text: Our CIO and other leaders work collaboratively across our organization to protect our information systems from cybersecurity threats and to promptly respond to incidents in accordance with our incident response plan, including the necessary steps to ensure remediation. Through ongoing communications, these teams monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to our board of directors when appropriate.


text: Our CIO has over 20 years of professional experience specializing in business transformation, change management, executive leadership, and IT strategy, and has worked with technology security, banking and media companies. Our head of Information Security also brings over 20 years of security, privacy, and compliance experience from public and private sector roles of which he spent the last ten years specifically leading security programs at late-stage SaaS companies.

companyName: ON24 INC.

ticker: ONTF

secItem: Item 1C


text: We periodically assess and test our cybersecurity policies and practices. These efforts include tabletop exercises, vulnerability and penetration tests, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We also engage third parties to assess our cybersecurity measures. As of December 31, 2024, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, although we are unable to provide any assurance that such risks will not become material in the future.


text: Our board of directors oversees cybersecurity as part of its risk oversight function. The audit committee also assists our board of directors in fulfilling its responsibilities with respect to oversight of our cybersecurity programs, including assisting with reviewing the adequacy and effectiveness of our cybersecurity policies and practices and receiving regular presentations and reports from management. The audit committee provides regular briefings to our board of directors as appropriate. We follow an incident response plan that includes reporting prompt and timely information regarding material cybersecurity incidents, remediation, and related matters.


text: Our CIO has over 20 years of professional experience specializing in business transformation, change management, executive leadership, and IT strategy, and has worked with technology security, banking and media companies. Our head of Information Security also brings over 20 years of security, privacy, and compliance experience from public and private sector roles, including leading the security programs at SaaS companies for over a decade.


text: Risk Management and Strategy We have developed an information security program to assess, identify and manage material risks from cybersecurity threats. Our program includes policies and procedures that identify how security measures and controls are developed, implemented and maintained. We have aligned our cybersecurity program to the NIST Cybersecurity Framework and we assess our program against this standard annually. We are regulated by the Transportation Security Administration (TSA) as a pipeline infrastructure company and are required to comply with all TSA cybersecurity regulations. We use industry standard metrics to assess the criticality of software, data assets and operational technology.

companyName: NuStar Energy L.P.


text: We conduct periodic cyber risk assessments and assessments of our operational-technology network. We use these risk assessments together with risk-based analysis and judgment to determine which security controls to use to address identified risks. We also complete internal and external testing of software, hardware, defensive capabilities and other information security systems as advised by industry standards, and we use the test results to address identified vulnerabilities. We regularly conduct cyber threat exercises, which help us identify and address any gaps in our incident response plan. These exercises also help us practice sound decision-making skills to enhance our ability to react effectively during a material cyber event.


text: We rely on third-party software, third-party service providers and third-party applications to run certain aspects of our business and to aid in the development, implementation and maintenance of our security measures and controls. We regularly conduct third-party security audits and use vendor management programs to ensure that third-party software, service providers and applications comply with our vendor management program.


text: We consider the following factors, among others, to identify and manage material risks: (i) the likelihood of a risk occurring; (ii) the impact of a risk on us and others, including the likelihood of enforcement actions alleging potential regulatory violations, sanctions, litigation and other legal risks; and (iii) the controls we have applied to mitigate a risk's likelihood and impact. When selecting controls, we consider the likelihood and impact of identified risks, regulatory and other legal requirements, the feasibility of implementing a control and the potential impact of a control on our operations.


text: We use the following controls, among others, to mitigate the material cyber risks that we face: endpoint threat detection and response (EDR), identity and access management (IAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, a vendor management program (VMP) and vulnerability and patch management.


text: We use third-party security firms to provide or operate certain controls and technology systems. We use third parties to conduct assessments, such as monitoring vulnerability scans and penetration testing. We address cybersecurity threats related to our third-party technology and services through several processes, including pre-acquisition due diligence, contractual obligations and performance monitoring.


text: We have a written incident response plan and we conduct tabletop exercises to enhance incident response preparedness. We use business continuity and disaster recovery plans to prepare for a potential disruption in the technology we rely on. We train our employees on cybersecurity awareness when they are hired and conduct additional training annually thereafter.


text: Our executive management team has the day-to-day responsibility of assessing and managing our overall risk exposure, and our Board of Directors oversees those efforts. We have integrated cybersecurity risk into our overall risk management systems and processes. Our full Board has direct oversight over our cybersecurity risk management. The Board interfaces regularly with management and receives periodic reports on our areas of risk, including cybersecurity. Management interacts regularly with our Cyber Risk Governance Committee (CRGC), which meets regularly and oversees the effectiveness of our cybersecurity program. We make additional disclosures regarding our assessment, identification and management of cybersecurity risks below under the caption "Governance," and we hereby incorporate by reference those disclosures into this discussion of "Risk Management and Strategy."


text: We (or third parties we rely on) may not be able to fully, continuously and effectively implement security controls as designed or intended. We use a risk-based approach and the judgment of our CRGC, management and third parties with extensive expertise in cyber risk management to determine which security controls we implement. It is possible we may not implement appropriate controls if we do not properly identify or inadvertently underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate but not fully eliminate risks. Further, when security tools or third parties detect events, it may take us and our third parties time to analyze and understand the risks — and to determine the proper procedural steps to mitigate the effects of such risks — before we can effectively act upon the events. Impacts of Material Risk.


text: Pipeline operators have faced and continue to face risks from threat actors that focus their attacks on critical infrastructure assets and disruption to operations. We also face risks from ransomware groups that steal data, encrypt systems and demand a payment. We have cybersecurity protocols and procedures in place—and we rely on third-party software, hardware and vendors—to manage critical aspects of our operations. While we have controls in place to address these risks, if these risks occur, the impact could be material, such as in the event of a cybersecurity incident causing the loss of operational control, disruption of our operations, a demand for ransomware payment or physical damage to our assets or the environment.


text: Additionally, in Item 1A. "Risk Factors" under the caption "Risks Related to our Business," we discuss forward-looking cybersecurity risks that could have a material impact on us. Our disclosures in Item 1A. "Risk Factors" should be read in conjunction with this Item 1C.


text: Our Board of Directors has direct oversight over key risks that are broadly applicable across NuStar's businesses, including cybersecurity risk management. At each regularly scheduled meeting of the Board, the Board receives reports from our President and Chief Executive Officer (CEO) and Senior Vice President–Chief Information Officer and Controller (CIO) regarding our cybersecurity program. These reports include (i) regulatory updates, which include information on regulatory initiatives promulgated by governmental agencies and our compliance with such initiatives, and (ii) quarterly metrics and data, which include information on employee training, threats, incidents, preventive practices (e.g., patch installation), tabletop exercises, cybersecurity policies and cybersecurity program resources, risks and controls.


text: Our CIO is the management position with primary responsibility for the development, operation and maintenance of our information security program. He reports directly to our CEO. Certain of the CIO's direct reports have extensive expertise in the area of cyber risk management.


text: Our CRGC is composed of management representatives from key functions across our company. Our CIO serves as the Chair of the CRGC. The CRGC meets regularly and oversees the effectiveness of our cybersecurity program. The CRGC operates to deliver management-level oversight of cybersecurity matters. The CRGC reports regularly to our executive management team. The Chair of our CRGC reports regularly to our Board of Directors.


text: We use governance, risk and compliance tools to assess, identify and manage cybersecurity risks. To address potential cybersecurity events, we have developed an incident response plan that defines protocols and processes for effectively managing our response to an event, including protocols for the escalation of critical information to management, key company personnel and the Board.


text: Cyber Risk Management and Strategy We have implemented a number of technical and organizational safeguards designed to manage our risks from cybersecurity threats and to protect against, detect and prepare to respond to cybersecurity incidents. These include employee training, incident response capability reviews and exercises, cybersecurity insurance and business continuity mechanisms. Additionally, we engage a third-party cybersecurity firm to assist with security features such as network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures.

companyName: IPG PHOTONICS CORP

ticker: IPGP


text: Our incident response plan coordinates the activities that we and our third-party cybersecurity provider take to prepare, to respond and to recover from cybersecurity incidents. We have processes designed to triage, assess severity, investigate, escalate, contain and remediate an incident. We also have processes to comply with potentially applicable legal obligations and mitigate brand and reputational damage. As part of the above processes, we engage with consultants to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.


text: Our processes include assessing cybersecurity risks associated with our use of third-party service providers in the normal course of business, including those in our supply chain or who have access to our customer and employee data or our systems. Additionally, we assess cybersecurity considerations in the selection and oversight of our third-party service providers, including due diligence on the third parties that have access to our systems and facilities that house systems and data.


text: Governance Related to Cybersecurity Risks The Company's Global Director, Information Security (Security Director) directs the Company's cybersecurity team. He reports to the Company's Global Director of Information Technologies (IT Director), who reports to the Chief Executive Officer of the Company. The Security Director is responsible for assessing and managing the Company's cyber risk management program, informing senior management, as appropriate, regarding the prevention, detection, mitigation and remediation of cybersecurity incidents and supervising such efforts generally by the cybersecurity team. Our Security Director is a Certified Information Systems Security Professional (CISSP) and has over 20 years of experience in cybersecurity in a broad range of industries. Our IT Director has a master's degree in information systems and has prior experience managing global security efforts. Our Security Director manages a team of cybersecurity professionals with relevant experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance.


text: In addition, the Company's IT Steering Committee (ITSC) considers, among other IT matters, risks relating to cybersecurity and applicable mitigation plans to address such risks. The ITSC is comprised of certain members of the Company's senior management. The IT Director and Security Director attend each ITSC meeting. The ITSC generally meets quarterly during the year with the IT Director and Security Director to review risk mitigation activities as well as updated status of global security operations and metrics, including the prevention, detection, mitigation and remediation of cyber incidents. The IT Director, Security Director and ITSC monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in the cybersecurity risk management and strategy processes, including the operation of the Company's incident response plan. The Company has an established process led by our Security Director governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident.


text: Our Board of Directors (the "Board") is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on the Company's risks, risk management process and the risk trends related to cybersecurity at least annually, which includes a review of key performance indicators, recent threats and the Company's management of such threats. The Audit Committee specifically assists the Board in its oversight of risks related to cybersecurity. The Security Director and IT Director brief the Audit Committee on information security and cybersecurity annually and as necessary in response to certain incidents.


text: Although risks from cybersecurity incidents and threats have to date not materially impacted us, our business strategy, results of operations or financial condition, we have from time to time and will continue to experience threats to and security incidents related to our and our third party vendors' data and systems. For more information, please see "Item 1A, Risk Factors."


text: We have adopted cybersecurity control principles based on the National Institute of Standards and Technology Cybersecurity Framework (NIST), the Center for Internet Security (CIS) and ISO 27001. Further, our cybersecurity controls are designed to comply with applicable laws concerning protection of private information, including the EU General Data Protection Regulation (GDPR), Brazil's Lei General de Prote o de Dados Pessoais (LGPD) and the California Consumer Privacy Act of 2018 (CCPA).


text: Technology is a key component of our business operations, and cybersecurity is a significant consideration for the firm. T. Rowe Price has a holistic firm-wide approach to risk management including material risks from cybersecurity threats. The firm's overall risk management activities are designed to identify, assess, report, and manage risks that could affect the firm in achieving its objectives and goals. This risk management framework operates across our business lines and integrates business operational resiliency and technology related risks such as cybersecurity threats. As part of the firm's risk identification and assessment framework, key risks from cybersecurity threats specific to our environment are identified and assessed for adequacy of controls. Management identifies risk inherent to cybersecurity threats, estimates the significance of the risks, assesses the likelihood of their occurrence, establishes acceptable risk tolerance levels, and implements appropriate measures to monitor those risks. Action plans may be developed for identified control issues and management is responsible for addressing these issues.

companyName: PRICE T ROWE GROUP INC

ticker: TROW


text: Although management is responsible for the firm's day to day cybersecurity operations, the Board of Directors oversees the firm's cybersecurity program. The Board does not delegate this responsibility to a committee, nor does the Board identify a cybersecurity expert to consider the firm's activities and make recommendations or provide advice to the Board. Instead, many of our directors have significant technology experience gained through their prior work experience and through their positions on other boards of directors, all of which provides the Board with insight and practical guidance in overseeing the firm's technology and operations as well as our continuing investment in and development of our cybersecurity program.


text: Our Chief Executive Officer and President (CEO) has ultimate responsibility for developing strategy and overseeing execution to meet the firm's objectives. The CEO has delegated to our Chief Operating Officer (COO) oversight of this operational execution. The COO has several leaders within the COO organization who develop and oversee the firm's risk management, technology, and information security practices. These executive leaders play a critical role in cybersecurity risk management and strategy, as further described below.


text: The firm's Chief Risk Officer (CRO) leads the Enterprise Risk program, providing the framework and tools used by all business teams across the firm, including technology, to identify, assess, and manage risks from cybersecurity threats in coordination with the firm's Chief Information Security Officer (CISO). The Enterprise Risk team provides guidance and support in identifying, assessing, and monitoring all aspects of risks from cybersecurity threats. The Enterprise Risk function conducts risk assessments for technology and cybersecurity, and coordinates with Internal Audit and Firm-wide Compliance to provide risk assurance activities.


text: Enterprise Risk is primarily responsible for reporting risks from cybersecurity threats to executive leadership and our Enterprise Risk Management Committee (ERMC). The ERMC supports the efforts of the CRO in providing corporate-wide oversight of our firm's risk management efforts and provides a path for risk escalation. This committee monitors risk management activities, including cybersecurity matters, and reports periodically and more frequently as necessary, to our Board of Directors and Audit Committee. Cybersecurity risk management practices operate enterprise-wide, across T. Rowe Price legal entities, including Oak Hill Advisors (OHA). In addition, OHA has established an independent risk committee, which includes responsibilities for prompt escalation of key risks and incidents such as Cybersecurity to the T. Rowe Price CRO.


text: T. Rowe Price maintains documented Enterprise Incident Management and Reporting Policies and Procedures, outlining responsibilities and requirements for escalation of various types of incidents, including cybersecurity threats and incidents. Our process is designed to investigate incidents efficiently, identify root cause, communicate with the affected parties as appropriate, spot trends, and recommend improvements to mitigate risk. These procedures incorporate incident materiality determination within senior executive levels and operate firm-wide.


text: Global Technology and Business Unit management are also responsible for implementing internal controls to manage risks from cybersecurity threats to an appropriate level and in line with the firm's risk appetite. Cybersecurity risks are managed across all lines of business, requiring support and participation across all levels in the organization. Within Global Technology, Enterprise Security is responsible for maintaining security policies, standards, and guidelines and routinely works with our Enterprise Risk, Compliance, Internal Audit, and other key technology and corporate stakeholders to establish security controls, enforce them, and monitor their adherence on an ongoing basis. Enterprise Security also conducts regular phishing tests and manages annual employee training focused on raising awareness, highlighting the important role our employees play in protecting the firm from cybersecurity threats. Business Continuity and Disaster Recovery programs execute regular testing across business and technology teams to demonstrate resilience. The CISO regularly reviews the cybersecurity program and strategy with various risk committees, including the ERMC, Management Committee, and the Audit Committee. This ensures risks from cybersecurity threats are properly managed and our enterprise-wide cybersecurity program is aligned with the business needs and defined risk tolerances or risk appetite.


text: The cybersecurity program includes regular assessment on the effectiveness of the firm's risk mitigation strategies. Assessments include third-party validation to help ensure our internal controls and safeguards adhere to security and compliance standards. We annually undergo external examinations, such as Sarbanes-Oxley relating to financial reporting and SOC 1 and/or SOC 2 for key operational Business Units. In addition, we periodically engage with third-party partners to perform an independent evaluation of our cybersecurity program as well as external network penetration testing. This complements our internal assessments, such as application security testing, vulnerability management, and penetration testing. The firm participates in various industry threat intelligence information sharing forums to stay current on evolving cyber risks and threats. The results of these assessments are discussed with and reviewed by the Audit Committee, and shared with the Board, annually.


text: Within the firm's global Procurement department, governance processes are established, including a formal Supplier Risk Management program overseeing third-party relationships based on documented risk thresholds. The Supplier Risk Management program performs regular assessments, including information security reviews. Ongoing monitoring is performed through our centralized risk function as well as by business line supplier managers to raise new threats or weaknesses associated with a third-party service. In accordance with our Enterprise Incident Management Policy, any third-party cybersecurity incident is reported and evaluated for further review and impact analysis.


text: We have previously been the target of cybersecurity attacks and expect such attempts to continue, potentially with more frequency or sophistication. Although no cybersecurity incident during the year ended December 31, 2023 resulted in an interruption of our operations, known losses of critical data or otherwise had a material impact on the firm's strategy, financial condition or results of operations, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors–Technology Risks" for more information on how a material cybersecurity incident may impact us.


text: Although management is responsible for the firm's day to day cybersecurity operations, the Board of Directors ("the Board") oversees the firm's cybersecurity program. The Board does not delegate this responsibility to a committee, nor does the Board identify a cybersecurity expert to consider the firm's activities and make recommendations or provide advice to the Board. Instead, many of our directors have significant technology experience gained through their prior work experience and through their positions on other boards of directors, all of which provides the Board with insight and practical guidance in overseeing the firm's technology and operations as well as our continuing investment in and development of our cybersecurity program.


text: Our CEO has ultimate responsibility for developing strategy and overseeing execution to meet the firm's objectives. The CEO has delegated to our Chief Operating Officer (COO) oversight of this operational execution. The COO has several leaders within the COO organization who develop and oversee the firm's risk management, technology, and information security practices. These executive leaders play a critical role in cybersecurity risk management and strategy, as further described below.


text: The firm's Chief Risk Officer (CRO) leads the Enterprise Risk program, providing the framework and tools used by all business teams across the firm, including technology, to identify, assess, and manage risks from cybersecurity threats in coordination with the firm's Chief Information Security Officer (CISO). The Enterprise Risk team provides guidance and support in identifying, assessing, and monitoring all aspects of risks from cybersecurity threats. The Enterprise Risk function conducts risk assessments for technology and cybersecurity, and coordinates with Internal Audit and Global Compliance to provide risk assurance activities.


text: Enterprise Risk is primarily responsible for reporting risks from cybersecurity threats to executive leadership and our Enterprise Risk Management Committee (ERMC). The ERMC supports the efforts of the CRO in providing corporate-wide oversight of our firm's risk management efforts and provides a path for risk escalation. This committee monitors risk management activities, including cybersecurity matters, and reports periodically and more frequently, as necessary, to our Board of Directors and Audit Committee. For example, at each quarterly meeting the Audit Committee receives an update concerning the company's cybersecurity metrics. In addition, at least annually the Board receives a technology and cybersecurity update led by the senior management from the company's technology and information security teams. Cybersecurity risk management practices operate enterprise-wide, across T. Rowe Price legal entities, including Oak Hill Advisors (OHA). In addition, OHA has established an independent risk committee, which includes responsibilities for prompt escalation of key risks and incidents such as cybersecurity to the T. Rowe Price CRO.


text: The cybersecurity program includes regular assessment on the effectiveness of the firm's risk mitigation strategies. Assessments include third-party validation to help ensure our internal controls and safeguards adhere to security and compliance standards. We annually undergo external examinations, such as Sarbanes-Oxley relating to financial reporting, System and Organization Controls (SOC) 1, and SOC 2 for key operational Business Units. In addition, we periodically engage with third-party partners to perform an independent evaluation of our cybersecurity program as well as external network penetration testing. This complements our internal assessments, such as application security testing, vulnerability management, and penetration testing. The firm participates in various industry threat intelligence information sharing forums to stay current on evolving cyber risks and threats. The results of these assessments are discussed with and reviewed by the Audit Committee, and shared with the Board, annually.


text: Within the firm's global risk department, governance processes are established, including a formal Supplier Risk Management program overseeing third-party relationships based on documented risk thresholds. The Supplier Risk Management program performs regular assessments, including information security reviews. Ongoing monitoring is performed through our centralized risk function as well as by business line supplier managers to raise new threats or weaknesses associated with a third-party service. In accordance with our Enterprise Incident Management Policy, any third-party cybersecurity incident is reported and evaluated for further review and impact analysis.


text: We have previously been the target of cybersecurity attacks and expect such attempts to continue, potentially with more frequency or sophistication. Although no cybersecurity incident during the year ended December 31, 2024, resulted in an interruption of our operations, known losses of critical data, nor a material impact on the firm's strategy, financial condition or results of operations. The scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors–Technology Risks" for more information on how a material cybersecurity incident may impact us.


text: Cybersecurity Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protecting the confidentiality, integrity, and availability of our data and other information located on our information systems. Below is a discussion of how we assess, identify and manage material risks from cybersecurity threats.

companyName: Integer Holdings Corp

ticker: ITGR


text: Managing Material Cybersecurity Risks Within Our Overall Risk Management Framework We have strategically and deliberately integrated cybersecurity risk management into our broader risk management framework to promote a Company-wide culture of cybersecurity risk management. This integration seeks to ensure that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management-level Security, Privacy and Compliance Committee (the "SPCC") was established to help ensure that the Company's information security strategy supports our business operations and that the Company complies with applicable laws and regulations with respect to privacy and other cybersecurity matters. The SPCC is also primarily responsible for monitoring and responding to cybersecurity threats as they arise. The SPCC meets quarterly and as necessary. The SPCC is a cross-functional committee, and its members include Company officers and associates involved in various aspects of the Company's governance and operations, including our General Counsel, Corporate Controller, Chief Information Officer, Head of Environmental, Health, Safety and Security and others, and is chaired by Mr. Richard Balducci, our Chief Information Security Officer ("CISO"). In addition, we have established a management-level Cyber Disclosure Escalation Committee (the "CDEC") to assist in the evaluation of cybersecurity incidents that may arise from time to time and the potential need for public disclosure of any such incident. The CDEC meets quarterly and on an ad hoc basis as necessary, and it reports to our CEO and other members of the Company's senior management.


text: Third-Party Engagement in Cybersecurity Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our cybersecurity risk management systems. These partnerships enable us to leverage specialized knowledge and insights, seeking to ensure that our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third parties includes threat assessments, consultations on security enhancements and cybersecurity strategies and trends and penetration testing designed to simulate an external cyberattack on the Company. We also periodically retain a third-party advisor to perform a cybersecurity materiality assessment of the Company using the NIST CSF framework. Finally, we also engage a third party to evaluate the cybersecurity strengths of our vendors as part of our third-party risk oversight, as described below under "Oversight of Third-Party Risks."


text: Oversight of Third-Party Risks We have sought to implement stringent processes to oversee and manage cybersecurity risks resulting from our day-to-day business interactions with third parties. Our third-party risk oversight is primarily handled internally at the Company and consists of four fundamental pillars. First, we require each third-party information technology vendor that we engage with to complete a cybersecurity questionnaire detailing their cybersecurity standards and practices. These questionnaires are completed at the beginning of the relationship and thereafter periodically throughout the relationship based upon our risk level assessment. Second, we use a third-party consultant to monitor and assess cybersecurity matters relating to our vendors based on publicly available information. This monitoring is ongoing and, if an issue is identified, we will proactively seek to engage with our vendors to remediate the issue. Third, we seek to strictly limit access to our internal infrastructure and, for those vendors that have a need to access to our infrastructure, we use methods and processes to limit their access. Finally, we require our contracts with third-party vendors to include contractual obligations with respect to cybersecurity matters that are applicable those vendors, including data breach notifications.


text: Risks from Cybersecurity Threats We are not aware of any risks from any potential cybersecurity threat or from any previous cybersecurity incident that have materially affected or are likely to materially affect our business strategy, results of operations or financial condition. However, the risks from cybersecurity threats and incidents continues to increase, and the preventative actions we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against all such threats and incidents. We describe whether and how cybersecurity-related risks could materially affect our business, results of operation and financial condition in Item 1A, "Risk Factors" under the heading "Our operations are subject to cyber-attacks and other information technology disruptions that could have a material adverse effect on our business, results of operations and financial condition."


text: Cybersecurity Governance Matters Our Board understands the critical nature of managing risks associated with cybersecurity threats. Our Board has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and in maintaining stockholder confidence.


text: Board of Directors' Oversight Role and Management's Role in Managing Cybersecurity Risk Our Board has direct oversight responsibility for the Company's strategic risks. The Audit Committee has been made primarily responsible for the Board's oversight of cybersecurity risks, but the Board has discretion to delegate this oversight responsibility to any committee or sub-committee as it deems appropriate. The Audit Committee is composed of directors with diverse expertise including risk management, operations, technology and finance and accounting, equipping them to oversee cybersecurity risks effectively.


text: Our CISO is responsible for updating the Audit Committee on cybersecurity risks and the processes and procedures that Company management has put in place to seek to mitigate these risks. At least twice each year, our CISO provides updates to the Audit Committee on cybersecurity risks, incidents and incident resolution. The Audit Committee also discusses at least annually with the CISO regarding the status of the Company's IT policies, procedures, disaster recovery plans and other security issues. In addition, reports describing known cybersecurity threats are delivered to our executive leadership team on a monthly basis and general updates relating to our cybersecurity systems are delivered to our executive leadership team on a bi-monthly basis. Monthly cybersecurity reviews are also undertaken with our IT leadership team to discuss actionable cybersecurity issues. In addition to our scheduled meetings, the Audit Committee, CISO and other senior members of management maintain an ongoing and active dialogue regarding emerging or potential cybersecurity risks. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering oversight and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company. This oversight review by our Audit Committee helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework. In addition, we require all Company associates to complete mandatory cybersecurity awareness and information handling training at the time of hiring and on an annual basis.


text: Risk Management Personnel Our CISO, Mr. Richard Balducci, is primarily responsible for assessing, monitoring and managing our cybersecurity risks. Mr. Balducci has worked in the cybersecurity field since 1996. His background includes both the public and private sectors. Mr. Balducci has served as our CISO since 2020 and has built out a comprehensive security program for the Company by adding cybersecurity capabilities and aligning our cybersecurity systems to leading industry standards, including the National Institute of Standards and Technology Cybersecurity Framework. In addition, Mr. Balducci oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our cybersecurity training program for associates.


text: Company Processes for Monitoring Cybersecurity Incidents The CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO works with the SPCC to implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. If a cybersecurity event involving the Company were to occur, the CDEC would be immediately engaged to initially evaluate the potential materiality of the event and the potential need for public disclosure, and the SPCC and other members of senior management would be engaged to determine the timing and extent of the response and to consider whether any future vulnerabilities are expected. As part of this evaluation, the Company, through the SPCC, would also identify immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents. After an initial evaluation by the CDEC, the relevant information regarding the cybersecurity event and its potential materiality would also be promptly raised to the Company's Disclosure Committee for further review and evaluation as to whether public disclosure would be required.


text: Managing Material Cybersecurity Risks Within Our Overall Risk Management Framework We have strategically and deliberately integrated cybersecurity risk management into our broader risk management framework to promote a Company-wide culture of cybersecurity risk management. This integration seeks to ensure that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management-level Security, Privacy and Compliance Committee (the "SPCC") was established to help ensure that the Company's information security strategy supports our business operations and that the Company complies with applicable laws and regulations with respect to privacy and other cybersecurity matters. The SPCC is also primarily responsible for monitoring and responding to cybersecurity threats as they arise. The SPCC meets quarterly and as necessary. The SPCC is a cross-functional committee, and its members include Company officers and associates involved in various aspects of the Company's governance and operations, including our General Counsel, Corporate Controller, Chief Information Officer, Head of Environmental, Health, Safety and Security and others, and is chaired by our Chief Information Security Officer ("CISO"). In addition, we have established a management-level Cyber Disclosure Escalation Committee (the "CDEC") to assist in the evaluation of cybersecurity incidents that may arise from time to time and the potential need for public disclosure of any such incident. The CDEC meets quarterly and on an ad hoc basis as necessary, and it reports to our CEO and other members of the Company's senior management.


text: Risks from Cybersecurity Threats Based upon the information that we have as of the end of the year covered by this report, we do not believe that any risks from any cybersecurity threat or from any previous cybersecurity incident have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, the risks from cybersecurity threats and incidents continue to increase, and the preventative actions we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against all such threats and incidents, and, as a result, there can be no assurance that we or the third parties we interact with will not experience a cybersecurity event in the future that will materially affect us. For more information on risks to us from cybersecurity threats see Item 1A, "Risk Factors," under the heading "Our operations are subject to cyber-attacks and other information technology disruptions that could have a material adverse effect on our business, results of operations and financial condition."


text: Risk Management Personnel Our CISO is primarily responsible for assessing, monitoring and managing our cybersecurity risks and has worked in the cybersecurity field since 1996. His background includes both the public and private sectors. Our CISO has served in his position with the Company since 2020 and has built out a comprehensive security program for the Company by adding cybersecurity capabilities and aligning our cybersecurity systems to leading industry standards, including the National Institute of Standards and Technology Cybersecurity Framework. In addition, our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our cybersecurity training program for associates.


text: Company Processes for Monitoring Cybersecurity Incidents The CISO is regularly informed about developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO works with the SPCC to implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to seek to identify potential vulnerabilities. If a cybersecurity event involving the Company were to occur, the CDEC would be engaged to initially evaluate the potential materiality of the event and the potential need for public disclosure, and the SPCC and other members of senior management would be engaged to determine the timing and extent of the response and to consider whether any future vulnerabilities are expected. As part of this evaluation, the Company, through the SPCC, would also work to identify actions to seek to mitigate the impact and long-term strategies for remediation and prevention of future incidents. After an initial evaluation by the CDEC, the relevant information regarding the cybersecurity event and its potential materiality would also be promptly raised to the Company's Disclosure Committee for further review and evaluation as to whether public disclosure would be required.


text: Risk Management and Strategy The Company manages strategic, operational and external risks, including cybersecurity risk, through the Enterprise Risk Management ("ERM") program which has direct involvement from the Board, the Audit Committee of the Board (the "Audit Committee"), and Senior Management. Our ERM program provides a framework whereby management conducts a comprehensive annual enterprise risk assessment to identify and prioritize the most critical risks facing the Company, as well as emerging risks, and the development and reporting of risk mitigation strategies. Through this process, we have identified cybersecurity as a risk management priority.

companyName: TAPESTRY, INC.

ticker: TPR


text: The Company has a comprehensive cybersecurity risk assessment program that systematically identifies, analyzes and evaluates potential threats and vulnerabilities that may impact the confidentiality, integrity, and availability of the Company's information systems and data. This program includes governance structure, risk identification, risk analysis, risk management, and risk communication and reporting.


text: On a periodic basis, the Company engages independent third-party subject matter experts to conduct a cybersecurity maturity assessment based on the National Institute of Standards Technology framework, focused on risk assessment, global payment card industry audits, and compliance audits to help identify gaps and improve existing processes. In addition, the Company has a cybersecurity risk program that includes policies and procedures around onboarding of third-parties, contractual agreement review, risk assessment and on-going monitoring of high-risk vendors.


text: The Company also has several tools and processes in place to actively prevent, detect and manage cybersecurity incidents. This includes: • Vulnerability Management – continuous scanning of the technology environment to identify and remediate potential vulnerabilities. • Attack Surface Management – actively monitor and prevent external attack attempts. • Security Monitoring and Operations – collection and aggregation of security alerts that are reviewed, analyzed and managed by the security operations team. • Threat Intelligence – gathering and analyzing information about current and emerging cyber threats. • Incident Response – incorporating detection and recovery processes, defining roles and responsibilities across the Company, establishing communication protocols and escalation procedures, including performing tabletop exercises. • Disaster Recovery and Business Continuity Plans – covering both technology and business areas globally with annual exercises to validate processes. • Cybersecurity Awareness – educating employees and third-party service providers on best practices for protecting the Company from cyber threats, which includes providing annual security and privacy industry-specific training to employees as well as conducting period phishing simulations to test their awareness. We are continuously enhancing our cybersecurity framework in response to the ongoing incidents and threats that we face.


text: Cybersecurity is a key component of the Company's risk mitigation strategy. As such, a multi-year cybersecurity strategy and roadmap are developed and incorporated into Tapestry's long range planning and capital allocation process.


text: During the three fiscal years presented within this Form 10-K, our results of operations and financial condition have not been materially affected by cybersecurity risks and incidents. For a detailed discussion of significant risk factors regarding cybersecurity threats, refer to Item 1A — "Risk Factors — Risks Related to Information Security and Technology."


text: Our Board has active oversight of risk management, which includes cybersecurity. Several members of our Board have cybersecurity experience gained through direct responsibilities, oversight or other relevant education and experience. Our Board has delegated primary responsibility of cybersecurity risk to the Audit Committee.


text: The Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO") provide quarterly updates to the Audit Committee on information security, privacy risk and compliance, with updates to the Board at least annually.


text: Our CISO manages the Company's cybersecurity compliance program, including prevention, mitigation, detection and remediation of cybersecurity incidents. Our CISO, who reports directly into the CIO, has over 30 years of experience in information technology and cybersecurity and holds multiple industry certifications.


text: The Company has an Information Governance, Privacy & Security Committee responsible for management oversight of cybersecurity risk, which includes the CISO and key members of management and meets quarterly.


text: As part of our cyber incident response plan, our CISO is responsible escalating certain cybersecurity incidents to relevant senior management, along with several stakeholders, who then convene to evaluate the materiality of such incident using a list of quantitative and qualitative guidelines. In addition, outside advisors would be engaged as deemed necessary. The CEO, CFO, and Board are informed if the incident is deemed potentially material.


text: On a periodic basis, the Company engages independent third-party subject matter experts to conduct a cybersecurity maturity assessment based on the National Institute of Standards and Technology framework, focused on risk assessment, global payment card industry audits, and compliance audits to help identify gaps and improve existing processes. In addition, the Company has a cybersecurity risk program that includes policies and procedures around onboarding of third parties, contractual agreement review, risk assessment and ongoing monitoring of high-risk vendors.


text: The Company also has several tools and processes in place to actively prevent, detect and manage cybersecurity incidents. This includes: • Vulnerability Management – continuous scanning of the technology environment to identify and remediate potential vulnerabilities. • Attack Surface Management – actively monitor and prevent external attack attempts. • Security Monitoring and Operations – collection and aggregation of security alerts that are reviewed, analyzed and managed by the security operations team. • Threat Intelligence – gathering and analyzing information about current and emerging cyber threats. • Incident Response – incorporating detection and recovery processes, defining roles and responsibilities across the Company, establishing communication protocols and escalation procedures, including performing tabletop exercises. • Disaster Recovery and Business Continuity Plans – covering both technology and business areas globally with annual exercises to validate processes. • Cybersecurity Awareness – educating employees and third-party service providers on best practices for protecting the Company from cyber threats, which includes providing annual security and privacy industry-specific training to employees as well as conducting periodic phishing simulations to test their awareness. We are continuously enhancing our cybersecurity framework in response to the ongoing incidents and threats that we face.


text: Cybersecurity is a key component of the Company's risk mitigation strategy. As such, a multi-year cybersecurity strategy and roadmap are developed and incorporated into Tapestry's long-range planning and capital allocation process.


text: As part of our cyber incident response plan, our CISO is responsible for escalating certain cybersecurity incidents to relevant senior management, along with several stakeholders, who then convene to evaluate the materiality of such incident using a list of quantitative and qualitative guidelines. In addition, outside advisors would be engaged as deemed necessary. The CEO, CFO, and Board are informed if the incident is deemed potentially material.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to ongoing or previous clinical trials. (Information Systems and Data).

companyName: CHIMERIX INC


text: Our CEO and CFO, along with our Legal, Quality Assurance (QA), and IT (Information Technology) departments help identify, assess and manage the Company's cybersecurity threats and risks. The IT department works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating threats reported to us, internal and external audits, and utilizing trusted third parties to conduct vulnerability assessments to identify vulnerabilities.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, our incident response policy, incident detection and response procedures, encryption of certain data, network security controls, and data segregation across certain of our environments, access controls, physical security, systems monitoring, employee cybersecurity training, penetration testing conducted by third-parties, and maintaining cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the IT department works with management to prioritize our risk management processes and to mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us in identifying, assessing, and managing certain material risks from cybersecurity threats, including for example, data protection and privacy compliance professional service providers, external legal counsel, cybersecurity software providers, penetration testing firms, and managed cybersecurity service providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. We have a vendor qualification and management program designed to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. For example, we may conduct vendor qualification audits that assess a potential third party's cybersecurity risk potential. We may conduct a vendor risk assessment that evaluates the likelihood and potential impact of a cybersecurity threat involving the third-party service provider, based on factors such as the type and scope of services, the data processed, and the third-party service provider's security practices. We may request security attestations and certifications to verify that the vendor has met the relevant industry standards and best practices for cybersecurity. We may establish security clauses in our agreements with third-party service providers that address such matters as the roles, responsibilities, and expectations of both parties regarding cybersecurity, such as the security policies and procedures, the incident response and notification expectations, the remediation measures to be adopted, the responsibility for losses associated with incidents.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the "Risks Related to Information Technology." The Company has not experienced a cybersecurity threat that has materially affected the company.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Director of Information Technology and Senior Manager of Information Technology. Combined they have more than 35 years of experience in IT and cybersecurity. They hold many industry certifications in areas including Risk Management, Cybersecurity, Digital Forensics, Networking, and Enterprise Architecture. Their previous positions include work in Security Operations Centers and cybersecurity consulting for Fortune 500 companies and critical infrastructure providers.


text: The Information Technology and Legal departments are responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy and communicating key priorities to relevant personnel. The Senior Director of Information Technology, Senior Manager of Information Technology, and Assistant General Counsel are also responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Legal, the CFO, the CEO, and the IT department. Chimerix follows the cybersecurity incident response policy to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.


text: The Audit Committee of the Board of Directors receives quarterly reports from the Senior Director of IT concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented (or plans to implement) to address them. The Audit Committee of the Board of Directors also may request various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. We have a vendor qualification and management program designed to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process involves different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. For example, we may conduct vendor qualification audits that assess a potential third party's cybersecurity risk potential. We may conduct a vendor risk assessment that evaluates the likelihood and potential impact of a cybersecurity threat involving the third-party service provider, based on factors such as the type and scope of services, the data processed, and the third-party service provider's security practices. We may request security attestations and certifications to verify that the vendor has met the relevant industry standards and best practices for cybersecurity. We may establish security clauses in our agreements with third-party service providers that address such matters as the roles, responsibilities, and expectations of both parties regarding cybersecurity, such as the security policies and procedures, the incident response and notification expectations, the remediation measures to be adopted, the responsibility for losses associated with incidents.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the "Risks Related to Information Technology." The Company has not experienced a cybersecurity incident that has materially affected the company.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of Information Technology who has more than 20 years of experience in IT and cybersecurity. She holds many industry certifications in areas including Security Management and Cybersecurity and IT Service Delivery. Her previous positions include work in Security Operations Centers supporting enterprise corporations' security infrastructure and implementation and troubleshooting of network and security appliances.


text: The Information Technology and Legal departments are responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy and communicating key priorities to relevant personnel. The Director of Information Technology and Assistant General Counsel are also responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Legal, the CFO, the CEO, and the IT department, and help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.


text: The Audit Committee of the Board of Directors receives quarterly reports from the Director of IT concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented (or plans to implement) to address them. The Audit Committee of the Board of Directors also may request various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: BancPlus recognizes the critical importance of assessing, identifying, and managing material risks from cybersecurity threats and safeguarding the security of its banking operations and data, including protecting its customers' information. As described in more detail below, BancPlus has established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats (collectively, the "cybersecurity program"). The Company has devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and have made significant investments to maintain the security of the Company's banking operations and data and cybersecurity infrastructure.

companyName: BANCPLUS CORP


text: Risk Management and Strategy BancPlus' cybersecurity program is integrated into its overall enterprise-wide risk management program and based on guidance established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and applicable regulatory standards, as described below.


text: BancPlus' cybersecurity program seeks to address cybersecurity risks through a cross-functional approach that is focused on confidentiality, security, and availability of the information that the Company collects and stores by identifying and mitigating cybersecurity threats and effectively responding to cyber threats when they occur. BancPlus' cybersecurity program is primarily administered at the management level by the Cybersecurity Committee, which is led by Bancplus' Chief Information Security Officer ("CISO") with other members of executive management serving as members. The Cybersecurity Committee is a cross-functional governing body that drives alignment on security decisions across the Company. The Cybersecurity Committee meets regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. The cybersecurity program includes controls and procedures that are designed to ensure prompt escalation of appropriate cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the BancPlus board of directors in a timely manner.


text: The Cybersecurity Committee, described below, meets as needed, but at least monthly, to review security performance metrics, identify security risks, and assess the status of approved security enhancements. The Cybersecurity Committee also considers and makes recommendations to the BancPlus board of directors on the Company's cybersecurity program, including security policies and procedures, security service requirements, and risk mitigation strategies. At least annually, the Cybersecurity Committee conducts a cybersecurity risk assessment that considers information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance the Company's cybersecurity program, including security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to the Risk Committee of the BancPlus board of directors and members of management.


text: Technical Safeguards As part of the Company's cybersecurity program, BancPlus regularly assess and deploy technical safeguards designed to protect the Company's information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence, and incident response experience. In the event of a cybersecurity incident, the CISO will notify the Cybersecurity Committee.


text: Incident Response and Recovery Planning As part of its cybersecurity program, BancPlus has established comprehensive incident response and recovery plans in the case of a cybersecurity incident and continues to regularly test and evaluate the effectiveness of those plans. The Company's incident response and recovery plans address and guide its employees, management, and the BancPlus board of directors on responses to a cybersecurity incident.


text: Third-Party Risk Management BancPlus engages third party assessors, consultants and auditors in connection with the Company's information security program, including to conduct external penetration testing, independent audits, and risk assessments. BancPlus also utilizes third party service providers in the ordinary course of business. The Company has implemented controls designed to identify and mitigate cybersecurity threats associated with its use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. The Company uses a variety of inputs in such risk assessments, including information supplied by providers and third parties who assist in such risk assessment. In addition, the Company requires its providers to meet appropriate security requirements, controls, and responsibilities and investigate security incidents that have impacted the Company's third-party providers, as appropriate.


text: Education and Awareness BancPlus' cybersecurity program requires each of the Company's employees to contribute to the Company's data security efforts. The Company regularly reminds employees of the importance of handling and protecting customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: External Assessments BancPlus' cybersecurity program, including the related policies, standards, processes, and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities, including information security maturity assessments, audits and independent reviews of the Company's information security control environment and operating effectiveness. Reports and significant findings from these assessments are provided to management and the Risk Committee of the BancPlus board of directors. The Company's cybersecurity program is reviewed by the BancPlus board of directors at least annually and is adjusted based on the information provided from these assessments and other recommendations from the Cybersecurity Committee.


text: Cybersecurity Risk Oversight The BancPlus board of directors, through the Risk Committee, provides direction and oversight of the enterprise-wide risk management framework of BancPlus. The Risk Committee of the BancPlus board of directors oversees the Company's cybersecurity program. They receive regular reports from the Cybersecurity Committee about the prevention, detection, mitigation, and remediation of cybersecurity risks, including cybersecurity incidents, information security vulnerabilities, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents. BancPlus' risk management framework is overseen by the Chief Risk Officer at the management level. BancPlus' CISO has primary responsibility for assessing and managing material cybersecurity risks and leads management's Cybersecurity Committee. The CISO's experience spans over 20 years of cybersecurity operations and management, leading teams in highly regulated industries such as healthcare, education, and financial industry consulting for private and public companies. The CISO holds a Master of Business Administration and has attained a variety of professional certifications such as CISSP, CISM, GLAW, and GSEC, among others. The CISO reports to the Chief Risk Officer. See the section entitled "Part I, Item 1. Business—Enterprise Risk Management" for additional information on the role of the BancPlus board of directors and its committees in overseeing risk management.


text: Relevant Regulations As a regulated financial institution, BankPlus is also subject to financial privacy laws and the Company's cybersecurity practices are subject to oversight by the federal banking agencies. In addition, the SEC recently enacted rules, effective as of December 18, 2023, requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on annual basis material information regarding their cybersecurity risk management, strategy, and governance. For additional information, see the section entitled "Part I, Item 1. Business—Supervision and Regulation—Financial Privacy and Cybersecurity."


text: Although BancPlus has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business, financial condition or results of operations, there can be no guarantee that it will not experience such an incident in the future. There can be no guarantee that BancPlus' policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. For additional information regarding the risks the Company faces from cybersecurity threats, please see the risk factor titled "Unauthorized access, cyber-crime and other threats to data security may subject BancPlus to regulatory action or penalties, require significant resources, harm BancPlus' reputation, and otherwise cause harm to its business" included in Part I, Item 1A. Risk Factors of this report.


text: BancPlus recognizes the critical importance of assessing, identifying, and managing material risks from cybersecurity threats and safeguarding the security of its banking operations and data, including protecting its customers' information. As described in more detail below, BancPlus has established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats (collectively, the "cybersecurity program"). The Company has devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and has made significant investments to maintain the security of the Company's banking operations and data and cybersecurity infrastructure.


text: Risk Management and Strategy BancPlus' cybersecurity program is integrated into its overall enterprise-wide risk management program and based on guidance established by the National Institute of Standards and Technology ("NIST"), the Federal Financial Institutions Examination Council ("FFIEC") and other applicable regulatory standards, as described below.


text: Education and Awareness BancPlus' cybersecurity program requires each of the Company's employees to contribute to the Company's data security efforts. The Company regularly educates and tests employees on the importance of the proper handling and protection of customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: Cybersecurity Risk Oversight The BancPlus board of directors, through the Risk Committee, provides direction and oversight of the enterprise-wide risk management framework of BancPlus. The Risk Committee of the BancPlus board of directors oversees the Company's cybersecurity program. They receive regular reports from the Cybersecurity Committee about the prevention, detection, mitigation, and remediation of cybersecurity risks, including cybersecurity incidents, information security vulnerabilities, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents. BancPlus' risk management framework is overseen by the Chief Risk Officer at the management level. BancPlus' CISO has primary responsibility for assessing and managing material cybersecurity risks and leads management's Cybersecurity Committee. The CISO's experience spans over 20 years of cybersecurity operations and management, leading teams in highly regulated industries such as financial services, healthcare, education, and cybersecurity consulting for private and public companies. The CISO holds a Master of Business Administration and has attained a variety of professional certifications such as CISSP, CISM, GLAW, and GSEC, among others. The CISO reports to the Chief Risk Officer. See the section entitled "Business—Enterprise Risk Management" in Part I, Item 1 of this Annual Report on Form 10-K for additional information on the role of the BancPlus board of directors and its committees in overseeing risk management.


text: Relevant Regulations As a regulated financial institution, BankPlus is also subject to financial privacy laws and the Company's cybersecurity practices are subject to oversight by the federal banking agencies. In addition, the SEC recently enacted rules, effective as of December 18, 2023, requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on annual basis material information regarding their cybersecurity risk management, strategy, and governance. For additional information, see the section entitled "Business—Supervision and Regulation—Financial Privacy and Cybersecurity" in Part I, Item 1 of this Annual Report on Form 10-K.


text: Although BancPlus has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business, financial condition or results of operations, there can be no guarantee that it will not experience such an incident in the future. There can be no guarantee that BancPlus' policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. For additional information regarding the risks the Company faces from cybersecurity threats, please see the risk factor titled "Unauthorized access, cyber-crime and other threats to data security may subject BancPlus to regulatory action or penalties, require significant resources, harm BancPlus' reputation, and otherwise cause harm to its business" included in Part I, Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: Risk management and strategy Nasdaq's brand and role as a critical infrastructure provider for global financial markets, and operator of the Nasdaq Stock Market, make us an attractive target for cybersecurity risks, including from international political opponents, hacktivists and ransomware or other financially motivated criminals targeting the financial sector. Our cybersecurity risks include financial and reputational damage, along with collateral damage from loss of customer confidence in our exchange, products or offerings, as applicable, potential regulatory enforcement actions or litigation, either from governmental authorities or shareholders, or the failure to comply with contractual breach notifications. To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our business, our business strategy, our results of operations or financial condition. For further information, see "Our role in the global marketplace positions us at greater risk for a cyberattack" and "Expanded cybersecurity regulations, and increased cybersecurity infrastructure and compliance costs, may adversely impact our results of operations" in "Item 1A, Risk Factors" of this Annual Report on Form 10-K.

companyName: NASDAQ, INC.

ticker: NDAQ


text: Our risk management and mitigation approach includes the adoption of security controls and adaptive ongoing threat analysis. Our policies and our baseline security controls incorporate robust security infrastructure, risk-based controls and multi- layered defense systems. We have 16 System and Organization Controls Type 2, or SOC 2, certifications with respect to our information security and infrastructure. Our adaptive analysis monitors the threat landscape relevant to Nasdaq, our vendors and financial industry peers, and threats arising from geopolitical events. As the external threat landscape evolves, our information security controls are regularly evaluated, updated and enhanced to help protect against emerging risks. Additionally, we conduct extensive cybersecurity assessments of our acquired entities, both prior to acquisition and following completion of the transaction, to understand potential threats and mitigate any potential security gaps, as well as to ensure compliance with our security infrastructure and access management practices and policies.


text: We periodically engage external advisors to perform an analysis of our information security procedures, which include a review of program documentation and an overall maturity assessment of Nasdaq's information security programs. These advisors provide recommendations to further enhance our procedures. The findings are then presented to the Audit & Risk Committee of the Board of Directors, or the Audit & Risk Committee. In 2023, our management team and the Board of Directors conducted tabletop exercises and simulations in cybersecurity matters with assistance from internal and outside experts.


text: We use certain cloud-based third-party vendors for the core trading systems of certain of our exchanges and certain of our governance products and solutions. Prior to engaging such vendors, we analyze each provider's SOC2 certifications and perform due diligence and testing for information security and interoperability with our systems, and annually review the SOC2 certifications. Our security assurance and threat assessment team, within our Information Security organization, collaborates with our external threat intelligence providers to proactively review Nasdaq, and our vendors with respect to emerging threats and associated risks.


text: For our third-party service providers, our risk assessment process evaluates the probability and potential impact of incidents related to operational errors, technology disruptions, information security breaches, workforce issues, internal and external fraud, financial actions, and legal and regulatory matters. This assessment process is part of our Supplier Risk Management program, which establishes processes for identifying, assessing, and periodically reviewing our exposure to risk through third party vendors.


text: Cybersecurity is an integral part of risk management at Nasdaq. The Board of Directors appreciates the rapidly evolving nature of threats presented by cybersecurity incidents and is committed to the prevention, timely detection, and mitigation of the effect any such incidents may have on us. We use a cross-departmental approach to assess and manage cybersecurity risk, with our Information Security; Legal, Risk and Regulatory; and Internal Audit functions presenting on key topics to the Audit & Risk Committee, which provides oversight of our cybersecurity risk. Additionally, members from these organizations, along with Finance and Accounting, comprise a rapid response team that would mobilize in the event of a significant cybersecurity incident and would analyze and evaluate the incident while also advising the executive management team. Our Global Risk Management Committee, which includes our Chair and CEO and other senior executives, assists the Board of Directors in its cybersecurity risk oversight role.


text: Our Audit & Risk Committee receives quarterly or, if needed, more frequent reports on cybersecurity and information security matters from our Chief Information Security Officer, or CISO, and his team. The CISO has more than 25 years of experience in information technology and information security, particularly in the financial services industry, and our Information Security organization has more than 100 members, with expertise in application security; governance and compliance; program and vulnerability management; security engineering; security operations security assurance; and threat intelligence and security architecture.


text: This regular reporting to the Audit & Risk Committee also includes a cybersecurity dashboard that contains information on cybersecurity governance processes, and from time to time, also includes the status of projects to strengthen internal cybersecurity, ongoing prevention and mitigation efforts, security features of the products and services we provide our customers, or the results of security events during the period. The Audit & Risk Committee also reviews and discusses recent cyber incidents affecting the industry and the emerging threat landscape.


text: Cybersecurity is a shared responsibility, and our goal is for all employees to be vigilant in helping to protect our organization and themselves, at all times. We routinely perform simulations and tabletop exercises, and incorporate external resources and advisors as needed, to help strengthen our cybersecurity protection and information security procedures and safeguards. All employees are required to complete annual cybersecurity awareness training and have access to continuous cybersecurity educational opportunities throughout the year. Nasdaq also maintains a cybersecurity and information security risk insurance policy, and our Nasdaq Information Security Management System conforms to ISO 27001 requirements and is ISO 27001 certified.


text: On an annual basis, the Information Security team reviews and updates its governance documents, including the Information Security Charter, the Information Security Policy, and the Information Security Program Plan, and then presents the revised documents to the Audit & Risk Committee for review and/or approval. Additionally, the Information Security team maintains a formal cybersecurity strategic three-year plan, which outlines the strategic vision and associated goals for the cybersecurity of our global operations. The plan is regularly updated with new initiatives that align with technology innovations and changes in the threat landscape, and is reviewed and approved by the CISO and the Audit & Risk Committee. Throughout the three-year plan term, the CISO regularly provides management with progress reports.


text: Risk Management and Strategy Nasdaq's brand and role as a critical infrastructure provider for global financial markets, and operator of The Nasdaq Stock Market, make us an attractive target for cybersecurity risks, including from international political opponents, hacktivists and ransomware or other financially motivated criminals targeting the financial sector. Our cybersecurity risks include financial and reputational damage, along with collateral damage from loss of customer confidence in our exchange, products or offerings, as applicable, potential regulatory enforcement actions or litigation, either from governmental authorities, shareholders, or other litigants, or the failure to comply with contractual breach notifications. To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our business, our business strategy, our results of operations or financial condition. For further information, see "Our role in the global marketplace positions us at greater risk for a cyberattack" and "Expanded cybersecurity regulations, and increased cybersecurity infrastructure and compliance costs, may adversely impact our results of operations" in "Item 1A, Risk Factors" of this Annual Report on Form 10-K.


text: Our risk management and mitigation approach includes the adoption of NIST CSF and NIST 800-53 security control frameworks and adaptive ongoing threat analysis. In addition, our Information Security, or InfoSec, team reviews and conducts a risk assessment of any novel technologies Nasdaq plans to implement. Our policies and our baseline security controls incorporate robust security infrastructure with multi-layered defense systems. We have 17 System and Organization Controls Type 2, or SOC 2, certifications with respect to our information security and infrastructure. Our adaptive analysis monitors the threat landscape relevant to Nasdaq, our vendors and financial industry peers, and threats arising from geopolitical events. As the external threat landscape evolves, our information security controls are regularly evaluated, updated and enhanced to help protect against emerging risks. Additionally, we conduct extensive cybersecurity assessments of our acquired entities, both prior to acquisition and following completion of the transaction, to understand potential threats and mitigate any potential security gaps, as well as to ensure compliance with our security infrastructure and access management practices and policies.


text: We periodically engage external advisors to perform an independent assessment of the maturity of Nasdaq's information security programs, and compare our programs to our financial and technology industry peers. Nasdaq's InfoSec program has demonstrated increasing levels of maturity year-over-year for every InfoSec department.


text: R ecommendations to further enhance our procedures and maturity ratings from these assessments are then presented to the Audit & Risk Committee.


text: On a periodic basis, our management team and the Board of Directors conduct tabletop exercises and simulations in cybersecurity matters with assistance from internal and outside experts. These exercises are intended to strengthen resilience and readiness with scenarios, including cybersecurity matters.


text: We use certain cloud-based third-party vendors for the core trading systems of certain of our exchanges and certain of our governance products and solutions. Prior to engaging such vendors, we analyze each provider's SOC2 certifications, perform due diligence testing for information security and interoperability with our systems, and annually review the SOC2 certifications. Our security assurance and threat assessment team, within our Information Security organization, collaborates with our external threat intelligence providers to proactively review Nasdaq, and our vendors with respect to emerging threats and associated risks.


text: Our Audit & Risk Committee receives quarterly or, if needed, more frequent reports on cybersecurity and information security matters from our Chief Information Security Officer, or CISO, and his team. The CISO has more than 25 years of experience in information technology and information security, particularly in the financial services industry, and our InfoSec organization has seasoned members with expertise in application security; governance and compliance; program and vulnerability management; security engineering; security operations security assurance; and threat intelligence and security architecture.


text: Risk Management and Strategy As part of our operational risk management strategy, led by our chief operating officer, we have implemented processes to assess, identify, and manage material risks facing the Company, including from cybersecurity threats. Components of this strategy includes the use of industry standard traffic monitoring tools, training users to detect, report, and prevent unusual behavior, and working with reputable service providers capable of ensuring their ability to operate with strategies equal to or better than our own. The implementation and management of these processes are integrated with the Company's overall operational risk management processes that seeks to limit our exposure to unnecessary risks across our operations. For cybersecurity threat management and mitigation, the Company engages with expert consultants and third party services providers for the design and implementation of these industry standard strategies to identify any potential threats or vulnerabilities in our system. We have developed a cyber crisis response plan which provides a documented framework for handling high severity security incidents and facilitates coordination across multiple parts of the company. Our incident response team constantly monitors threat intelligence feeds, handles vulnerability management and responds to incidents.

companyName: Comstock Inc.

ticker: LODE


text: To date, risks from cybersecurity threats have not previously materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business, strategy, results of operations or financial condition. The sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types, including security threats that may result from third parties improperly employing AI technologies, and we may not be able to implement effective preventive measures against such security breaches in a timely manner. See Item 1A: Risk Factors above for additional information on risk related to cyber attacks.


text: Role of the Board The Audit and Finance Committee of the Board of Directors is responsible for the primary oversight of our information security programs, including relating to cybersecurity, and are integrated into the Company's Cybersecurity Incident response process. Our chief operating officer is responsible for reporting to the Audit and Finance Committee on our incident response plan, which includes an evaluation of cyber risks and threats, and notifies the Audit and Finance Committee of a cybersecurity threat. In the event of an incident, the Audit and Finance Committee reviews and approves the material incident disclosure plan and recommendation for determination of materiality using the guidelines approved by the Audit and Finance Committee. The Board of Directors and Audit and Finance Committee receive regular updates throughout the year on cybersecurity.


text: Role of the Management Our chief operating officer, together with our principal accounting officer, is responsible for the day-to-day management of our cybersecurity risks. We have an incident response framework in place. We use this incident response framework as part of the process we employ to keep our management and Board of Directors informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The framework is a set of coordinated procedures and tasks that our incident response team, under the direction of the chief operating officer, executes with the goal of ensuring timely and accurate resolution of cybersecurity incidents. The chief operating officer activates the incident response plan to assess and mitigate a cybersecurity incident. In the event of an incident, the chief operating officer and principal accounting officer consult with cybersecurity consultants and other involved parties to identify the undesirable effects of the cybersecurity incident and develop a material incident disclosure plan for review and approval by the Audit and Finance Committee.


text: We are subject to numerous cybersecurity threats which could result in equipment or network failures, loss of information (including sensitive personal information of customers or employees or proprietary information) as well as disruptions to our or our customers', suppliers' or vendors' operations. Cybersecurity risks we face include threats from entities and persons that may seek to target our information technology ("IT") infrastructure or use malware, computer viruses, denial of services attacks, ransomware attacks, credential harvesting, social engineering and other means to obtain unauthorized access to or disrupt the operation of our networks, systems and those of our suppliers, vendors and other service providers. In addition, we may face cyber threats from parties that seek to target us through our customers, suppliers, and other stakeholders with whom we do business. Cybersecurity threats are constantly evolving and becoming increasingly sophisticated and complex, increasing the difficulty of detecting and successfully defending against them.

companyName: OIL STATES INTERNATIONAL, INC

ticker: OIS


text: Risk Management Process We strive to follow the guidelines set by the National Institute of Standards and Technology Cybersecurity Framework to manage information assets, protect sensitive data and mitigate security risks. To address risks from cybersecurity threats, we maintain an information security team, automated monitoring and detection services, and policies and procedures for managing risk to our information systems. As part of our information security program, our operations strive to assess, identify and manage cybersecurity threat risks by: • identifying cybersecurity threats and critical information assets; • implementing cybersecurity prevention, detection and response controls; • incorporating cyber risk assessment practices into program activities; and • integrating cyber risk management into our business risk governance practices.


text: Additionally, we periodically review and update our cybersecurity policies, procedures, practices, and response plans considering evolving threats, changes in federal government compliance standards, and emerging commercial best practices, as applicable. We conduct employee training programs on cybersecurity as part of our efforts to mitigate persistent and continuously evolving cybersecurity threats. We have implemented processes requiring that material cybersecurity events, or losses of customer or personal data, are reported to affected parties, applicable regulatory authorities and management, as appropriate. The above cybersecurity risk management processes are integrated into our overall enterprise risk management process.