text: We believe our information technology team to be well-qualified in this area. These qualifications include collective decades of professional experience in the field, in both private enterprise and government, and relevant training and certifications, such as Certified Information Systems Security Professional (CISSP) certification, ISO 27001 certification, and other technical cybersecurity certifications from ISC2, the SANs Institute and OffSec as well as recent participation in IT and cybersecurity programs organized by leading educational institutions with expertise in the field.


text: Cybersecurity Risk Management and Strategy The Container Store has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We design and assess our program based on a hybrid security framework model using the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and the Payment Card Industry Security Standard (PCI DSS). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF and PCI DSS as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Container Store Group, Inc.

secItem: Item 1C


text: We have an enterprise risk management program designed to identify and assess enterprise risks. At certain committee and Board meetings periodically throughout the year, management discusses the risk exposures identified as being most significant to the Company and the related actions that management may take to monitor such exposures. Our cybersecurity risk management program is integrated into our enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program.


text: Our cybersecurity risk management program currently includes the following key elements, which are deployed as the Company deems applicable: • We conduct periodic risk assessments, as well as internal and external vulnerability scanning and penetration testing of select systems and platforms, which are designed to help identify material risks from cybersecurity threats to our critical systems and information. • We have established security procedures for day-to-day operations designed to promote optimal system performance and maintain the integrity of critical systems and information, including detection, prevention and recovery controls, as well as backup procedures designed to prevent the loss of critical data, among other practices. • Our policy is to train employees and relevant contractors on cybersecurity awareness. The Company's office-based associates, store-based associates and certain distribution and fulfillment center associates are required to undergo security awareness training at the time of hiring. The Company's store-based associates may also receive ad hoc cybersecurity awareness communications and materials as part of their store's local operations training. • We have established, and periodically test, data security breach preparedness and response plans that are designed to address a range of scenarios that include data breaches and ransomware attacks. • We are subject to regular information technology and security audits by internal audit staff and external third parties. • We conduct third-party cybersecurity risk diligence for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: The Company (or a third party on which it relies) may not be able to fully, continuously and effectively implement security controls as designed or intended. The Company utilizes a risk-based approach and judgment to determine which security controls to implement, and it is possible that the Company may not implement appropriate controls if management does not recognize, or underestimates, a particular risk. In addition, security controls, no matter how well designed or implemented, may only partially mitigate, but not fully eliminate, risks. Security events, when detected by security tools or third parties, may not always be immediately understood or acted upon by the Company (or by third parties on which it relies).


text: As of the filing of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents that have occurred that have materially affected us, including our business strategy, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. If as a result of any future attacks our information technology systems are significantly damaged, cease to function properly or are subject to a significant cybersecurity breach, we may suffer an interruption in our ability to manage and operate the business, and our business strategy, results of operations or financial condition could be adversely affected. See "Risk Factors – Information Technology Risks."


text: The Audit Committee (Committee) of our Board of Directors has primary oversight responsibility for the Company's risk assessment and risk management activities, including addressing risks related to cybersecurity through policies and processes, and considering any recommendations for improvement of relevant controls. The chairperson of the Audit Committee updates the full Board of Directors on these matters as deemed appropriate.


text: The Company has a Cybersecurity Council, which is composed of representatives of the Company's senior management and exercises management-level oversight of cybersecurity matters. Our Chief Information Security Officer ("CISO") has primary responsibility for the development, operation, and maintenance of the Company's cybersecurity risk management program. The CISO holds multiple cybersecurity certifications and has approximately 15 years of cybersecurity experience with public retail companies.


text: The Committee receives reports from the CISO at least twice per year regarding our cybersecurity risk management program and cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding internal and external security reviews, risk assessments, breach preparedness, threat assessments, and cybersecurity incidents it considers to be significant.


text: Personnel with access to certain Company data and information technology assets are required to promptly report known or suspected security incidents. Our incident response process is designed to facilitate the reporting of cybersecurity incidents to management, including the CISO and the Company's designated internal legal counsel, as well as other identified associates from across the Company's business, as applicable.


text: We at Faraday Future employ a cybersecurity strategy for addressing cybersecurity risks, security vulnerabilities, and impacts that align with the NIST Cybersecurity Framework (CSF). The NIST Risk Management Framework (RMF) provides a comprehensive, flexible, and measurable process to manage information security and privacy risks for Faraday Future systems. This framework outlines standards and guidelines to support the implementation of risk management programs to meet the requirements of the Federal Information Security Modernization Act (FISMA). The NIST framework promotes the protection of Faraday Future infrastructure. We utilize the five core functions of the framework which are Identify, Protect, Detect, Respond, and Recover.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: Our Information technology security team has a working relationship with our third-party vendors such as Rapid7, Carbon Black and Cisco to provide guidance related to the management of cybersecurity risks. Our strategy includes both short- and long-term projects to increase the security surrounding our assets by using threat monitoring, threat detection, and SIEM tools within our security systems. We perform cybersecurity assessments with respect to asset scanning, risk assessments, and vulnerability scans with respect to users in our organization and third parties who provide critical services or who have access to critical confidential data.


text: We have not identified any cybersecurity threats that have materially impaired or are reasonably likely to materially impair our operations or financial standing. Our critical business systems are fully redundant and backed up. Our security systems correlate security events from our SIEM and aggregate security-related incident data, such as malware activity, malicious activities, and ransomware. Security functionality is continuously monitored by our IT security team and our third party comanaged vendor soc team, and our network traffic is analyzed for signs of malicious activity through the Cyber security systems. Anti-virus solutions are deployed throughout our organization on servers, laptops and workstations in our data centers, headquarters, and remote sites.


text: We have hired an independent third-party cybersecurity firm to perform penetration testing annually. The third-party checks for vulnerabilities on our external and internal network perimeters. If vulnerabilities are found, corrective actions are implemented to remediate any issues.


text: Our employees are required to take annual cyber security training designed to help employees guard our cyber and physical data. Employees are tested on this training.


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. This cybersecurity risk management process includes a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access and other security incidents and vulnerabilities.

companyName: Digital Turbine, Inc.

ticker: APPS


text: As part of our cybersecurity risk management process, we conduct regular application security assessments, vulnerability management, external penetration testing, security audits, and risk assessments. We leverage third-party security service providers to provide continuous and uninterrupted identification and mitigation of risk-prioritized security events. We maintain an incident response plan that is utilized when incidents are detected. Our incident response plan coordinates the activities that we and our third-party cybersecurity provider take to prepare to respond, recover from and mitigate cybersecurity incidents, which include processes to assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational harm.


text: We require employees with access to information systems, including all corporate employees, to undertake data protection, cybersecurity, privacy and compliance programs at least annually. We maintain a team of dedicated security and compliance professionals who oversee cybersecurity risk management, mitigation, incident prevention, detection, and remediation, which is led by our Chief Information Security Officer ("CISO"). The team has deep cybersecurity experience with an average tenure of over 20 years with expertise in protecting critical assets for top firms in a myriad of different industries.


text: We leverage SOC 2 Type 2 attestation framework to determine the operating effectiveness of our internal security controls and use NIST Cybersecurity framework to better understand, manage and reduce cybersecurity risk and protect our business from ever-changing cyber threats.


text: As part of our cybersecurity risk management process, we contractually require third-party service providers to implement and maintain key security measures in connection with their work with us when appropriate that is consistent with applicable laws. Additionally, our third-party service providers are to promptly report any breach of their security measures or systems that may affect our Company. Our security and compliance professionals track and log privacy and security incidents across our vendors and other third-party service providers to remediate and resolve any such incidents. Significant incidents associated with our vendors and service providers are reviewed regularly to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management.


text: Our executive leadership team, along with input from the above team, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the Company.


text: The Audit Committee has oversight responsibility over our cybersecurity risk management process, including risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration.


text: Senior management regularly discusses on at least a quarterly basis and otherwise as needed, cyber risks and trends and, should they arise, any material incidents with the Audit Committee.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: Risk management and strategy Nextracker places emphasis on addressing cybersecurity threats and effectively managing associated risks. Our cybersecurity program is designed to identify, assess, and proactively manage material risks.

companyName: Nextpower Inc.

ticker: NXT


text: Our approach to cybersecurity is not a one-time effort but an ongoing process. We engage in monitoring, risk assessments, and robust security measures designed to ensure the confidentiality, integrity, and availability of our information systems, including critical computer networks, hosted services, communication systems, hardware, and software and to protect critical data, including our employees' and customers' data, intellectual property, confidential and proprietary data, and strategic competitive information. We address cybersecurity challenges and enhance our overall risk management efforts by adopting and working to integrate recognized best practices, standards, and controls such as the CIS 18 Critical Security Controls and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).


text: Our cybersecurity program includes some key aspects such as (i) a Cybersecurity Leader who oversees our day-to-day program and who is a long-term member of both ISC2 and ISACA organizations, which specialize in cybersecurity and governance, (ii) a cybersecurity council comprised of a cross-section of management with oversight over our program, (iii) incident response, and (iv) ongoing security awareness training.


text: At Nextracker, we maintain a practical approach to cybersecurity. Our cybersecurity risk management program (an integral part of our overall Enterprise Risk Management Program) is designed to incorporate established best practices and industry standards, drawing guidance from both CIS 18 and NIST CSF. Within our program, we conduct internal and external security-based activities, including reviews and assessments of our third-party service providers and vendors. 1.Information Security Assessments: We collaborate with internal and external partners to evaluate our security. 2.Vulnerability Scanning and Penetration Testing: Engaging third-party service providers to assess external and internal vulnerabilities and potential threats. 3.Cyber Risk Register Reviews: Regularly review our internal risk register to stay vigilant against potential and identified risks. 4.Risk Prioritization: We prioritize and address risks through our dedicated cybersecurity risk management program and the cybersecurity council.


text: We monitor the threat environment for potential risks, employing various methods, including automated detection tools, environment scans, and investigations of potential threats and reports. We also use threat intelligence feeds and vulnerability databases to monitor our systems, and have incident response processes designed to ensure swift action.


text: As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably expected to materially affect our business. However, we acknowledge the evolving nature of cybersecurity threats and remain committed to enhancing our protective measures as needed. For more detailed information about our company's specific cybersecurity risks, please refer to the risk factor titled "Cybersecurity or other data security incidents could harm our business, expose us to liability and cause reputational damage" in Item IA. Risk Factors of this Form 10-K.


text: Our Board of Directors has oversight responsibility for our overall enterprise risk management, and has delegated cybersecurity risk management oversight to the Audit Committee of our Board of Directors. The Audit Committee of our Board of Directors is responsible for reviewing internal risk assessments with respect to cybersecurity, including assessments of the overall threat landscape and related strategies and investments.


text: Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Security Leader. Our Security Leader reports regularly to the cybersecurity council, management and the Audit Committee concerning our significant cybersecurity threats and risks, the processes we have implemented to address them, and various reports, summaries, or presentations on cybersecurity threats, risks, and mitigation. The Audit Committee also reports to our Board of Directors on cybersecurity matters as needed.


text: We describe whether and how risks from cybersecurity threats are reasonably likely to materially affect us, including our results of operations and financial condition, under the heading "Data breaches or incidents involving our technology could damage our business, reputation and brand and substantially harm our business and results of operations." in Item 1A, "Risk Factors" of Part I of this report.

companyName: Momentus Inc.

ticker: MNTS


text: Risk Management and Mitigation Strategies As part of our commitment to safeguarding our assets and maintaining the integrity of our operations, C3 AI has established a comprehensive cybersecurity risk management program. This program is designed to identify, assess, and mitigate cybersecurity risks that could potentially impact our business operations, customers, and stakeholders. C3 AI employs a multi-layered approach to identify and assess cybersecurity threats. This includes: • Regular vulnerability scanning: We conduct internal and external vulnerability scans of our systems and applications to identify potential weaknesses that attackers could exploit. • Penetration testing: We engage independent security professionals to conduct simulated cyberattacks on our systems to assess the effectiveness of our security controls. • Threat intelligence monitoring: We subscribe to threat intelligence feeds that provide us with real-time information about the latest cyber threats and vulnerabilities. • Risk assessment framework: We utilize a risk assessment framework to categorize identified threats based on likelihood and potential impact on our business operations, financial stability, and reputation. This framework includes third-party vendor risk assessment to manage cybersecurity risks associated with our use of these providers. The third-party vendor risk assessment framework includes the following: Perform due diligence of the vendors' standards, including reviewing security policies, certifications, and third-party attestation and past security incidents. Request vendors to complete security questionnaires and provide any security and vulnerability scans.

companyName: C3.ai, Inc.

ticker: AI


text: Define security expectations within the vendor contract including data security obligations, access controls, incident reporting procedures, security assessment calls if necessary and review of incident response plan, business continuity and disaster recovery plan.


text: • Network security: Firewalls, intrusion detection/prevention systems (IDS/IPS), and data loss prevention (DLP) solutions are deployed to monitor and filter network traffic. • Endpoint security: Antivirus, anti-malware, and Mobile Device Management solutions are implemented on all company devices. • Access controls: User access controls are implemented to restrict access to sensitive data and systems based on the principle of least privilege. • Data security: Encryption solutions are used to protect sensitive data both at rest and in transit. • Security awareness and training: We provide regular security awareness training to all employees to educate them on cybersecurity best practices and phishing attempts.


text: For a description of the risks from cybersecurity threats that may materially affect us, see the section titled "Risk Factors" contained in Part I, Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity risk management is integrated with our overall enterprise risk management framework. Identified cybersecurity risks are reported through established channels to relevant stakeholders, including senior management and the Board of Directors. Mitigation strategies are prioritized and incorporated into the overall risk management plan. We continuously identify and evaluate potential cybersecurity threats. While the nature of cyber threats makes it impossible to predict all future incidents, some currently identified material cybersecurity risks include: • Ransomware attacks that could disrupt business operations and lead to data breaches. • Phishing attacks that could compromise employee credentials and provide unauthorized access to sensitive data. • Supply chain attacks targeting third-party vendors with access to our systems or data.


text: Management is responsible for the overall implementation and effectiveness of the cybersecurity program. This includes allocating resources, establishing policies, and ensuring employee adherence to security practices. The VP of Information Security leads the cybersecurity team and reports directly to the VP of Cloud Infrastructure.


text: The Audit Committee of the Board of Directors has specific oversight responsibilities related to cybersecurity, including review of security controls and incident response plans. Management provides updates to the Audit Committee on cybersecurity risks and the effectiveness of our cybersecurity program.


text: Our commitment to security is evidenced by our certifications under ISO 27001, ISO 27017, SOC 2 Type II, HIPAA, NIST 800-171 and FedRamp Additionally, we subject our standards-based certifications to annual audits by third parties and have successfully undergone examinations such as the Health Insurance Portability and Accountability Act (HIPAA), validated by qualified third-party assessors. There were no material cybersecurity incidents experienced by C3 AI during the fiscal year ended April 30, 2024.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our VP of IT, software and telematics who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: IDEANOMICS, INC.

ticker: IDEXQ


text: We engaged consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the information technology team at the direction of our Chief Executive Officer. Our executive team including our Chief Executive Officer, and Chief Financial Officer are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. This executive team is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Risk Management and Strategy The Company maintains comprehensive policies, procedures, and controls to protect the Company's information systems and related data from cybersecurity threats and incidents. The Company's cybersecurity program is led by its Chief Information Security Officer ("CISO") and supervised by its Chief Information Officer ("CIO"). The Company's cybersecurity program is a component of its overarching enterprise risk management program and interfaces with other functional areas within the Company, including, but not limited to, legal, accounting, risk management, human resources, internal audit, as well as external third-party partners, to identify, understand, and combat potential cybersecurity threats. Our cybersecurity program is aligned with three recognized control frameworks: ISO 27001; 2013, NIST SP 800 – 52; and the Center for Internet Security Top 20 Critical Security Controls. We conduct ongoing and robust testing of our systems, including penetration testing, internal and external audits, tabletop incident response exercises, and an annual Cyber Risk Assessment, the results of which are shared with the Audit Committee.

companyName: GMS Inc.


text: We provide regular awareness training to our employees and contractors, including periodic phishing tests, to help identify, avoid, and mitigate cybersecurity threats, as well as targeted security training for key departments dealing with sensitive data types.


text: The Company has engaged a third-party managed detection and response company to monitor the security of its information systems. The Company also maintains a cybersecurity insurance policy and has engaged a third-party incident response consultant and legal counsel.


text: Cybersecurity Incident Response Process We maintain and actively update our Cybersecurity Incident Response Plan to triage, contain, and mitigate any issues as quickly as possible. Our Cybersecurity Incident Response Plan includes steps to analyze, and as necessary, escalate cybersecurity incidents both internally and with third-party service providers based on the type and severity of the specific incident. Our Cybersecurity Incident Response Policy ensures that our CIO, and, as appropriate, our senior management team, members of our legal staff and outside legal counsel, our disclosure committee, and members of our Audit Committee or Board of Directors are timely informed of and consulted regarding cyber incidents.


text: The Company's Board of Directors provide ultimate oversight of the Company's cybersecurity risk management. As reflected in the Audit Committee's charter, the Board of Directors has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee. The CIO presents quarterly updates to the Audit Committee on the Company's cyber risks and threats, status of projects to strengthen the Company's information security systems, and emerging threats. The Company also engages third parties to periodically evaluate and audit aspects of the Company's information security programs, including by conducting vulnerability assessments and penetration testing, and the results of those findings are reported to the Audit Committee and used to help identify potentially material risks and prioritize certain security initiatives.


text: The Company does not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected the Company. However, the sophistication of cyber threats continues to increase, and the preventative actions the Company has taken and continues to take to reduce the risk of cyber incidents and protect its systems and information may not successfully protect against all cyber incidents. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors."


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. These policies and processes are intended to protect the confidentiality, integrity, and availability of our critical information systems and our critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature.

companyName: Credo Technology Group Holding Ltd

ticker: CRDO


text: We conduct periodic risk assessments to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. We also use third-party service providers from time to time in connection with our risk assessment processes.


text: As part of our overall risk management program, we provide training to employees at all levels on cybersecurity awareness and the protection of confidential information. In addition, we have established a cybersecurity incident response process that includes procedures for detecting and responding to cybersecurity incidents. The Company also participates in a cybersecurity risk insurance policy.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Cybersecurity breaches, cyberattacks, and other disruptions to information technology systems could disrupt our operations, compromise the confidentiality of our data or our intellectual property, and adversely affect our business, reputation, operations, and financial results" and "Our business may be impacted by information technology system failures or network disruptions, and lack of redundancy."


text: Our Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to the Nominating and Corporate Governance Committee of the Board (the NCG Committee) overall oversight of cybersecurity matters and other policies and internal controls regarding cybersecurity risks. The Audit Committee of the Board (the Audit Committee) is responsible for oversight of disclosure controls with respect to potential cybersecurity incidents as well as the Company's compliance with SEC rules applicable to cybersecurity risk management.


text: In fiscal 2024 the Audit Committee received reports on our cybersecurity risk management initiatives. In addition, our management team updates the Board with respect to the Company's overall cybersecurity risk posture and initiatives in order to improve our cybersecurity risk controls. As necessary, the Audit Committee will oversee management's responses to any significant cybersecurity incidents including any disclosures required by law. The full Board also receives a briefing from management on our cyber risk management program at least annually.


text: Our management team, which includes our IT management team, is responsible for day-to-day implementation, management and evaluation of our cybersecurity risk assessment and management processes. The IT management team has primary responsibility for our overall cybersecurity risk management program, including monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents, and works in partnership with our other business leaders, including our Chief Legal Officer, Vice President of Systems Engineering, and internal audit function, as needed. Our IT management team supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our Director of IT has served in various roles in information technology and information security for over 15 years.


text: Our cybersecurity incident response process is designed to escalate significant cybersecurity incidents to a team of business leaders, including, but not limited to, our Vice President of Systems Engineering, Chief Legal Officer, and Chief Financial Officer. In the case of a cybersecurity incident, this team of business leaders will work with our incident response team to help determine the severity of the impact of a cybersecurity incident, as well as to help mitigate and remediate cybersecurity incidents of which they are notified. The incident response team will also work under the oversight of legal counsel and the Audit Committee to determine whether an incident is material for disclosure purposes under applicable law.


text: Risk Management and Strategy We have an established cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our cyber risk management program is designed to protect the confidentiality, integrity and availability of our systems and the data of our clients, candidates and company. This program and its processes are an integral component of our enterprise risk management ("ERM") program.

companyName: KORN FERRY

ticker: KFY


text: Our cybersecurity program leverages several industry and regulatory frameworks, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, International Organization for Standardization Information Security Management Systems ("ISO 27001"), and the Center for Internet Security Critical Security Controls. Our approach to protecting our systems uses the concept of defense in depth, providing multiple layers of defense, monitoring, and controls. It is a mutually supporting environment of fit-for-purpose technology, established processes, trained security and operations personnel, and supporting external services.


text: As of the date of this report, we have not experienced a cybersecurity incident that has materially affected us, including our business strategy, results of operations or financial condition. While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an effect. Additional information on cybersecurity risks we face can be found in Item 1A "Risk Factors" under the heading "Risks Related to Technology, Cybersecurity and Intellectual Property," which should be read in conjunction with the foregoing information.


text: Our global security team is led by our Global Vice President Security who reports to the Chief Information Officer. Our Chief Information Officer has more than three decades of technology, security and leadership experience across both the public and private sector. The Global Vice President Security leads the strategy and execution of our cybersecurity program, has more than two decades of dedicated security experience, and holds multiple security qualifications including Certified Information Systems Security Professional ("CISSP"). He leads an experienced security team, organized and geographically structured with the goal of maximizing responsiveness and coverage for our global enterprise. The team is additionally supported through external services and on demand incident response capabilities. These capabilities include pre-established relationships with industry leading providers for incident containment, forensic analysis, systems recovery, legal advice, and external communications assistance.


text: Korn Ferry has invested in a spectrum of security tools and capabilities designed to prevent compromise of our systems and data. These solutions are selected from well recognized industry leaders and encompass a wide range of security capabilities including, among other things, threat detection, prevention, system monitoring, logging, vulnerability assessment, incident and event management, system and cloud configuration and permission management. To validate the effectiveness of our security capabilities and our supporting environment we assess them across multiple dimensions. This includes the use of independent external third-party security firms to conduct external and internal penetration tests, vulnerability assessments, and audits.


text: We leverage a structured process framework based on ISO 27001 to minimize cyber risks and facilitate continuous improvement. We adhere to the principle of least privilege when provisioning access to systems, seeking to limit potential abuse of system privileges by internal or external threats. We train our employees annually in cybersecurity awareness and responsibilities and we engage them throughout the year with phishing awareness exercises, additional focused training, and messaging about current and persistent threats. Employees with privileged access to systems are further trained in security-by-design principles, centered on best practices for securely developing and managing software systems.


text: Our software development processes are governed by a structured systems development lifecycle process that is designed to review new features and system changes for adherence to security requirements prior to deployment. Our systems are further protected via a regular cadence of patching and prioritized vulnerability remediation. Lastly, the use of third-party software in our environment is governed by our third-party risk management ("TPRM") program, which is designed to assess and remediate cyber and business risks associated with vendor-provided software and services.


text: Integral to our cybersecurity processes is our Security Incident Response Plan ("SIRP"), designed to facilitate the timely and accurate reporting of any material cybersecurity incident. The incident management process is designed so that incidents are appropriately categorized and escalated to the Security Incident Response Team ("SIRT") for action and materiality determination. Our SIRT is comprised of senior executives including the Chief Financial Officer, Chief Information Officer, Global Vice President Security, Co-Chief Privacy Officers, General Counsel and other members as required depending on the nature of the incident. In addition to managing escalated incidents, the SIRT conducts tabletop exercises to simulate various threat scenarios, and outcomes are used to build experience and to refine the SIRP and response approaches. Korn Ferry has also maintained cyber insurance for more than a decade.


text: Korn Ferry has been certified by the British Standards Institute (BSI) to ISO/IEC 27001 and ISO/IEC 27018 for our key technology platforms and processes across global operations.


text: Board of Directors Oversight Our Board is responsible for the oversight of the Company's overall ERM program, which includes cybersecurity risks. The Board is briefed at least annually by the Chief Information Officer on the readiness and efficacy of the cybersecurity program. These briefs include a review of the Company's cybersecurity initiatives, key security metrics, business continuity and disaster recovery plans and updates on evolving cyber threats and mitigation plans. These briefs also review significant updates to procedures, policies, and controls used to identify, manage, and mitigate cybersecurity risks. The Board is supported in this oversight by the Audit Committee, which receives regular updates from members of the executive leadership team including the Chief Financial Officer, General Counsel, Chief Information Officer, and the Senior Vice President Internal Audit on emerging cybersecurity risks and issues.


text: Management Oversight Management regularly assesses and identifies potential cybersecurity risks as a key component of the Company's ERM program. The Company's cyber risks are reviewed and prioritized as part of the annual Enterprise Risk Assessment and ongoing quarterly reviews. Changes in these risks are communicated at least quarterly to the Audit Committee. Management further enables regular reviews of systemic, emerging, and ongoing security and data privacy risks through a standing body, the Privacy and Security Executive Committee ("PEC/SEC") which meets quarterly and whose reporting is used to inform the Audit Committee and annual reporting to the Board of Directors. The PEC/SEC is comprised of senior management including the Chief Financial Officer, Chief Information Officer, Global Vice President Security, Co-Chief Privacy Officers, Chief Human Resources Officer, General Counsel and other senior leaders as required.


text: Risk Management and Strategy Description of Company's processes for assessing, identifying and managing cybersecurity risks The Company takes an integrated, holistic approach to managing risks that pose a significant threat to the Company's business, which includes, but is not limited to its personnel, assets and revenue, as well as those of its clients and vendors. Those assets include systems, networks and data of our clients and our Company, as well as our employees, our application software, our confidential information and other forms of our intellectual property, among other examples. Cybersecurity threats are an important, but not all-inclusive, risk to the Company's business.

companyName: LOGILITY SUPPLY CHAIN SOLUTIONS, INC


text: The Company's Enterprise Risk Committee provides high-level guidance and direction regarding the assessment, identification and management of cybersecurity risks. Key members of the Enterprise Risk Committee, such as our Chief Executive Officer, Chief Financial Officer and General Counsel, participate in all or substantially all of the meetings of the Committee and make decisions to address cybersecurity and non-cybersecurity risks across the enterprise on a prioritized basis. The Committee meets regularly, usually on a quarterly basis, to reassess the risks facing the Company, as cybersecurity and other risks change from time to time, both in their nature and potential impact to the Company. The Company identifies cybersecurity risks through a layered system of automated and human-staffed monitoring systems and controls, as well as through guidance from internal and external subject matter experts. Potential cybersecurity incidents are subsequently assessed through both automated and human-staffed systems and controls that prioritize event review based on their likelihood or probability of occurrence, together with their potential harm or impact.


text: Beyond identification and assessment, the Company uses automated and human-staffed monitoring and other systems to respond to and otherwise manage cybersecurity threats and potential cybersecurity incidents. The Company has developed and implemented practices and policies that will guide the Company through responding to actual and suspected cybersecurity incidents.


text: Training the Company's personnel is a vital part of how the Company manages cybersecurity threat risks. Effective training can both prevent cybersecurity incidents from occurring and can also enable the Company to rapidly and effectively respond to an actual cybersecurity incident through fast reporting. Company personnel are required to participate in new hire, annual and monthly training. In regular town hall meetings, a member of our information security team speaks to the entire Company, focusing Company personnel's attention on a specific risk or scenario in real-time, with the opportunity for Company personnel to ask questions. In addition, on an on going-basis, the Company's information security team has and will test Company personnel to see how they respond to phish emails or similar communications that originate from the Company.


text: Integration into the Company's overall risk management system or processes To take a holistic perspective on risk, the Company's processes regarding identification, assessment and management of cybersecurity risks are integrated into the Company's overall risk management system and processes. As a result, as examples, the Company's insurance programs, standard and negotiated contract terms with clients and vendors, operational processes, other procedures, and communication protocols in the event of a crisis take into account both cybersecurity threat and non-cybersecurity threat risks, with differentiation based on the nature of the risk.


text: Engagement of assessors, consultants, auditors, or other such processes by the Company The Company engages outside consultants to conduct vulnerability scans and penetration tests to help the Company find and then mitigate cybersecurity threats. As noted above in Item 1 Business under the sub-heading Data Security, the Company also uses an external auditor to conduct an annual SOC 2 Audit.


text: Processes to oversee and identify such cybersecurity threat risks associated with third party service providers The Company performs risk assessments on critical third party service providers, software and other tools used in the Company's operations that may have the potential to create material cybersecurity threats to our business.


text: Cybersecurity Risk & Material Effects on the Company The Company does not believe that any risks from past cybersecurity incidents have materially affected the Company or are reasonably likely to materially affect the Company. As to ongoing risks from cybersecurity threats, see Item 1A, "Risk Factors."


text: The Board's oversight of risks from cybersecurity threats The full Board of Directors receives a report from the Company's Enterprise Risk Committee in connection with each of their quarterly, regularly scheduled meetings. Twice a year, an executive employee member of the Committee presents during those Board meetings, with the opportunity for the Board to ask questions and engage in discussions regarding risks and cybersecurity threats, and the Company's plans and efforts to address them. The materials presented to the Board may include, among other topics, updates and information regarding risk controls and related initiatives, cybersecurity monitoring data, cybersecurity threats and related risks, our SOC 2 Audit, and cybersecurity insurance. Our Chief Executive Officer, our Chief Financial Officer, and our General Counsel, who are members of our Enterprise Risk Committee, regularly attend Board meetings and are available to liaise between the Board and the rest of the Enterprise Risk Committee, should the Board have additional questions or concerns that need to be addressed.


text: Management's role in assessing and managing material risks from cybersecurity threats The Company's Enterprise Risk Committee, described above, includes our Chief Executive Officer, Chief Financial Officer, General Counsel and our Chief Technology Officer. Depending on the nature of the risk at issue, other managers and employees of the Company may participate in the work of the Enterprise Risk Committee. As to cybersecurity threat risks, the following individuals play a role: • Chief Financial Officer and Executive Vice President Information, Technology & Risk – The Company's information security and information technology team reports to our Chief Financial Officer ("CFO"). For example, our EVP Information, Technology & Risk reports to our CFO ("EVP, IT & Risk"). Our Chief Financial Officer and EVP, IT & Risk have familiarity with cybersecurity matters, appropriate for their position. Our EVP, IT & Risk is a member of our Enterprise Risk Committee as to cybersecurity threat risks and also participates in Board discussions regarding those risks. • Manager, Information Security – Our Manager, Information Security identifies, assesses and manages our day to day cybersecurity threats and related risks on a daily basis. He reports to the EVP, IT & Risk and is a member of our Enterprise Risk Committee as to cybersecurity threat risks and has eight years of experience as an information security professional. • General Counsel – Our General Counsel has experience advising on cybersecurity-related matters, including cybersecurity incidents, cybersecurity risk program design and execution. He is also experienced in other related cybersecurity risk management practices, such as engaging with outside advisors and risk managers, among other examples.


text: How the Enterprise Risk Committee is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents The Enterprise Risk Committee meets on a regular basis at least quarterly to review and assess the Company's cybersecurity threat risk and other risk posture, new controls and initiatives to prevent or mitigate cybersecurity threat risks and potentially evaluate relevant Company policies. Where appropriate, other managers and personnel participate in Committee meetings. Members of the Committee inform the Board, as noted above.


text: Risk Management and Strategy We believe we maintain an information technology and security program appropriate for a company of our size, taking into account our operations and risks. We recognize the critical importance of maintaining the trust and confidence of our investors, employees, customers and vendors. Our cybersecurity policies and processes are integrated into the Company's enterprise risk management program. We have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes include mechanisms, controls, and certain technologies designed to prevent or mitigate system intrusion or data loss, theft, misuse, or other security incidents or vulnerabilities and maintain a stable and secure information technology environment. For example, we conduct ongoing monitoring of critical systems for any compromised or potentially compromised accounts. We conduct regular trainings on cyber and information security, along with phishing simulations, among other topics. In addition, we consult with an outside information technology consultant on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: CHAMPIONS ONCOLOGY, INC.

ticker: CSBR


text: Our Board of Directors oversees our risk management process. The Audit Committee, by way of Board delegation, retains oversight of the Company's cybersecurity risks. The senior leadership team, including our Chief Financial Officer and Chief Executive Officer, provides periodic reports to our Board, as applicable. Our Vice President of Technology is responsible for leading the assessment and management of cybersecurity threats and periodically updating the Audit Committee as needed.


text: The cybersecurity risk management program is led by the Senior Vice President, Information Technology ("SVP of IT"). Our SVP of IT has over 28 years of experience assisting public and privately held companies in a variety of industries, leading several enterprise-wide transformation initiatives to adapt to changing cybersecurity threats. Our SVP of IT reports to the Chief Executive Officer (CEO), who works closely with the Executive Committee to guide strategic direction and IT decisions to drive business outcomes.

companyName: ANGIODYNAMICS INC

ticker: ANGO


text: The Company maintains a cybersecurity program that is designed to identify, detect, assess and manage cybersecurity risks. The Company's senior management and its Board are actively involved in the oversight of the Company's risk management program, of which cybersecurity is an important part. The Company's cybersecurity program, which aligns to the National Institute of Standards and Technology Cybersecurity Framework (the "NIST Framework") includes, among other things: • regular internal and external penetration testing of our technology environments at the application, infrastructure and network level, covering the systems, products and practices collecting or storing confidential business and personal information— including user data—in accordance with the Company's security policies. This testing is conducted multiple times a year by third-party firms; • third-party provider security assessments to evaluate associated risks and appropriate internal and third-party provider security controls; • processes to manage security risks and vulnerabilities; • mandatory company-wide cybersecurity compliance and information handling training; • a documented cybersecurity incident response plan that establishes procedures, roles, responsibilities and communication protocols for internal staff and external resources in the event of a cybersecurity incident; • cybersecurity tools that assist with the automation and orchestration of security alert response based on the relative risk; and • threat intelligence sharing relationships with industry partners, peers, and government agencies, as needed and appropriate.

companyName: Fox Corp

ticker: FOXA


text: FOX's cybersecurity program is based on recognized best practices and standards applicable to our industry. The Company engages a third-party firm to assess the overall maturity of its program against the NIST Framework on a bi-annual basis. This evaluation includes an assessment of how the program evaluates and mitigates risk, as well as how it compares against industry benchmarks. The results of this evaluation are provided to the Audit Committee of the Board.


text: The Company's Chief Information Security Officer ("CISO") leads the Company's dedicated information security department, which monitors FOX's prevention, detection, mitigation and remediation efforts related to cyber threats. The CISO regularly consults with the Company's Co-Chief Privacy Officers, and the Company's Chief Technology Officer ("CTO") provides additional oversight of the cybersecurity program, and previously served as the Company's CISO. The CISO has over 15 years of experience in cybersecurity, information security and technology, including a background in broadcast media and networking and systems engineering, and has held numerous industry certifications.


text: The CISO is in regular communication with senior management regarding cybersecurity matters and provides frequent routine (generally weekly) updates to the Company's Executive Chair and Chief Executive Officer, Chief Operating Officer ("COO"), Chief Financial Officer ("CFO"), CTO and Chief Legal and Policy Officer. As part of the Company's incident response plan process, cybersecurity risk events of a certain criteria are communicated in a timely manner to the Company's incident response governing body, which is comprised of members of senior management, including the COO, CTO, and CFO. The Company tests the effectiveness of the incidence response plan and assesses its response capabilities by conducting executive tabletop exercises involving detailed topical cybersecurity scenarios with these executives, as well as technical tabletop exercises including technical and operational personnel. The Company also has processes in place that are designed to ensure that decisions regarding public disclosure and reporting of cybersecurity incidents can be made in a timely manner.


text: The Company's Board has an active role, as a whole and at the committee level, in overseeing the management of the Company's risks. The Audit Committee of the Board is responsible for (i) overseeing the Company's policies and practices with respect to risk assessment and risk management, including with respect to cybersecurity and the use of AI, (ii) overseeing the Company's financial and other major risk exposures and the steps taken to monitor and control them, and (iii) providing guidance to the Board on such matters.


text: The Audit Committee regularly reviews and discusses FOX's cybersecurity risks and receives updates from the CISO on how the Company identifies, assesses and mitigates these risks. The CISO provides the Audit Committee with quarterly reports regarding cybersecurity issues and risks, including information regarding progress on efforts to strengthen and enhance the Company's cybersecurity program. The Audit Committee also periodically devotes additional meeting time, as needed, to in-depth discussions on a particularly relevant cybersecurity topic, including industry trends and relative risks. In addition to the quarterly reports, cybersecurity incidents meeting certain criteria are reported to the Audit Committee outside of regularly scheduled quarterly updates as necessary.


text: From time to time, the Company experiences cybersecurity threats and attacks. Although no cybersecurity incident has been material to the Company's businesses to date, FOX expects to continue to be subject to cybersecurity threats and attacks and there can be no assurance that the Company will not experience a material incident. For more information, see Item 1A., "Risk Factors—Risks Relating to Cybersecurity, Piracy, Privacy and Data Protection."


text: Risk Management and Strategy Cybersecurity risk management is an important part of and is integrated into our overall enterprise risk management framework, with cybersecurity risks being among the core enterprise risks identified for oversight by our Board of Directors (the "Board") through our annual enterprise risk assessment. We maintain an enterprise-wide cybersecurity risk assessment program and framework that is designed to identify, assess, and manage cybersecurity risk, vulnerabilities, and threats. The foundation of our cybersecurity program is based on the International Organization for Standardization (ISO) and the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. In alignment with the concepts and principles articulated in these standards, we have implemented controls related to cybersecurity threats and incidents including monitoring, log collection and analysis, threat hunting and intelligence surveillance, and regular vulnerability scans/penetration tests. Additionally, in furtherance of assessing, identifying, and managing material cybersecurity risks, we: • Leverage technology solutions to provide protection for our assets and detect threats in our environment; • Regular vulnerability assessments and penetration testing to identify, assess, and remediate weaknesses; • Maintain an enterprise-wide disaster recovery governance program, which includes cybersecurity-related disaster recovery policies and procedures related thereto; • Regularly perform cybersecurity-related disaster recovery testing designed to ensure that the Company's mission-critical systems are recoverable, in support of our business continuity needs; and • Work with each of our business and corporate groups with our internal cybersecurity program to integrate cybersecurity requirements into operating environments as appropriate, which drives business strategies, budgeting, and similar processes. In addition, executive management, as well as our Board, regularly review our financial planning processes for these areas, inclusive of our cybersecurity programs.

companyName: Lumentum Holdings Inc.

ticker: LITE


text: Changes or additions to our cybersecurity risk assessment program and related practices and procedures described above in response to cybersecurity needs are reviewed by our Cybersecurity Steering Committee ("CSC"), which is an executive management-level cross-functional group.


text: We regularly engage independent third parties to assess our cybersecurity program and practices, and to assist with risk mitigation. The effectiveness of our cybersecurity environment is regularly tested by internal personnel and these third parties. These assessments are performed in conformance with ISO standards and requirements. Enhancements to our cybersecurity program and practices are identified from assessment findings, and if deemed appropriate, implemented.


text: In addition, we evaluate critical systems and applications hosted by third parties for cybersecurity risks and we also assess the security posture and features of those services. This includes review and monitoring of the third party, and inclusion of cybersecurity requirements in contractual agreements to ensure third party services meet our standards for such providers, and the cybersecurity risks associated with the use of these services is appropriate.


text: For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors - Any failure, disruption or security breach or incident of or impacting our information technology infrastructure or information systems have an adverse impact on our business and operations." We believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. However, we can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.


text: Our Board oversees our enterprise risk management program and practices, and the Audit Committee assists the Board in its oversight of cybersecurity matters. Quarterly updates are presented to our Audit Committee by our Chief Information Security Officer ("CISO") on cybersecurity risks and threats. In addition, our Audit Committee provides Board-level oversight for management's actions with respect to practices, procedures and controls used to identify, assess, and manage our key cybersecurity programs and risks, and, as necessary, responses to any significant cybersecurity incidents.


text: Our cybersecurity program is led by our CISO who manages a team of cybersecurity professionals. Our CISO has over 20 years of experience in cybersecurity and technology, including as a CISO at another public company. Members of our cybersecurity team, combined, have over 80 years of cybersecurity experience and hold professional certifications, including Certified Information Systems Security Professional ("CISSP").


text: As noted above, we also maintain a Cybersecurity Steering Committee, or CSC, which consists of our Group Vice President, IT and CISO, Executive Vice President, Chief Financial Officer, Executive Vice President, Chief Human Resources Officer, Senior Vice President, General Counsel, Senior Vice President, Global Operations, Senior Vice President, Chief Accounting Officer, and Vice President, Internal Audit. The CSC group has the primary day to day responsibility to monitor and manage cybersecurity risks. The CSC provides oversight of the cybersecurity initiatives within Lumentum and is responsible integrating cybersecurity risk management practices with critical business processes so that cybersecurity is appropriately addressed throughout Lumentum.


text: Risk Management & Strategy Our cybersecurity program is designed to safeguard the confidentiality, integrity and availability of information assets by monitoring the cyber threat landscape, internal threats and technological changes and through the development of controls to mitigate risk to the organization and our customers. While cybersecurity is a dynamic and constantly evolving field, we strive to minimize the occurrence and impact of unauthorized access, disruption to our information systems and are committed to staying informed about emerging threats, adopting industry best practices, and integrating feedback from our assessment and incidents. We deploy and manage both preventive and detective controls and processes to mitigate cybersecurity threats, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems. We also deploy and manage preventive and detective controls and processes related to the mitigation of risks from our use of third-party service providers.

companyName: CANTALOUPE, INC.

ticker: CTLP


text: Our organization undergoes annual reviews by third-party consultants to help assess the implementation and operational effectiveness of the security controls implemented in our service environment which is in scope for Payment Card Industry Data Security Standard ("PCI DSS") and American Institute of Certified Public Accountants ("AICPA") System and Organization Controls ("SOC").


text: Our program is designed to guide our practices which are based on relevant industry frameworks and laws. This program consists of policies and procedures designed to manage material risks from cybersecurity threats, including training requirements, threat monitoring and detection and threat containment and risk assessments. Additionally, we leverage third-party firms to conduct routine external and internal penetration testing to emulate the common tactics and techniques of cyber threat actors and have processes to address identified vulnerabilities, although it may take time to mitigate or manage such vulnerabilities. Results of this testing is included in the Company's SOC report. Further, we also carry cyber security insurance, which is renewed annually and covers cyber events and business interruption. We closely monitor costs of breaches within the industry in an effort to ensure that our coverage is sufficient to address all reasonably foreseeable threats and levels of risk.


text: We have an Incident Management Policy ("IMP") and Incident Response Plan ("IRP") which helps enable us to quickly detect, respond to, and recover from third-party malicious attacks and potential security incidents. This plan includes formal steps to review incidents and implement improvements, including steps to involve the CISO, CIO and CTO as appropriate.


text: Our Information Security Program is overseen by our Chief Information Security Officer ("CISO"), who reports to our Chief Technology Officer ("CTO"). Our CISO oversees the third-party consultants who help assess our security controls and penetration testing previously described. The CTO provides oversight, leadership and direction for data risks, technology risks and information security. Our CISO leads the Cybersecurity organization and has the overall responsibility of implementing its strategy and objectives to build a strong cyber engineering function.


text: Our CISO has over 20 years of information technology experience with specialization in information security and risk management. Our CISO has industry recognized certifications including Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Payment Card Industry Professional (PCI ISA & PCIP). He worked in various information security roles at other large public traded companies.


text: The CISO and CTO report to the Board of Directors who have ultimate responsibility in overseeing enterprise risks, including cybersecurity threats.


text: We have aligned our cybersecurity risk management program with recognized security frameworks such as the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and ISO standards. This does not imply that we meet any particular technical standards, specifications or requirements, only that we use these frameworks as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: Penguin Solutions, Inc.

ticker: PENG


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees; • an information security incident response plan that includes procedures for responding to cybersecurity incidents; • an incident response team (the "Response Team") principally responsible for managing our response to cybersecurity incidents; and • a third-party risk management process for key IT vendors based on our assessment of their criticality to our operations and respective risk profile.


text: During 2024, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected us, including our business strategy, results of operations or financial condition. However, we face ongoing and increasing cybersecurity risks, including from bad actors that are becoming more sophisticated and effective over time, and if realized, these risks are reasonably likely to materially affect us. Additional information on the cybersecurity risks we face is discussed in "Item 1A. Risk Factors."


text: The Cybersecurity Committee receives regular reports from our Chief Information Officer ("CIO") regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential. The CIO periodically reports to the Board of Directors regarding cybersecurity risks and our cybersecurity risk management program. Board members periodically receive presentations on cybersecurity topics from our CIO or external experts as part of the Board of Directors' continuing education on topics that impact public companies.


text: Our management team, including our CIO, is responsible for assessing and managing our material risks from cybersecurity threats. Our CIO has over two decades of IT experience, including in applications, infrastructure, development, security and governance, and has presented as a featured speaker at numerous IT and security conferences. Our management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The Response Team, including our CIO and other members of our management team, has primary responsibility for assessing and managing our response to cybersecurity incidents.


text: Risk Management and Strategy We are committed to reducing the risk of cybersecurity compromise, either intentional or unintentional, to our customers, employees, and company proprietary information resources.

companyName: JABIL INC

ticker: JBL


text: Our cybersecurity risk management program is integrated into our global enterprise risk management framework, which is designed to help identify, monitor, and mitigate key strategic risks. Our enterprise risk assessment, which includes data protection and cybersecurity, is developed annually to provide insight into the risks with the greatest potential to impact Jabil's strategy and our financial goals. Key components of our cybersecurity risk management program include the following: • Cybersecurity policies. We leverage cybersecurity industry-standard frameworks and insights from internal assessments to develop policies to guide the use of our information assets (for example, business information and information resources such as mobile phones, computers, and workstations), access to specific intellectual property or technologies, and protection of personal information. The Company has also established written policies and procedures to help ensure that cybersecurity incidents are quickly assessed and addressed. • Risk assessment. The Company uses routine risk assessment processes to identify and prioritize cybersecurity risks, employ operational controls to mitigate risks, report incidents, and analyze trends, and employ a corrective action process to address nonconformities. Key risk indicators are used across all business functions to monitor and measure our cybersecurity risk exposure. Through this cross-functional approach, management identifies potential operational and strategic risks which could impact our strategy and financial goals. • System safeguards. We implement industry-standard technical safeguards that are designed to protect our information systems, operations, and sensitive information from cybersecurity threats. By collaborating with internal stakeholders across the company, we integrate foundational cybersecurity principles throughout our organization, including multiple layers of cybersecurity defenses and restricted access based on business need. We frequently conduct vulnerability assessments to identify new risks and periodically test the efficacy of our safeguards through both internal and external penetration tests. • Security Awareness and Training. Cybersecurity education contributes to safety of the Company, customer data, and employee sensitive data and assets. Our employees undergo regular training on information security, cybersecurity awareness, and the protection of confidential information. This training is designed to promote an understanding of the behaviors and technical requirements needed to safeguard Company data. Additionally, we provide ongoing education to help employees recognize and report suspicious activity. In addition, higher risk employees undergo routine anti-phishing testing and training. • Assessments. We periodically assess and test our cybersecurity policies, standards, processes, and practices that are designed to address threats. This includes monthly metrics review, threat modeling, vulnerability testing, and other exercises to evaluate our cybersecurity effectiveness. We regularly engage third parties to assist with our assessments and testing. Where appropriate, we adjust our cybersecurity policies, standards, processes, and practices accordingly based on internal and external assessment and testing results. • Engagement of third-party service providers. The Company utilizes third-party cybersecurity experts to assess the Company's cybersecurity risks and conduct penetration testing to measure our cybersecurity risk management program relative to industry-standard frameworks. The Company has established a standardized process for assessing and managing potential risks associated with the engagement of third-party service providers that request access to the Company's information systems.


text: • Incident response. The Cybersecurity Incident Response Team ("CIRT"), deploys, maintains, and monitors various tools and processes designed to safeguard against and detect cybersecurity incidents that may occur. As part of our incident response program, members of management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. In accordance with established written policies and procedures, escalation protocols are used to provide information to, and engage with, executive management, the Cybersecurity Committee and the Board, throughout the incident response process. The CIRT reviews these controls regularly, and makes enhancements as needed to incorporate lessons learned, updated industry standards, and any new or revised legal requirements.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Additional information about our cybersecurity risks is discussed in "Disruptions to our information systems, including security breaches, losses of data or outages, and other security issues, have and could in the future adversely affect our operations" in Item 1A. Risk Factors, which should be read in conjunction with the information above.


text: The Board oversees risk management directly and through its committees. Generally, the Board oversees risks that may affect the business of Jabil as a whole, including operational matters. The Cybersecurity Committee ("the Committee") assists the Board in fulfilling its oversight responsibilities with regard to the Company's cybersecurity programs and risks, including the cybersecurity practices, procedures, and controls management uses to identify, assess, and manage the Company's key cybersecurity programs and risks, to protect the confidential intellectual property information and data of the Company and its customers and to comply with applicable data protection laws and regulations.


text: The Committee of the Board meets quarterly. At each meeting, it receives reports from the Chief Information Security Officer ("CISO").


text: As part of its role in overseeing risk management, the Committee periodically reports to the Board regarding briefings provided by management and advisors as well as the Committees' own analysis and conclusions regarding cybersecurity risks faced by the Company. The Committee will review with management and the Board, and advise them regarding the following matters, as necessary: • Management's implementation of cybersecurity programs, policies, and procedures and management's actions to safeguard their effectiveness; • The effectiveness of the Company's cybersecurity programs and its practices for identifying, assessing, and mitigating cybersecurity risks across all business functions; • The Company's controls to prevent, detect and respond to cyber-attacks or information or data breaches involving the Company; • Cyber crisis preparedness, incident response plans, and disaster recovery capabilities; • Reports and presentations received from management and the Company's advisors regarding the management of cybersecurity programs and risks, including protection of confidential intellectual property, information, and data.


text: The CISO leads the Corporate Information Security organization which oversees the security posture of Jabil's data, networks, and resources. The CISO is responsible for notifying and providing updates on cybersecurity incidents to the Chief Information Officer ("CIO"). The CIO is responsible for overseeing global IT operations and digital transformation across the Company and leads the strategic direction on IT polices to safeguard company and client assets against cybersecurity threats.


text: The CISO has over 38 years of experience working in cybersecurity, risk management, and infrastructure technology and network architecture. Our CISO holds industry-recognized cybersecurity certifications, including Certified Information Systems Security Professional (CISSP) certification. The CIO has over 32 years of experience focused on corporate strategy formulation and implementation, IT management including cybersecurity, and business and process transformation.


text: Management Oversight and Governance The Company's Chief Information Security Officer ("CISO"), who reports to the Executive Vice President, Software, is responsible for the design and implementation of our security program and strategy based on the mandate provided by the Board and senior management. The CISO has extensive experience in the management of cybersecurity risk management programs, having served in various leadership roles in information technology and information security for over 20 years, including serving as the Chief Security Officer of two other large public technology companies. We believe the Company's business leaders have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats.

companyName: FAIR ISAAC CORP

ticker: FICO


text: The CISO, in coordination with other members of senior management, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company are tasked with addressing cybersecurity threats and responding to cybersecurity incidents. Through ongoing communications with these teams, the CISO and senior management are informed promptly about, and monitor the prevention, detection, investigation, mitigation and remediation of, cybersecurity threats. These teams are expected to operate pursuant to documented plans and playbooks that include processes for escalation of incidents to leadership and to the Audit Committee and Board, as appropriate, based on the severity level of an incident. In addition, the Company periodically consults with outside advisors and experts to assist with assessing, identifying and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk management environment.


text: Board Oversight and Governance Our management is responsible for identifying the various risks facing the Company, formulating risk management policies and procedures, and managing the Company's risk exposures. Our Board of Directors' responsibility is to monitor the Company's risk management processes by informing itself concerning our material risks and evaluating whether management has reasonable controls in place to address the material risks. The Audit Committee of the Board of Directors is responsible for discussing with management the Company's major risk exposures and the steps management has taken to monitor and control such exposures, including the Company's risk assessment and risk management policies. Accordingly, our internal risk management team regularly reports to the Audit Committee on our major risk exposures and the steps management has taken to monitor and control such exposures, including our risk assessment and risk management policies. The Audit Committee, in turn, reports on the matters discussed at the committee level to the full Board of Directors.


text: The Audit Committee ("Audit Committee") of the Company's Board of Directors (the "Board") is involved in the oversight of the Company's enterprise risk management program, including risks of cybersecurity threats. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on ensuring the implementation of effective and efficient controls, technologies, and other processes to assess, identify, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents when they occur.

companyName: Steel Connect LLC


text: Cybersecurity risk management and strategy As one of the critical elements of the Company's overall enterprise risk management approach, the Company's cybersecurity program includes: • Collaboration: Through ongoing communications with management and the IT department of Steel Holdings, the Company's IT department monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents applicable to the particular operating company in real time, and reports such threats and incidents to the Data Breach Response Team, who will then report to the Audit Committee when appropriate. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats and such safeguards are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Managed Security Service Provider ("MSSP"): The Company has an Agreement in place with a third-party managed security service provider. They provide strategic and technical services helping our business manage cyber risk and improve security posture. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that address the Company's response to a cybersecurity incident. The Company has adopted a Cybersecurity Incident Policy and has established a Data Breach Response Team to timely, consistently, and compliantly address cybersecurity threats that may occur despite the Company's safeguards. • Outside Consultants: The Company engages various outside consultants, including forensic specialists, public relations and data breach resolutions firms, outside attorneys and other third parties, to among other things, obtain information of a cybersecurity incident and isolate compromised systems and electronic data from further exposure; and determine and execute mitigation and remediation options and plans. • Education and Awareness: The Company provides awareness training to its personnel regarding cybersecurity threats to help identify, avoid and mitigate cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: As discussed above, the Board has delegated to the Audit Committee the responsibility for monitoring and overseeing the Company's overall cybersecurity and other information technology risks, controls, strategies and procedures. The Audit Committee periodically evaluates the Company's information security strategies to ensure its effectiveness. The Company's management reports to the Audit Committee as part of every quarterly scheduled meeting of the Audit Committee (or more frequently, as needed) regarding technological risk exposure and cybersecurity risk management strategy. In addition, the full Board may review and assess cybersecurity risks as part of its responsibilities for oversight of the Company's broad enterprise risk management program.


text: The Company's IT department, in coordination with the Company's legal department, Chief Financial Officer ("CFO"), and as needed Steel Partners Holdings' IT department (collectively, the "Data Breach Response Team"), works collaboratively to promptly respond to any cybersecurity incidents in accordance with the Company's Cybersecurity Incident Policy. The Company's response planning is reviewed annually and kept up to date with industry developments.


text: Management's Expertise The Company's Senior Vice President, Information Technology, holds a Master's degree in business administration and industrial psychology. He has served in various roles in information technology for over 26 years. Additionally, he stays informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques as staying informed on developments in the cyber industry is crucial to the Company's effective prevention, detection, mitigation and remediation of any cybersecurity incidents.


text: Risk Management and Strategy We have a cybersecurity program to assess, identify, and manage risks from cybersecurity threats. This includes multiple tools and processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: EDGEWELL PERSONAL CARE Co

ticker: EPC


text: Our efforts are designed to maintain the confidentiality, integrity, and availability of our information and operational technology systems and the data stored on those systems. The program includes: • Conduct periodic risk assessments to identify cybersecurity risks in our IT systems • Monitor for external threats and manage incident response • Engage third-party security providers for penetration testing and program reviews based on National Institute of Standards and Technology ("NIST") standards • Perform internal audit reviews of IT-related controls • Assess cybersecurity risks of third-party vendors • Train employees regularly, including phishing simulations The cyber security program is continually adapting to the evolving threat landscape and technology developments.


text: A multi-functional enterprise cyber security and Infrastructure team reviews and assesses top cybersecurity risks. This assessment is shared with members of senior management, including the CFO and Senior Vice President ("SVP"), IT, and helps guide the Company's cybersecurity operational priorities and strategy. In addition, cybersecurity risks are integrated into the Company's broader Enterprise Risk Management program and, when identified, are reported to relevant business and governance leaders within the Company for appropriate action.


text: To support the ongoing identification and management of cybersecurity issues, the Company provides information security employee training, conducts global and targeted phishing simulation campaigns and conducts tabletop exercises. The Company also deploys a combination of security tools and experts to help prevent, detect, contain, eradicate and recover from potential cybersecurity issues and cyber-attacks. Further, the Company engages third-party consultants and services for cyber threat intelligence, insights and assessments of its cybersecurity risk posture and governance.


text: The Company's third-party intake process incorporates cybersecurity risk into the assessment of our third-party vendors when we engage a new vendor or experience a change in relationship with an existing vendor. Further, the Company's cybersecurity team conducts reviews of its third-party vendors depending on the vendor's risk profile as determined by its cybersecurity team.


text: Security Policy and Requirements As part of our overall risk management program, we have adopted our Information Security Policy which details the overall risk-based framework and governance for the management and security of our information technology assets and information. The policy applies to everyone who accesses our data or information resources and all of our information systems and resources, including third parties we engage. Our program aligns with the NIST 2.0 cybersecurity framework.


text: Our Board of Directors are part of the Company's Cyber Response Task Force and table top simulations. Additionally, the Board of Directors have delegated to the Audit Committee oversight responsibility of our risk management program, including cybersecurity, business continuity, IT operational resilience, and data privacy. The Audit Committee has specific responsibility for reviewing the status of the security of the Company's electronic data processing information systems related to the Company's people, assets and information systems. The Audit Committee receives regular updates from the SVP, IT, about information security and systems security programs and plans, including emerging trends and progress on overall enterprise cybersecurity programs and priorities. These updates occur at least two times a year, with interim updates as needed. Additionally, we have protocols by which certain cybersecurity incidents are reported promptly to the Chief Executive Officer, or the Audit Committee, as appropriate. A Cyber dashboard is also provided to the Board of Directors quarterly.


text: Management is responsible for implementing its strategic plans, including identifying, evaluating, managing and mitigating the risks inherent in them, such as cybersecurity risks.


text: Internal Cybersecurity Team The Information Security organization reports into the SVP, IT and includes a dedicated team of centralized information security experts with extensive cybersecurity knowledge and experience to manage the cyber risk under the leadership of the Director of Information Security.


text: The team is responsible for the following: • Implementing Enterprise-wide cybersecurity strategy • Developing and enforcing Cybersecurity Policy • Developing and enforcing Cybersecurity Standards • Approving and reviewing Cybersecurity Architecture • Developing and enforcing Cybersecurity Processes • Developing and testing Cybersecurity Incident response • Performing other Cybersecurity operational activities including but not limited to: Vulnerability management strategy Network security configurations Risk Management and oversight of third parties


text: Incident Response We have adopted a cybersecurity incident response plan that is designed to provide a framework across all functions for a coordinated identification and response to security incidents. The plan specifies the process for identifying, validating, classifying, documenting, and responding to cybersecurity events as well as determining whether reporting of an event is appropriate under regulatory standards. Internal reporting and escalation protocols are in place to ensure the involvement of the SVP, IT, other senior leaders, and the Audit Committee, as appropriate. Under the plan, we conduct tabletop exercises to test our preparedness and our incident response process, and we provide ongoing training.


text: Our cybersecurity program is based on the International Organization for Standardization ("ISO") 27001 security controls. We maintain an ISO 27001:2022 certification and we undergo routine audits by an independent, certified accreditation body to maintain this certification. We also provide annual, mandatory cybersecurity training for employees to equip our workforce with the knowledge to identify and respond to cybersecurity threats, such as phishing attempts.

companyName: Twist Bioscience Corp

ticker: TWST


text: Material Risks from Cybersecurity Threats We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. For additional information regarding these risks, please refer to Item 1A, "Risk Factors," "If we, or our partners or suppliers, experience a significant disruption in, or breach in security of, information technology systems, or fail to implement new systems and software successfully, our business could be adversely affected. Cyberattacks and security vulnerabilities could lead to reduced revenue, increased costs, liability claims, or harm to our reputation or competitive position" in this Annual Report on Form 10-K.


text: Management's Role in Assessing and Managing Materials Risks from Cybersecurity Threats Under the IRP, cybersecurity incidents are escalated based on a defined incident severity to management as appropriate. Management, including the CIO, is involved in assessing and managing our cybersecurity risks. Our CIO has 13 years of experience managing information technology in complex environments. As noted above, the company's IRP includes standard processes for escalating significant cybersecurity incidents to management, including the CIO, who then informs the Board based on the nature and severity of the incident. The company's incident response team also coordinates with external legal advisors, cybersecurity forensic firms, communication specialists, and other outside advisors and experts, as appropriate.


text: We devote resources and designate high-level personnel, including our Chief Information Security Officer ("CISO") who reports to our Chief Information Officer ("CIO") who in turn reports to our Chief Executive Officer, to manage cybersecurity risk. We received ISO 27001 certification for our cybersecurity function and functionality for streaming media through Dolby Millicast in 2024 and are subject to annual ISO 27001 standard compliance monitoring audits in connection with that certification. We also take part in periodic security audits by our clients and partners.

companyName: Dolby Laboratories, Inc.

ticker: DLB


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, under the heading "Operations".


text: Cybersecurity continues to be a particularly acute area of risk for companies of all sizes and in all industries, including us. Our management and board of directors recognize the importance of developing, implementing, and maintaining appropriate cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Both management and our board of directors are actively involved in our enterprise risk management, and cybersecurity represents an important component of our overall approach to enterprise risk.

companyName: AZEK Co Inc.