with respect to cybersecurity. Board members receive presentations on cybersecurity topics from our CISO or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our CISO, Chief Risk Officer (CRO) and Chief Operational Risk Officer (CORO), is responsible for assessing and managing our material risks from cybersecurity threats. Our management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO works closely with our CRO and CORO, who are responsible for providing effective oversight and challenge to the activities of our CISO.


text: Our CISO, who reports to our Executive Vice President and Chief Technology Officer, has 30 years of cybersecurity, risk and technology experience across the financial services, banking and insurance industries. She maintains both Certified Enterprise Risk Professional (CERP) and Certified Information Systems Auditor (CISA) certifications. She serves on CyberOhio as an advisor to the State of Ohio and is active as a Board member at Ohio University Grid Computing and Emerging Technologies program. She is an active member in several CISO forums. Each of our CRO (who reports to our Chief Executive Officer) and CORO (who reports to our CRO) has over 25 years of financial services experience in operations and risk management.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, and, as appropriate, provides briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management and Strategy As noted above under "Risk Management", we maintain an information and cybersecurity risk management program, which is led by our CISO and is designed to protect the confidentiality, integrity and availability of critical information and information systems. The program is designed based on the NIST CSF; provided that this does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall ERM program, and shares common methodologies, reporting channels and governance processes that apply across the ERM program to other legal, compliance, strategic, operational, and financial risk areas.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. We face certain ongoing risks from cybersecurity threats such as loss or theft of data, ransomware or other disruptive attacks from financially motivated bad actors, and third-party supply chain issues that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, and financial condition. For further discussion, see "Item 1A. Risk Factors – Risk Management" and "Item 1A. Risk Factors – Cybersecurity, Technology and Vendor Risks".


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk to be a critical part of its risk oversight function and has delegated to the Risk & Technology Committee primary oversight of cybersecurity and other information technology risks. The Audit Committee also reviews cybersecurity matters as part of its oversight of major financial risk exposures. The Risk & Technology Committee oversees management's implementation of our cybersecurity risk management program, and receives regular reports from management on our cybersecurity risks. In addition, management updates the Risk & Technology Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Risk & Technology Committee periodically reports to the Board of Directors regarding its activities, including those related to cybersecurity. As part of its oversight of major financial risk exposures, the Audit Committee also reviews with management and our internal and independent auditors our risk assessments and risk management program, including with respect to cybersecurity. Board members receive presentations on cybersecurity topics from our CISO or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our CISO, CRO and CORO, is responsible for assessing and managing our material risks from cybersecurity threats. Our management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO works closely with our CRO and CORO, who are responsible for providing effective oversight and challenge to the activities of our CISO.


text: Our CISO, who reports to our Executive Vice President and Chief Technology Officer, has 25 years of cybersecurity and information security experience across a number of regulated industries, including financial services, healthcare and defense and national security. Our CISO has been a Certified Information System Security Professional (CISSP) for over 20 years and serves on the governing body of various organizations focused on technology and cybersecurity, including as an Advisory Council Member to the Harvard Business Review and a Governing Board Member of Evanta, an organization of peer-CISOs. Each of our CRO (who reports to our Chief Executive Officer) and CORO (who reports to our CRO) has over 20 years of financial services experience in operations and risk management.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, and, as appropriate, provides briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Risk management and strategy As a key supplier to in the semiconductor ecosystem, security and risk management of our technology systems and processes is critical to ensuring our ability to serve our customers without interruption.

companyName: ENTEGRIS INC

ticker: ENTG


text: Management of Cybersecurity Risks Our management of cybersecurity risks is integrated into our company-wide enterprise risk management program. As part of this process, our risk management team works closely with our IT department to identify and evaluate potential cybersecurity risks to the Company and to develop controls to mitigate and protect against those risks.


text: Each quarter, our Chief Information Security Officer ("CISO") presents an overview of the Company's cybersecurity risk landscape to our Enterprise Risk Management Committee, which includes our Executive Leadership Team and Vice President, Internal Audit. In addition, our CISO Council, which includes our CISO and our Chief Information and Digital Officer, holds meetings with our Executive Leadership Team on a quarterly basis to review these cybersecurity risks and mitigation measures in further detail.


text: Our cybersecurity risk management program is aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We identify key assets that are critical to our business and assess potential cyber threats and vulnerabilities associated with those assets and the operations they enable. Following that assessment, we implement strategies and design controls to manage those risks. For example, we use single sign-on to limit access to our networks and multi-factor authentication to verify users' identities. We also continuously monitor our systems and networks to protect against internal and external threat actors. We have policies and procedures in place, such as our Privileged Access Management process, to limit and control access to our confidential information by our vendors and other third parties. We also conduct due diligence and reviews of cybersecurity policies of third parties that access our systems or data. Additionally, we are focused on segregating our manufacturing processes from the Company's other networks to minimize the risk of interruptions to our manufacturing operations resulting from cyber breaches. To increase our employees' vigilance of cybersecurity risks and educate them on best practices relating to those risks, we conduct cybersecurity trainings and awareness campaigns, such as quarterly phishing campaigns.


text: Engagement of Third Parties Given the complex and evolving nature of cybersecurity threats, the Company engages third parties to assist us in developing and maintaining effective cybersecurity risk management. Partnering with third parties enables us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes are well-designed and effective. For example, in 2023, we engaged a global law firm to conduct an external assessment of our cybersecurity governance framework and processes and provide recommendations to improve our cybersecurity readiness and posture. We also work with third party specialists who perform threat and vulnerability assessments, audits and develop strategies to mitigate cybersecurity-related risks.


text: Oversight of Third-party Risk We are aware of the cybersecurity risks associated with engaging third-party service providers. To mitigate such risks, we conduct security assessments of high-risk third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments by our CISO and ongoing assessments by our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties.


text: Risks from Cybersecurity Threats The Company's information and operational technology systems and its third-party providers' systems have been, and will likely continue to be, subject to cybersecurity threats, such as computer viruses or other malicious codes, ransomware, unauthorized access attempts, business email compromise, cyber extortion, denial of service attacks, phishing, social engineering, hacking and other cyberattacks attempting to exploit vulnerabilities.


text: To date, the Company is not aware that its business or operations have been materially impacted by these cyberattacks. However, the Company's security efforts and the efforts of its third-party providers may not prevent or timely detect attacks and resulting breaches or breakdowns of the Company's, or its third-party service providers', databases or systems.


text: Board of Directors' Oversight The Audit and Finance Committee (the "Audit and Finance Committee") of our Board of Directors is responsible for reviewing and monitoring general information technology and cybersecurity matters, including related risks and reporting to the Board its determinations, actions and recommendations related thereto. Our Audit and Finance Committee is composed of independent directors with extensive executive leadership and risk management experience. Our CISO, together with our Chief Information and Digital Officer ("CIDO"), provide quarterly updates to our Audit and Finance Committee regarding the cybersecurity risk landscape, specific risks affecting the Company and solutions to mitigate those risks, and legal and regulatory requirements relating to cybersecurity. These updates assist the Board in performing its oversight and risk management function. In addition, the full Board receives an annual report on cybersecurity directly from the CISO.


text: Management's Role Managing Risk Our CISO is responsible for the implementation, operation and monitoring of our cybersecurity risk management program. Our current CISO, who reports to our CIDO, has over 20 years of experience managing the information technology and cybersecurity operations within large, global organizations. His extensive experience assessing and mitigating cybersecurity risk, implementing governance structures and developing employee training programs is critical in developing and executing our cybersecurity strategies.


text: Monitoring of Cybersecurity Incidents Our Cybersecurity Incident Response Plan establishes how we monitor and respond to cybersecurity incidents impacting our environment. The CISO works closely with members of our Executive Leadership Team and his cybersecurity team to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. We engage a third-party managed security services provider (MSSP) to provide 24/7 continuous monitoring of the Company's IT and operational technology environments for potential cybersecurity incidents. In the event such an incident is identified by our MSSP or any of our employees, the incident is assigned a severity classification (minor, moderate or major) by our cybersecurity team and escalated accordingly. Depending on the severity of the incident, certain key personnel are notified and work together to further investigate the incident and take actions to respond, which may include engaging with external specialists, regulatory authorities and our cybersecurity insurance carrier. The CISO receives daily and weekly updates on all incidents and incident responses, which the CISO shares with our Executive Leadership Team on a weekly basis. Our cybersecurity team conducts a post-incident review of all major cybersecurity incidents, which review includes identification of vulnerabilities, assessment of the incident's impact on the Company and recommendations to help prevent similar incidents in the future.


text: Risk management and strategy As a key supplier in the semiconductor ecosystem, security and risk management of our technology systems and processes is critical to ensuring our ability to serve our customers without interruption.


text: Each quarter, our Chief Information Security Officer ("CISO") presents an overview of the Company's cybersecurity risk landscape to our Enterprise Risk Management Committee, which includes our Executive Leadership Team and Vice President, Internal Audit. In addition, our CISO Council, which includes our CISO and our Chief Information and Digital Officer ("CIDO"), holds meetings with our Executive Leadership Team on a quarterly basis to review these cybersecurity risks and mitigation measures in further detail.


text: Our cybersecurity risk management program is aligned with the National Institute of Standards and Technology Cybersecurity Framework. We identify key assets that are critical to our business and assess potential cyber threats and vulnerabilities associated with those assets and the operations they enable. Following that assessment, we implement strategies and design controls to manage those risks. For example, we use single sign-on to limit access to our networks and multi-factor authentication to verify users' identities. We also continuously monitor our systems and networks to protect against internal and external threat actors. We have policies and procedures in place, such as our Privileged Access Management process, to limit and control access to our confidential information by our vendors and other third parties. We also conduct due diligence and reviews of cybersecurity policies of third parties that access our systems or data. Additionally, we are focused on segregating our manufacturing processes from the Company's other networks to minimize the risk of interruptions to our manufacturing operations resulting from cyber breaches. To increase our employees' vigilance of cybersecurity risks and educate them on best practices relating to those risks, we conduct cybersecurity trainings and awareness campaigns, such as quarterly phishing campaigns.