text: Current Cybersecurity Risk Posture For an additional description of the risks from cybersecurity threats that may materially affect the Company, see "Risk Factors" in this Annual Report on Form 10-K, including " If our information technology systems or data, or those of third parties upon which we rely, are or were compromised by a cybersecurity incident, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."


text: The Board, through its Risk Committee, oversees the Company's risk identification, risk tolerance, and management practices for enterprise risks facing the Company, including, but not limited to, risks associated with technology and operations, such as cybersecurity and cyber incident analysis and assessment. Our cybersecurity policies, standards, processes and practices are fully integrated into our enterprise risk management ("ERM") program and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry best practices. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on protecting our systems to support our business operations, preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively assessing and, if and as needed, responding to any cybersecurity threats and/or incidents.

companyName: OLD DOMINION FREIGHT LINE, INC.

ticker: ODFL

secItem: Item 1C


text: Risk Management and Strategy Key elements of our cybersecurity program include the following: • The Board's oversight of cybersecurity risk management is supported by the Risk Committee, which regularly interacts with our ERM function, our Director of Information Security, and other members of the OD Technology Department. • We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and/or incidents, while also implementing controls and procedures that provide for the prompt escalation of cybersecurity incidents as appropriate (including information that is conveyed to the Board under certain circumstances) so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • We have established and maintain comprehensive incident response and recovery plans that are designed to help us to timely and efficiently respond to a cybersecurity incident, and such plans are tested and evaluated on at least an annual basis. • We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • We provide regular, mandatory training for employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: Our Internal Audit Department, as part of its audit plan that is approved by the Audit Committee of the Board, conducts information technology audits as well as periodically engages third parties to perform cybersecurity attack and penetration assessments. We also use third parties to periodically benchmark and assess our cybersecurity readiness and to assess how any known vulnerabilities might impact our Company as well as the sufficiency of our response. The results generated from these activities are reported to management and are used to develop action plans to address any identified opportunities for risk mitigation and overall improvement. The Risk Committee of our Board is apprised by management of the results of the third-party analysis, any related action plans, and progress against those plans. Management, together with members of our OD Technology Department, brief the Board directly, or through their communications with the Risk Committee, on information security matters on at least a quarterly basis. After gathering and assessing information about our risk exposure, the Risk Committee reports the results of its review to the Board on a regular basis.


text: Please refer to "Risks Related to Cybersecurity and Technology Matters" under Item 1A, "Risk Factors" above for a discussion of the risks from cybersecurity threats and the potential impact to our strategy, results of operations and financial condition.


text: The Board and the Risk Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Board and the Risk Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident.


text: Our Director of Information Security has served in various roles in information technology and information security for over 30 years, and is a Certified Information Systems Security Professional (CISSP). He and other members of the OD Technology Department work collaboratively across the Company and have implemented programs designed to protect our information systems from cybersecurity threats and position our Company to promptly respond, in coordination with various members of our senior management team, to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to any cybersecurity incidents. Through ongoing communications and collaboration with these teams, including members of our senior management team, as appropriate, our Director of Information Security monitors the prevention, detection, mitigation and remediation of any cybersecurity threats and incidents in real time, and reports any such threats and incidents to the Risk Committee when appropriate.


text: The Company's board of directors, or the Board, recognizes the critical importance of maintaining the trust and confidence of our patients, investors, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management, or ERM. The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, mitigating and remediating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Day One Biopharmaceuticals, Inc.

ticker: DAWN


text: Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, or the Audit Committee, which regularly interacts with the Company's Head of Information Technology and other members of management, including members of management's Data Privacy and Security Committee.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and processes that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Information Security: We implement organizational, administrative and technical measures based on commercially reasonable procedures using (i) industry standard information security measures prescribed for use by National Institute of Standards and Technology, (ii) security measures aligned with the ISO/IEC 27000 series of standards, (iii) the Sarbanes-Oxley Act and SSAE 18/ISAE 3402, (iv) privacy regulations such as the European Union's General Data Protection Regulation and the California Consumer Privacy Act, (v) business continuity management measures aligned with the ISO/IEC 22301 standard and (vi) other generally recognized industry standards, in each case, designed to safeguard the confidentiality, integrity, and availability of our infrastructure and data and the resiliency of our operations.


text: Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: Education and Awareness: The Company provides regular, mandatory training for personnel and contractors regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: Risk and Readiness Assessments: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. Insurance: We maintain information security risk insurance coverage.


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with members of the Data Privacy and Security Committee, which includes the Company's Head of Information Technology.


text: The Head of Information Technology, in coordination with the Data Privacy and Security Committee, which includes our Chief Executive Officer, or CEO, Chief Operating and Financial Officer, or COO and CFO, and General Counsel, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Head of Information Technology and the Data Privacy and Security Committee monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: The Head of Information Technology has served in various roles in information technology and information security for over 20 years, including serving as Vice President, Information Technology at three public companies. The Head of Information Technology holds an undergraduate degree in Business Administration, Management Information Systems. The Company's CEO, COO and CFO, and General Counsel each hold undergraduate and graduate degrees in their respective fields, and have extensive experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. If we were to experience a material cybersecurity incident in the future, such incidents may have a material effect, including on our operations, business strategy, results of operations or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the risk factor titled "If our security measures are compromised, or our information technology systems or those of our CROs, CMOs, vendors, contractors, consultants or other third-party partners fail or suffer security breaches, cyber-attacks, loss or leakage of data or other disruptions, this could result in a material disruption of our development programs, compromise sensitive information related to our business or other personal information or prevent us from accessing critical information, potentially exposing us to liability, harm our reputation or otherwise adversely affecting our business."


text: We use the NIST Cybersecurity Framework and CIS Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements.

companyName: Aimco OP L.P.


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a team comprised of IT personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to monitor, assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan and Security Operations Center (SOC) to respond to cybersecurity incidents; and • a third-party risk management process for service providers.


text: There can be no assurance that our cybersecurity risk management program, including our controls, procedures and processes, will be fully complied with or that our program will be fully effective in protecting the confidentiality, integrity and availability of our information systems, product and network.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. These and other risks related to cybersecurity matters are described in more detail in Item 1A. Risk Factors.


text: Cybersecurity Governance Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees management's design, implementation, and enforcement of our cybersecurity risk management program.


text: Our Chief Information Officer (CIO) reports to the Chief Administrative Officer & General Counsel and leads the Company's overall cybersecurity function. Prior to December 31, 2023, the Audit Committee received regular reports from AIR on our cybersecurity risks. Since December 31, 2023, the Audit Committee has begun receiving and will continue to receive regular reports from our CIO on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents. Audit Committee members also receive periodic presentations on cybersecurity topics from our CIO, supported by our internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our CIO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment.


text: Our CIO is responsible for assessing and managing our material risks from cybersecurity threats. Our CIO has primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CIO has been publicly recognized as a cybersecurity thought leader by leading industry analysts. Our CIO has over 24 years of technical leadership and industry experience, which is inclusive of global experience in managing and leading IT and cybersecurity teams. Our cybersecurity team holds industry standard certifications and participates in routine training.


text: Wesbanco maintains an Information Security and Cybersecurity program that is responsive to statutory and regulatory requirements, which includes policies, standards, rigorous testing by internal and external parties pursuant to those standards and policies and operating procedures. Wesbanco generally approaches cybersecurity threats through a cross-functional, multi-layered approach, with the specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to Wesbanco; (ii) maintaining the confidence of its customers and business partners; and (iii) preserving the confidentiality of its customers' and employees' information. Wesbanco's Information Security and Cybersecurity program is integrated into its overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas. The bank also partners with trusted security vendors to help ensure that the security control infrastructure adequately addresses current and emerging technical threats with appropriate countermeasures. This oftentimes includes the engagement of consultative assistance for each of the three lines of defense to ensure appropriate technical expertise exists in the control area that is being evaluated and to maintain best practices.

companyName: WESBANCO INC

ticker: WSBC


text: As detailed in the risks related to the use of technology, third-party technology relationships pose a risk to the organization. As such, third-party risk management processes are aligned with regulatory requirements and are another key focus area within the bank's enterprise risk management framework. Wesbanco employs a third-party risk management program that includes a systematic evaluation of potential risks associated with engaging third-party vendors, suppliers or partners that may have access to Wesbanco's sensitive information, systems or networks. This process is also intended to provide for the security and integrity of Wesbanco's data that may be stored on third-party systems. The process identifies and addresses potential security vulnerabilities, safeguarding Wesbanco's information assets and reducing the overall risk of cyber threats. Third-party providers are evaluated during onboarding and throughout the ongoing relationship based on the level of risk that the service being provided presents to the organization. The evaluation process includes a thorough review of operational practices related to cybersecurity and considers factors that impact the protection of bank and customer data.


text: Cybersecurity risks continue to evolve with certain risks leading the way. Risks experienced in the last year involved third party service providers, with no material impact to Wesbanco related to these incidents. Wesbanco continues to foster a risk averse focus and leverages various threat intelligence sources to continually evaluate current and future risks to the organization. The bank's cybersecurity strategy and roadmap is frequently evaluated and updated according to multiple inputs including any tangible cybersecurity incidents.


text: Cybersecurity threats, a security strategy roadmap, and key risk indicators are shared with management and the board of directors through both committee reporting structures and periodic reports of the Chief Security Officer. In addition, management updates our Enterprise Risk Management Committee, as necessary, regarding significant cybersecurity incidents. Our Enterprise Risk Management Committee regularly reports to the full Board of Directors regarding its activities, including those related to cybersecurity. As part of the Enterprise Risk Management Framework, cybersecurity oversight also utilizes the concept of three lines of defense which allows for multiple challenge response processes to continually mature the cybersecurity program. Cybersecurity best practices from the National Institute of Standards and Technology ("NIST") and the Center for Internet Security ("CIS") are used to establish, operate, and validate security controls.


text: The Enterprise Risk Management Committee is a board-level committee that focuses on enterprise risk which is inclusive of cybersecurity risks. Multiple directors have decades of experience, not only in the banking sector, but also have been responsible for cybersecurity and technology departments at larger organizations. The Chief Security Officer is responsible for providing the Information Security strategy and operational planning for the overall Information Security program. The Chief Security Officer has multiple decades of experience in the industry, advanced education degrees, and holds industry standard technical and security certifications. Several members of the Information Security leadership team also hold multiple security certifications that tie directly to their job responsibilities.


text: While Wesbanco and its third-party providers have in the past experienced cybersecurity incidents, Wesbanco is not aware of any current incidents or new types of threats which have materially affected or are reasonably likely to materially affect Wesbanco, including its business strategy, results of operations, or financial condition. We face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, "Risk Factors – Interruption to Our Information Systems or Breaches in Security Could Adversely Affect Wesbanco's Operations."


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: CrossAmerica Partners LP

ticker: CAPL


text: Substantially all our locations are branded fuel locations for which sensitive debit and credit card transactions for fuel or merchandise products or services do not pass through our networks; rather, such information passes through the branded fuel supplier's (or its service providers') networks.


text: We have an enterprise-wide information security platform, which is part of our enterprise risk assessment process and designed to protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we seek to use best-in-class security tools that help prevent, identify, escalate, investigate, resolve and recover from identified security incidents in a timely manner. These include, but are not limited to, internal reporting and monitoring and detection tools. We also maintain a third party security operations service to identify, prioritize, assess, mitigate and remediate risks. We rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We conduct regular reviews and tests of our information security program and leverage audits by our internal audit team and third party consultants, penetration and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We also provide employee training to support identification of and how to respond to cyber attacks. The results of these assessments are reported to the Audit Committee of the Board.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties and employees) and other data, confidential information or intellectual property. To date, these incidents have not had a material impact on our service, systems or business and we do not believe cybersecurity risks from these prior incidents are reasonably likely to materially affect our operations. For further information on cybersecurity risks and potential related impacts on us, see "Risk Factors – Our business and our reputation could be adversely affected by the failure to protect sensitive customer, employee or vendor data, whether as a result of cyber security attacks or otherwise, or to comply with applicable regulations relating to data security and privacy."


text: The Director of Information Technology is responsible for overseeing the information security program as well as members of the Information Technology department that execute our program with oversight by members of our senior leadership team. These members of our Information Technology department have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, compliance and systems. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: The Board oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. The Audit Committee of the Board oversees our cybersecurity risk and receives regular reports from our Director of Information Technology on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.


text: Global cybersecurity vulnerabilities and threats continue to evolve and are increasingly more sophisticated. The Company is aware of the dynamic nature of the cybersecurity threats we face and has a security program led by our Chief Information Security Officer (CISO) that strives to monitor and mitigate risks from cybersecurity threats. The CISO reports to the Chief Information Officer (CIO), provides periodic reports to the Chief Executive Officer (CEO) and Chief Financial Officer (CFO), and reports quarterly to the Audit Committee of the Board of Directors, which oversees risks from cybersecurity threats, regarding the Company's cybersecurity risk profile and mitigation activities. The Company's CISO has over 35 years of security and cybersecurity experience between the military and corporate sectors. Prior to joining Benchmark, he oversaw cybersecurity for Masco Corporation, a Fortune 500 company and La-Z-Boy Incorporated, both of which are global manufacturing organizations with similar complexities as the Company. The CISO also served as a member of the Department of Defense as a civilian in charge of cybersecurity for an Army acquisition command, overseeing the cybersecurity for approximately 320 programs of record.

companyName: BENCHMARK ELECTRONICS INC

ticker: BHE


text: The Company's CIO has been responsible for Global IT, including overseeing cybersecurity since joining the Company in 2017. In addition, he was responsible for cybersecurity in previous roles prior to joining the Company, including during his time at DigitalGlobe, a satellite imagery provider to the U.S. Government, as well as other global high tech manufacturing companies.


text: The Company has an Enterprise Risk Management (ERM) process, with an annual risk assessment performed. A universe of key risks is updated annually, with key risks rated by and discussed with corporate and site-level executives, as well as our Board of Directors, which oversees the Company's ERM process. As a result of the annual risk assessment, the enterprise's top risks are identified, with action plans developed to address each risk. Results of the annual enterprise risk assessment are presented to and discussed with the Board of Directors at least annually. One of the key risks evaluated annually is cybersecurity. Our cybersecurity risk evaluation assesses whether, or to what extent, information assets (hardware, software, systems, laptops, data, intellectual property) might be compromised in an attack by a malicious actor, resulting in potential data leakage, data destruction, malware infiltration, or a ransomware attack. With the increasing sophistication of cyber-criminals and constantly evolving threat vectors, the Company continues to identify cybersecurity as a top risk, prompting numerous actions and measures across the Company that endeavor to mitigate and, where possible, minimize such risks.


text: The Company increasingly leverages and relies upon digital technologies and services to conduct our business and support our customers. These technologies and services are a blend of organic and third-party supplied solutions that encompass data storage, processing and transmissions. Our digital technologies support business processes for financial management, human capital management, customer engagement, and manufacturing services. Examples of such technologies include Enterprise Resource Planning (ERP) systems, shop floor controls, test equipment, general business applications, and our global infrastructure and networks, as well as external systems, analytics, automation and cloud services. Such digital technologies and services are subject to numerous risks including, but not limited to, ransomware or cyber-extortion, denial of service to systems, malicious code introduced through third party software products or software updates or theft of company, customer, vendor and employee data. As discussed further below, our operations have been, and may in the future be, subject to ransomware or cyber-extortion attacks, which could significantly disrupt our operations. Generally, such attacks involve restricting access to electronic and computer systems or the restriction or theft of vital data including customer supplied data.


text: The Company has a security program that strives to implement best practices for protecting our systems with the understanding that adversaries have varying skills and competencies and may be able to exploit or evade our current protective technologies. We actively monitor our systems for cyber threats and have processes in place to detect and remediate vulnerabilities. Our approach relies on both internal and external monitoring, vulnerability assessments as well as penetration testing by third parties. We also use leading end-point detection response tools to continuously monitor our security environment. We regularly conduct a review of our data management practices to ensure the proper retention, protection and storage of data, and to apply new technology-based tools to better manage the protection of customer data. Our information security policies and practices, including our Information Technology Disaster Recovery Plan, are designed to comply with several regulatory requirements including DFARS/NIST 800-171 controls, and for our defense customers, we are undergoing certification to the U.S. Cybersecurity Maturity Model Certification (CMMC) program and performed a CMMC self-assessment with the assistance of a qualified third-party inspector. To ensure security awareness throughout the Company, we conduct employee training on multiple topics, and also conduct simulated phishing campaign tests. Regular communications remind all employees of how to be vigilant against cyberattacks. We have also recently implemented a third-party cybersecurity risk management program that continuously monitors key suppliers and customers' cybersecurity scores.


text: The Company's protective technologies include firewall and email protection against malware and phishing campaigns, and information system access management solutions such as multifactor authentication (MFA). We augment these protective technologies with security monitoring and detection capabilities to limit the impact of cybersecurity incidents. The security monitoring and detection tools we utilize leverage Endpoint Detection and Response (EDR) and Security Incident and Event Management (SIEM) augmented with threat intelligence information from multiple sources. We have further enhanced the security posture of the Company by implementing data security technologies and measures to reduce the impact of attempts to steal data. These technologies are tested regularly by both internal resources and external experts that evaluate the technology and identify vulnerabilities for mitigation and/or remediation. Our security program leverages Company and third-party security professionals and services to achieve an appropriate level of security and resilience that is reviewed periodically by an information technology (IT) steering committee that includes senior officers such as the CEO, CFO, Chief Legal Officer, CIO, Chief Operating Officer and Chief Technology Officer, and the efficacy of these programs is also reviewed quarterly with the Audit Committee of the Company's Board of Directors. We have also recently implemented a third-party cybersecurity risk management program that continuously monitors cybersecurity scores of key suppliers and customers.


text: Despite the systems and processes we have in place to monitor, detect, mitigate and remediate potential vulnerabilities, in the past, we have experienced cyberattacks, and attempted breaches, including phishing emails and other targeted attacks. In the fourth quarter of fiscal year 2019, a ransomware incident encrypted information on our systems and disrupted customer and employee access to our systems and services, which resulted in the Company incurring costs relating to this event, including costs to retain third party consultants and forensic experts to assist with the restoration and remediation of systems and, with the assistance of law enforcement, to investigate the attack. As a result of this cybersecurity incident, we experienced increased expenditures for our IT infrastructure, systems and network. This ransomware incident also adversely affected our operations and the Company's fourth quarter 2019 revenue. See Note 18 to the consolidated financial statements in Part II, Item 8 of this Report for additional information.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and we have integrated these processes into our overall risk management program. We assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: STAAR SURGICAL CO

ticker: STAA


text: We have adopted as the governance framework for our cybersecurity program the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). We use this framework as a guide to help us identify, assess, respond to, and manage cybersecurity risks relevant to our business. Our cybersecurity risk management program includes: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise information technology environment; • skilled internal information security and data privacy personnel, who support our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • external service providers, where appropriate, to monitor, assess, test, or otherwise assist with aspects of our security controls, and to support risk mitigation efforts; • training for our employees on cybersecurity awareness and the importance of protecting information assets, including "phishing" tests; • periodic reviews of key cybersecurity policies, and updating as needed; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity, including data security risk mitigation efforts, to the Audit Committee. Under the Audit Committee charter, the Audit Committee has responsibility for discussing with management the Company's policies with respect to risk assessment and risk management, including guidelines and policies to govern the process by which the Company's exposure to risk is handled.


text: The Audit Committee receives reports from management on the Company's cybersecurity risks and the Company's cybersecurity program. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. STAAR's Chief Information Officer leads a team of information security professionals who have primary responsibility for our overall cybersecurity risk management program and supervises both our internal personnel and our retained external cybersecurity consultants. This team collaborates with STAAR's legal and internal audit functions to address cybersecurity and data privacy risks. The Company's internal information security and data privacy specialists have certifications from various organizations, including ISC2 (Certified Information Security Systems Professional or CISSP), Global Information Assurance (GIAC), the Computing Technology Industry Association (CompTIA) and International Association of Privacy Professionals (IAPP).


text: Our management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat briefings from internal personnel and external service providers, as well as alerts and reports produced by security tools deployed in the information technology environment.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan. Our cybersecurity risk management program is a key component of our overall risk management process, and includes similar characteristics, reporting channels and governance processes to those that apply across other legal, compliance, strategic, operational, and financial risk areas within the Company.

companyName: Nuvalent, Inc.

ticker: NUVL


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to its audit committee oversight of cybersecurity and other information technology risks. The audit committee oversees management's implementation of our cybersecurity risk management program.


text: The audit committee receives reports from management on our cybersecurity risks at least annually. In addition, management updates the audit committee regarding all material cybersecurity incidents, as well as any incidents with lesser impact potential that management, in its discretion, determines may be relevant for audit committee review. The audit committee reports to the full board regarding its activities, including those related to cybersecurity.


text: Our management team, including specifically our Chief Financial Officer, working closely with our Vice President of Information Technology and our Director of Cybersecurity (our Cybersecurity Oversight Team), is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Cybersecurity Oversight Team's experience includes a combined 50+ years in the pharmaceutical industry and information technology. This includes software and systems development, cybersecurity program oversight, and overall IT management. The team has over two decades of experience dedicated to supporting enterprise architecture and more than eight years of experience specializing in cybersecurity, implementing cybersecurity frameworks, assessing and managing cybersecurity risks, and executing incident response plans.


text: Our Cybersecurity Oversight Team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. Pursuant to our Incident Response Plan (IRP), all of our employees are trained to report a suspected cybersecurity incident or breach to our information technology team. Reporting guidelines under the IRP describe how to report an incident and what details to include. As a first step under the IRP, our information technology team assesses the reported risk or breach and escalates it to our Incident Response Team (IRT), as appropriate. The IRT is comprised of the members of our Cybersecurity Oversight Team and other critical business function leaders, including members of our legal and communications teams. Following notification from our information technology team, the IRT is responsible for continuing to assess the suspected risk or breach to determine its potential impact on our organization, systems and data. Based on that assessment, the IRT may raise the incident or breach to other members of management or the audit committee for further review and triage.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall risk management program/information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and clinical trial information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and enhance our practices. We engage certain external parties, including consultants, independent privacy assessors, computer security firms and risk management, peer companies, industry groups and governance experts, to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect our company from any related vulnerabilities.

companyName: Beam Therapeutics Inc.

ticker: BEAM


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect our company or our business strategy, results of operations or financial condition.


text: The Audit Committee of our board of directors provides direct oversight over cybersecurity risk, and provides updates to the board of directors regarding such oversight. The Audit Committee receives updates quarterly from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our Vice President of Information Security, or the VP, IS, leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees and third-party service providers to address cybersecurity risks. The VP, IS's cybersecurity training includes 25 years of experience building and maintaining cybersecurity programs, and he obtained his certified information systems security professional, or CISSP, certification from the International Information System Security Certification Consortium, or ISC2, and his Cybersecurity and Infrastructure Security Agency, or CISA, certification from ISACA.


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect employee and third party, including patients, information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards and routine review of our policies and procedures to identify risks and enhance our practices. We have developed an incident response policy which is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to triage, assess the severity of, escalate, contain, investigate, and remediate incidents, as well as to comply with applicable legal obligations. Internally and through a third-party service provider, we regularly conduct tests on our systems and incident simulations to help discover potential vulnerabilities, which enable improved decision-making and prioritization and promote monitoring and reporting across compliance functions. As part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance coverage may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.

companyName: Verve Therapeutics, Inc.


text: We engage certain external parties, including consultants, independent privacy assessors, computer security firms and risk management experts, to assess and enhance our cybersecurity oversight. Our third-party security firms periodically assess our cybersecurity process against the National Institute of Standards and Technology Cybersecurity Framework. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities. We also regularly consult with industry groups on emerging industry trends.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect the company or our business strategy, results of operations or financial condition.


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: We have a Vice President, Information Technology, whose team is responsible for leading company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and prepare the Company and its employees to address cybersecurity risks. The Vice President, Information Technology has a Master of Science in Information Technology and has implemented cybersecurity programs at four companies in the biotechnology industry over a 20-year career.


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools that are designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical systems, information and other information technology assets (including those of third parties upon which we rely).

companyName: EVERBRIDGE, INC.


text: The information security function is overseen by our Chief Information Security Officer ("CISO") and is supported by the Information Security and Privacy Committee ("ISPC"), which is made up of members of our executive management team including our Chief Legal & Compliance Officer and Chief Information Officer ("CIO").


text: The information security function works to identify and assess risks from cybersecurity threats by monitoring and evaluating internal and external cybersecurity threats including, for example using automated and manual tools and controls in certain environments and systems, overseeing internal and external audits, conducting vulnerability assessments and penetration tests in certain environments and systems, and facilitating tabletop incident response exercises. Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our critical systems, information and assets, including, for example: incident response plan and incident response policy, systems monitoring, vulnerability management policy, third party management program, failover and contingency plans, employee training, cybersecurity insurance, encryption of certain data, dedicated cybersecurity staff, network security controls and data segregation for certain environments and systems, physical security controls, and certain cloud security posture management processes.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms (such as outside legal counsel), penetration testing firms, threat intelligence service providers, forensic investigators, and cybersecurity software providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and other vendors that help us provide critical business services. We have a risk management process to manage cybersecurity risks associated with our use of certain of these third-party providers. Depending on the nature of the services provided, the sensitivity of the critical systems, information and assets at issue, and the identity of the provider, our third-party risk management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including, for example, risk assessments that include a review of security risk and questionnaires.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Risks Related to Cybersecurity and Reliability." Our Board addresses the Company's cybersecurity risk management as part of its general oversight function.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CISO, who has over 20 years of information security experience; our CIO, who has over 20 years of experience in information technology and cybersecurity; our Deputy CISO who has over 20 years of experience in the information technology and cybersecurity industry; and our Chief Legal & Compliance Officer, who has served as chief legal and compliance officer of various companies for the past five years.


text: Our CISO, who reports to the CIO, is responsible for hiring appropriate personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the CIO, Chief Legal & Compliance Officer, and others, who help the Company mitigate and remediate cybersecurity incidents of which they are notified and who may further notify the Board in accordance with such policies.


text: Our CIO, CISO, and Chief Legal & Compliance Officer report quarterly to the ISPC and the Board concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them.


text: We have implemented and maintain a cybersecurity program that is aligned with the NIST Framework and reasonably designed to protect our information and to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: PATTERSON UTI ENERGY INC

ticker: PTEN


text: Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives reports and presentations from members of our senior leadership for overseeing the company's cybersecurity risk management, including the Vice President of Information Technology, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. Such members of our senior leadership also report to the Board at least annually on cybersecurity matters, including information security and cybersecurity risk. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported promptly to the Board and Audit Committee.


text: Our Audit Committee is responsible for overseeing information security and cybersecurity risk. Senior leadership communicates with the Audit Committee at least quarterly regarding information security and cybersecurity risk and formally reports to the entire Board on information security and cybersecurity risk at least annually.


text: At the management level, our Vice President of Information Technology, who has extensive cybersecurity knowledge and skills gained from over 18 years of work experience at our company and elsewhere, heads the team responsible for implementing, monitoring, and maintaining information security and cybersecurity practices across our businesses and reports directly to the Chief Financial Officer.


text: The Vice President of Information Technology receives reports on information security and cybersecurity threats from our Director of Infrastructure and Cybersecurity and in conjunction with management, regularly reviews risk management measures implemented by our company to identify and mitigate information security and cybersecurity risks. A number of experienced information security team members responsible for various parts of the business also report to the Vice President of Information Technology on an ongoing basis. In addition to our internal cybersecurity capabilities, we also regularly engage assessors, consultants, auditors, and other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: We have adopted a cybersecurity incident reporting process ("IRP") that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping senior management, the Board and other key stakeholders informed and involved as appropriate.


text: All employees with a company-provided email receive annual cyber awareness training. In addition, we perform monthly phishing simulations, with remediation training required as necessary.


text: We maintain a cybersecurity program that is reasonably designed to protect our information, and that of our customers, against cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: Innovex International, Inc.

ticker: INVX


text: Board of Directors Our Board, in coordination with the Audit Committee, oversees the Company's enterprise risk management process, including the management and monitoring of risks arising from cybersecurity threats. The Company's management regularly reviews with the Board and the Audit Committee the measures implemented by the Company designed to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Board and the Audit Committee receive reports and presentations quarterly, and on an as-needed basis, from members of our team responsible for overseeing the company's cybersecurity risk management, including the head of our IT department, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. In addition, we employ a major international accounting firm to act as our internal audit function and cybersecurity experts from the firm regularly assess the Company's data protection and cybersecurity systems and present the results of its assessments to our Audit Committee. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Board, as well as ongoing updates regarding any such incident until it has been addressed.


text: Internal Cybersecurity Team Our internal cybersecurity team, led by our IT Director, is responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across the company. The team includes IT Security staff with over 27 years of collective cybersecurity work experience and the globally recognized Certified Information Systems Security Professional (CISSP) credential. In addition to our internal cybersecurity capabilities, we regularly engage cybersecurity consultants to assess, identify, and manage cybersecurity risks.


text: Our entire management team periodically participates in the review of our cybersecurity systems, processes, threats and incidents with our internal cybersecurity team, including the controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Our entire management team also periodically participates in cybersecurity incident response exercises with our third-party cybersecurity firms to review how material incidents will be handled and reported. Our internal cybersecurity team works closely with our Legal department to oversee compliance with legal, regulatory and contractual security requirements.


text: Risk Management and Strategy We employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at key third-party vendors, service providers or customers or otherwise implicating the third-party technology and systems we use. The Company maintains cybersecurity risk insurance as part of its protection against potential losses arising from a cybersecurity incident.


text: Security Policy and Requirements The Company regularly conducts cybersecurity training for its employees along with ongoing tests such as simulated phishing exercises for its employees. The Company also has its third-party service provider regularly conduct penetration testing and vulnerability scanning.


text: With respect to incident response, we have adopted a Cybersecurity Incident Response Plan that applies in the event of a significant cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services require access to secure Company information, and to all devices and network services that are owned or managed by the Company.


text: Material Cybersecurity Risks, Threats & Incidents Evolving cybersecurity threats have and will continue to pose difficulties in preventing, detecting, mitigating, and remediating cybersecurity incidents. While we have not experienced any material, or reasonably likely material, cybersecurity threats or incidents during the reporting period, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents.


text: We rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" under the heading "Risks Related to Cybersecurity and Technology," which should be read in conjunction with the foregoing information.


text: The Company recognizes the critical importance of maintaining the safety and security of its systems to protect its customers, maintain its reputation, and preserve the value of the Company and data and therefore have an enterprise-wide risk management framework for overseeing and managing cybersecurity and related risks. The process is supported by both management and its Board of Directors.

companyName: BANCFIRST CORP /OK/

ticker: BANF


text: The Company relies heavily on sensitive information to run daily operations and deliver products and services. To protect the availability, integrity, and confidentiality of sensitive information and sensitive infrastructure, the Board of Directors requires the Company develop and implement a comprehensive Information Security Program, which focuses on the confidentiality, availability and security of information and systems. The Information Security Program defines the strategy that the Company uses to protect and secure its systems and media that process and maintain sensitive information. The program details the governance, management, operations, and assurance of the program, and seeks to identify, prevent and mitigate cyber threats and to respond effectively to cyber threats when they occur.


text: The cybersecurity function, is led by the Company's Chief Information Officer ("CIO"), who reports to The Company's Chief Operating Officer ("COO"). The Chief Information Security Officer ("CISO") reports to the CIO and generally is responsible for management of cybersecurity risk and the protection and defense of the Company's networks and systems. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including threat assessments and detection, mitigation technologies, cybersecurity training, incident response, insider threats and regulatory compliance.


text: The Company has not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to its business or operations. Nevertheless, there are no assurances the Company will not experience such an incident in the future. Such incidents, whether or not successful, could result in the Company incurring significant costs related to, for example, rebuilding its internal systems, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, risk of customers moving relationships with the Company to another institution, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually and receive reports on incidents that exceed certain thresholds and updates on responses thereto. The Information Security Committee is directly responsible for oversight of risks related to cybersecurity. The Board receives reports on information security and cybersecurity from the Information Security Committee at least four times a year.


text: Risk Management and Strategy The Company continuously seeks to identify threats, vulnerabilities, and cybersecurity risks on information assets. Threats are identified through experience, regulatory requirements, information sharing, third party vendors, internal and external security assessments, and industry periodicals.


text: The risk assessment process identifies areas that are required to be protected and determine if adequate controls are used to safeguard the Company against threats and vulnerabilities. Adjustments required to adhere to regulatory changes are a regular function of the assessment process as well as changes to technologies, processes, and other factors. From the analyses, any additional controls are identified, prioritized and implemented.


text: Security Controls and Continuous Monitoring Security controls and design are critical to mitigating risks. The Company works to protect its computing environments and products from cybersecurity threats through multi-layered defenses and applies lessons learned from its defense and monitoring efforts to help prevent future attacks. The Company utilizes data analytics to detect anomalies and monitor for possible cyber threats. The Company's Cybersecurity Operations Center provides comprehensive cyber threat detection and response capabilities and maintains a 24x7 monitoring system which complements the technology, processes and threat detection techniques the Company uses to monitor, manage and mitigate cybersecurity threats. From time to time, the Company engages third party consultants or other advisors to assist in assessing, identifying and/or managing cybersecurity threats. The Company's Internal Audit function also conducts information technology and cybersecurity reviews and assessments.


text: Threat Intelligence The Company considers threat intelligence from third party sources to strengthen systems and network preparedness for cybersecurity risks. The Company uses associations, such as the Financial Services Information Sharing and Analysis Center ("FS-ISAC"), to stay informed of threat information.


text: Third Party Risk Assessments The Company conducts information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties, and its standard terms and conditions contain contractual provisions requiring certain security protections.


text: Incident Response and Recovery Planning The Company has established comprehensive incident response and recovery plans and continues to regularly test and evaluate the effectiveness of those plans. The Company's incident response and recovery plans address and guide its employees, management and the Board on its response to a cybersecurity incident.


text: Training and Awareness The Company provides awareness training to its employees to help identify, avoid and mitigate cybersecurity threats. All employees with network access participate annually in required training, including spear phishing and other awareness training. The Company also periodically hosts tabletop exercises with management and other employees to practice cyber incident response.


text: Risk Management and Strategy Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats We primarily assess, identify and manage material risks from cybersecurity threats through our enterprise information security program, which is maintained by our Chief Information Security Officer ("CISO") and overseen by our Executive Vice President and Chief Information Officer ("CIO").

companyName: MKS INC

ticker: MKSI


text: Our enterprise information security program, which is designed to ensure that our information systems are adequately protected, is based on frameworks established by the National Institute of Standards and Technology and other applicable industry standards. Following the ransomware incident we identified in February 2023, we made certain enhancements to our enterprise information security program, including with respect to privileged access management, security monitoring and response, and application backup and recovery. We consider our enterprise information security program to be a key component of our overall risk management system.


text: As part of our enterprise information security program, we regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. In addition, we maintain incident response and recovery plans, the effectiveness of which is tested and evaluated on a regular basis. We also provide privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: We regularly engage assessors, consultants, auditors and other third parties to support our enterprise information security program. These assessments include a variety of activities, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness.


text: The information provided by these assessments is used to improve our enterprise information security program, including cybersecurity policies, standards, processes and practices. In addition, the results of significant assessments are reported to management and the Audit Committee of our Board of Directors (the "Board").


text: We also have processes in place to oversee and identify risks from cybersecurity threats associated with the use of third-party service providers. Third-party service providers are subject to security risk assessments at the time of on-boarding, contract renewal, and upon detection of an increase in risk profile. We have similar processes in place to oversee and identify cybersecurity-related risks posed by our suppliers.


text: Risks from Cybersecurity Threats As discussed above, in February 2023, we identified that we had become subject to a ransomware incident. Based on our investigation, we concluded ransomware actors encrypted certain of our systems by deploying malware. This incident required us to temporarily suspend operations at certain of our facilities and had a material impact during the three months ended March 31, 2023 on our ability to process orders, ship products and provide service to our VSD and PSD customers.


text: In addition, based on our investigation of the incident, we became aware that ransomware actors may have exfiltrated personal information from our systems. We provided notifications to individuals and to regulators in accordance with applicable laws, and we may be required to provide additional notifications in the future.


text: We and our third-party administrators, vendors and partners are also subject to ongoing cybersecurity threats. While we cannot guarantee that these threats will not have an adverse impact on us, we do not believe such threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Board of Directors' Oversight of Risks from Cybersecurity Threats The Audit Committee is primarily responsible for oversight of risks from cybersecurity threats. As provided for in the Amended & Restated Audit Committee Charter, the Audit Committee oversees the steps management has taken to monitor and control our data privacy and cybersecurity risk exposure. The Board delegated this responsibility to the Audit Committee in part because it includes members with significant experience and/or expertise in cybersecurity and other technology matters.


text: The Audit Committee is informed of risks from cybersecurity threats through regular reports from our CIO and CISO. The Audit Committee actively engages with our CIO and CISO regarding these risks. Depending on the materiality of a risk, the Audit Committee, CIO or CISO may report on such risk to the full Board.


text: In addition, from time to time, the Board may constitute a special committee to focus on a particular cybersecurity matter or risk. As discussed above, in February 2023, we identified that we had become subject to a ransomware incident. Our Board of Directors responded quickly and constituted a special committee of the Board for cybersecurity, which included Gerald G. Colella, the Chair of our Board, Elizabeth A. Mora, the Chair of our Audit Committee, and Peter J. Cannone III and Joseph B. Donahue, each a member of our Audit Committee, to oversee the investigation, recovery, and restoration phases following the incident (the "Special Committee"). The Special Committee held 21 meetings during the first three months following the identification of the incident. At these meetings, our Chief Executive Officer, our Chief Financial Officer, our General Counsel, our Executive Vice President of Operations and Corporate Marketing, and our then-Chief Information Officer reported to the Special Committee on various aspects of the incident, including the information technology forensic investigation, business restoration and recovery activities, and the impact of the incident on our annual audit and assessment of internal controls as well as the filing of our Annual Report on Form 10-K for the year ended December 31, 2022.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Management is integral to assessing and managing our material risks from cybersecurity threats. While all members of management are involved in the review of these risks, our CIO has primary oversight of our cybersecurity program. Our CIO is a seasoned technology leader and change agent who has served as the top technology executive for multi-billion-dollar global organizations spanning diverse industries. With over 25 years of experience, our CIO has led business and information technology transformation, implemented global digital strategies, and optimized and integrated governance, risk, and compliance frameworks, processes and technologies in complex regulatory and industry environments. We believe our CIO's knowledge, skills and experience provide significant value to our Company.


text: Our CIO and CISO provide regular reports to management regarding risks from cybersecurity threats and the prevention, detection, mitigation and remediation of cybersecurity incidents. Within our information technology organization, our CISO and other key members of our information security team provide regular reports to our CIO.


text: As discussed above, our CIO and CISO also provide regular reports regarding risks from cybersecurity threats to our Audit Committee and, depending on the materiality of a risk, the full Board. In addition, from time to time, members of management may provide reports to a special committee of the Board for cybersecurity. For example, as discussed above, management provided regular reports to the Special Committee on various aspects of the ransomware incident we identified in February 2023.


text: Cyber Risk Management and Strategy At Fulcrum Therapeutics, we recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management process in accordance with our risk profile and business that is informed by industry standards and is integrated into our enterprise risk management process.

companyName: Fulcrum Therapeutics, Inc.

ticker: FULC


text: We leverage the support of third-party information technology and security providers, including for periodic security testing and risk assessments, as part of our risk management process, designed to identify, assess, and manage cybersecurity risks. We conduct employee cybersecurity training and maintain an incident response and notification plan designed to assist us in identifying, responding to, and recovering from cybersecurity incidents. Further, we intend to evaluate and update our existing cybersecurity policies and procedures as appropriate to continue to align them to our risk profile.


text: We have a process to assess the security practices of certain third-party vendors, including through the use of vendor security questionnaires, as appropriate.


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third party vendors' data and systems. For more information about these risks, please refer to the section entitled "Risk Factors" in this Annual Report on Form 10-K.


text: Governance Related to Cybersecurity Risks Our Executive Director, IT & Operations, or Executive Director, who reports to the Chief Financial Officer, is responsible for the strategic leadership and direction of our cybersecurity program. With over 15 years of experience in information technology, the Executive Director works alongside individuals across other functions, such as legal and engineering, to establish and implement our cybersecurity strategy.


text: The Executive Director and our Chief Legal Officer participate in periodic discussions with other members of our management, including executive leadership, regarding implementation of our cybersecurity program, program enhancements, and relevant cyber risks or threats. Our Chief Legal Officer has received the National Association of Corporate Directors CERT Certificate in Cyber-Risk Oversight.


text: Our audit committee has oversight over cybersecurity risks. With the input of the executive team, the Executive Director provides annual presentations to the audit committee on our cyber program, including updates on security testing and assessments, cyber risks, and related cyber strategy as applicable. The management team will also update the full board of directors on matters related to cybersecurity as needed.


text: Additionally, we have implemented an enterprise risk management process, which addresses cyber risks. This process is led by our Chief Legal Officer and includes participation by the board of directors, as appropriate. Our Chief Legal Officer reports regularly on the enterprise risk management process to executive leadership and the audit committee.


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to materially protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes policies and processes for assessing, identifying, and managing risk from cybersecurity threats as well as a cybersecurity incident response plan.

companyName: Cerevel Therapeutics Holdings, Inc.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other strategic, operational, legal, compliance and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify cybersecurity risks to our critical systems, information and our broader enterprise IT environment; • an information security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified any known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report.


text: Our Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to the Audit Committee oversight over our information security and technology risks, including our information security, cybersecurity and related risk management programs.


text: The Audit Committee receives periodic reports from our Chief Digital Officer on our cybersecurity risks and risk management program as well as presentations on cybersecurity topics as part of the Audit Committee's continuing education on topics that impact public companies. In addition, management updates the Audit Committee, as necessary, regarding any potentially material cybersecurity incidents.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program through our overall enterprise risk management program, which includes processes designed to identify, assess, categorize, and monitor key current and evolving risks that may affect us, including cybersecurity risks.


text: Our management team, including our Chief Digital Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The Chief Digital Officer oversees a team of information security professionals who are responsible for assessing and managing cybersecurity threats on a day-to-day basis. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Digital Officer has served in the role since 2019 and has experience in application security, intrusion detection, penetration testing, complex threat modeling and unconventional cyber-attack vectors.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Identifying and assessing cybersecurity risk is integrated into our overall enterprise risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT audits, IT security, governance, and risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct privacy and cybersecurity reviews of systems, applications, and applicable data policies; perform penetration testing using external third-party tools and techniques; conduct employee training; monitor emerging laws and regulations related to data protection and information security; and implement appropriate changes. We have implemented incident response and breach management processes that are overseen by leaders from our information security, engineering, compliance and legal teams regarding matters of cybersecurity. Security threats are evaluated, ranked by severity and prioritized for response and remediation. Potential data security incidents are investigated to determine operational and business impact, applicability of regulatory or contractual data privacy requirements, including state data breach notification statutes, and materiality We conduct tabletop exercises to simulate responses to cybersecurity incidents and collaborate with technical and business stakeholders across our business units to form detection, mitigation and remediation strategies. We also maintain third party security procedures to identify, prioritize, assess, mitigate and remediate third party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: EverQuote, Inc.

ticker: EVER


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property. However, to date these incidents have not had a material impact on our service, systems or business. Any significant disruption to our service or access to our systems could result in a loss of insurance provider customers, third-party publishers, other service providers, or consumer referrals and adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See "Risk Factors —Our business could be materially and adversely affected by a cybersecurity breach or other attack involving our computer systems or our third-party service providers."


text: The Chief Information Officer, or CIO, leads our information security organization responsible for overseeing EverQuote's information security program. Our CIO has over 30 years of industry experience managing risks or advising on cybersecurity matters. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at large technology companies. The teams provide regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings.


text: The Board oversees our enterprise risk management processes directly and through its Audit Committee. The Audit Committee of the Board oversees our cybersecurity risk and receives regular reports from our CIO on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic, financial, or competitive in nature, information related to our clinical trials and preclinical studies and information of our employees, or Information Systems and Data.

companyName: Kura Oncology, Inc.

ticker: KURA


text: Our Information Technology, or IT, department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual and automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats and threat actors, evaluating threats that are reported to us, using external intelligence feeds, engaging in internal and external audits, and engaging third parties to conduct threat assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, a disaster recover/business continuity plan and information security policy, encrypting certain data, data segmentation, network security controls, access and physical security controls, asset management, tracking and disposal, systems monitoring, employee training, maintaining cyber insurance and using third party threat detection software.


text: The head of our IT department reports to our Chief Operating Officer, or COO, and works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. We have established an Incident Review Team, which consists of representatives of our Finance, IT and Legal departments, to investigate, evaluate and respond to cybersecurity incidents. The Incident Review Team is responsible for escalating confirmed cybersecurity incidents to a Materiality Assessment Team, consisting of members of management. The Materiality Assessment Team is responsible for reporting cybersecurity incidents to the audit committee of the board of directors, as appropriate based upon the nature of the incident (or series of incidents).


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example threat intelligence service providers, cybersecurity software, and darkweb monitoring services. We also use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the section entitled "Risks Related to Employee Matters, Managing Growth and Macroeconomic Conditions."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain company management, including the head of our IT department. The head of IT is responsible for integrating cybersecurity risk considerations into our overall risk management strategy, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to our Materiality Assessment Team, comprised of members of management. In addition, our cybersecurity incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives regular reports from the head of our IT department concerning the measures we have taken to monitor and evaluate our cybersecurity threat environment and any cybersecurity incidents that have occurred.


text: The Company maintains a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The program is integrated within the Company's enterprise risk management framework and addresses both the corporate information technology environment and the external facing ecosystem.

companyName: ROCKET PHARMACEUTICALS, INC.

ticker: RCKT