text: In general, our incident and crisis management plans are aligned with the National Institute of Standards and Technology (NIST) framework for cybersecurity. These plans are intended to provide a framework and processes that allow us to take a consistent approach to cybersecurity before, during and after a cybersecurity incident. Our plans are reviewed and updated periodically. In addition, we conduct cybersecurity tabletop exercises to simulate an actual incident and increase our team's awareness and preparedness. Based upon these activities, we maintain a risk register to track identified vulnerabilities and associated mitigation plans. We also regularly conduct security awareness training and phishing exercises for our employees around the world to help them identify and report suspicious activity.


text: We have implemented a number of cybersecurity risk management processes to assess, identify and manage material risks from cybersecurity threats. We conduct real-time monitoring of our environment for suspicious cyber activity using a variety of security tools and centralized logging systems. In addition, we leverage threat intelligence monitoring to stay updated on emerging cyber threats and vulnerabilities and, utilizing this information, conduct regular vulnerability assessments. Furthermore, we conduct regular penetration tests to simulate real-world attacks and identify weaknesses.

companyName: Ingredion Inc

ticker: INGR

secItem: Item 1C


text: To supplement our internal resources, we engage external consultants to conduct independent assessments, perform penetration testing, and provide other cybersecurity-related services as needed. We also utilize external consultants and legal counsel to facilitate cybersecurity tabletop simulations. In addition, we engage external vendors to review and test key controls within our cybersecurity program.


text: We regularly assess cybersecurity risks associated with our use of suppliers and other third-party service providers. In this process, we classify by level of risk our principal suppliers and other key service providers and evaluate their data security controls and changes in potential cybersecurity risk levels. In addition, our contracts with these service providers require them to promptly report security incidents to us and to provide us with access to relevant information and resources to allow us to conduct related investigations.


text: Our cybersecurity risk management processes are integrated as part of our overall enterprise risk management (ERM) processes. Our Audit Committee conducts its oversight of our cybersecurity risk management as part of its oversight of our enterprise risk management policies and procedures. In addition, we conduct an annual survey of over 150 Ingredion business leaders across multiple functions and geographic locations that asks them to evaluate the potential severity and likelihood of cybersecurity matters, among other enterprise and information technology risks. We solicit their views on information and data security protection against cyber and internal threats, reliability of systems including disaster recovery related to malware or other cyber threats, and system implementation failures, and use the responses to modify our risk mitigation strategies accordingly.


text: Subject to oversight by our Board of Directors and Audit Committee, as described above, our Chief Digital and Information Officer is responsible for developing and guiding our global information technology and digital strategy, which includes overseeing cybersecurity risk management. The Chief Digital and Information Officer provides guidance on cybersecurity strategy initiatives and risk mitigation activities to the Senior Director, Global Information Security and the associated function. Our Chief Digital and Information Officer and our Senior Director, Global Information Security provide regular reports on security incident activity, including containment and remediation measures as relevant, and other cybersecurity risk management matters to the Board of Directors and the Audit Committee.


text: Our Chief Digital and Information Officer has over 30 years of experience at multinational companies, including six years of service at our company in his current position as a digital leader and executive, including experience managing and responding to cybersecurity risks. He holds a bachelor's degree in computer science. Our Senior Director, Global Information Security has over two decades of service at multinational companies and a federal government agency, including over one year of service at our company in his current position dedicated to information technology and cybersecurity, and possesses significant experience in protecting critical data and building cybersecurity-resilient organizations. He holds a bachelor's degree in telecommunications management and a master's degree in cybersecurity, as well as a current Certified Information Systems Security Professional (CISSP) certification.


text: To date, the risks from cybersecurity threats have not materially affected us. Notwithstanding our investment in cybersecurity, however, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, results of operations, or financial condition.


text: For a discussion of cybersecurity risks affecting our business, see Item 1A - Risk Factors - Risks Related to Our Information Technology Systems.


text: We face numerous cybersecurity risks that include cyber-based attacks and other security threats to our systems. We also could be adversely affected by cybersecurity incidents affecting our suppliers and other third-party service providers. To meet these threats, we expend what we consider to be adequate resources on cybersecurity risk management, strategy and governance.


text: The Board of Directors, directly and through its Audit Committee, oversees our cybersecurity risk management by reviewing material cybersecurity trends, potential risks and strategic priorities, and by monitoring progress made towards those priorities. The Audit Committee is responsible under its charter for reviewing with our management the processes management has implemented to monitor and mitigate cybersecurity risk exposures. On a regular basis, the Audit Committee considers management's reports on significant changes to our cybersecurity strategy, as well as risk mitigation and remediation efforts being undertaken with respect to cybersecurity incidents and under the program generally. The Audit Committee regularly reports to the Board of Directors on its activities with respect to cybersecurity matters.


text: In general, our incident and crisis management plans are aligned with the National Institute of Standards and Technology ("NIST") framework for cybersecurity. These plans are intended to provide a framework and processes that allow us to take a consistent approach to cybersecurity before, during and after a cybersecurity incident. Our plans are reviewed and updated periodically. In addition, we conduct cybersecurity tabletop exercises to simulate an actual incident and increase our team's awareness and preparedness. Based upon these activities, we maintain a risk register to track identified vulnerabilities and associated mitigation plans. We also regularly conduct security awareness training and phishing exercises for our employees around the world to help them identify and report suspicious activity.


text: Our cybersecurity risk management processes are integrated as part of our overall enterprise risk management processes. Our Audit Committee conducts its oversight of our cybersecurity risk management as part of its oversight of our enterprise risk management policies and procedures. In addition, we conduct an annual survey of over 150 Ingredion business leaders across multiple functions and geographic locations that asks them to evaluate the potential severity and likelihood of cybersecurity matters, among other enterprise and information technology risks. We solicit their views on information and data security protection against cyber and internal threats, reliability of systems including disaster recovery related to malware or other cyber threats, and system implementation failures, and use the responses to modify our risk mitigation strategies accordingly.


text: Our Chief Digital and Information Officer, who holds a bachelor's degree in computer science, has over 30 years of experience at multinational companies, including seven years of service at Ingredion in his current position as a digital leader and executive, which includes experience managing and responding to cybersecurity risks. Our Senior Director, Global Information Security, who has over two decades of service at multinational companies and a federal government agency, including over two years of service at Ingredion in his current position dedicated to information technology and cybersecurity, possesses significant experience in protecting critical data and building cybersecurity-resilient organizations. He holds a bachelor's degree in telecommunications management and a master's degree in cybersecurity, as well as a current Certified Information Systems Security Professional ("CISSP") certification.


text: To date, cybersecurity breaches have not materially affected us. Notwithstanding our investment in cybersecurity, however, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, results of operations, or financial condition. For a discussion of cybersecurity risks affecting our business, see Item 1A - Risk Factors - Risks Related to Our Information Technology Systems.


text: Risk Management and Strategy Cybersecurity is an important element of the Company's overall enterprise risk management program. The Company has a multilayered system for assessing, identifying, and managing cybersecurity risks, designed to help protect the Company's information assets and operations from internal and external cyber threats by understanding and seeking to manage risk while helping to support business resiliency and seeking to protect employee, guest, and franchisee information from unauthorized access or attack, as well as seeking to secure the Company's networks, systems, devices, products, and services. Cybersecurity is incorporated into the Company's enterprise risk management program through membership within and regular reporting to the Compliance and Enterprise Risk Management Committee.

companyName: CHOICE HOTELS INTERNATIONAL INC /DE

ticker: CHH


text: The Company devotes significant resources to helping protect and evolve the security of its computer systems, software, networks, and other technology assets, and the Company's cybersecurity risk management program includes physical, administrative, and technical safeguards. The Company's cybersecurity policies, standards, and procedures include data breach response plans, which are reviewed regularly. The Company is in the process of assessing its cybersecurity program and safeguards against the National Institute of Standards of Technology Cybersecurity Framework (the "Framework"). The Company's cyber incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes intended to triage, assess the severity of, escalate, contain, investigate, and remediate incidents, as well as to comply with applicable legal obligations.


text: The Company endeavors to continually refine its policies and practices to help protect its platform, adapt to changes in regulations, identify potential and emerging security risks, and develop mitigations for those risks. For example, the Company seeks to conduct incident simulations and assessments annually to help discover potential vulnerabilities, with the objective of improving decision-making and prioritization and promoting monitoring and reporting across compliance functions. As part of its overall risk mitigation strategy, the Company also maintains cyber insurance coverage.


text: The Company engages external parties, including consultants, computer security firms, and risk management and governance experts, as part of its cybersecurity program. For example, the Company's independent assessor provides a periodic assessment of the Company's risk posture to help identify threats as well as opportunities to enhance safeguards. Annually, the Company's adherence to the Payment Card Industry Data Security Standard is assessed by an external party which includes one or more penetration tests of the Company's technological environment. The Company has engaged an independent security assessor to evaluate the Company's cybersecurity program against the Framework. Additionally, the cybersecurity program is subject to regular assessment by internal audit and the Company's external auditors. The Company participates in the Retail & Hospitality Information Sharing and Analysis Center ("RH-ISAC") where peer companies are engaged on industry trends and emerging threats, including those relating to cybersecurity.


text: To help oversee and identify risks from cybersecurity threats associated with the Company's use of third-party service providers, the Company has a third-party information risk management program intended to minimize the likelihood of misuse of Choice data by third parties and business partners and requires that third-party service providers complete a periodic security risk assessment. Depending upon the identified risk, actions such as obligating the third party to remediate the identified deficiencies or termination of the relationship may occur. Also, depending upon the nature of the relationship and data, third party agreements include security and privacy provisions that oblige third parties to abide with applicable regulations and employ reasonable security controls.


text: The Company's Board of Directors does not believe that there are currently any risks from cybersecurity threats that are reasonably likely to materially affect the Company or its business strategy, financial condition, results of operations, or cash flows.


text: Governance and Oversight The Audit Committee of the Company's Board of Directors maintains oversight over cybersecurity risk, in coordination with the full Board of Directors. The Board of Directors and the Audit Committee receive and provide feedback on quarterly updates from management regarding cybersecurity, including highlights of recent incidents throughout the industry and the emerging threat landscape, as well as the prompt notice of any cybersecurity threats or incidents with the potential to significantly impact the Company, including its financial condition, results of operations, and cash flows, and regular updates about incidents with a lesser impact. Cybersecurity updates are rotated quarterly between the Board of Directors and the Audit Committee. The reports generally focus on items such as risk reduction efforts, emerging and existing threats, training initiatives, the status of projects to strengthen cybersecurity, emerging regulatory policies and regulations, cybersecurity technologies and best practices, cyber readiness, results of third-party assessments, mitigation efforts, and response plans.


text: The Company has a Chief Information Security Officer ("CISO") whose team is responsible for leading company-wide cybersecurity strategy, policy, standards, and processes and works across all of the units of the Company to help protect the Company and its employees against cybersecurity risks. The CISO has significant cybersecurity expertise, including prior cybersecurity leadership in banking and insurance organizations. The CISO holds a Master of Business Administration, as well as Certified Information Systems Security Professional, Certified Information Systems Auditor, and Certified Information Security Manager cybersecurity-related certifications. The CISO also serves as a Director for the RH-ISAC.


text: The Company has also established a cross-functional cybersecurity oversight committee led by our CISO serving as the chair and consisting of executive-level leaders, that is responsible for the Company's cybersecurity, disaster recovery, and business continuity programs. The Company's internal audit team also provides independent assurance on the functional components of the Company's cybersecurity program and reports the results of these audits in its quarterly reports to the Audit Committee.


text: In an effort to prevent and detect cyber threats, the Company annually provides all employees, including part-time and temporary, with cybersecurity and privacy training, which covers timely and relevant topics, including social engineering, phishing, password protection, data protection, physical security, and educates employees on the importance of reporting all incidents immediately.


text: Risk Management and Strategy Cybersecurity is an important element of the Company's overall enterprise risk management program. The Company has a multilayered system to assess, identify, and manage cybersecurity risks. The system is designed to help protect the Company's information assets and operations from internal and external cyber threats. The system is used to understand and manage risks to help support business resiliency and to protect data subjects' information from unauthorized access or attack, as well as to secure the Company's networks, systems, devices, products, and services. Cybersecurity is incorporated into the Company's enterprise risk management program through membership within and regular reporting to the Enterprise Risk Committee.


text: The Company devotes significant resources to help protect and evolve the security of its computer systems, software, networks, and other technology assets, and the Company's cybersecurity risk management program includes physical, administrative, and technical safeguards. The Company's cybersecurity policies, standards, and procedures include data breach response plans, which are reviewed regularly. The Company annually assesses its cybersecurity program and safeguards against the National Institute of Standards of Technology Cybersecurity Framework (the "Framework"). The Company's cyber incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes intended to triage, assess the severity of, escalate, contain, investigate, and remediate incidents, as well as to comply with applicable legal obligations.


text: The Company endeavors to continually refine its policies and practices to help protect its platform, adapt to changes in regulations, identify potential and emerging security risks, and develop mitigations for those risks. For example, the Company seeks to conduct incident simulations and assessments annually to help discover potential vulnerabilities, with the objective to improve decision-making and prioritize and promote the monitoring and reporting across compliance functions. As part of its overall risk mitigation strategy, the Company also maintains cyber insurance coverage.


text: The Company engages external parties, including consultants, computer security firms, and risk management and governance experts, as part of its cybersecurity program. For example, the Company's independent assessor provides a periodic assessment of the Company's risk posture to help identify threats as well as opportunities to enhance safeguards. Annually, the Company's adherence to the Payment Card Industry Data Security Standard is assessed by an external party which includes one or more penetration tests of the Company's applicable technological environment. The Company has engaged an independent security assessor to evaluate the Company's cybersecurity program against the Framework. Additionally, the cybersecurity program is subject to regular assessment by internal audit and the Company's external auditors. The Company participates in the Retail & Hospitality Information Sharing and Analysis Center ("RH-ISAC") where peer companies are engaged on industry trends and emerging threats, including those relating to cybersecurity.


text: Governance and Oversight The Audit Committee of the Company's Board of Directors maintains oversight over cybersecurity risk, in coordination with the full Board of Directors. The Board of Directors and the Audit Committee receive and provide feedback on quarterly updates from management regarding cybersecurity, including highlights of recent incidents throughout the industry and the emerging threat landscape, as well as the prompt notice of any cybersecurity threats or incidents with the potential to significantly impact the Company, including its financial condition, results of operations, and cash flows, and regular updates about incidents with a lesser impact. Cybersecurity updates are rotated quarterly between the Board of Directors and the Audit Committee. The reports generally focus on items such as risk reduction efforts, emerging and existing threats, training initiatives, the status of projects to strengthen cybersecurity, emerging security and privacy regulatory policies and regulations, cybersecurity technologies and best practices, cyber readiness, results of third-party assessments, mitigation efforts, and response plans.


text: Cybersecurity Risk Management and Strategy Our cybersecurity measures are designed to help protect our information security systems from cybersecurity threats. Our Global Information Security Team is led by our Corporate Vice President and Chief Information Officer ("CIO") and is composed of key functional leaders. Our Global Information Security Team assesses, identifies and manages cybersecurity risks to the Company, including by: • Assessing, identifying and managing cybersecurity risks to our information systems: We assess, identify and manage cybersecurity risks to our information systems, including by: (i) establishing and maintaining a governance structure that includes policies, procedures and processes designed to manage cybersecurity threats and cybersecurity incidents; (ii) conducting ongoing risk assessments, including to identify and assess cybersecurity risks; (iii) developing and implementing an overall risk management strategy, which includes cybersecurity risks; (iv) overseeing, identifying and managing risks from cybersecurity threats associated with our use of third-party service providers and our supply chain; and (v) engaging external experts, including cybersecurity assessors, consultants and auditors to evaluate and test our cybersecurity measures and risk management processes; and • Establishing a program to assess and help mitigate cybersecurity threats: We are committed to establishing a program to assess and help mitigate cybersecurity threats through: (i) conducting employee training on cybersecurity risks and best practices; (ii) implementing measures to classify and protect data; and (iii) taking steps to be aware of and address new cybersecurity threats, including through the receipt of threat information from third-parties that helps us proactively prevent and detect cybersecurity threats.

companyName: AMKOR TECHNOLOGY, INC.

ticker: AMKR


text: Impact of Cybersecurity Risks We assess, on an ongoing basis, the potential impact of risks from cybersecurity threats on us and our business. During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Board Oversight of Cybersecurity Risks Our Board of Directors, through the Audit Committee, provides strategic oversight regarding risks from cybersecurity threats through oversight of our overarching cybersecurity posture and risk management practices. The Audit Committee receives periodic updates from our CIO on the current status of our cybersecurity program and risks from cybersecurity threats, and our Board of Directors is apprised of significant cybersecurity matters.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Management is responsible for assessing and managing risks from cybersecurity threats. Specifically, our CIO, supported by our Global Information Security Team, is responsible for the overall management of our information security program, which includes assessing, identifying and managing cybersecurity risks and material risks from cybersecurity threats. The Company's CIO was promoted to the position in January 2024 after serving as Senior Vice President – Enterprise Applications since July 2022. The CIO has more than 25 years of manufacturing experience, mostly in IT leadership roles in the semiconductor industry, and holds electrical and computer engineering degrees from the University of Missouri and an MBA from The Ohio State University.


text: Members of the Global Information Security Team possess expertise in various disciplines that are key to effectively managing our information security program. Team members represent relevant functions within the organization (e.g., Risk and Compliance, Security Operation Center & Network Engineering and Operational Technology). Each Global Information Security Team member has more than 15 years of experience working for large enterprises in the information technology and information security space. This includes, but is not limited to, expertise in data infrastructure, operations and information security and risk and compliance. In addition, our CIO and certain members of the Global Information Security Team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through their participation in incident response protocols.


text: Cybersecurity Risk Management and Strategy Our cybersecurity measures are designed to help protect our information security systems from cybersecurity threats. Our Global Information Security Team is led by our Corporate Vice President and Chief Information Officer ("CIO") and is composed of key functional leaders. Our Global Information Security Team assesses, identifies and manages cybersecurity risks to the Company, including by: • Assessing, identifying and managing cybersecurity risks to our information systems: We assess, identify and manage cybersecurity risks to our information systems, including by: (i) establishing and maintaining a governance structure that includes policies, procedures and processes designed to manage cybersecurity threats and cybersecurity incidents; (ii) conducting ongoing risk assessments, including to identify and assess cybersecurity risks; (iii) developing and implementing an overall risk management strategy, which includes cybersecurity risks; (iv) overseeing, identifying and managing risks from cybersecurity threats associated with our use of third-party service providers and our supply chain; and (v) engaging external experts, including cybersecurity assessors, consultants and auditors to evaluate and test our cybersecurity measures and risk management processes; and • Establishing a program to assess and help mitigate cybersecurity threats: We have established a program to assess and help mitigate cybersecurity threats through: (i) conducting employee training on cybersecurity risks and best practices; (ii) implementing measures to classify and protect data; and (iii) taking steps to be aware of and address new cybersecurity threats, including through the receipt of threat information from third-parties that helps us proactively prevent and detect cybersecurity threats.


text: Members of the Global Information Security Team possess expertise in various disciplines that are key to effectively managing our information security program. Team members represent relevant functions within the organization (e.g., Risk and Compliance, Security Operation Center & Network Engineering and Operational Technology). Global Information Security Team members have multiple years of experience working for large enterprises in the information technology and information security space. This includes, but is not limited to, expertise in data infrastructure, operations and information security and risk and compliance. In addition, our CIO and certain members of the Global Information Security Team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through their participation in incident response protocols.


text: Cybersecurity risk management and strategy Our Board recognizes the increasing significance that cybersecurity has on our operations and business and is responsible for overseeing our cybersecurity plan and risks to the Company from cybersecurity threat actors. From farm to table our operations rely on various information systems and technologies, including those provided by third party suppliers. These systems collect, process, transmit and retain information that may require both mandatory and voluntary data protection regimens.

companyName: FRESH DEL MONTE PRODUCE INC

ticker: FDP


text: Our cybersecurity policies, standards, processes, and practices are designed to provide reasonable information security given the integrated nature of our organization, our third-party relationships, and the geographic regions we operate in. With this multi-layered approach, we aim to mitigate cybersecurity vulnerabilities across all aspects of our operations. Our approach to cybersecurity is grounded in the NIST Cybersecurity Framework v1.1, a nationally recognized and adaptable model that aligns with our goals, and addresses the following key areas:


text: Cross-Functional Approach: We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of cybersecurity incidents so that decisions regarding the disclosure and reporting of such material incidents may be made by management in a timely manner.


text: Identify, Protect and Detect: We have designed and implemented an industry standard security architecture, policies and procedures applying least privilege, and third-party monitoring of security controls of our core enterprise systems.


text: Response and Recovery: Working with our third-party security operations center, we maintain an incident response plan to timely, consistently and compliantly address any cyber event that may occur and have a designated Incident Response Team consisting of representatives from select business functions which is led by our Vice President of Information Technology ("CISO"). We regularly test our incident response plan, conduct compliance audits, periodic tabletop exercises, vulnerability assessments, and where necessary engage third parties to assist with these audits and assessments, as well as mitigation and remediation options and plans.


text: Third-Party Risk Management: We rely on the representations and certifications of key partnerships with suppliers recognizing these third-party relationships introduce additional cybersecurity risks. To address these third-party risks, we have established strict criteria for supplier selection and conduct security risk assessments to mitigate potential impacts on our business.


text: Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats to educate and empower our workforce to be vigilant against threat actors and actively participate in cybersecurity efforts.


text: Our Board believes a strong cybersecurity strategy is vital to protect our business operations, sustain our control environment and honor our data protection obligations. The Board has delegated to its Governance Committee the responsibility for monitoring the effectiveness of the Company's internal cybersecurity program and coordinates its finding with the company Audit Committee. The CISO and various members of the Incident Response Team report on cybersecurity threats, incidents, plans and responses to the Governance Committee and/or the entire Board on at least a quarterly basis, and more often as needed.


text: Management Oversight Our COO, CISO, Chief Global Privacy Officer ("CPO"), our General Counsel ("GC") and various members of the Incident Response Team play an important role in managing the Company's cybersecurity-related risks and maintaining an ongoing dialogue with the Board, the Governance Committee and the Company's Disclosure Committee. Potential cybersecurity incidents come to the attention of the Incident Response Team, which then responds to such incidents in accordance with our incident response plan. When appropriate, cybersecurity incidents are reported to the Company's Management Disclosure Committee to review and assess the materiality of the cybersecurity incident. The members of the Disclosure Committee, which is responsible for addressing the Company's public disclosures and internal controls, include the GC, CISO, CPO, our Chief Operating Officer, certain members of the Incident Response Team, and other members of senior management from legal, finance, risk management, internal audit and communications.


text: While we have not experienced any cybersecurity incidents that have had, either individually or in the aggregate, a material adverse effect on our business, financial condition or results of operations, we did experience and incur costs related to a cybersecurity incident in 2023. Future incidents may interrupt our operations, cause reputational harm, subject us to increased operating costs or expose us to litigation. For additional discussion of the risks posed by cybersecurity threats, see Part I, Item 1A. Risk Factors – Risks Related to our Information Systems of this Annual Report on Form 10-K.


text: Our cybersecurity policies, standards, processes, and practices are designed to provide reasonable information security given the integrated nature of our organization, our third-party relationships, and the geographic regions we operate in. With this multi-layered approach, we aim to mitigate cybersecurity vulnerabilities across all aspects of our operations. Our approach to cybersecurity is grounded in the NIST Cybersecurity Framework v2.0, a nationally recognized and adaptable model that aligns with our goals, and addresses the following key areas:


text: Cross-Functional Approach and Disclosure Committee: We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of cybersecurity incidents so that decisions regarding the disclosure and reporting of such material incidents may be made by management in a timely manner. Cybersecurity incidents are reported to the Company's Management Disclosure Committee to review and assess the materiality of the cybersecurity incident.


text: Response and Recovery: Working with our third-party security operations center, we maintain an incident response plan to timely, consistently and compliantly address any cyber event that may occur and have a designated Incident Response Team consisting of representatives from select business functions which is led by our Vice President of Information Technology ("VP of IT"), who is also in charge of information security, and our Chief Global Privacy Officer ("CPO"). We regularly test our incident response plan, conduct compliance audits, annual tabletop exercises, vulnerability assessments, and where necessary engage third parties to assist with these audits and assessments, as well as mitigation and remediation options and plans.


text: Third-Party Risk Management: We rely on the representations and certifications of key partnerships with suppliers recognizing these third-party relationships introduce additional cybersecurity risks. To address these third-party risks, we have established strict criteria for technology supplier selection.


text: Our Board believes a strong cybersecurity strategy is vital to protect our business operations, sustain our control environment and honor our data protection obligations. Our Board has delegated to its Governance Committee the responsibility for monitoring the effectiveness of the Company's internal cybersecurity program and coordinates its findings with the company Audit Committee. The VP of IT and various members of the Incident Response Team report on cybersecurity threats, incidents, plans and responses to the Governance Committee and/or the entire Board on at least a quarterly basis, and more often as needed.


text: Management Oversight Our Chief Operating Officer ("COO"), Chief Financial Officer ("CFO"), VP of IT, CPO, General Counsel ("GC") and various members of the Incident Response Team play an important role in managing the Company's cybersecurity-related risks and maintaining an ongoing dialogue with our Board, the Governance Committee and the Company's Disclosure Committee. Potential cybersecurity incidents come to the attention of the Incident Response Team, which then responds to such incidents in accordance with our incident response plan. Cybersecurity incidents are reported to the Company's Management Disclosure Committee to review and assess the materiality of the cybersecurity incident. The members of the Disclosure Committee, which is responsible for addressing the Company's public disclosures and internal controls, include the GC, VP of IT, CPO, CFO, COO, certain members of the Incident Response Team, and other members of senior management from legal, finance, risk management, internal audit and communications.


text: Cybersecurity Risk Management and Strategy As part of the Company's overall risk management, the Company has adopted processes designed to assess, identify and manage material risks from cybersecurity threats. Our program has been designed and evaluated based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use NIST CSF as a guide to identify, assess, and manage cybersecurity risks relevant to our business. The cybersecurity risk management program includes, among other things, processes to manage risks associated with third party service providers, regular review and testing of the Company's cybersecurity practices through audits, internal assessments and tabletop exercises, and mandatory annual cybersecurity awareness training for all employees. In addition, the Company has adopted an incident response plan establishing the processes for responding to any cybersecurity incident. The Company has engaged third party cybersecurity firms to perform maturity assessments of our cybersecurity risk management program, the results of which are reported to the Board.

companyName: IES Holdings, Inc.

ticker: IESC


text: We have experienced cybersecurity attacks and incidents in the past and could in the future experience similar attacks. To date, no cybersecurity incident or attack, or any risk from cybersecurity threats, has materially affected or has been determined to be reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board oversees the Company's general risk management processes, and with respect to cybersecurity risks the oversight is performed primarily through the Audit Committee of the Board, which is briefed at least quarterly on cybersecurity threats, the results of periodic assessment and reviews of the Company's cybersecurity programs, and cybersecurity developments affecting companies generally. Our incident response plan provides for prompt notice to the Board of any material cybersecurity incident.


text: Our cybersecurity program is overseen by our head of cybersecurity, with guidance from our Chief Technical Officer and our Vice President of Information Technology. Our head of cybersecurity has more than ten years of experience managing cybersecurity matters, holds an undergraduate degree in information systems with a focus on information security, and holds numerous certificates across the cybersecurity landscape. Our head of cybersecurity is also responsible for providing the Audit Committee with quarterly updates on cybersecurity risks and developments.


text: Cybersecurity Risk Management and Strategy As part of the Company's overall risk management, the Company has adopted processes designed to assess, identify and manage material risks from cybersecurity threats. Our program has been designed and evaluated based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use NIST CSF as a guide to identify, assess, and manage cybersecurity risks relevant to our business. The cybersecurity risk management program includes, among other things, processes to manage risks associated with third party service providers, regular review and testing of the Company's cybersecurity practices through audits, internal assessments and tabletop exercises, and mandatory annual cybersecurity awareness training for all employees. In addition, the Company has adopted an incident response plan establishing the processes for responding to any cybersecurity incident. The Company periodically engages third party cybersecurity firms to perform maturity assessments of our cybersecurity risk management program, the results of which are reported to the Board.


text: Our cybersecurity program is overseen by our head of cybersecurity, with guidance from our Chief Technical Officer. Our head of cybersecurity has more than ten years of experience managing cybersecurity matters, holds an undergraduate degree in information systems with a focus on information security, and holds numerous certificates across the cybersecurity landscape. Our Chief Technical Officer is responsible for providing the Audit Committee with quarterly updates on cybersecurity risks and developments.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including, among other things, intellectual property, trade secrets, confidential information that is proprietary, strategic or competitive in nature, and personal data (collectively, Information Systems and Data).

companyName: BIOMARIN PHARMACEUTICAL INC

ticker: BMRN


text: Our cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) cybersecurity framework. Our cybersecurity operations team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile. We use various methods and security tools designed to help prevent, identify, protect, detect, escalate, respond, and recover from identified vulnerabilities and security incidents in a timely manner.


text: Depending on the technology environment, we implement and maintain various technical, physical, and organizational measures, in the form of policies, standards, processes, and technical capabilities, designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, among other things, internal reporting, annual and ongoing cybersecurity awareness training for employees, mechanisms to detect and monitor unusual network activity, as well as threat detection, containment, incident response and backup recovery tools.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. As part of such process, we conduct tests of our cybersecurity program on a regular basis that are designed to identify cybersecurity risks associated with our technology environment. We use third-party security service providers and cybersecurity consultants to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats and review our cybersecurity program. Our internal audit team also conducts audits to evaluate the effectiveness of our cybersecurity program and improve our security measures and planning. The results of such reviews are reflected in the cybersecurity risk register and certain members of our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee (Audit Committee) of the Board of Directors (Board), which evaluates our overall enterprise risk, as well as to the full Board.


text: We use third-party service providers to perform a variety of functions throughout our business, such as research collaborators, contract research organizations, contract manufacturers, suppliers, and distributors. Depending on the nature of the services provided, certain providers are subject to cybersecurity risk assessments at the time of onboarding and upon contract renewal. We also use various inputs to assess the risk of our third-party service providers, including information supplied by them. Depending on the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve various levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, please see "Risk Factors" included in Part I, Item 1A of this Annual Report on Form 10-K, including "We rely significantly on information technology systems and any failure, inadequacy, interruption or security lapse of that technology, including any cybersecurity incidents, could harm our ability to operate our business effectively and have a material adverse effect on our business, reputation, financial condition, and results of operations."


text: Our Board has ultimate oversight of cybersecurity risk, which it manages as part of its general risk oversight function. The Board satisfies its responsibility to oversee cybersecurity risk through full reports by the Chair of the Audit Committee chair regarding such committee's considerations and actions, as well as through regular reports directly from officers responsible for oversight of risks. The Audit Committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The Board and the Audit Committee receives periodic reports, summaries, and presentations from our senior management, including the Chief Information Officer and Global Head of Cybersecurity, concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them.


text: We recently established the Executive Cybersecurity Committee (ECC), which is comprised of our Chief Financial Officer, Chief Information Officer, Chief Legal Officer, Chief Accounting Officer, and Global Head of Cybersecurity, with the goal of providing oversight of the Company's cybersecurity program. The ECC is responsible for, among other things, evaluating and determining the materiality of cybersecurity incidents as well as reviewing and approving any public disclosures with respect to material cybersecurity incidents. Our cybersecurity incident response policy is designed for our cybersecurity operations team, which is led by our Global Head of Cybersecurity who works in conjunction with the cross-functional incident response team, to escalate certain cybersecurity incidents to the ECC depending on the circumstances. The ECC also has the responsibility of reporting to the Board and/or the Audit Committee.


text: We maintain a Cybersecurity Risk Committee (CRC) that is comprised of management level representatives from key organizations and functions within the Company and led by our Global Head of Cybersecurity. The CRC is responsible for our enterprise-wide cybersecurity risk management framework established by certain members of our senior management, including the review and approval of significant strategies, policies, procedures, processes, controls, and systems designed to identify, assess, monitor, and report the major risk factors facing the Company. In addition, the CRC provides guidance to senior management on risk appetite, risk profile and approves the effectiveness of the Company's enterprise-wide cybersecurity risk framework and such other duties as directed by the Board. The CRC also assists in the oversight of decisions that affect cybersecurity compliance with applicable laws, regulations, and corporate policies.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including the Chief Information Officer, who reports to the CFO. Our Chief Information Officer has nearly 25 years of industry experience and has been with us since 2008. Our Global Head of Cybersecurity has over 25 years of cybersecurity and privacy experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies.


text: While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, please see "Risk Factors" included in Part I, Item 1A of this Annual Report on Form 10-K, including "We, and the third parties with whom we work, rely significantly on information technology systems and any failure, inadequacy, interruption or security lapse of that technology, including any cybersecurity incidents, could harm our ability to operate our business effectively and have a material adverse effect on our business, reputation, financial condition, and results of operations."


text: Our Board has ultimate oversight of cybersecurity risk, which it manages as part of its general risk oversight function. The Board satisfies its responsibility to oversee cybersecurity risk through full reports by the Chair of the Audit Committee regarding such committee's considerations and actions, as well as through regular reports directly from officers responsible for oversight of risks. The Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The Board and the Audit Committee receive periodic reports, summaries, and presentations from our senior management, including the Chief Information Officer and Global Head of Cybersecurity, concerning our significant cybersecurity threats and risk and the processes the Company has implemented to address them.


text: We have an Executive Cybersecurity Committee (ECC), which is comprised of our Chief Financial Officer (CFO), Chief Information Officer, Chief Legal Officer, Chief Accounting Officer, and Global Head of Cybersecurity, with the goal of providing oversight of the Company's cybersecurity program. The ECC is responsible for, among other things, evaluating and determining the materiality of cybersecurity incidents as well as reviewing and approving any public disclosures with respect to material cybersecurity incidents. Our cybersecurity incident response policy is designed for our cybersecurity operations team, which is led by our Global Head of Cybersecurity, who works in conjunction with the cross-functional incident response team, to escalate certain cybersecurity incidents to the ECC depending on the circumstances. The ECC also has the responsibility of reporting to the Board and/or the Audit Committee.


text: We maintain a Cybersecurity Risk Committee (CRC) that is comprised of management level representatives from key organizations and functions within the Company and led by our Global Head of Cybersecurity. The CRC is responsible for our enterprise-wide cybersecurity risk management framework established by certain members of our senior management, including the review and approval of significant strategies, policies, procedures, processes, controls, and systems designed to identify, assess, monitor, and report the major risk factors facing the Company. In addition, the CRC provides guidance to senior management on risk appetite and risk profile and approves the effectiveness of the Company's enterprise-wide cybersecurity risk framework and such other duties as directed by the Board. The CRC also assists in the oversight of decisions that affect cybersecurity compliance with applicable laws, regulations, and corporate policies.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including the Chief Information Officer, who reports to the CFO. Our Chief Information Officer has nearly 25 years of industry experience and has been with us since 2008. Our Global Head of Cybersecurity has over 20 years of cybersecurity and privacy experience, including serving in similar roles leading and overseeing cybersecurity programs at public companies.


text: Risk Management and Strategy We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risks; and reputational risks. Our process for identifying and assessing material risks from cybersecurity threats operates in conjunction with our overall risk management systems and processes, covering all company risks.

companyName: F5, INC.

ticker: FFIV


text: Our cybersecurity risk management program is led by our Chief Information Security Officer ("CISO"), who manages our security team and is principally responsible for our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents. Our program includes protocols for preventing, monitoring, detecting and responding to cybersecurity events and incidents, and cross-functional coordination and governance of business continuity and disaster recovery plans. Components of our program include: • risk assessments designed to help identify cybersecurity threats to our products and related supportive infrastructure, critical IT systems, information, and our broader enterprise IT environment; • monitoring, detection and collection and analysis of information regarding evolving, ongoing, and emerging threats and vulnerabilities, and corresponding actions to assess and remediate corresponding risks; • regular testing and assessments to identify vulnerabilities; • the periodic engagement of independent security firms and other third-party experts, where appropriate, to assess, test, and certify components of our cybersecurity program, and to otherwise assist with aspects of our cybersecurity processes and controls; • annual cybersecurity awareness training for our employees; • regular assessments of the design and operational effectiveness of the program's key processes and controls by our internal audit team as well as external consultants; and • a risk management process for third-party service providers and vendors that includes due diligence in the selection process and periodic monitoring regarding adherence to applicable cybersecurity standards.


text: We also have a cybersecurity incident response plan to assess and manage cybersecurity incidents, which includes escalation procedures based on the nature and severity of the incident, including, where appropriate, escalation to the Risk Committee and the Board. We periodically perform tabletop exercises to test our incident response procedures, identify gaps and improvement opportunities, and assess team preparedness.


text: As part of our overall risk mitigation strategy, we maintain insurance coverage that is intended to address certain aspects of cybersecurity risks; however, such insurance may not be sufficient in type or amount to cover us against claims related to cybersecurity breaches, cyberattacks and other related breaches. We periodically review our cybersecurity insurance program.


text: As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with whom we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information on our cybersecurity related risks, see Part I, Item 1A. "Risk Factors," including "Security vulnerabilities or control failures in our IT infrastructure or multicloud application security and delivery products and services as well as unforeseen product errors could have a material adverse impact on our business, results of operations, financial condition and reputation."


text: Our Board of Directors is actively involved in overseeing risks from cybersecurity threats and is assisted in that oversight by its Risk Committee. The Risk Committee reviews and assesses the Company's cybersecurity risk exposure and evaluates the adequacy and effectiveness of related risk management processes and policies.


text: As part of the oversight process, the Risk Committee has the following responsibilities, among others: • reviews and advises on our cybersecurity and operational risk strategy, resiliency, crisis and incident management, and security-related information technology planning processes, and reviews strategy and implementation for investing in related systems, controls, and procedures with management; • reviews our compliance with applicable global data protection and security laws and regulations, and the Company's adoption and implementation of systems, controls and procedures designed to comply with such laws and regulations; • reviews plans for periodic assessments and related findings and remediation of our cybersecurity and operational risk and incident response and disaster recovery programs by outside professionals; • reviews analyses of our cybersecurity and operational risks by management and third parties, as applicable; and • evaluates our disclosure controls and procedures related to cybersecurity to ensure timely and accurate reporting of cybersecurity and operational risks and incidents, as appropriate.


text: The Risk Committee meets at least four times a year and regularly reports to the full Board, including regarding its review and assessment of cybersecurity risk oversight matters and related recommendations. The Board of Directors discusses our programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of F5's business strategy.


text: The Risk Committee receives periodic updates from our CISO, and other persons the Risk Committee deems appropriate, on a range of cybersecurity matters, including those referenced above as well as on the status of the Company's cybersecurity posture and risk mitigation efforts. If cyber-related issues arise between Risk Committee meetings that the CISO believes could have a material adverse impact on the Company, the CISO, or another appropriate risk management leader, will report to the Chair of the Risk Committee.


text: At the management level, our CISO leads our enterprise-wide cybersecurity program in partnership with other business leaders, including our General Counsel and Chief Operating Officer. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above. In December 2023, our CISO retired after three years in the position, and a career spanning over twenty-five years as an industry-recognized leader in cybersecurity, information technology, and risk management. Her replacement has served in various roles in information technology, security and risk management for over 15 years, including having previously served as the CISO of two other publicly traded technology companies. In September 2024, our current CISO began transitioning to a new role within the Company, and as a result, we have appointed an interim CISO while we conduct a search for his permanent replacement. Our interim CISO has over 25 years of experience in technology and information security operations across a diverse range of business sectors.


text: As of the date of this report, other than with respect to the Cyber Incident, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations or financial condition. For more information on the Cyber Incident, see Part II, Item 7. "Management's Discussion and Analysis of Financial Condition and Results of Operations - Cyber Incident". Despite our security measures, however, there can be no assurance that we, or third parties with whom we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information on our cybersecurity related risks, see Part I, Item 1A. "Risk Factors," including "Security vulnerabilities or control failures in our IT infrastructure or multicloud application delivery and security products and services as well as unforeseen product errors could have a material adverse impact on our business, results of operations, financial condition and reputation," and "The Cyber Incident has had and may continue to have an adverse effect on our business, reputation, customer, employee and partner relations, results of operations, financial condition and cash flows."


text: At the management level, our CISO leads our enterprise-wide cybersecurity program in partnership with other business leaders, including our General Counsel and Chief Operating Officer. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above. Our CISO has over 25 years of experience in techn ology and information security operations across a diverse range of business sectors. In addition, on October 15, 2025 Michael Montoya, a former member of our Board of Directors, was appointed as the Company's Chief Technology Operations Officer. In his role, Mr. Montoya will lead the enterprise-wide strategy and execution of our enterprise-wide cybersecurity program with our CISO, and in partnership with other business leaders, including our General Counsel and Chief Operating Officer to further embed security into every aspect of how F5 operates.


text: Our ability to attract and retain customers, efficiently operate our businesses, execute our DRIVE transformation, including Network 2.0, and compete effectively increasingly depends in part upon the sophistication, security, and reliability of our technology network, including our ability to provide features of service that are important to our customers, to protect our confidential business information and the information provided by our customers, and to maintain customer confidence in our ability to protect our systems and to provide services consistent with their expectations.

companyName: FEDEX CORP

ticker: FDX


text: Cybersecurity Risk Management and Strategy FedEx has an information technology ("IT") risk management process designed to identify and manage risk within its IT environment, including cybersecurity. The IT risk management process is based on an established framework for identification, measurement, and monitoring of cybersecurity and other risk areas and supplements our Enterprise Risk Management ("ERM") process and framework. Our IT risk management, ERM, and compliance teams collaborate to regularly evaluate and manage cybersecurity-related risks using various tools and services. Leveraging components from multiple industry frameworks and best practices such as the International Organization for Standardization ("ISO") 27001 and National Institute of Standards and Technology ("NIST") standards, including the NIST Cybersecurity Framework, our cybersecurity program prioritizes governance, identification, protection, detection, response, and remediation measures.


text: We regularly conduct table-top simulation exercises to test our cybersecurity incident response processes with the aim of enhancing effectiveness against evolving threats. Our incident response procedures guide our preparedness, detection, response, and recovery actions.


text: In the last three fiscal years to date, we have not identified any risks from cybersecurity threats or become aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations, or financial condition.


text: While we have significant security processes and initiatives in place, we may be unable to detect or prevent a breach or disruption in the future. For more information about cybersecurity-related risks, please see " Item 1A. "Risk Factors " of this Form 10-K.


text: The CyTOC receives regular updates from our CISO and other members of management on risks related to these matters. Specific topics may include updates to FedEx's cyber risks and threats, the status of existing or new strategies and associated projects intended to strengthen FedEx's information security systems, assessments of FedEx's cybersecurity program, risks associated with third-party service providers, and the emerging threat landscape. The CyTOC also receives regular updates on key metrics related to our cybersecurity-related risks. The results of the IT risk management process are also presented at least annually to the CyTOC. Additionally, members of the CyTOC participate in certain of the simulation exercises conducted by management. The Chair of the CyTOC briefs the full Board on certain of these matters. In addition, the Board periodically receives cybersecurity updates directly from management. Separately, through our ERM program, key enterprise risks, including with respect to cybersecurity, are communicated to the Board and its Audit and Finance Committee at least annually, and any significant changes to these risks are reported to the Board and its Audit and Finance Committee.


text: Our CISO, who reports to the Chief Executive Officer, leads our information security team and has management responsibility for overseeing FedEx's cybersecurity program, including assessing and managing material risks from cybersecurity threats. The CISO, who has over 25 years of experience at FedEx and has received industry-recognized information security certifications, oversees an information security organization of more than 400 security, risk, and compliance professionals based in the U.S. and internationally across the FedEx enterprise. The leadership team of our information security organization has extensive experience in IT and cybersecurity and possess certifications in cybersecurity and related fields.


text: The FedEx Data and Technology Risk Council ("DTRC"), which is sponsored by the CISO, oversees the execution of FedEx's comprehensive IT risk management program. The DTRC, which receives quarterly reports on FedEx's IT risk management, is responsible for assessing the overall risk framework on an annual basis, setting acceptable risk tolerance levels, approving risk prioritization and associated risk mitigation activities, and monitoring the changing risk landscape and posture.


text: Both our CISO and other members of our cybersecurity leadership team participate in threat intelligence briefings provided by various government and industry entities. Our CISO reports to the Chief Executive Officer, and the FedEx Executive Committee oversees our business risk, with cybersecurity threat risks being a regular topic of discussion. Our cybersecurity incident response plan includes processes for communicating cybersecurity incidents to relevant levels of management, including the DTRC, Executive Committee, the CyTOC, and the full Board of Directors, as appropriate, and consideration of external reporting and disclosure requirements.


text: We assess and identify material risks from cybersecurity threats primarily through the work of our Chief Information Officer ("CIO") as part of our enterprise risk management ("ERM") process. The ERM process, administered by management with input from business leaders and our global and corporate functions, monitors material risks facing Mercury, including cybersecurity threats. Our CIO works directly with our CFO and other members of senior management to assess cybersecurity threats as part of the ERM process. Our CIO oversees the internal cybersecurity organization headed by our Chief Information Security Officer (our "Cybersecurity Team").

companyName: MERCURY SYSTEMS INC

ticker: MRCY


text: Risks related to cybersecurity threats are reflected in an enterprise risk "heat map," along with other material risks identified through the ERM process, and any mitigation plans developed to manage such risks are reported to our Board of Directors. We could be negatively impacted by a security breach, through a cyber-attack, cyber intrusion, insider threat, supply chain incident, or other significant disruption of our IT networks and related systems. See "Item 1A - Risk Factors" in this Annual Report for a further discussion of specific risks related to cybersecurity threats.


text: Our Cybersecurity Team monitors activity, scans applications and systems for vulnerabilities to risk from cybersecurity threats, and creates action plans to address and track identified cybersecurity threats until they have been remediated. Activities and cybersecurity incidents are reported to our cyber critical incident response team and to our CIO, who briefs our Compliance Committee, a dedicated committee of senior management focused on regulatory compliance. Our Cybersecurity Team also routinely engages with third parties, including government agencies focused on cyber resiliency, to manage risks from cybersecurity threats. For example, we are members of the DoD Defense Industrial Base Collaborative Information Sharing Environment, the National Defense Information Sharing and Analysis Center, and the National Security Agency Enduring Security Framework as well as Infragard, a partnership between the FBI and members of the private sector for the protection of U.S. critical infrastructure. These organizations share real-time cybersecurity threat information and best practices in protecting, detecting, and recovering from cybersecurity threats.


text: We maintain an insider threat program designed to identify, assess, and address potential internal risks from within our Company. Our program evaluates potential risks consistent with industry practices, customer requirements and applicable law, including privacy and other considerations. As a government contractor, we must comply with extensive cybersecurity regulations, including the Defense Federal Acquisition Regulation Supplement related to adequately safeguarding controlled unclassified information and reporting cybersecurity incidents to the DoD. Our policies and implemented controls reflect our adherence to these requirements.


text: Additionally, as part of our processes to manage risks related to a breach in our information systems, management requires employees to take cybersecurity trainings and shares regular awareness updates regarding cybersecurity threats. Our Cybersecurity Team regularly tests employees throughout the year to assess the effectiveness of our cybersecurity training. We also conduct penetration testing of our network, hold tabletop exercises of cyber incidents, and undertake cybersecurity assessments to improve our risk mitigation and assist in the determination of a potential material impact caused by a cybersecurity incident.


text: Our Board of Directors provides oversight of our ERM process and other guidelines and policies governing the processes by which our CEO and senior management assess our exposure to risk, including risk from cybersecurity threats. Our management Compliance Committee receives briefings from our CIO, Chief Information Security Officer, and other members of senior management on cybersecurity threats and related matters and assists the Board in its oversight and review of our ERM process.


text: Our management Compliance Committee reviews our cybersecurity risk across the enterprise and our cybersecurity strategy framework and operational posture. The Compliance Committee also reviews our IT, data security and other systems, processes, policies, procedures and controls to (a) identify, assess, monitor, and mitigate cybersecurity risks; (b) identify measures to protect and safeguard against cybersecurity threats and breaches of confidential information and data and IT infrastructure and our other assets or assets of our customers or other third parties in our possession or custody; (c) support the response and management of cybersecurity threats and data breach incidents; and (d) aid in compliance with legal and regulatory requirements governing cybersecurity or data security reporting requirements.


text: To date, we have not experienced any cybersecurity incidents that have had a material affect on the Company or our financial position, results of operations and/or cash flows. We continue to invest in cybersecurity and enhance the resiliency of our networks and to strengthen our internal controls and processes, which are designed to help protect our systems and infrastructure, and the data they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."


text: We assess and identify material risks from cybersecurity threats primarily through the work of our Chief Information Officer ("CIO") as part of our enterprise risk management ("ERM") process and through regularly scheduled meetings of our multidisciplinary cyber critical incident response team. The ERM process, administered by management with input from business leaders and our global and corporate functions, monitors material risks facing Mercury, including cybersecurity threats. Our CIO works directly with our CFO and other members of senior management to assess cybersecurity threats as part of the ERM process. Our CIO oversees the internal cybersecurity organization headed by our Chief Information Security Officer (our "Cybersecurity Team").


text: We could be negatively impacted by a security breach, through a cyber-attack, cyber intrusion, insider threat, supply chain incident, or other significant disruption of our IT networks and related systems. See "Item 1A - Risk Factors" in this Annual Report for a further discussion of specific risks related to cybersecurity threats.


text: Our Cybersecurity Team monitors activity, scans applications and systems for vulnerabilities and risk from cybersecurity threats, and creates action plans to address and track identified cybersecurity threats until they have been remediated. Activities and cybersecurity incidents are reported to our cyber critical incident response team, and the CISO, who briefs our Compliance Committee, a dedicated committee of senior management focused on regulatory compliance. Our Cybersecurity Team also routinely engages with third parties, including government agencies focused on cyber resiliency, to manage risks from cybersecurity threats. For example, we are members of the DoD Defense Industrial Base Collaborative Information Sharing Environment, the National Defense Information Sharing and Analysis Center, and the National Security Agency Enduring Security Framework as well as Infragard, a partnership between the FBI and members of the private sector for the protection of U.S. critical infrastructure. These organizations share real-time cybersecurity threat information and best practices in protecting, detecting, and recovering from cybersecurity threats.


text: Additionally, as part of our processes to manage risks related to a breach in our information systems, management requires employees to take cybersecurity trainings and shares regular awareness updates regarding cybersecurity threats. Our Cybersecurity Team regularly tests employees throughout the year to assess the effectiveness of our cybersecurity training. We also conduct penetration testing of our network and undertake cybersecurity assessments to improve our risk mitigation and assist in the determination of a potential material impact caused by a cybersecurity incident.


text: To date, we have not experienced any cybersecurity incidents that have had a material effect on the Company or our financial position, results of operations and/or cash flows. We continue to invest in cybersecurity and enhance the resiliency of our networks and to strengthen our internal controls and processes, which are designed to help protect our systems and infrastructure, and the data they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."


text: As a financial services company, we face cybersecurity risks and threats, and our customers, suppliers, and third-party service providers face cybersecurity risks and threats. As part of the operation of our business, the Company uses, stores, and processes data for our customers, employees, partners, and suppliers. A cybersecurity incident impacting any of these entities could materially adversely affect our operations, performance, or results of operations. In addition, as a financial services company we are subject to extensive regulatory compliance requirements, including those established by the FRB, MDOB, RIDBR, and NYDFS. To address these risks and regulatory requirements, the Company implemented a Cybersecurity Risk Management Program (the "Program") that is designed to identify, assess and mitigate risks from cybersecurity threats to the data and our systems. The Program adheres to regulatory requirements and the tenets of the Federal Financial Institutions Examination Council ("FFIEC") handbook and the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF").

companyName: BROOKLINE BANCORP INC


text: Risk Management Oversight and Governance Our Chief Information Security Officer ("CISO"), assisted by our Information Security team, has primary responsibility for assessing and managing the Program and reporting on cybersecurity matters to the Company's Board of Directors and members of executive management. Our CISO has extensive experience managing information technology systems and information security systems, previously served as the Company's Chief Information Officer, and holds the Certified Information Systems Security Professional ("CISSP") and Certified Information Security Manager ("CISM") certifications. Our CISO regularly updates members of executive management on developments surrounding cybersecurity. The CISO reports to the Risk Committee of the Board of Directors and provides regular reports to the Board of Directors and Risk Committee on emerging cybersecurity issues and the Company's cybersecurity infrastructure.


text: Our Program is overseen by the Company's Board of Directors, which has delegated certain responsibilities to the Audit Committee and the Risk Committee. The Chairs of the Audit Committee and Risk Committee, in turn, report to the Board of Directors a summary of the presentations they have received relative to the Program. The Board of Directors oversees management's processes for identifying and mitigating risks, including cyber risks, to assist in the alignment of our risk exposure with our overall strategic business objectives. The Board of Directors has also engaged an experienced information security advisor to assist them with cybersecurity and data privacy oversight responsibilities. This advisor provides the Board of Directors with independent updates on external market cybersecurity threats and emerging risks on a regular basis.


text: The Risk Committee, Audit Committee, and the Board of Directors are active in understanding and evaluating cybersecurity risks. The Risk Committee receives and reviews a quarterly Enterprise Risk Management ("ERM") report from the Chief Risk Officer that is the cumulation of a process that involves discussions with leaders across the Company and incorporates a number of enterprise risk factors, including those related to cybersecurity threats. The Audit Committee receives the results of internal and external penetration testing as well as any other audits applicable to the Company's information security programs. The Audit Committee actively engages management in discussions surrounding the outcome of these audits.


text: At least annually, the Board of Directors receives a report from the CISO covering the Company's information security program. This report includes a review of enhancements to the Company's programs, a discussion of management's actions to identify and detect threats and planned action steps in the event of an incident, and an overview of employee training and engagement efforts. In addition, separately, on at least an annual basis, the Board of Directors receives updates from the CISO on the Company's Incident Response Plan, which outlines steps to be followed in the event of an incident including detection, mitigation, recovery, and notification (including notification to senior management, the Board of Directors, and functional business areas), and remediation.


text: Cybersecurity Risk Management Program The Program is designed to identify, assess, manage, mitigate, and respond to cyber threats with the goal of preventing cybersecurity incidents to the extent feasible, while also increasing our system resilience to minimize business disruption in the event we experience a cyber event. Our program is structured to be nimble and adaptable to changes in cybersecurity threats over time and to respond to emerging threats in a timely and efficient manner. Our Program consists of a layered cybersecurity approach and is incorporated into our overall ERM program.


text: Our Information Security team, led by our CISO, is responsible for monitoring our information systems for vulnerabilities and mitigating any issues. The Information Security team works collaboratively across the Company to understand the potential impacts of a cybersecurity incident and prioritize mitigation and other measures based on, among other things, the materiality to our business. The Information Security team has established processes designed to monitor threats in the cybersecurity landscape which include interacting with intelligence networks, working with researchers, discussions with peers at other companies, monitoring social media, reviewing government alerts and other news items and attending industry specific security conferences and trainings. The team regularly monitors our internal network and customer-facing network to identify any security issues. In addition, the Company augments the team's monitoring via the engagement of external vendors who provide continuous threat monitoring services of the Company's environment.


text: We regularly review and update our investments in information technology security to identify and protect critical assets, provide monitoring and alerts, and, as needed, engage third-party experts. To assess the effectiveness of our Program, we have engaged consultants to conduct penetration testing and other vulnerability assessments. Additionally, our Internal Audit department and external auditors conduct assessments of different systems to provide the Audit Committee with information on our risk management processes, including cybersecurity risk management. We also test our defenses internally and conduct regular cybersecurity simulations and tabletop exercises with members of executive management present. These tests and assessments provide useful insights into the strengths and weaknesses of our cybersecurity framework.


text: Our cybersecurity framework is designed to protect our customers, employees, investors, and our intellectual property. Before purchasing third-party technology or other solutions that could expose the Company's assets and electronic information, our Information Security and Information Technology teams complete security reviews on the vendors. We also conduct ongoing reviews of cybersecurity risks associated with our third-party service providers. As part of the Company's Vendor Management Program, annual reviews are conducted for certain third-party vendors. Members of our Information Security team work with our Vendor Management team to review System and Organization Controls ("SOC") 1 or SOC 2 reports. In the event a third-party vendor is unable to provide either a SOC 1 or SOC 2 report, this group conducts additional reviews to assess the cybersecurity preparedness of the specific vendor. This assessment of the risks associated with the use of third-party service providers is part of our overall vendor management and cybersecurity risk management framework.


text: Our Company faces a number of cybersecurity risks in connection with the operation of our business which could have a material adverse effect on our business financial condition, results of operations, cash flows, or reputation. Although, to date, such risks have not materially affected us, we have, from time to time, experienced threats and breaches to our data and systems. For more information about the cybersecurity risks we face, see the risk factors entitled "We face continuing and growing security risks to our information base, including the information we maintain relating to our customers." and "We rely on other companies to provide key components of our business infrastructure." in Item 1A- Risk Factors.


text: As a financial services company, we face cybersecurity risks and threats, and our customers, suppliers, and third-party service providers face cybersecurity risks and threats. As part of the operation of our business, the Company uses, stores, and processes data for our customers, employees, partners, and suppliers. A cybersecurity incident impacting any of these entities could materially adversely affect our operations, performance, or results of operations. In addition, as a financial services company we are subject to extensive regulatory compliance requirements, including those established by the FRB, MDOB, RIDBR, and NYDFS. To address these risks and regulatory requirements, the Company implemented the Program that is designed to identify, assess and mitigate risks from cybersecurity threats to the data and our systems. The Program adheres to regulatory requirements and the tenets of the FFIEC handbook and the NIST Cybersecurity Framework.


text: Risk Management Oversight and Governance Our CISO, assisted by our Information Security team, has primary responsibility for assessing and managing the Program and reporting on cybersecurity matters to the Company's Board of Directors and members of executive management. Our CISO has extensive experience managing information technology systems and information security systems, previously served as the Company's Chief Information Officer, and holds the Certified Information Systems Security Professional ("CISSP") and Certified Information Security Manager ("CISM") certifications. Our CISO regularly updates members of executive management on developments surrounding cybersecurity. The CISO reports to the Risk Committee of the Board of Directors and provides regular reports to the Board of Directors and Risk Committee on emerging cybersecurity issues and the Company's cybersecurity infrastructure.


text: Our cybersecurity framework is designed to protect our customers, employees, investors, and our intellectual property. Before purchasing third-party technology or other solutions that could expose the Company's assets and electronic information, our Information Security and Information Technology teams complete security reviews on the vendors. We also conduct ongoing reviews of cybersecurity risks associated with our third-party service providers. As part of the Company's Vendor Management Program, annual reviews are conducted for certain third-party vendors. Members of our Information Security team work with our Vendor Management team to review SOC 1 or SOC 2 reports. In the event a third-party vendor is unable to provide either a SOC 1 or SOC 2 report, this group conducts additional reviews to assess the cybersecurity preparedness of the specific vendor. This assessment of the risks associated with the use of third-party service providers is part of our overall vendor management and cybersecurity risk management framework.


text: As a publicly-traded financial institution, we are subject to various cybersecurity risks that could adversely affect our business, financial condition, results of operations and reputation, including, but not limited to, cyber-attacks against us or our service providers focused on gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data or causing operational disruption. As described below, we have risk management and governance practices and processes designed to address these risks.

companyName: EAGLE BANCORP INC

ticker: EGBN


text: The Company has established an enterprise risk management framework that outlines the processes and procedures the Company uses to identify, assess, mitigate, and monitor the risks faced by the Company, including cybersecurity risk.


text: Within the overarching enterprise risk management framework, we have an information security program designed to preserve the confidentiality, integrity, and availability of information or data on our systems and those of our service providers, as documented in our information security policy.


text: Our information security program takes a risk-based approach to identifying and assessing the cybersecurity risks that exist within our business and information technology systems. The program addresses the roles and responsibilities of the Board, its committees and management.


text: The Board is responsible for the oversight of cybersecurity risk management, as well as the selection of a Chief Information Security Officer ("CISO"), the management official responsible for administering and executing the information security program. The Board's Technology Oversight Committee ("TOC") assists the Board in its oversight of the information security program. The TOC reviews information security metrics, oversees significant instances of non-compliance with the information security policy and monitors remediation of those instances, and reviews the appointment of the CISO for recommendation to the Board.


text: At the management level, the Enterprise Risk Management Committee ("ERMC") is primarily responsible for cybersecurity risk management. As it pertains to the information security program, the ERMC assesses and monitors information security risks and approves the information security policy on at least an annual basis. Certain instances of non-compliance with the information security policy are escalated to the EMRC, which may further escalate to the TOC as appropriate. Once escalated to a committee, the committee is responsible for overseeing related remediation.


text: Our CISO is responsible for the overall administration and execution of the information security program and reports to our Chief Risk Officer ("CRO"). Our CISO has over thirty years of experience working in information security for a variety of companies and organizations, including multiple financial institutions. The CISO monitors the security of, among other things, systems, applications, tools, databases, computers, websites, cloud infrastructure, vendor tools, and user access systems. The CISO performs an annual information security risk assessment, which, among other things, documents inherent risk levels and controls in place to manage those risks. The information security risk assessment is presented to the Board annually.


text: We strive to minimize the occurrence of cybersecurity incidents and the risks resulting from such incidents. However, when a cybersecurity incident does occur, the Company has in place an incident response program to guide our assessment of and response to the incident. The CISO coordinates the Company's response to a cybersecurity incident, including investigating, recording and evaluating any potential, suspected or confirmed incidents involving non-public customer information or Company confidential information.


text: On a regular basis, the CISO reports to the CRO information security risk issues, risk mitigation progress and developments, and information security enhancement initiatives. The CISO also reports the status of information security-related key risk indicators to the CRO. The CISO reports to the TOC monthly on information security developments and emerging risks, both in the industry and specific to the Company. The CISO and CRO report on the information security program to the TOC and the ERMC and review and propose updates to the information security policy to the ERMC.


text: The Company employs third parties in certain aspects of its information security and cybersecurity risk management. For example, we engage third parties to assess the information security risks related to new products, and we utilize third parties to conduct certain security operations and maintain certain information security infrastructure. We have adopted a Contract and Vendor Management Policy, which addresses the identification, measurement, monitoring, and management of our third-party service provider relationships, including those related to information security. The CISO assesses and monitors information risks posed by third parties and any non-compliance with the controls created to address such risks. With respect to cybersecurity incidents affecting our third party service providers, the CISO works with our service providers to understand and document any incidents, along with managing the impact to us and reporting such incidents to the CRO, ERMC, TOC, and, if applicable, the Board.


text: To date, we have not incurred any material losses related to cybersecurity incidents. However, the risk management and governance processes described above may not be sufficient to prevent cybersecurity incidents, and we could incur substantial costs and suffer other negative consequences from cybersecurity incidents. See "Part 1, Item IA. – Risk Factors" for more information on the cybersecurity risks facing the Company.


text: The Company has established an enterprise risk management framework that outlines the processes and procedures the Company uses to identify, assess, mitigate and monitor the risks faced by the Company, including cybersecurity risk.


text: The Board is responsible for the oversight of cybersecurity risk management, as well as the selection of a Chief Information Security Officer ("CISO"), the management official responsible for administering and executing the information security program. The Board's Technology Oversight Committee (the "TOC") assists the Board in its oversight of the information security program. The TOC reviews information security metrics, oversees significant instances of non-compliance with the information security policy and monitors remediation of those instances, and reviews the appointment of the CISO for recommendation to the Board.


text: At the management level, the Enterprise Risk Management Committee (the "ERMC") is primarily responsible for cybersecurity risk management. As it pertains to the information security program, the ERMC assesses and monitors information security risks and approves the information security policy on at least an annual basis. Certain instances of non-compliance with the information security policy are escalated to the EMRC, which may further escalate to the TOC as appropriate. Once escalated to a committee, the committee is responsible for overseeing related remediation.


text: Our CISO is responsible for the overall administration and execution of the information security program and reports to our Chief Risk Officer ("CRO"). Our CISO has over fifteen years of experience working in information security and risk for a variety of companies and organizations, including multiple financial institutions. The CISO monitors the security of, among other things, systems, applications, tools, databases, computers, websites, cloud infrastructure, vendor tools, and user access systems. The CISO performs an annual information security risk assessment, which, among other things, documents inherent risk levels and controls in place to manage those risks. The information security risk assessment is presented to the Board annually.


text: On a regular basis, the CISO discusses with the CRO information security risk issues, risk mitigation progress and developments and information security enhancement initiatives. The CISO reports to the TOC quarterly on information security developments and emerging risks, both in the industry and specific to the Company. The CISO and CRO report on the information security program, including the status of information security-related key risk indicators, to the TOC and the ERMC. The Information Security Policy is also approved by the TOC on an annual basis.