text: Cybersecurity Risk Oversight Our executive management team is responsible for the development of our policies and procedures and for managing any exception to the same. In particular, our DIS oversees information security compliance, as described above. The board of directors of the Company has ultimate oversight of cybersecurity-related risk and activities, including the review and approval of our policies and procedures related to cybersecurity. The Information Security Program is approved on an annual basis. Cybersecurity risk management is also incorporated into our overall enterprise risk management model, which is updated on a quarterly basis and subject to oversight by our board of directors.


text: In the ordinary course of business, our board of directors receives quarterly updates from the DIS regarding the Information Security Program and compliance with relevant regulations, as described above. Members of the Audit Committee of our board of directors receive presentations as well as minutes of the meetings of our information technology steering committee on a quarterly basis. Our information technology steering committee consists of members of our board of directors who have relevant experience from their audit and management experience as well as training provided by our management. If an incident occurs, depending on its priority as identified through the procedures described above, management may inform our board of directors and/or the Audit Committee sooner than its next quarterly update. See the section entitled "Part I, Item 1. Business—Risk Management" for additional information on the role of our board of directors and its committees in overseeing risk management.

companyName: FIVE STAR BANCORP

ticker: FSBC

secItem: Item 1C


text: Relevant Regulations As a regulated financial institution, the Bank is also subject to financial privacy laws, and our cybersecurity practices are subject to oversight by the federal banking agencies. In addition, the Bank is subject to SEC rules requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. For additional information, see the section entitled "Part I, Item 1. Business—Supervision and Regulation—Supervision and Regulation of the Bank—Cybersecurity."


text: Risk Management and Strategy We have designed and implemented a cybersecurity risk management program to help us identify, assess, and mitigate cybersecurity risks relevant to our business, based on the National Institute of Standards and Technology (NIST) Cyber Security Framework 2.0.

companyName: ANGIODYNAMICS INC

ticker: ANGO


text: Our cybersecurity risk management program includes: • dedicated third-party cybersecurity professionals who analyze cybersecurity threats, define cybersecurity policy and requirements, implement protections, and monitor and respond to cybersecurity incidents; • cybersecurity regulatory based risk assessments for the Company's systems and applications (where required); • a formal incident response plan, in which incidents are classified based upon the severity, impact, and the potential harm that can be caused by the incident; • annual information security training program for all employees, including phishing awareness training; • working closely with application development and infrastructure & operation teams to embed security considerations into the foundation of technology; • engagement of third-party service providers to conduct assessment of the Company's cybersecurity risk management program, penetration testing, and vulnerability testing; and • a third-party risk assessment process for service providers, suppliers, and vendors.


text: Risks from cybersecurity threats are integrated into AngioDynamics' enterprise risk management (ERM) program. The ERM program establishes a risk management framework that seeks to identify, assess, and mitigate risks that could materially impact the Company's business and operation.


text: To date, the Company is not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on the Company's business or operations. However, despite our security measures, there can be no assurance that the Company, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us. See Item 1A. Risk Factors under, A cyber-attack or other breach of our, our distributors, or our supply chain partners' information technology systems could have a material adverse effect on our business, financial condition and/or results of operations.


text: The cybersecurity risk management program is led by the Senior Vice President, Information Technology ("SVP of IT"). Our SVP of IT has over 28 years of experience assisting public and privately held companies in a variety of industries, leading several enterprise-wide transformation initiatives to adapt to changing cybersecurity threats. Our SVP of IT reports to the Chief Executive Officer (CEO), who works closely with the Executive Committee to guide strategic direction and IT decisions to drive business outcomes. Our SVP of IT also leads the Security & Risk Governance committee which provides general oversight and assists in the Cybersecurity program when appropriate.


text: Our Board of Directors is engaged in the Company's ERM program and receives briefings on the outcomes of the ERM program and the steps the Company takes to mitigate risks that the program identifies. The Board oversees the Company's cybersecurity strategies, systems, and controls to ensure reliability and prevent unauthorized access. The Audit Committee discusses policies with respect to risk assessment and risk management, including risks associated with the reliability and security of the Company's information technology and security systems, and the steps management has undertaken to monitor and control such exposures. The Board of Directors receives regular updates on the Company's cybersecurity risk management program from the SVP of IT.


text: Risk Management and Strategy Cybersecurity threats are inherent in the banking and financial services industry. To safeguard our customers' sensitive data, financial transactions, information systems and information assets, we have established a comprehensive cybersecurity risk management program that is part of our enterprise risk management strategy. Our risk management team oversees the program and regularly collaborates with our information security function, led by our Chief Security Officer, to gather insights for identifying, assessing and managing cybersecurity threat risks, their severity, and potential mitigations.

companyName: MVB FINANCIAL CORP

ticker: MVBF


text: As part of our strategy, we also leverage reputable third-party service providers to implement and maintain processes and controls to manage identified risks. We perform rigorous due diligence before onboarding and engage in ongoing monitoring of all third parties with access to our information assets to ensure such parties maintain adequate security controls. Our security practices also include continuous threat monitoring and detection services as well as vulnerability and patch management process to ensure systems are hardened to further protect our critical information assets.


text: Furthermore, we are consistently broadening our scope of training and awareness practices to alleviate potential risks associated with human error, including mandatory computer-based training, internal communications, and frequent phishing awareness campaigns.


text: Apart from the measures implemented to decrease the possibility of a material cyberattack being successful, we have created clear incident response protocols to deal with any cyber events that may arise. Our program provides for the coordination of different corporate functions and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan includes processes to triage, assess severity for, escalate, contain, investigate, and remediate any incidents. Testing, training and exercising of our incident response capabilities are carried out routinely and After Actions Reports are prepared to continuously improve these practices. We also have processes to evaluate potential disclosure, comply with applicable legal obligations, and mitigate reputational damage.


text: Based on the information we have as of the date of this Annual Report on Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Oversight of cybersecurity matters is the responsibility of the Risk & Compliance Committee, which is a board committee, with oversight from the Board of Directors.


text: The Risk & Compliance Committee receives regular updates on cybersecurity risks and incidents and the cybersecurity risk management program through direct interaction with the Chief Information Officer and provides periodic updates regarding cybersecurity risks and the cybersecurity risk management program to the full Board of Directors. Our Chief Information Officer has significant experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing compliance environments.


text: Risk Management and Strategy Cybersecurity threats are inherent in the banking and financial services industry. To safeguard our customers' sensitive data, financial transactions, information systems and information assets, we have established a comprehensive cybersecurity risk management program that is part of our enterprise risk management strategy. Our risk management team oversees the program and regularly collaborates with our information security function, led by our Chief Information Security Officer, to gather insights for identifying, assessing and managing cybersecurity threat risks, their severity and potential mitigations.


text: Furthermore, we are consistently broadening our scope of training and awareness practices to alleviate potential risks associated with human error, including mandatory computer-based training, internal communications and frequent phishing awareness campaigns.


text: Apart from the measures implemented to decrease the possibility of a material cyberattack being successful, we have created clear incident response protocols to deal with any cyber events that may arise. Our program provides for the coordination of different corporate functions and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan includes processes to triage, assess severity for, escalate, contain, investigate and remediate any incidents. Testing, training and exercising of our incident response capabilities are carried out routinely and After Actions Reports are prepared to continuously improve these practices. We also have processes to evaluate potential disclosure, comply with applicable legal obligations, and mitigate reputational damage.


text: The Risk & Compliance Committee receives regular updates on cybersecurity risks and incidents and the cybersecurity risk management program through direct interaction with the Chief Information Security Officer and provides periodic updates regarding cybersecurity risks and the cybersecurity risk management program to the full Board of Directors. Our Chief Information Security Officer has significant experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing compliance environments.


text: Risk Management and Strategy Because technology, data and information security is a top priority at Blackbaud, we maintain and continuously assess and strengthen our cybersecurity program. Comprehensive cybersecurity risk management, including identification, analysis and response to risks affecting our business and its customers, provides the foundation for our program.

companyName: BLACKBAUD INC

ticker: BLKB


text: 1.Operational security: We leverage the industry standard CIA Triad Model in conjunction with comprehensive industry control frameworks, compliance regulations, privacy requirements and best practices, including: the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, PCI DSS, System and Organization Controls ("SOC") 1, SOC 2, GDPR, HIPAA, the Trans-Atlantic Data Privacy Framework and Cloud Security Alliance.


text: 2.Product security: Our development teams take part in regular training and use industry best practices to build security into our solutions.


text: 3.Incident response: We monitor the threat landscape 24/7 in coordination with a third-party firm, routinely test our incident response capabilities and preparedness and maintain proactive relationships with law enforcement.


text: 4.Ongoing landscape analysis: We continually evaluate upcoming and changing data privacy regulations and provide thought leadership for our customers on the operational impacts of these regulations and compliance requirements.


text: We believe that information and technology security is a shared responsibility and, therefore, incorporate data and privacy protection education into the customer experience through ongoing resources such as best practices content, one-on-one consultations with customer success managers and bbcon sessions. We also participate in global communities and conference platforms to share information and present on best practices to improve the industry's security awareness posture. In addition, Blackbaud employees are all engaged in on-going security and privacy awareness training campaigns to ensure they are empowered to protect both Blackbaud's and our customers' data.


text: Blackbaud also maintains a defined program and dedicated team that provides security oversight of its third-party service providers. This program assesses and manages risk at the onboarding phase of engagement with third-party vendors and partners as well as oversight throughout the lifecycle of the vendor relationship.


text: We regularly engage outside consultants and experts to assist us regarding our cybersecurity program. Engagements include an annual NIST Cybersecurity Framework assessment to ensure a reasonable cybersecurity program and retained leading external cybersecurity Incident Response (IR) experts.


text: Consistent with our prioritization of information and technology protection, cybersecurity risk management has been and remains a key aspect of our overall business strategy, financial planning and capital allocation and a point of ongoing emphasis at all levels of our Company.


text: In addition, we continuously learn from and leverage experience gained from previous cybersecurity incidents that we, like many other companies, have experienced. As previously disclosed, we have been and remain subject to risks and uncertainties as a result of a ransomware attack against us in May 2020 in which a cybercriminal removed a copy of a subset of data from our self-hosted environment. As a result of the Security Incident, we are currently subject to certain legal proceedings, claims and investigations and could be the subject of additional legal proceedings, claims, inquiries and investigations in the future that might result in adverse judgments, settlements, fines, penalties or other resolution. See Note 11 to the consolidated audited financial statements contained in this Annual Report on Form 10-K for additional information regarding the Security Incident and its past and potential impact on the Company.


text: Notwithstanding our strong commitment to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. "Risk Factors" for a discussion of our cybersecurity risks.


text: Our multi-level cybersecurity governance and risk management structure begins with our Operational Risk Compliance and Security ("ORCAS") Committee consisting of cross-functional management representatives throughout our Company. The ORCAS Committee receives detailed cybersecurity information from key security personnel and reports at least quarterly up through our Risk Steering Committee, which is made up of executives and senior management from various Blackbaud departments: Chief Executive Officer, Chief Operating Officer, Chief Financial Officer, Chief Technology Officer, General Counsel, Chief Privacy Officer and Chief Information Security Officer ("CISO"), who has extensive information technology and program management experience. Our CISO has served in various roles of increasing responsibility in information technology and information security for more than 25 years, including serving in various cybersecurity leadership roles within public and private companies. He holds two undergraduate degrees—one in business administration and the other in computer information systems, a graduate degree in information systems and maintains two cybersecurity industry recognized certifications: Certified Information Systems Security Professional (CISSP) and Certified Cloud Security Professional (CCSP), both from the International Information System Security Certification Consortium. Cybersecurity leaders reporting to our CISO also have significant information technology and information security experience and industry recognized certifications.


text: The Risk Steering Committee reports to the Risk Oversight Committee of our Board of Directors at the regular quarterly meetings, or more frequently as needed. The Risk Oversight Committee's duties include, among other things, oversight of risks related to information technology security. The Risk Oversight Committee communicates as appropriate with the full Board of Directors, which is ultimately responsible for cybersecurity risk oversight.


text: Additionally, our cybersecurity Incident Response plan timely informs our Cybersecurity Incident Subcommittee on active cybersecurity incidents that are potentially material. The Cybersecurity Subcommittee determines cybersecurity materiality and is made up of our General Counsel, Chief Information Security Officer, Chief Accounting Officer and Director of SEC Reporting. Our Cybersecurity Incident Subcommittee is part of our Disclosure Committee, which is appointed by Chief Executive Officer and Chief Financial Officer to assist our executives in their responsibility for oversight of the accuracy and timeliness of the disclosures made by Blackbaud. Blackbaud, Inc.


text: Risk Management and Strategy Overview of Processes for Assessing, Identifying and Managing Material Cyber Risks Because technology, data and information security is a top priority at Blackbaud, we maintain and continuously assess and strengthen our cybersecurity program. Comprehensive cybersecurity risk management, including identification, analysis and response to risks affecting our business and its customers, provides the foundation for our program. Our cybersecurity program has been and will continue to be further enhanced by our compliance with the settlement of governmental investigations relating to the Security Incident. See Note 11 to the consolidated audited financial statements contained in this report for additional information regarding the Security Incident.


text: Integration into Overall Risk Management System or Processes Consistent with our prioritization of information and technology protection, cybersecurity risk management has been and remains a key aspect of our overall business strategy, financial planning and capital allocation and a point of ongoing emphasis at all levels of our Company. Our enterprise risk management ("ERM") framework integrates our information technology and data management systems and related policies and practices into the larger framework to help guide and prioritize our cybersecurity and information technology-related investments, activities and risk management strategy. At least annually, we review cybersecurity risk as part of our ERM processes and integrate those findings into our overall strategy. Additionally, our cybersecurity program is further integrated with our overall risk management program through our Chief Information Security Officer's ("CISO") participation in such governance structures as our Risk Steering Committee and our Disclosure Committee, both of which are described in detail below.


text: Engagement of Third Parties We regularly engage outside consultants and experts to assist us regarding our cybersecurity program. Engagements include an annual NIST Cybersecurity Framework assessment to ensure a reasonable cybersecurity program and retained leading external cybersecurity Incident Response (IR) experts. Blackbaud, Inc.


text: Risks from Third-Party Service Providers and Others Blackbaud also maintains a defined program and dedicated team that provides security oversight of its third-party service providers. This program assesses and manages risk at the onboarding phase of engagement with third-party vendors and partners as well as oversight throughout the lifecycle of the vendor relationship.


text: Risks from Cybersecurity Threats; Actual and Potential Material Impact In addition, we continuously learn from and leverage experience gained from previous cybersecurity incidents that we, like many other companies, have experienced. As previously disclosed, we have been and remain subject to risks and uncertainties as a result of a ransomware attack against us in May 2020 in which a cybercriminal removed a copy of a subset of data from our self-hosted environment. As a result of the Security Incident, we are currently subject to certain legal proceedings and claims and could be the subject of additional legal proceedings, claims, inquiries and investigations in the future that might result in adverse judgments, settlements, fines, penalties or other resolution. See Note 11 to the consolidated audited financial statements contained in this report for additional information regarding the Security Incident and its past and potential impact on the Company.


text: Management's Assessment and Management of Cybersecurity Threats Our multi-level cybersecurity governance and risk management structure begins with our Operational Risk Compliance and Security ("ORCAS") Committee consisting of cross-functional management representatives throughout our Company. The ORCAS Committee receives detailed cybersecurity information from key security personnel and reports at least quarterly up through our Risk Steering Committee, which is made up of executives and senior management from various Blackbaud departments: Chief Executive Officer, Chief Operating Officer, Chief Financial Officer, Chief Technology Officer, General Counsel, Chief Privacy Officer and CISO, who has extensive information technology and program management experience. Our CISO has served in various roles of increasing responsibility in information technology and information security for more than 25 years, including serving in various cybersecurity leadership roles within public and private companies. He holds two undergraduate degrees—one in business administration and the other in computer information systems, a graduate degree in information systems and maintains two cybersecurity industry recognized certifications: Certified Information Systems Security Professional (CISSP) and Certified Cloud Security Professional (CCSP), both from the International Information System Security Certification Consortium. Cybersecurity leaders reporting to our CISO also have significant information technology and information security experience and industry recognized certifications.


text: Additionally, our cybersecurity Incident Response plan timely informs our Cybersecurity Incident Subcommittee on active cybersecurity incidents that are potentially material. The Cybersecurity Subcommittee determines cybersecurity materiality and is made up of our General Counsel, CISO, Chief Accounting Officer and Director of SEC Reporting. Our Cybersecurity Incident Subcommittee is part of our Disclosure Committee, which is appointed by Chief Executive Officer and Chief Financial Officer to assist our executives in their responsibility for oversight of the accuracy and timeliness of the disclosures made by Blackbaud.


text: The Risk Steering Committee reports to the Risk Oversight Committee of our Board of Directors at the regular quarterly meetings, or more frequently as needed. The Risk Oversight Committee's duties include, among other things, oversight of risks related to information technology security. The Risk Oversight Committee communicates as appropriate with the full Board of Directors, which is ultimately responsible for cybersecurity risk oversight. Blackbaud, Inc.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an IT consultant who reports to our Head of IT who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: IMMUNIC, INC.

ticker: IMUX


text: Our Chief Executive Officer and General Counsel are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.


text: Our Chief Executive Officer and General Counsel oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.


text: Our Chief Executive Officer and IT consultant provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our internal information technology ("IT") team who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.


text: Our Chief Executive Officer and General Counsel are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from our internal information technology team.


text: Our Chief Executive Officer provides periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.


text: Cybersecurity Program Overview Our cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. We actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. We engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes. We depend on and engage various third parties, including suppliers, vendors, and service providers. Our risk management, legal, information technology, and compliance personnel identify and oversee risks from cybersecurity threats associated with our use of such entities.

companyName: Hercules Capital, Inc.

ticker: HTGC


text: Board Oversight of Cybersecurity Risks Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from our Chief Operating Officer and, as appropriate, the Chief Compliance Officer and the Director of Information Technology, regarding the overall state of our cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents.


text: Management's Role in Cybersecurity Risk Management Our management, including our Chief Operating Officer and Chief Compliance Officer, is responsible for assessing and managing material risks from cybersecurity threats. Members of Company management possess relevant expertise in various disciplines that are key to effectively managing such risks, such as information systems technology, cybersecurity, regulatory compliance and corporate governance. Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel.


text: Cybersecurity Program Overview Our cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. We actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. We engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes. We depend on and engage various third parties, including suppliers, vendors, and service providers. Our legal, operations, information technology, and compliance personnel identify and oversee risks from cybersecurity threats associated with our use of such entities.


text: Board Oversight of Cybersecurity Risks Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from our Chief Operating Officer and, as appropriate, the Chief Compliance Officer, the Director of Information Technology and third-party cybersecurity experts, regarding the overall state of our cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents.


text: Management's Role in Cybersecurity Risk Management Our management, including our Chief Operating Officer and Chief Compliance Officer, is responsible for assessing and managing material risks from cybersecurity threats. Members of Company management possess relevant expertise in various disciplines that are key to effectively managing such risks, such as information systems technology, cybersecurity, regulatory compliance and corporate governance. Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from service providers and reliance on communications with legal, operations, information technology, and/or compliance personnel.


text: Risk Identification and Assessment. Regions devotes significant financial and non-financial resources to identify and mitigate threats to the confidentiality, availability and integrity of its information systems. As more fully described below, the Regions IS Program's controls and risk management practices are designed to prevent and detect cybersecurity threats in order to reduce the likelihood that they materially affect Regions' business strategy, operations, or financial condition.

companyName: REGIONS FINANCIAL CORP

ticker: RF


text: Regions regularly tests and assesses its environment so it can update and maintain its systems and controls to mitigate the risks from cyber threats and vulnerabilities. These include risk assessments and penetration testing as well as testing against security controls. Layered security controls are designed and maintained to complement each other and enhance risk mitigation efforts. Regions will continue to develop and enhance controls, processes and technology to respond to evolving disruptive technology and to protect its systems from attacks or unauthorized access. In addition, Regions' TPRM function establishes the risk-based framework that governs all associates, subsidiaries, and affiliates who are engaged in the sourcing, planning, risk assessment, due diligence, contracting, ongoing monitoring, and governance of vendor engagements, including those that present cybersecurity risks for Regions. The TPRM framework includes the initial inherent-risk assessment conducted at onboarding and the applicable due diligence risk assessments, based on the engagement's risk profile. Upon completion of the applicable due diligence, the contract is constructed and negotiated, with efforts made to ensure appropriate terms are in place to further mitigate the risks presented. Thereafter, each engagement is reassessed on the established cadence associated with the inherent-risk tier, and performance scorecards are competed to ensure optimal delivery and to denote material changes in the engagement.


text: Risk Management. As a company that deals with large volumes of sensitive customer information and financial transactions, Regions treats cybersecurity risk as a key operational risk within its enterprise-wide risk management framework. As part of this framework, Regions utilizes the "Three Lines of Defense" concept to clearly designate risk management activities within the Company, and this concept is applicable to cybersecurity risk (see the "Risk Management" section of Item 7. "Management's Discussion and Analysis of Financial Condition and Results of Operations" of this Annual Report on Form 10-K). To manage cybersecurity risk, the Company has designed and implemented an IS Program that is led by our Chief Information Security Officer, who has close to two decades of experience in the cybersecurity field, including leadership roles at multiple financial services organizations. The IS Program includes information security policies, procedures, and controls designed to prevent, detect, limit and respond to cyber-attack or other similar incidents which might impact Regions' technologies, systems, and networks. Regions' IS Program is designed and implemented to substantially align with standards promulgated by the NIST. The Information Security Policy establishes technical, administrative, and physical control directives that are implemented to protect informational assets from reasonably foreseeable risks and threats. The IS Program is supplemented by cybersecurity operations that protect the integrity and availability of information systems. As discussed above, Regions' TPRM function also conducts due diligence and ongoing oversight of the Company's third-party vendors. The Company maintains a Cyber Incident Response Plan, which is part of broader business continuity planning and the Crisis Management Program, to help the Company respond to a possible data breach.


text: The Company engages with external experts and advisors, as needed, to review, enhance, and support our IS Program. For example, third parties may be used to assist in the event of a breach or to mitigate certain threats to Regions' environment. Internally, the Company regularly provides associates with cybersecurity training and education. To bolster these practices, Regions maintains cybersecurity insurance, which is reviewed annually, to cover potential financial losses from cyber events. In addition, Regions participates in information sharing organizations to gather and share information with peer banks and other financial institutions to better prepare and protect its information systems from attack as well as topics including fraud.


text: Governance. Regions' system of internal controls also incorporates an organization-wide protocol for the reporting and escalation of cybersecurity matters, including to management and the Board. The Board also receives updates on the Company's enterprise services, which includes resilience, information technology, and cybersecurity. The Board considers both business and technical resilience, cybersecurity and technological innovation, and privacy considerations, along with related risk considerations and mitigation efforts, within the Company's strategic plan. The Board is actively engaged in the oversight of Regions' continuous efforts to reinforce and enhance its operational resilience and receives education on the cybersecurity landscape. The Board oversees the management of cybersecurity and related risks primarily through its Risk Committee, which is supported at the management level by the ERMC, ORC, and TOROC which fall under the Risk Committee's purview. The Board's Risk Committee annually reviews and approves the Information Security Policy; reviews information and regular reports on the topic from members of management on at least a quarterly basis; and recommends actions and other steps to be taken, as it deems appropriate. Additionally, the Board's Audit Committee periodically receives reports on the IS Program prepared by the Chief Information Security Officer and the Company's Risk Management and Internal Audit functions. The Board's Technology Committee is charged with oversight of the overall role of technology in executing Regions' business strategy and coordinates with the Risk Committee on risk assessment and management associated with technology-related strategic investments, major technology vendor relationships, and risks associated with information technology and security activities. The Board annually reviews the information security program and, through its various committees, is briefed at least quarterly on cybersecurity matters. In addition, our management follows a risk-based escalation process to notify the Audit Committee and Risk Committee outside of the regular reporting cycle when they identify an emerging risk or material issue.


text: Cybersecurity Incidents. In 2023, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see the Technology Risks in Item 1A. "Risk Factors".


text: Regions regularly tests and assesses its environment so it can update and maintain its systems and controls to mitigate the risks from cyber threats and vulnerabilities. These include risk assessments and penetration testing as well as testing against security controls. Layered security controls are designed and maintained to complement each other and enhance risk mitigation efforts. Regions is aiming to continue to develop and enhance controls, processes and technology to respond to evolving disruptive technology and to protect its systems from attacks or unauthorized access. In addition, Regions' TPRM function establishes the risk-based framework that governs all associates, subsidiaries, and affiliates who are engaged in the sourcing, planning, risk assessment, due diligence, contracting, ongoing monitoring, and governance of vendor engagements, including those that present cybersecurity risks for Regions. The TPRM framework includes the initial inherent-risk assessment conducted at onboarding and the applicable due diligence risk assessments, based on the engagement's risk profile. Upon completion of the applicable due diligence, the contract is constructed and negotiated, with efforts made to ensure appropriate terms are in place to further mitigate the risks presented. Thereafter, each engagement is reassessed on the established cadence associated with the inherent-risk tier, and performance scorecards are completed to to denote material changes in the engagement.


text: Risk Management and Strategy. As a company that deals with large volumes of sensitive customer information and financial transactions, Regions treats cybersecurity risk as a key operational risk within its enterprise-wide risk management framework. As part of this framework, Regions utilizes the "Three Lines of Defense" concept to clearly designate risk management activities within the Company, and this concept is applicable to cybersecurity risk (see the "Risk Management" section of Item 7. "Management's Discussion and Analysis of Financial Condition and Results of Operations" of this Annual Report on Form 10-K). To manage cybersecurity risk, the Company has designed and implemented an IS Program that is led by our Chief Information Security Officer. The IS Program includes information security policies, procedures, and controls designed to prevent, detect, limit and respond to cyber-attacks or other similar incidents which might impact Regions' technologies, systems, and networks. Regions' IS Program is designed and implemented to substantially align with standards promulgated by the NIST. Regions' Information Security Policy establishes technical, administrative, and physical control directives that are implemented to protect informational assets from reasonably foreseeable risks and threats. The IS Program is supplemented by cybersecurity operations that protect the integrity and availability of information systems. As discussed above, Regions' TPRM function also conducts due diligence and ongoing oversight of the Company's third-party vendors. The Company maintains a Cyber Incident Response Plan, which is part of broader business continuity planning and the Crisis Management Program, to help the Company respond to a possible data breach.


text: The Company engages with external experts and advisors, as needed, to review, enhance, and support our IS Program. For example, third parties may be used to assist in the event of a breach or to mitigate certain threats to Regions' environment. Internally, the Company regularly provides associates with cybersecurity training and education at least annually. To bolster these practices, Regions maintains cybersecurity insurance, which is reviewed annually, to cover potential financial losses from cyber events. In addition, Regions participates in information sharing organizations to gather and share information with peer banks and other financial institutions to better prepare and protect its information systems from attack.


text: Governance. Regions' system of internal controls also incorporates an organization-wide protocol for the reporting and escalation of cybersecurity matters, including to management and the Board. The Board also receives updates on the Company's enterprise services, which includes resilience, information technology, and cybersecurity. The Board considers both business and technical resilience, cybersecurity and technological innovation, and privacy considerations, along with related risk considerations and mitigation efforts, within the Company's strategic plan. The Board is actively engaged in the oversight of Regions' continuous efforts to reinforce and enhance its operational resilience and receives education on the cybersecurity landscape. The Board oversees the management of cybersecurity and related risks primarily through its Risk Committee, which is supported at the management level by the ERMC, ORC, and TOROC which fall under the Risk Committee's purview. The Board's Risk Committee annually reviews and approves Regions' Information Security Policy; reviews information and regular reports on the topic from members of management on at least a quarterly basis; and recommends actions and other steps to be taken, as it deems appropriate. Additionally, the Board's Audit Committee periodically receives reports on the IS Program prepared by the Chief Information Security Officer and the Company's Risk Management and Internal Audit functions. The Board's Technology Committee is charged with oversight of the overall role of technology in executing Regions' business strategy and coordinates with the Risk Committee on risk assessment and management associated with technology-related strategic investments, major technology vendor relationships, and risks associated with information technology and security activities. The Board annually reviews the IS Program and, through its various committees, is briefed at least quarterly on cybersecurity matters. In addition, our management follows a risk-based escalation process to notify the Audit Committee and Risk Committee outside of the regular reporting cycle when they identify an emerging or risk or material issue.


text: Our Chief Information Security Officer, who has close to two decades of experience in the cybersecurity field, including leadership roles at multiple financial services organizations, has primary responsibility for our IS Program.


text: Cybersecurity Incidents. We have not experienced any material losses relating to cybersecurity threats or incidents for the year ended December 31, 2024. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see the "Technology Risks" discussion within in Item 1. "Risk Factors".


text: Material Risks from Cybersecurity Threats Our operations and other aspects of our business rely heavily on various information technology systems, some of which are managed by third parties. We face significant cybersecurity threats, which are continuously increasing in sophistication, including computer viruses, internal and external security breaches, and other cyber-attacks. These threats could disrupt our operations, lead to the loss of confidential information (such as the personally identifiable information of individuals, including our employees), and hinder our ability to process transactions with customers, operate our manufacturing facilities, and accurately report transactions in a timely manner. To manage these cybersecurity risks, our organization leverages the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We have implemented comprehensive policies and procedures that facilitate the timely identification and reporting of cyber incidents.

companyName: NEWMARKET CORP

ticker: NEU


text: Additionally, we have established protective measures for the forensic analysis of cyber incidents. While we are proactive in our efforts to mitigate these threats through robust security processes and disaster recovery plans, the evolving nature of cybersecurity threats means that our systems may not always be able to identify or protect against a threat promptly or at all. As a result, there is a continuous risk of potential financial, legal, business, and reputational damage to our company stemming from cybersecurity threats.


text: We employ a number of people who are part of our Information Technology group and are dedicated to and responsible for assessing and managing cybersecurity threats. Our Information Technology Director, who has over 25 years of experience in information security serving in roles of increasing responsibility, works with our cybersecurity employees to set priorities and is responsible for cybersecurity oversight and the escalation of incidents with business impact to senior leadership based on our Information Security Incident Management Policy.


text: We utilize specialized third-party services and tools for identifying, protecting against, and detecting cyber incidents, and also partner with external cybersecurity experts and vendors to augment our internal security team. Through these third-party services, our detection capabilities include, but are not limited, to, real-time monitoring, intrusion detection systems, and advanced analytics to identify abnormal patterns of behavior. These third-party detection tools provide real-time alerts, log aggregation, and threat intelligence feeds, which are integrated into our incident response platform.


text: Additionally, we engage third-parties to conduct independent assessments of our cybersecurity posture that evaluate the efficiency and effectiveness of our detection capabilities, along with our response mechanisms, and overall risk management.


text: Third-party service providers are integral to our business operations and are incorporated into our enterprise-wide risk management program, which subjects the providers to rigorous vetting processes and ongoing oversight. We use specialized monitoring tools that evaluate the cybersecurity posture of our third-party providers using a cybersecurity scorecard. This allows us to continually assess the cybersecurity risk levels associated with these external partners.


text: Our approach to managing cybersecurity risks (including third-party risk) is part of a continuous improvement process, both in the context of cybersecurity and broader operational risk management. This ongoing process, which includes employee training, is aimed at routinely reviewing and, as necessary, improving, our oversight processes and tools to ensure they remain effective and resilient in their management of cybersecurity risk.


text: Material Impact of Cybersecurity Threats While we have yet to experience a material cybersecurity event, we acknowledge the persistent and evolving nature of these threats, which have the potential to materially impact our business strategy, operations, and financial standing adversely. See Item 1A, "Risk Factors" under the operational risks section for more information. We maintain robust policies and procedures focused on cybersecurity incident management, ensuring timely communication and escalation to all relevant stakeholders. This enables faster response and effective communication, including public disclosure if a material cybersecurity event were to occur.


text: Board of Directors Oversight The Board of Directors oversees risks related to cybersecurity, including the security of corporate information and the steps management is taking to monitor and control these risks. Management regularly briefs the Board on our cybersecurity risk profile, emerging threats, and the efficacy of our risk mitigation strategies, including our continuous improvement initiatives. These initiatives aim to enhance the resiliency of our cybersecurity program as well as our broader operational risk management strategies.


text: Material Risks from Cybersecurity Threats Our operations and other aspects of our business rely heavily on various information technology systems, some of which are managed by third parties. We face significant cybersecurity threats, which are continuously increasing in sophistication, including computer viruses, internal and external security breaches, and other cyber attacks. These threats could disrupt our operations, lead to the loss of confidential information (such as the personally identifiable information of individuals, including our employees), and hinder our ability to process transactions with customers, operate our manufacturing facilities, and accurately report transactions in a timely manner. To manage these cybersecurity risks, our organization leverages the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We have implemented comprehensive policies and procedures that facilitate the timely identification and reporting of cyber incidents.


text: Risk Management and Strategy Our Cybersecurity Approach and Integration We have implemented processes for overseeing and identifying material risks from cybersecurity threats, and our cybersecurity processes are integrated into the Company's overall risk management system and processes. As part of management's oversight of cybersecurity, our Chief Security Officer ("CSO") presents on our cybersecurity practices to the Nominating and Corporate Governance Committee of our Board of Directors (the "NCG Committee") and to our full Board of Directors on a periodic basis. Our Senior Vice President, Internal Audit & Risk Management (the "Chief Audit Executive"), periodically presents enterprise risks, including cybersecurity risks, to the Audit Committee of our Board of Directors (the "Audit Committee"). Our Chief Compliance Officer regularly attends meetings at the NCG Committee providing insights from the compliance perspective relating to cybersecurity.

companyName: T-Mobile US, Inc.

ticker: TMUS


text: Cyber risk management is a core component of the Company's governance structure. We utilize the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF") as a guide in cyber risk management to identify, assess, and assist the CSO in managing cybersecurity risks. Cyber risk management encompasses partnerships among teams that are responsible for cyber governance, prevention, detection, and remediation activities within the Company's cybersecurity environment. As part of our cyber risk management efforts, we conduct periodic reviews and collaborate with enterprise-wide risk assessments to assess and manage cybersecurity risks. Our cybersecurity team also provides enterprise-wide cybersecurity training for employees to continuously improve our mitigation against human-driven vulnerabilities.


text: Our management also conducts a quarterly enterprise-wide risk assessment that considers a wide spectrum of risks facing the Company, including cybersecurity. Through these quarterly risk assessments, management informs the Audit Committee on the cyber risk landscape facing the Company and the Company's preparedness to manage such risk. The enterprise-wide risk assessment is a top-down risk assessment that leverages the assessments performed by cyber risk management.


text: Engagement with External Experts The Company engages top-tier external cyber security firms, as needed, leveraging their expertise as part of our ongoing effort to evaluate and enhance our cybersecurity program. They help with cyber defense capabilities (including staff enhancement of certain functions) and transformation to mitigate associated threats, reduce risk, enhance our cybersecurity posture, and meet the Company's evolving needs.


text: Oversight of Third-Party Service Providers Our third-party risk management program includes processes for identifying and managing material cybersecurity risks arising from third-party providers. Our third-party risk management program actively engages with the enterprise-wide risk assessment process and partners with cyber risk management to report relevant risks to the NCG Committee, the Audit Committee and our internal Enterprise Risk & Compliance Committee. Our third-party risk management program includes cybersecurity as an aspect of its risk assessment of third parties with the objective that key risks are identified and addressed. Moreover, the program also considers risks associated with certain fourth parties, entities that are partners or subcontractors of our direct third-party vendors, through assessments carried out by our third-party service providers.


text: Cybersecurity Incident Impact As previously disclosed, in August 2021, we experienced a cybersecurity incident that resulted in numerous lawsuits, including mass arbitration claims and multiple class action lawsuits. In January 2023, we experienced another cybersecurity incident that also resulted in consumer class actions and regulatory inquires. As a result of the August 2021 cyberattack and the January 2023 cyberattack, we have incurred and may continue to incur significant costs or experience other material financial impacts, which may not be covered by, or may exceed the coverage limits of, our cyber liability insurance, and such costs and impacts may have a material adverse effect on our business, reputation, financial condition, cash flows and operating results. For additional details regarding the impact of both cybersecurity incidents, see Note 17 – Commitments and Contingencies of the Notes to the Consolidated Financial Statements.


text: We have not identified other known risks from previous cybersecurity threats that have materially affected or are reasonably likely to materially affect us. However, we face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect business strategy, results of operations, or financial condition. See "Risk Factors – We have experienced criminal cyberattacks and could in the future be further harmed by disruption, data loss or other security breaches, whether directly or indirectly through third parties whose products and services we rely on in operating our business."


text: Disclosure of Management's Responsibilities Transformation and Chief Information & Digital Officer The Transformation and Chief Information & Digital Officer under the direction of the Company's Chief Executive Officer, is responsible for overseeing the Company's information technology systems, digital capabilities, and cybersecurity practices. The CSO, under the direction of the Transformation and Chief Information & Digital Officer, is responsible for overseeing the cybersecurity organization and promoting a security-centric culture throughout our business and operational functions. The CSO is at the forefront of enhancing our cybersecurity framework and strengthening the overall cybersecurity program. This involves upgrading tools and capabilities, which are part of a broader, multi-year strategy to continue to enhance security measures. The CSO oversees the cyber risk management function, which identifies cybersecurity threats, assesses cybersecurity risks and supports the Transformation and Chief Information & Digital Officer and the Company in managing such risks.


text: As the Company's Executive Vice President, Transformation and Chief Information & Digital Officer, N stor Cano has served in several leadership positions at both the Company and Sprint, including as Sprint's Chief Operating Officer, overseeing, among other things, Sprint's digital architecture and delivery. Mr. Cano studied industrial engineering at Barcelona Polytechnic University, attended the Executive Distribution Academy by INSEAD Business School in Fontainebleau, France, and also completed his post-graduate degree in executive management at IESE Business School in Barcelona, Spain.


text: As the Company's CSO, Jeff Simon has extensive experience in risk management and information security, including serving as the Chief Information Security Officer at Fidelity National Information Services, Inc. Mr. Simon received his Master of Science in Computer Science, Software Engineering & Artificial Intelligence from the Johns Hopkins Whiting School of Engineering and Bachelor of Science in Business Administration and Applied Economics from Marquette University. Mr. Simon is a Certified Information Systems Security Professional.


text: Enterprise Risk & Compliance Committee Our Enterprise Risk & Compliance Committee is comprised of a collective of senior management representatives and subject matter experts from across the Company. The Enterprise Risk & Compliance Committee is chaired by the Chief Financial Officer ("CFO") of the Company, with the Executive Vice President & General Counsel as the co-chair and comprises core members including the Transformation and Chief Information & Digital Officer, while the CSO serves in an advisory capacity. The purpose of the Enterprise Risk & Compliance Committee is to oversee and govern the Company's risk management, environmental, social, corporate governance, cybersecurity, and operational compliance activities, as well as provide a means of bringing risk issues to the attention of management. Specific to cybersecurity, the Transformation and Chief Information & Digital Officer and the CSO have the expertise to provide insights into the nature of cyber threats, the Company's readiness, and actions taken to mitigate such risks.


text: Disclosure of the Board's Roles and Responsibilities Our Board of Directors oversees risks from cybersecurity threats using a multi-faceted approach that involves the NGC Committee and Audit Committee and various executive roles. Additionally, our Transformation and Chief Information & Digital Officer and CSO report on cybersecurity to the full Board.


text: Nominating and Corporate Governance Committee The NCG Committee oversees risks associated with data privacy and information security, which encompasses cybersecurity. Our CSO and Chief Compliance Officer, among other executives, provide periodic reports to the NCG Committee and also meet with the NCG Committee to discuss any material events when they arise. The periodic reports are designed to keep the NCG Committee abreast of the Company's cybersecurity practices, risks and trends in cybersecurity threats. The NCG Committee also has discussions with management focused on evaluating the Company's exposure to cybersecurity risks and cybersecurity practices in place to mitigate such risks. These discussions enable the NCG Committee to be informed of the steps management is taking to detect, monitor and manage cybersecurity risks. These reports to the NCG Committee typically include information on any significant incidents that have occurred, how they were managed, and any changes to the risk profile of the Company. The NCG Committee seeks updates to facilitate proactive governance and to allow the NCG Committee to address emerging cybersecurity issues with management.


text: The Audit Committee is integral to overseeing the Company's overall risk management strategies, including cybersecurity risks and disclosures. To keep the Audit Committee informed, the Chief Audit Executive maintains a direct and open communication channel with the Audit Committee. Regular meetings are held for the Chief Audit Executive to report to the Audit Committee. These include an enterprise-wide risk assessment that highlights cybersecurity risks and cybersecurity risk mitigation actions. Additionally, the Audit Committee receives updates on significant incidents and cybersecurity risks that have been presented to or discussed with the Enterprise Risk and Compliance Committee.


text: Risk Management and Strategy Our Cybersecurity Approach and Integration We have implemented processes for overseeing and identifying material risks from cybersecurity threats, and our cybersecurity processes are integrated into the Company's overall risk management system and processes. As part of management's oversight of cybersecurity, our Chief Security Officer ("CSO") presents on our cybersecurity practices to the Nominating and Corporate Governance Committee of our Board of Directors (the "NCG Committee") and to our full Board of Directors on a periodic basis. Our Senior Vice President, Internal Audit & Risk Management (the "Chief Audit Executive"), periodically presents enterprise risks, including cybersecurity risks, to the Audit Committee of our Board of Directors (the "Audit Committee"). Our Chief Compliance Officer regularly attends meetings of the NCG Committee to provide insights from the compliance perspective relating to cybersecurity.


text: Cyber risk management is a core component of the Company's governance structure. We utilize the National Institute of Standards and Technology's Cybersecurity Framework as a guide in cyber risk management to identify, assess, and assist the CSO in managing cybersecurity risks. Cyber risk management encompasses partnerships among teams that are responsible for cyber governance, prevention, detection, and remediation activities within the Company's cybersecurity environment. As part of our cyber risk management efforts, we conduct periodic reviews and collaborate with enterprise-wide risk assessments to assess and manage cybersecurity risks. Our cybersecurity team also provides enterprise-wide cybersecurity training for employees to continuously improve our mitigation against human-driven vulnerabilities.


text: Cybersecurity Incident Impact As previously disclosed, in August 2021, we experienced a cybersecurity incident that resulted in numerous lawsuits, including mass arbitration claims and multiple class action lawsuits. In January 2023, we experienced another cybersecurity incident that also resulted in consumer class actions and regulatory inquiries. As a result of the August 2021 cyberattack and the January 2023 cyberattack, we have incurred and may continue to incur significant costs or experience other material financial impacts, which may not be covered by, or may exceed the coverage limits of, our cyber liability insurance, and such costs and impacts may have a material adverse effect on our business, reputation, financial condition, cash flows and operating results. For additional details regarding the impact of both cybersecurity incidents, see Note 18 – Commitments and Contingencies of the Notes to the Consolidated Financial Statements.


text: Enterprise Risk & Compliance Committee Our Enterprise Risk & Compliance Committee is comprised of a collective of senior management representatives and subject matter experts from across the Company. The Enterprise Risk & Compliance Committee is chaired by the Chief Financial Officer of the Company, with the Executive Vice President & General Counsel as the co-chair and comprises core members including the Transformation and Chief Information & Digital Officer, while the CSO serves in an advisory capacity. The purpose of the Enterprise Risk & Compliance Committee is to oversee and govern the Company's risk management, environmental, social, corporate governance, cybersecurity, and operational compliance activities, as well as provide a means of bringing risk issues to the attention of management. Specific to cybersecurity, the Transformation and Chief Information & Digital Officer and the CSO have the expertise to provide insights into the nature of cyber threats, the Company's readiness, and actions taken to mitigate such risks.


text: Disclosure of the Board's Roles and Responsibilities Our Board of Directors oversees risks from cybersecurity threats using a multi-faceted approach that involves the NCG Committee and Audit Committee and various executive roles. Additionally, our Transformation and Chief Information & Digital Officer and CSO report on cybersecurity to the full Board.


text: The Audit Committee is integral to overseeing the Company's overall risk management strategies, including cybersecurity risks and disclosures. To keep the Audit Committee informed, the Chief Audit Executive maintains a direct and open communication channel with the Audit Committee. Regular meetings are held for the Chief Audit Executive to report to the Audit Committee. These include an enterprise-wide risk assessment that highlights cybersecurity risks and cybersecurity risk mitigation actions. Additionally, the Audit Committee receives updates on significant incidents and cybersecurity risks that have been presented to or discussed with the Enterprise Risk & Compliance Committee.


text: Cybersecurity is a crucial component of our enterprise risk management program. Like many companies, both we and our external providers have been subject to, and expect to continue to be subject to, a range of cybersecurity threats and risks. We have invested significant resources into cybersecurity and risk management processes to adjust to the continuing evolution in cybersecurity and respond to related threats.

companyName: COHEN & STEERS, INC.

ticker: CNS


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature and information relating to our clients and investments (Information Systems and Data).


text: Our cybersecurity risk management function is led by our Chief Information Security Officer (CISO) and Chief Technology Officer (CTO) and includes members of our Information Technology (IT) department and other personnel that oversee our information security and engineering operations. Input and guidance are also provided by members of our Legal and Compliance departments. Together, these employees (collectively referred to as members of our Cybersecurity Management) are primarily responsible for developing, implementing and monitoring our cybersecurity program and reporting on cybersecurity matters to senior management as well as our board of directors.


text: Members of our Cybersecurity Management identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's enterprise risk profile using various manual and automated tools as well as by: (i) utilizing shared information about vulnerabilities and exploits from various professional security organizations, reports or other services that identify cybersecurity threats and through the use of external intelligence feeds; (ii) analyzing reports of threats and actors; (iii) conducting scans of the Company's threat environment; (iv) evaluating our and our industry's risk profile; (v) evaluating threats that are reported to us; (vi) coordinating with law enforcement concerning threats; (vii) conducting internal and external audits of our information security control environment and operating effectiveness; and (viii) conducting threat assessments for internal and external threats, including through the use of third party threat assessments and vulnerability threat assessments.


text: Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, but not limited to: • technical and physical safeguards: (i) systems monitoring, including anti-virus/anti-malware software for workstations and servers, reports about correlated events detected from server log reviews, desktop forensics software and suspicious firewall traffic, firewall logs and alerts from users about blocked websites, systems monitoring of Company websites, network monitoring software alerts and scheduled internal and external vulnerability scans; (ii) asset management tracking and disposal; (iii) incident detection and response; (iv) data encryption; (v) notification monitoring from Company personnel and from third parties regarding issues and signs of potential incidents; and (vi) access controls and network security controls; and • organizational safeguards: (i) incident response plans that address our response to a cybersecurity incident; (ii) personnel and vendors dedicated to overseeing the Company's cybersecurity program; (iii) periodic mandatory employee cybersecurity training; (iv) periodic risk assessments and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents, such as audits, tabletop exercises, threat modeling and vulnerability testing; (v) policies and programs such as security standards, a vendor risk management program, a vulnerability management policy and disaster recovery and business continuity plans; and (vi) insurance coverage dedicated to losses resulting from cybersecurity incidents.


text: Cybersecurity risk management is integrated into the Company's overall enterprise risk management (ERM) process. For example, (i) enterprise risk management-level cybersecurity risks are reviewed at least annually by our information technology security team; (ii) internal and external penetration tests are performed to identify any vulnerabilities and findings are risk ranked based on potential likelihood and impact; and (iii) members of Cybersecurity Management report on cybersecurity risk management and related matters to the board of directors and the audit committee, as part of their ongoing evaluation and oversight of overall enterprise risk.


text: Third-party service providers play a key role in our cybersecurity program. We use third-party service providers to assist us in identifying, assessing and monitoring material risks from cybersecurity threats, including through penetration testing, provision of threat intelligence and monitoring our environment 24 hours a day and seven days a week. We have currently engaged with professional services firms, including legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, dark web monitoring firms and cyber insurance brokers and providers. We report key findings of such assessments to our board of directors and the audit committee and we adjust our cybersecurity policies, standards, processes and practices as necessary based in part on information provided by these assessments and engagements.


text: We also use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies and supply chain resources. We maintain a risk-based approach to identifying and overseeing cybersecurity risks and vulnerabilities presented by our engagement of third parties, including key vendors, service providers and other external users of our information systems, as well as the information systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue and the identity of the provider, our vendor risk management program may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider. Our vendor risk management program may entail: (i) vendor risk assessments; (ii) security questionnaires; (iii) vendor audits; (iv) vulnerability scans relating to vendors; (v) security assessment calls with the vendor's security personnel and our review of the vendor's written security program, security assessments and other reports; (vi) provision from the vendor of a System and Organization Controls (SOC) 1 or SOC 2 report to evidence cybersecurity preparedness; and (vii) the imposition of contractual obligations on the vendor.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including under the caption "We could incur financial losses, reputational harm and regulatory penalties if we fail to implement effective information security policies and procedures."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by members of our Cybersecurity Management, including our CISO, CTO and our Head of IT Infrastructure.


text: • Our CISO oversees the information security group and program within our IT department and holds a Bachelor of Arts degree in computer science. Our CISO has served in various roles in information technology for over 24 years within the financial services industry, including previously serving as Head of Information Security and Enterprise Infrastructure, Head of IT Audit and Chief Information Security Officer at other companies, and holds the Certified Information Systems Auditor (CISA) and Certified in Risk and Information Systems Control (CRISC) certifications and is registered with FINRA for the Series 99. • Our CTO oversees our IT department and holds a PhD in computer science, an MBA and Postgraduate Diploma in physics. Our CTO has served in various roles in information technology for over 28 years, including senior leadership roles for the investment banking division of a financial services company. • Our Head of IT Infrastructure oversees the infrastructure and service desk departments within our IT department and holds a Bachelor of Business Administration degree in finance and computer information systems. Our Head of IT Infrastructure has served in various roles in information technology for over 20 years.


text: Members of our Cybersecurity Management, including our CISO and our CTO, are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy and communicating key priorities to relevant personnel. Members of our Cybersecurity Management, including our CISO and our CTO, are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is a key component of our cybersecurity program. The response plan is designed to report certain cybersecurity incidents to members of Cybersecurity Management, who then work with the Company's incident response team to help the Company control, mitigate and remediate cybersecurity incidents of which they are notified. In addition, the response plan includes prompt reporting to the board of directors (or audit committee) of certain cybersecurity incidents and of the company's materiality and disclosure determinations relating thereto.


text: The audit committee and board of directors actively participate in discussions regarding cybersecurity risk exposures and steps taken by management to monitor and mitigate such risks, further to their responsibility to manage, oversee and remain informed about the most significant risks to Company and align our risk exposure with our strategic and business objectives. At least annually, the audit committee reviews with our CTO the Company's cybersecurity program, including the robustness and efficacy of the Company's overall cybersecurity program, steps taken to enhance defenses and security measures in place and our established plans to identify, detect and respond to threats we may encounter. The audit committee also annually reviews and discusses with management the ERM process and annual risk assessment, as well as the Company's cyber insurance coverage and annual SOC-1 report provided by an independent services firm. More frequently, the audit committee and board of directors receive reports and communications from our CTO and our Chief Operating Officer regarding material risks and specific developments related to the changing cybersecurity landscape and the Company's operating, technology and control environment. Such reports may cover topics such as: recent investments made in our cyber infrastructure; the undertaking of new technology projects and initiatives; vulnerability assessments and key findings from external cyber experts retained by the Company; the impact of new cybersecurity-related rules and regulations; changes in the threat environment including new and emergent risks; and evolving information security standards and market practices including with respect to peers and third parties.


text: Risk Management and Strategy Cybersecurity is a crucial component of our enterprise risk management program. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature and information relating to our clients and investments.


text: Our cybersecurity risk management function is led by our Cybersecurity Management team which is comprised of our Chief Information Security Officer (CISO), Chief Technology Officer (CTO), members of our Information Technology (IT) department, as well as members of our Legal and Compliance Departments. Our Cybersecurity Management team is primarily responsible for developing, implementing and monitoring our cybersecurity program and reporting on cybersecurity matters to senior management as well as our board of directors.


text: Members of our Cybersecurity Management identify and assess risks from cybersecurity threats by monitoring our threat environment and the Company's enterprise risk profile using various manual and automated tools as well as by: (i) utilizing shared information about vulnerabilities and exploits from professional security organizations, reports or other services that identify cybersecurity threats and through the use of external intelligence feeds; (ii) analyzing reports of threats and actors; (iii) conducting periodic vulnerability scans of the Company's IT environment; (iv) evaluating our and our industry's risk profile; (v) evaluating threats that are reported to us; (vi) coordinating with law enforcement concerning threats; (vii) conducting internal and external audits of our information security control environment and operating effectiveness; and (viii) conducting threat assessments for internal and external threats, including through the use of third party threat assessments and vulnerability threat assessments.


text: We implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats, including, but not limited to: • technical and physical safeguards: (i) real-time security information and event monitoring of systems, workstations, servers and networks, and periodic internal and external vulnerability scans; (ii) asset management tracking and disposal; (iii) incident detection and response; (iv) data encryption; (v) notification monitoring from Company personnel and from third parties regarding issues and signs of potential incidents; and (vi) logical access controls and network security controls; and • organizational safeguards: (i) incident response plans that address our response to a cybersecurity incident; (ii) personnel and vendors dedicated to overseeing the Company's cybersecurity program; (iii) periodic mandatory employee cybersecurity training; (iv) periodic risk assessments and testing of our policies, standards, processes and practices designed to address cybersecurity threats and incidents; (v) policies and programs such as security standards, a vendor risk management program, a vulnerability management policy and disaster recovery and business continuity plans; and (vi) insurance coverage dedicated to losses resulting from cybersecurity incidents.


text: Cybersecurity risk management is integrated into the Company's overall enterprise risk management (ERM) process. For example, (i) enterprise risk management-level cybersecurity risks are reviewed at least annually by our information technology security team; (ii) internal and external penetration tests are performed to identify vulnerabilities and findings are risk ranked based on potential likelihood and impact; and (iii) members of Cybersecurity Management report on cybersecurity risk management and related matters to the audit committee of the board of directors, as part of their ongoing evaluation and oversight of overall enterprise risk pursuant to non-exclusive authority delegated by the board of directors.


text: We use third-party service providers to assist us in identifying, assessing and monitoring material risks from cybersecurity threats, including through penetration testing, provision of threat intelligence and continuous monitoring of our environment. We report key findings to the audit committee of the board of directors and, if appropriate, the board of directors and adjust our cybersecurity policies, standards, processes and practices as necessary based in part on information provided by these assessments and engagements.


text: We also use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies and supply chain resources. We maintain a risk-based approach to identifying and overseeing cybersecurity risks and vulnerabilities presented by our engagement of third parties, as well as the information systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. Our vendor risk management program may involve different assessments designed to help identify cybersecurity risks including: (i) vendor risk assessments; (ii) security questionnaires; (iii) vendor audits; (iv) vulnerability scans relating to vendors; (v) security assessment calls with the vendor's security personnel and our review of the vendor's written security program, security assessments and other reports; (vi) evidence of cybersecurity preparedness through a System and Organization Controls (SOC) 1 or SOC 2 report; and (vii) the imposition of contractual obligations on the vendor.


text: For a description of the risks from cybersecurity threats that may materially affect the Company, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including under the caption "We could incur financial losses, reputational harm and regulatory penalties if we fail to implement effective information security policies and procedures."


text: • Our CISO oversees the information security group and program within our IT department with over 25 years of experience, including similar roles at other financial services companies, and holds the Certified Information Systems Auditor (CISA) and Certified in Risk and Information Systems Control (CRISC) certifications and is registered with FINRA for the Series 99. • Our CTO oversees our IT department and has served in various roles in information technology for over 29 years, including senior leadership roles at another financial services company. • Our Head of IT Infrastructure oversees the infrastructure and service desk within our IT department and has served in various roles in information technology for over 21 years.


text: Our cybersecurity incident response plan is a key component of our cybersecurity program. The response plan is designed to report certain cybersecurity incidents to members of Cybersecurity Management, who then work with the Company's incident response team to help control, mitigate and remediate cybersecurity incidents. In addition, the response plan includes prompt reporting to the board of directors (or audit committee) of certain cybersecurity incidents and related materiality and disclosure determinations.


text: The audit committee of the board of directors actively participates in discussions regarding cybersecurity risk exposures and steps taken by management to monitor and mitigate such risks, further to their responsibility to manage, oversee and remain informed about the most significant risks to Company and align our risk exposure with our strategic and business objectives. At least annually, the audit committee reviews with our CTO and CISO the Company's cybersecurity program, including the robustness and efficacy of the overall cybersecurity program, steps taken to enhance defenses and security measures in place and our established plans to identify, detect and respond to potential threats. The audit committee also annually reviews and discusses the ERM process and risk assessment, as well as the Company's cyber insurance coverage. Additionally, the audit committee of the board of directors receives reports and communications from our CTO and our Chief Operating Officer regarding material risks and specific developments related to the changing cybersecurity landscape and the Company's operating, technology and control environment. Such reports may cover topics such as: investments made in our cyber infrastructure; technology projects and initiatives; vulnerability assessments and key findings from external cyber experts; the impact of new cybersecurity-related rules and regulations; changes in the threat environment; and evolving information security standards and market practices. As of December 31, 2024, we have not experienced any cyber incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Cybersecurity Risk Management Process The Company relies extensively on IT systems to operate and manage its business and process transactions. As a result, our business is at risk from, and may be impacted by, cybersecurity incidents. The Company's cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.

companyName: KITE REALTY GROUP TRUST

ticker: KRG


text: As risk management is an ongoing process, the Company regularly assesses its cybersecurity risks and adjusts its program accordingly. Via multiple monitoring solutions, potential cyber threats are automatically logged and proactively addressed. Our monitoring tools use well-established vulnerability scoring to aid in the overall risk assessment. The scoring ranks by potential severity and likelihood and includes a review of mitigating factors. The Company prioritizes its cybersecurity investments based on the likelihood and impact of potential threats.


text: From onboarding and at least annually thereafter, the Company educates and trains its workforce on cybersecurity leading practices using a variety of methods. The Company regularly performs internal and external penetration testing and vulnerability scanning with the support of well-established third-party providers. Any identified deficiencies or vulnerabilities are reviewed by the IT staff and management and remediation steps are taken based on the criticality of the results.


text: Cybersecurity tools and services are configured to identify threats and risks that may be associated with the use of third-party applications or solutions.


text: The Company has developed incident response plans to contain, investigate, respond to and recover from cybersecurity incidents. Our response plans require prompt notification to members of senior management in the event of a significant cybersecurity incident and prompt briefings on further developments as appropriate.


text: Risks And Impact From Cybersecurity Threats To date, we are not aware of any risks from cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents. For more information regarding our cybersecurity risks, refer to Item 1A. "Risk Factors – We and our tenants face risks related to cybersecurity attacks that could cause loss of confidential information and other business disruptions." included elsewhere within this Annual Report on Form 10-K.


text: Board of Trustees Oversight Our Board of Trustees oversees various risks that the Company may face from time to time. While the full Board of Trustees has primary responsibility for risk oversight, it has delegated to the Audit Committee the responsibility for overseeing the Company's enterprise risk management and risk mitigation policies and programs, including matters related to privacy and cybersecurity. The Audit Committee reviews the Company's cybersecurity risks and the effectiveness of its cybersecurity program every quarter. Reports on these topics are provided to the Audit Committee by the Senior Vice President, Chief Technology Officer and the Vice President, Internal Audit and Enterprise Risk Management on a quarterly basis. In addition, when appropriate, cybersecurity risks and incidents will be reported to the Board of Trustees by the Company's Chief Financial Officer.


text: Management's Role The Company's management team is responsible for implementing and managing the Company's cybersecurity risk management program. The management team regularly reviews the Company's cybersecurity risks and adjusts the program as needed. Risk data analyzed includes summary and detailed data from monitoring and protection systems along with remediation reports to ensure the constant evolution of the program.


text: Key members of the IT team responsible for information security include several individuals with over 20 years of experience within various industries including real estate, global retail, fintech and insurance along with experience working for several top IT service and solutions providers.


text: The IT team provides quarterly reports to the Company's senior management. Such reports typically address, among other things, the Company's cybersecurity strategy, initiatives, key security metrics, business response plans, and the evolving cybersecurity threat landscape.


text: The Company has cybersecurity insurance designed to cover certain expenses relating to cybersecurity incidents. The Company also carries other insurance that may cover ancillary aspects of a cybersecurity incident; however, damage and claims arising from a cybersecurity incident may exceed the amount of any insurance available.


text: Cybersecurity Risk Management Process The Company relies extensively on IT systems to operate and manage its business and process transactions. As a result, our business is at risk from, and may be impacted by, cybersecurity incidents. The Company's cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, which is used to benchmark and tailor the Company's strategies and program to our risk profile and specific operational needs and goals.


text: We recognize that cybercriminals frequently target employees to gain unauthorized access to information systems. Therefore, from onboarding and at least annually thereafter, the Company educates and trains its employees on cybersecurity leading practices using a variety of methods, which is supplemented throughout the year with regular phishing and other cyber-related testing. The Company regularly performs internal and external penetration testing and vulnerability scanning with the support of well-established third-party providers. Identified deficiencies or vulnerabilities are reviewed by the IT staff and management, and remediation steps are taken based on the criticality of the results.


text: Cybersecurity tools and services are configured to identify threats and risks that may be associated with the use of third-party applications or solutions. We prioritize our cybersecurity efforts relating to third parties based on the likelihood and potential impact of cybersecurity threats. These efforts may include reviewing security documentation or protocols of key vendors, service providers, and external users of our systems.


text: The Company has developed cybersecurity incident response plans to contain, investigate, respond to, and recover from cybersecurity incidents that may jeopardize the confidentiality, integrity, or availability of our IT systems. Key members of management, including the Company's Chief Financial Officer, Chief Operating Officer, and Chief Legal Officer, as well as employees from IT, internal audit, marketing and communications, and human resources, serve on the Company's security incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. Our response plans require prompt notification to members of senior management in the event of a significant cybersecurity incident and prompt briefings on further developments as appropriate.


text: Risks And Impact From Cybersecurity Threats As of December 31, 2024, we are not aware of any risks from cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents. For more information regarding our cybersecurity risks, see "We and our tenants face risks related to cyber attacks that could cause loss of confidential information and other business disruptions" in Item 1A. "Risk Factors" within this Annual Report on Form 10-K.


text: Board of Trustees Oversight Our Board of Trustees oversees various risks that the Company may face from time to time. While the full Board of Trustees has primary responsibility for risk oversight, it has delegated to the Audit Committee the responsibility for overseeing the Company's enterprise risk management and risk mitigation policies and programs, including matters related to privacy and cybersecurity. The Audit Committee reviews the Company's cybersecurity risks and the effectiveness of its cybersecurity program every quarter, including current threat levels and ongoing program enhancements. Reports on these topics are provided to the Audit Committee by the Vice President, Chief Information Security Officer ("CISO") and the Vice President, Internal Audit and Enterprise Risk Management on a quarterly basis. In addition, when appropriate, cybersecurity risks and incidents will be reported to the Board of Trustees by the Company's Chief Financial Officer.