text: Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our information security team, internal governance processes, and by reviewing the results of internal and third-party assessments and audits. Our CISO regularly reports directly to the audit committee on our cybersecurity program and our efforts to prevent, detect, mitigate, and remediate cybersecurity risks. In addition, we have an Information Security Governance Council, made up of members of our senior management team as well as relevant information security personnel, that meets periodically to discuss and address relevant cybersecurity matters.


text: The Board and management believe that cybersecurity is vital to protecting proprietary and confidential information, company operations and maintaining the trust of our customers, agents, franchisees, and employees. The Company has a cybersecurity risk management strategy and a governance framework to assess, identify and manage material risks from cybersecurity threats. As discussed below, the Company utilizes both internal and external resources as part of its cybersecurity program.

companyName: Anywhere Real Estate Group LLC

secItem: Item 1C


text: Risk Management and Strategy Anywhere views its cybersecurity strategy through a multi-pronged lens encompassing prevention, detection and response to ensure holistic coverage of the program and our environments.


text: Prevention. Our cybersecurity program starts with prevention, which includes risk assessment and identification and utilizing that information to design an effective layer of controls as a baseline.


text: Our cybersecurity program includes robust risk assessment and identification processes that are aligned with our overall enterprise risk management (ERM) program. As part of the annual integrated risk assessment process, the cybersecurity team works with ERM, internal audit and our legal compliance function to assess and identify cybersecurity and related risks to our business. These risks are then included, as appropriate, in the updated ERM profile, and with top risks being addressed in the cybersecurity yearly plan. As part of that process, we utilize both internal and third-party resources to identify risks. In addition, Internal Audit regularly conducts operational audits of the cybersecurity processes.


text: In evaluating the risks posed by third parties, our cybersecurity program also includes a dedicated function for Third Party Risk Management, that oversees the identification and mitigation of risk associated with outsourcing to third party vendors and service providers, particularly focused on vendors who process personal information, intellectual property, or other sensitive information.


text: Finally, with regard to compliance risk, we utilize third party firms to help us determine compliance with industry standards and regulations. We also maintain a Data Privacy Steering Committee, which is a group of internal legal, risk and IT professionals, to assist management with fulfilling applicable data privacy regulations.


text: In order to protect our assets, we utilize a multi-layer defense strategy to control who logs on to our network and uses our computers and other devices. We have enforced multi-factor authentication, implemented firewalls, and deployed a VPN alternative solution that delivers a zero trust model for access to our network and resources. We also protect our data through our use of security software, which is regularly updated, encryption of sensitive data, both at rest and in transit, and by conducting regular data backups. We have formal policies for safely disposing of electronic files and old devices and we train all employees annually on cybersecurity and their crucial role in protecting the Company's assets.


text: Detection. Our cybersecurity program includes robust tools and processes designed to detect breaches and other cybersecurity incidents as well as unauthorized access and unusual network activity. We utilize a security operations program with 24/7 monitoring by both internal and third parties that includes a variety of detection tools. We also utilize backstop detection and preventative measures, like malware detection.


text: Response. Our Cyber Security Incident Response Plan (the "Response Plan") provides the methodology used by the Company to identify and respond to cyber security incidents. The Response Plan serves as a guide to facilitate a consistent and systematic response to cyber security incidents and is designed to (a) prevent or minimize disruption of critical information systems; (b) minimize loss or theft of sensitive information and/or funds; (c) quickly and efficiently remediate, report (including any public or internal company communications or required reporting) and recover from cyber security incidents; and (d) provide a centralized enterprise investigations process. The Response Plan also provides for incorporating lessons learned after an event to prevent future breaches of the same nature.


text: We utilize internal and external resources to evaluate the effectiveness and maturity of our cybersecurity program. We conduct regular penetration and vulnerability testing. We conduct annual tabletop exercises to test and iterate our Response Plan, while also providing training for the Response Plan working group. In addition, we conduct compliance training and regular phishing assessments for our employees.


text: To date, we have not experienced any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial condition. The cybersecurity risks that could materially affect Anywhere, including our business strategy, results of operations, or financial condition, are set forth in "Item 1A.—Risk Factors".


text: Effective risk management is critical to Anywhere's ability to achieve its strategy. The Board oversees management in exercising its responsibility for managing risk, considering our framework of policies, procedures, and processes to anticipate, identify, assess, prioritize, and mitigate risks across the Company.


text: Our Audit Committee shares oversight responsibility with the full Board for our information security and technology risks, including cybersecurity. Anywhere's Chief Information Security Officer (CISO) reports to the Audit Committee on a quarterly basis and once a year to the full Board on the cybersecurity program, including the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. Two Audit Committee members have significant business experience with respect to cybersecurity risks, namely the chair of the committee, who oversaw information security and data privacy as an Enterprise Risk Officer of a Fortune 500 publicly-traded company and a member who is the Chief Product Data, Analytics and Technology Officer of a Fortune 500 publicly-traded company.


text: While the Board and the committees oversee our risk management, our CEO and other members of senior management (including the Risk Management Committee) are primarily responsible for day-to-day risk management analysis and mitigation and report to the full Board or the relevant committee regarding risk management. We believe this division of responsibility is the most effective approach for addressing our risk management.


text: Our CISO leads a dedicated internal Global Information Security ("GIS") team that is responsible for leading enterprise-wide information cybersecurity strategy, policy, standards, architecture, and processes, all of which are designed to prevent, detect and respond to information security threats, as further described in "—Cybersecurity Strategy" above. The CISO's experience includes more than 20 years in the security and fraud profession in multiple high-risk industries, including the critical infrastructure sector, and encompasses various cybersecurity leadership roles and almost seven years as a CISO. She is a Certified Information Systems Security Professional (CISSP) and has a Master's Degree in Information Systems Management.


text: In support of the GIS team, the CISO leads the Information Security Steering Committee, a group of internal security leadership positions that ensure alignment between the company's information security program and company objectives.


text: Overseeing enterprise-wide risk management is our Risk Management Committee, chaired by our General Counsel and comprised of key members of our executive management team, including the CISO. The Risk Management Committee meets regularly and plays a core role in the identification, monitoring, mitigation, and management of the risks the Company faces and oversees our enterprise risk management framework, including cybersecurity and data protection/privacy.


text: Through this dynamic risk assessment and governance process, the Risk Management Committee and Board consistently evaluate the risk environment and adjust the Company's risk profile, including cybersecurity and data privacy risks, and focus as needed to respond to industry and macroeconomic changes and to protect the Company.


text: The Board of Directors ("Board") and management believe that cybersecurity is vital to protecting proprietary and confidential information, company operations and maintaining the trust of our customers, agents, franchisees, and employees. The Company has a cybersecurity risk management strategy and a governance framework to assess, identify and manage material risks from cybersecurity threats. As discussed below, the Company utilizes both internal and external resources as part of its cybersecurity program.


text: Our cybersecurity program includes risk assessment and identification processes that are aligned with our overall enterprise risk management ("ERM") program. As part of the annual integrated risk assessment process, the cybersecurity team works with our ERM, internal audit and legal compliance functions to assess and identify cybersecurity and related risks to our business. These risks are then included, as appropriate, in the updated ERM profile, and with top risks being addressed in the cybersecurity yearly plan. As part of that process, we utilize both internal and third-party resources to identify risks. In addition, Internal Audit regularly conducts operational audits of the cybersecurity processes.


text: Detection. Our cybersecurity program includes tools and processes designed to detect breaches and other cybersecurity incidents as well as unauthorized access and unusual network activity. We utilize a security operations program with 24/7 monitoring by both internal and third parties that includes a variety of detection tools. We also utilize backstop detection and preventative measures, like malware detection.


text: As of December 31, 2024, no known cybersecurity threats have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial condition. The cybersecurity risks that could materially affect Anywhere, including our business strategy, results of operations, or financial condition, are set forth in "Item 1A.—Risk Factors".


text: Our Audit Committee shares oversight responsibility with the full Board for our information security and technology risks, including cybersecurity. Anywhere's Chief Information Security Officer (CISO) reports to the Audit Committee on a quarterly basis and once a year to the full Board on the cybersecurity program, including the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. Two Audit Committee members have significant business experience with respect to cybersecurity risks, namely the chair of the committee, who oversaw information security and data privacy as an Enterprise Risk Officer of a Fortune 500 publicly-traded company and a member who, from June 2018 to March 2024, was Chief Product Data, Analytics and Technology Officer of a Fortune 500 publicly-traded company.


text: Our CISO leads a dedicated internal Global Information Security ("GIS") team that is responsible for leading enterprise-wide information cybersecurity strategy, policy, standards, architecture, and processes, all of which are designed to prevent, detect and respond to information security threats, as further described in "Risk Management and Strategy" above. The CISO's experience includes more than 20 years in the security and fraud profession in multiple high-risk industries, including the critical infrastructure sector, and encompasses various cybersecurity leadership roles and almost seven years as a CISO. She is a Certified Information Systems Security Professional (CISSP) and has a Master's Degree in Information Systems Management.


text: Protection is ensured through weekly oversight from the CEO and Accounting Supervisor and quarterly oversight from the Board of Directors.

companyName: BrewBilt Brewing Co


text: We design and assess our program based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: iHeartMedia, Inc.

ticker: IHRT


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for certain service providers, suppliers, and vendors.


text: The Company (or third parties it relies on) may not be able to fully, continuously, and effectively implement security controls as intended. We utilize a risk-based approach and judgment to determine and prioritize the security controls and measures utilized. In addition, security controls and measures, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: Our Board of Directors (the "Board") considers cybersecurity risk as part of its risk oversight function and has delegated to the Board's Audit Committee (the "Audit Committee") oversight of information security matters and risks, including reviewing information technology procedures and controls. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives annual reports from management on information security matters, including our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer ("CISO"), internal security staff and/or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our CISO, Chief Financial Officer, and General Counsel, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes a combined 30 years of experience in cybersecurity and risk management. Our CISO holds the CRISC, CISA, CDPSE, and PMP industry certifications.


text: Our management team supervises efforts to identify, prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: The Board and the Audit Committee receive updates from management at least annually on information security matters, including our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: We maintain a cybersecurity program designed to protect our information, and that of our customers, suppliers and other third parties we engage with, against cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: FORUM ENERGY TECHNOLOGIES, INC.

ticker: FET


text: Board of Directors Our board of directors has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives reports and presentations from members of our team responsible for overseeing the Company's cybersecurity risk management, including senior members of our IT, Finance and Accounting, and Legal teams. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Audit Committee.


text: The executive management team, including our Chief Executive Officer, Chief Financial Officer and General Counsel, receives periodic reports from the IT Director regarding cybersecurity objectives and risk management measures being implemented by the Company and discusses these updates to identify and mitigate data protection and cybersecurity risks. The cybersecurity objectives established by the IT Director are based on industry best practices and are designed to further develop the security IT infrastructure.


text: Our IT Director has cybersecurity knowledge and skills gained from over 15 years of information technology experience at the Company and elsewhere. Under his supervision, the IT Department, with the advice of outside consultants, is responsible for developing, implementing, monitoring and maintaining cybersecurity and data protection practices across our business and reports directly to the Company's Vice President of Operations. The IT Director receives regular reports on cybersecurity threats from the internal cybersecurity team and reviews risk management measures designed and implemented by the Company to identify and mitigate data protection and cybersecurity threats. Our IT Director works with the General Counsel and other members of the Legal Department to oversee compliance with legal, regulatory and contractual security requirements. The IT Director also periodically attends the Board's Audit Committee meetings to report on developments impacting the IT Department and discuss annual cybersecurity goals and initiatives.


text: Internal Cybersecurity Team Our internal cybersecurity team is responsible for the development, implementation, monitoring, and maintenance of the cybersecurity and data protection practices across the Company. Reporting to our IT Director are experienced personnel with training to assist with managing cybersecurity objectives and to implement related policies and tools. Our internal cybersecurity team includes a manager who is a Certified Information Systems Security Professional and Systems Security Certified Practitioner. Also, the internal cybersecurity team conducts periodic security awareness training for employees. In addition to our internal cybersecurity capabilities, we also regularly engage consultants to assist with assessing, identifying, and managing cybersecurity risks and optimize infrastructure.


text: Risk Management and Strategy Assessing, identifying and managing cybersecurity risks are integral to our enterprise risk management activities. Our cybersecurity program leverages people, processes, and technology to timely identify and respond to cybersecurity threats. The Company has access control systems to limit physical and virtual access into our system to authorized users. In addition, we utilize services and software from third-party providers to monitor the Company's network and obtain expeditious alerts of anomalous activity. The Company takes a risk-based approach to manage cybersecurity risks and reviews third-party reports to oversee and identify cybersecurity threats. The Company maintains cybersecurity insurance to defray costs associated with an information security incident.


text: Security Policy and Requirements The Company has information security policies to (i) protect information processed and stored by the Company in accordance with applicable laws; (ii) protect the Company's information from current and emerging threats to computing systems and the energy industry in particular; and (iii) establish appropriate levels of protection for the Company's information systems. The IT Department is responsible for designing and implementing information system controls, procedures and solutions to accomplish the Company's cybersecurity and data protection objectives. The executive management team, including our Chief Executive Officer, Chief Financial Officer and General Counsel, is responsible for (i) approving and reviewing any changes to the policies; (ii) ensuring necessary resources; (iii) defining information that is considered strategically important; (iv) reviewing and approving information security objectives on annual basis; and (v) driving continued improvement and communicate importance of information security to the organization. All Company employees, contractors, managers and partners are responsible for (i) following applicable information security controls and (ii) reporting violations of controls or suspicious incidents to their business manager or directly to the IT Department. We are regularly audited by certain customers to assess the adequacy of our cybersecurity controls.


text: Incident Response We have implemented a Cybersecurity Incident Response Plan that applies in the event of a cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to cybersecurity incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process follows the National Institute of Standards and Technology framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all Company personnel, including third-party contractors, vendors and partners, that perform functions or services require access to secure Company information, and to all devices and network services that are owned or managed by the Company.


text: Material Cybersecurity Risks, Threats and Incidents Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents.


text: While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful threats or incidents.


text: We also rely on information technology and third party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continuously improve our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems. Cybersecurity incidents may lead to reputational harm, revenue and client loss, legal actions, and statutory penalties, among other consequences. Additional information on cybersecurity risks we face are discussed in Item 1A "Risk Factors," which should be read in conjunction with the foregoing information.


text: Board of Directors Our board of directors has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives reports and presentations from members of our team responsible for overseeing the Company's cybersecurity risk management, including senior members of our IT, Finance and Accounting, and Legal teams. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Audit Committee and/or Board.


text: Our IT Director has cybersecurity knowledge and skills gained from over 15 years of information technology experience at the Company and elsewhere. Under his supervision, the IT Department, with the advice of outside consultants, is responsible for developing, implementing, monitoring and maintaining cybersecurity and data protection practices across our business and reports directly to the Company's Vice President of Operations. The IT Director receives regular reports on cybersecurity threats from the internal cybersecurity team and reviews risk management measures designed and implemented by the Company to identify and mitigate data protection and cybersecurity threats. Our IT Director works with the General Counsel and other members of the Legal Department to ensure compliance with legal, regulatory and contractual security requirements. The IT Director also periodically attends the Board's Audit Committee meetings to report on developments impacting the IT Department and discuss annual cybersecurity goals and initiatives.


text: Internal Cybersecurity Team Our internal cybersecurity team is responsible for the development, implementation, monitoring, and maintenance of the cybersecurity and data protection practices across the Company. Reporting to our IT Director are experienced personnel who assist with managing cybersecurity objectives and to implement related policies and tools. Also, the internal cybersecurity team conducts periodic security awareness training for employees. In addition to our internal cybersecurity capabilities, we also regularly engage consultants to assist with assessing, identifying, and managing cybersecurity risks and optimize infrastructure.


text: Risk Management and Strategy Assessing, identifying and managing cybersecurity risks are integral to our enterprise risk management activities. Our cybersecurity program leverages people, processes, and technology to timely identify and respond to cybersecurity threats. The Company has access control systems to limit physical and virtual access into our system to authorized users. In addition, we utilize services and software from third-party providers to monitor the Company's network and obtain expeditious alerts of anomalous activity. The Company takes a risk-based approach to manage cybersecurity risks and reviews third-party reports to oversee and identify cybersecurity threats. The Company maintains cybersecurity insurance to defray costs associated with a cybersecurity incident.


text: Security Policy and Requirements The Company has information security policies to (i) protect information processed and stored by the Company in accordance with applicable laws; (ii) protect the Company's information from current and emerging threats to computing systems and the energy industry in particular; and (iii) establish appropriate levels of protection for the Company's information systems. The IT Department is responsible for designing and implementing information system controls, procedures and solutions to accomplish the Company's cybersecurity and data protection objectives. The executive management team, including our Chief Executive Officer, Chief Financial Officer and General Counsel, is responsible for (i) approving and reviewing any changes to the policies; (ii) ensuring necessary resources; (iii) defining information that is considered strategically important; (iv) reviewing and approving information security objectives on annual basis; and (v) driving continued improvement and communicating the importance of information security to the organization. All Company employees, contractors, managers and partners are responsible for (i) following applicable information security controls and (ii) reporting violations of controls or suspicious incidents to their business manager or directly to the IT Department. We are regularly audited by certain customers to assess the adequacy of our cybersecurity controls.


text: Incident Response We have implemented a Cybersecurity Incident Response Plan (the "IRP") that applies in the event of a cybersecurity incident to provide a standardized framework for responses. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process follows the National Institute of Standards and Technology framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all Company personnel, including third-party contractors, vendors and partners, that perform functions or services require access to secure Company information, and to all devices and network services that are owned or managed by the Company.


text: Risk Management and Strategy As is the case for other companies in our industry, we may be the target of cyberattacks and other cyber incidents and, therefore, cybersecurity is an important element of our overall enterprise risk management, or ERM, program. Our management performs a semi-annual assessment of enterprise-wide risks to help assess, identify, and manage existing and emerging risks for our company, including cybersecurity risks. Through our ERM program we assess the characteristics and circumstances of the evolving business environment at the time and seek to identify the potential impacts to our company of a particular risk.

companyName: Dare Bioscience, Inc.

ticker: DARE


text: Primary responsibility for assessing, identifying, and managing our cybersecurity risks rests with our management. To assist our management with such responsibility, we engage and consult with an external third party information technology consultant who reports to our Chief Accounting Officer. We also perform an annual cybersecurity assessment designed to help improve the systems and processes we have implemented designed to safeguard our information assets and operational integrity from cyber threats, protect employee information from unauthorized access or attack, as well as secure our networks and systems. Network and information systems and other technologies, including those related to our network management, are important to our business activities. As a result, we have multiple layers of security designed to detect and deter cybersecurity incidents. As part of our overall ERM program, we monitor and test our safeguards and train our employees on these safeguards, in certain instances with the assistance of our external third party information technology consultant. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings. We also maintain an incident response plan designed to respond to, mitigate and remediate cybersecurity incidents according to a defined set of severity ratings based on the potential impact to our business, information technology systems, network or data, including data held or information technology services provided by third-party vendors or other service providers.


text: As of the date of filing this report, we do not believe there are any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Our board of directors administers its cybersecurity risk oversight function through its audit committee. The audit committee is responsible for overseeing our policies, practices and assessments with respect to cybersecurity, and provides periodic updates to our board of directors. The audit committee receives periodic updates from management and our external third party information technology consultant regarding the effectiveness of the systems and processes we have implemented designed to safeguard our information assets and operational integrity from cyber threats, protect employee information from unauthorized access or attack, as well as secure our networks and systems, and regarding other cybersecurity matters, including the results from cybersecurity systems testing and any recent cybersecurity incidents and related responses. Our audit committee is also notified between such updates as soon as practicable regarding significant new cybersecurity threats or incidents. The audit committee also receives a report on cybersecurity matters and related risk exposures at least semi-annually from our Chief Accounting Officer. Many of our board members have achieved the National Association of Corporate Directors Carnegie Mellon University CERT Certification in Cybersecurity Oversight.


text: Our board of directors administers its cybersecurity risk oversight function through its audit committee. The audit committee is responsible for overseeing our policies, practices and assessments with respect to cybersecurity, and provides periodic updates to our board of directors. The audit committee receives periodic updates from management and our external third party information technology consultant regarding the effectiveness of the systems and processes we have implemented designed to safeguard our information assets and operational integrity from cyber threats, protect employee information from unauthorized access or attack, as well as secure our networks and systems, and regarding other cybersecurity matters, including the results from cybersecurity systems testing and any recent cybersecurity incidents and related responses. Our audit committee is also notified between such updates as soon as practicable regarding significant new cybersecurity threats or incidents. The audit committee also receives a report on cybersecurity matters and related risk exposures at least semi-annually from our Chief Accounting Officer. The chair of our audit committee has a National Association of Corporate Directors Carnegie Mellon University CERT Certification in Cybersecurity Oversight.


text: We have a dedicated team of information security professionals who leads our enterprise-wide cyber security strategy, risk management, cyber defense, software security, security monitoring and other related functions. This team is overseen by our Chief Information Security Officer ("CISO"), who reports to our Chief Technology Officer ("CTO"). The CISO has extensive background in that role at an enterprise level and has over 20 years of experience in the field of cybersecurity. Additionally, the processes overseen by our global information security team are integrated with our enterprise risk management program, including routine reporting on cyber risk through the different levels of the enterprise risk management governance structure and alignment on risk management frameworks and processes.

companyName: CDW Corp

ticker: CDW


text: Our information security management program is ISO 27001 certified, and we undergo routine audits by an independent, certified accreditation body to maintain this certification. Our program is designed to guide our practices which are based on relevant industry frameworks and laws. This program consists of policies, practices and procedures designed to manage material risks from cybersecurity threats, including training requirements, threat monitoring and detection and threat containment and risk assessments. Additionally, we leverage third-party firms to conduct routine external and internal penetration testing to emulate the common tactics and techniques of cyber threat actors and have processes to address identified vulnerabilities, although it may take time to mitigate or manage such vulnerabilities. We also have policies and procedures to oversee and identify the cybersecurity risks associated with our use of third-party service providers for both internal use and external use. These policies and procedures include onboarding risk assessments prior to engagement and, as appropriate based on identified risk, may include cybersecurity-related contractual terms and periodic risk assessments throughout the life cycle of the third-party relationship. Lastly, we maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business to cover certain costs related to cybersecurity incidents. We refine our cybersecurity program by staying informed on security threats, leveraging third-party cybersecurity firms and investing in enhancements to our preventive and defensive capabilities. In addition to our policies and procedures to manage and identify cybersecurity risks, we have an incident response plan designed to analyze, contain, remediate and communicate cybersecurity matters to help ensure a timely and robust response to actual or attempted incidents. As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, we cannot provide assurance that these threats will not result in such an impact in the future. For more information regarding risks relating to information technology and cybersecurity, see "Item 1A. Risk Factors."


text: The Audit Committee is primarily responsible for overseeing our enterprise risk management process on behalf of the Board of Directors, including cybersecurity risks. The CTO and CISO regularly provide reporting on cybersecurity matters to both senior management and the Audit Committee and at least annually to the Board of Directors. This reporting includes updates on our information security strategy, key cyber risks and threats and our progress towards protecting the Company from such risks and threats, assessments of our cybersecurity program and emerging trends. Depending on the criticality of a cybersecurity incident, certain matters are required to be reported promptly to the Board of Directors, as appropriate, in accordance with our incident response plan.


text: Our corporate information security management program is ISO 27001 certified, and we undergo routine audits by an independent, certified accreditation body to maintain this certification. Our program is designed to guide our practices which are based on relevant industry frameworks and laws. This program consists of policies, practices and procedures designed to manage material risks from cybersecurity threats, including training requirements, threat monitoring and detection and threat containment and risk assessments. Additionally, we leverage third-party firms to conduct routine external and internal penetration testing to emulate the common tactics and techniques of cyber threat actors and have processes to address identified vulnerabilities, although it may take time to mitigate or manage such vulnerabilities. We also have policies and procedures to oversee and identify the cybersecurity risks associated with our use of third-party service providers for both internal use and external use. These policies and procedures include onboarding risk assessments prior to engagement and, as appropriate based on identified risk, may include cybersecurity-related contractual terms and periodic risk assessments throughout the life cycle of the third-party relationship. Lastly, we maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business to cover certain costs related to cybersecurity incidents. We refine our cybersecurity program by staying informed on security threats, leveraging third-party cybersecurity firms and investing in enhancements to our preventive and defensive capabilities. In addition to our policies and procedures to manage and identify cybersecurity risks, we have an incident response plan designed to analyze, contain, remediate and communicate cybersecurity matters to help ensure a timely and robust response to actual or attempted incidents. As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, we cannot provide assurance that these threats will not result in such an impact in the future. For more information regarding risks relating to information technology and cybersecurity, see "Item 1A. Risk Factors."


text: The Audit Committee is primarily responsible for overseeing our enterprise risk management process on behalf of the Board of Directors, including cybersecurity risks. The CTO and CISO regularly provide reporting on cybersecurity matters to both senior management and the Audit Committee and at least annually to the Board of Directors. This reporting includes updates on our information security strategy, key cyber risks and threats, our progress towards protecting the Company from such risks and threats, assessments of our cybersecurity program and emerging trends. Depending on the criticality of a cybersecurity incident, certain matters are required to be reported promptly to the Board of Directors, as appropriate, in accordance with our incident response plan.


text: Risk Management and Strategy We have implemented and maintain a robust cybersecurity program to safeguard our information systems and protect the confidentiality, integrity and availability of our data.

companyName: Orion Group Holdings Inc

ticker: ORN


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader enterprise risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our information technology ("IT") department continuously evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs.


text: Cybersecurity Insurance Coverage Our internal cybersecurity risk management processes are supported by cybersecurity insurance that we have secured through industry leading underwriters. We believe that our cybersecurity insurance provides sufficient coverage to protect our assets, operations, and our employees from the financial impact of any cyber-attacks.


text: Engage Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity insurers, assessors, consultants and auditors in evaluating and assessing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third parties includes regular audits, threat assessments and consultation on security enhancements.


text: The Board's Role in Overseeing Cybersecurity Risk The Board of Directors is acutely aware of the critical nature of managing cybersecurity risks. Given the potential significance of cybersecurity threats to our operational integrity and stakeholder confidence, the Board has established robust oversight mechanisms to ensure effective governance in managing our cybersecurity risks. The Board is comprised of directors with diverse backgrounds and expertise, including risk management, technology and finance equipping them to oversee cybersecurity risks effectively. In addition to our scheduled Board meetings, the Board, Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), and Vice-President of Information Technology ("VPIT") maintain an ongoing dialogue regarding emerging or potential cybersecurity risks, ensuring the Board's oversight is proactive and responsive. The Board actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives. The Board conducts an annual review of our cybersecurity program and the effectiveness of our applicable risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of our cybersecurity efforts with our overall risk management framework.


text: Management's Role in Managing Cybersecurity Risk Our CEO, CFO, and VPIT play a pivotal role in informing the Board regarding cybersecurity risks. They provide an annual comprehensive briefing to the Board, as well as interim updates throughout the year, as needed. The VPIT holds a Certified Information Systems Security Professional certification and an Engineering degree from Queen's University in Canada, and he has over twenty years of experience in cybersecurity. Our executive leadership team (composed of our CEO, CFO, and other senior officers representing functional and business areas) has ultimate management responsibility for our cybersecurity program. The executive leadership team meets regularly to discuss our strategy, opportunities and risks, including our risk management measures used to identify and mitigate cybersecurity threats.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the VPIT. Our VPIT oversees our governance programs, tests our compliance with standards, remediates known risks and leads our employee training program. Reporting to our VPIT are a number of experienced information security officers responsible for various parts of our business, each of whom is supported by a team of trained cybersecurity professionals.


text: Monitoring Cybersecurity Incidents The VPIT stays informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation and remediation of cybersecurity incidents. The VPIT implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the VPIT is equipped with a well-defined, robust incident response plan. This plan includes immediate actions to mitigate the impact, report the incident, if required, and develop and implement long-term strategies for the remediation and prevention of future incidents.


text: Material Cybersecurity Incidents We are not aware of any cybersecurity incidents that have materially impaired our operations or financial reporting responsibilities or performance historically.


text: Internal Communication of Cybersecurity Matters The VPIT regularly informs the executive leadership team of cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks we face. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board on a timely basis, ensuring that the Board has comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: External Reporting of Cybersecurity Matters We have adopted protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated and, where appropriate, reported promptly to the public. We have empowered a cross-functional team of management to determine whether established reporting thresholds have been met and whether public disclosure is necessary or required.


text: Visa's Approach to Cybersecurity As a global company providing payment services to consumers and companies around the world, trust is an indispensable asset. A strong cybersecurity program is a key element to maintaining this trust. As a result, we consider cybersecurity risk one of our key enterprise risks and we assess, identify, and manage such risk as part of our overall enterprise risk management framework. See Item 1A for further discussion on our overall risk factors, including technology and cybersecurity risks.

companyName: VISA INC.

ticker: V


text: Cybersecurity Program Visa's cybersecurity program has been established to identify, analyze, mitigate, monitor, and govern cybersecurity risk and was designed around widely accepted international standards, such as ISO 27002 and the Payment Card Industry Data Security Standards, as well as applicable legal and regulatory requirements. We implement our cybersecurity program primarily through our Key Controls, which define the requirements for the protection of Visa information and technology assets. All employees must complete annual training on our Key Controls and are required to comply with the requirements. Exceptions to the Key Controls must be approved by an established senior management working group, which is overseen by our Corporate Risk Committee (CRC), the management committee responsible for overseeing Visa's cybersecurity program and other operational risks. The Key Controls are updated and reviewed annually by our Cybersecurity Governance, Risk and Compliance team and approved by management committees to ensure they continue to address evolving cybersecurity threats and associated legal and regulatory obligations.


text: As part of our overall business strategy, we have acquired a number of companies for which our full cybersecurity standards may not be appropriate. These designated entities may deliver products and services using systems which are not fully integrated with our standard technology platforms or hosted in our data centers. We have established a separate set of Key Controls for designated entities appropriate to their size and operations that are designed around the same widely accepted international standards noted above, but tailored to the operational reality and business needs of these entities. Regular reporting of our acquired entities' cybersecurity program is provided to our Chief Information Security Officer (CISO), President of Technology, management committees and the board of directors. For additional information about our structural and organizational risks, see Item 1A of this report.


text: Incident Response Plans Visa's global cyber security incident response team provides monitoring of Visa networks and digital assets across three cyber fusion centers in the U.S., United Kingdom, and Singapore. In addition, Visa's threat intelligence and research teams monitor commercial and government intelligence sources for new and emerging threats. Our cybersecurity awareness team regularly publishes and shares information with Visa employees on emerging threats, such as deepfake and generative AI-powered social engineering schemes.


text: To address significant cybersecurity incidents and other crisis events, we maintain a business incident response plan, which identifies key stakeholders, defines escalation processes, and sets the thresholds above which our cybersecurity, legal, and crisis management teams will inform management's Executive and Disclosure Committees as well as when the CEO and his designee will inform the board of directors of an incident. For cybersecurity incidents below these crisis thresholds, we maintain subordinate incident response plans and standard operating procedures used by our security incident response team. Like many companies, we, and some third parties on which we rely periodically experience cybersecurity incidents. However, as of September 30, 2024, we were not aware of any direct or third-party cybersecurity incidents in the past three fiscal years that have materially affected our business strategy, results of operations, or financial condition.


text: Internal and External Testing We proactively manage our cybersecurity risk by continually seeking to identify and mitigate potential cybersecurity threats to and vulnerabilities in our information and technology assets, with both internal and external assessments, as appropriate. For example, public-facing technology assets are subject to both internal security assessments and external security researcher testing under our vulnerability disclosure and bug bounty programs. Identified threats and vulnerabilities are required to be remediated within stringent timelines, for which compliance and exceptions are tracked in reporting to management and the board of directors.


text: As further discussed in our risk factors in Item IA of this report, our cybersecurity policies and controls may not be implemented or followed appropriately to mitigate all of our risks. We employ three lines of defense designed to address this risk. The first line of defense consists of the technology teams who develop, build, and deploy our products and services. These teams are trained on and accountable for following our Key Controls. The second line of defense includes separate internal security and risk teams that conduct security assessments of our networks and products, overseeing the remediation of any findings. Finally, our independent internal audit function operates as the third line of defense, assessing the effectiveness of our policies and controls and implementation thereof. We are also subject to regular, detailed examinations by financial regulators and external auditors which often contain a significant cybersecurity component.


text: Third-party Risk Management We also apply this same overall framework to our oversight and management of cybersecurity risk from service providers, vendors, suppliers, and other third parties. Our policies require due diligence on our service providers, vendors and suppliers prior to engagement and impose audit rights in our contracts in order to identify cybersecurity risks associated with third-party relationships, proportionate to the inherent risk associated with the products and services provided and the criticality and sensitivity of our information and technology assets to which the third party may have access. As noted in our risk factors in Item IA of this report, our third-party risk management framework may not be implemented effectively or may not be successful or sufficient to mitigate all of our risks. When we become aware that a service provider, vendor, supplier, or other third party has experienced any compromise or failure in the cybersecurity infrastructure owned or controlled by such third party, we may attempt to mitigate our risk, including by terminating such third party's connection to our information and technology assets where appropriate.


text: Management's Role and Responsibilities Our CISO is responsible for day-to-day management and oversight of our information security program and leads our cybersecurity organization, which comprises approximately 1,000 professionals globally as of September 30, 2024. Our CISO and President of Technology receive regular reports from our cybersecurity personnel in connection with monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO reports directly to our President of Technology and provides quarterly reports on our cybersecurity performance to the CRC.


text: Our current CISO has over 30 years of industry experience leading enterprise cybersecurity teams and enabling secure and scalable ecommerce and payment platforms at multiple Fortune 500 companies. Since joining Visa in November 2015, he has been a core part of building Visa's Zero Trust Architecture and advancing VisaNet's cybersecurity defense capabilities. Our current President of Technology joined Visa in November 2013 and has over 30 years of experience in leading the development and deployment of commerce and transaction technologies, which includes overseeing cybersecurity risk and transformational technology initiatives. At Visa, our President of Technology is responsible for the Company's technology innovation and investment strategy, product engineering, cybersecurity, global IT, and operations infrastructure, and for accelerating the integration of engineering and product teams.


text: Board Governance Visa's board of directors exercises oversight and control of Visa's overall enterprise risk management framework and delegates oversight and control of Visa's cybersecurity program to our audit and risk committee (ARC), which is responsible for ensuring that management has risk-based processes in place designed to assess, identify, and manage cybersecurity risks to which Visa is exposed. As noted in Item 1A, however, these processes may not be sufficient to mitigate all cybersecurity risks. Our CISO provides an update on our cybersecurity program to the ARC twice per year and to the full board of directors annually. The updates to the ARC and the full board of directors provide an overview of our cybersecurity performance, progress against goals, cybersecurity threat landscape, and other relevant developments.


text: Incident Response Plans Visa's global cybersecurity incident response team provides monitoring of Visa systems and digital assets from three cyber fusion centers in the U.S., United Kingdom, and Singapore. In addition, Visa's threat intelligence and research teams monitor commercial and government intelligence sources for new and emerging threats. Our cybersecurity awareness team regularly publishes and shares information with Visa employees on emerging threats, such as deepfake and GenAI-powered social engineering schemes.


text: To address significant cybersecurity incidents and other crisis events, we maintain a business incident response plan, which identifies key stakeholders, defines escalation processes, and sets the thresholds above which our cybersecurity, legal, and crisis management teams will inform management's Executive and Disclosure Committees as well as when the CEO and his designee will inform the board of directors of an incident. For cybersecurity incidents below these crisis thresholds, we maintain subordinate incident response plans and standard operating procedures used by our security incident response team. Like many companies, we, and some third parties on which we rely periodically experience cybersecurity incidents. However, as of September 30, 2025, we were not aware of any direct or third-party cybersecurity incidents in the past three fiscal years that have materially affected our business strategy, results of operations, or financial condition.


text: Third-party Risk Management We also apply this same overall framework to our oversight and management of cybersecurity risk from service providers, vendors, suppliers, and other third parties. Our policies require due diligence on our service providers, vendors and suppliers prior to engagement and impose audit rights in our contracts in order to identify cybersecurity risks associated with third-party relationships, proportionate to the inherent risk associated with the products and services provided and the criticality and sensitivity of our information and technology assets to which the third party may have access. As noted in our risk factors in Item IA of this report, our third-party risk management framework may not be implemented effectively or may not be successful or sufficient to mitigate all of our risks. When we become aware that a service provider, vendor, supplier, or other third party has experienced any compromise or failure in the technology infrastructure owned or controlled by such third party, we may attempt to mitigate our risk, including by terminating such third party's connection to our information and technology assets where appropriate. We also regularly and proactively engage relevant vendors and other third parties to assess risk to Visa information assets when a new vulnerability or compromise is reported that may affect those third parties.


text: Management's Role and Responsibilities Our CISO is responsible for day-to-day management and oversight of our information security program and leads our cybersecurity organization, which comprises approximately 1,000 professionals globally as of September 30, 2025. Our CISO and President of Technology receive regular reports from our cybersecurity personnel in connection with monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO reports directly to our President of Technology and provides quarterly reports on our cybersecurity performance to the CRC.


text: Our current CISO has over 30 years of industry experience leading enterprise cybersecurity teams and enabling secure and scalable ecommerce and payment platforms at multiple Fortune 500 companies. Since joining Visa in November 2015, he has been a core part of building Visa's Zero Trust Architecture and advancing VisaNet's cybersecurity defense capabilities. Our current President of Technology joined Visa in November 2013 and has over 30 years of experience in leading the development, deployment and operations of broad technology platforms including commerce and transaction technologies, which includes overseeing cybersecurity risk and transformational technology initiatives. At Visa, our President of Technology is responsible for the Company's technology innovation and investment strategy, product engineering, cybersecurity, global IT, and operations infrastructure, and for accelerating the integration of engineering and product teams.


text: Cybersecurity Risk Management, Strategy, and Governance The Company recognizes that the security of our banking operations is critical to protecting our customers and maintaining our reputation. The cybersecurity landscape is constantly evolving. To mitigate these risks, the Company deploys a comprehensive and resilient information security program that consists of a layered security model using industry leading hardware, software, and services to protect customers' and the Bank's data and to ensure the confidentiality, integrity, and availability of our information systems. This information security program is a critical component of our overall enterprise risk management program.

companyName: Bank of Marin Bancorp

ticker: BMRC


text: The Company leverages the following guidelines and frameworks to continue to refine and maintain the information security program: FFIEC Information Security IT Examination Handbook, FFIEC Business Continuity Planning Handbook, FFIEC Cybersecurity Assessment Tool, Center for Internet Security Critical Security Controls, National Institute of Standards and Technology (NIST) Cybersecurity Framework.


text: Key components of the information security program include: • A risk assessment process that identifies and prioritizes material cybersecurity risks; refines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the Board of Directors. • A third-party Managed Detection and Response ("MDR") service, which monitors the security of our network, infrastructure and computer systems 24x7, 365 days a year. • An incident response plan that outlines the steps the Bank will take to respond to a cybersecurity incident, which is tested on a periodic basis. • Annual recurring cybersecurity controls testing program, which includes independent third-party penetration testing, cybersecurity procedures and system testing, and third-party independent network traffic monitoring. • A training and awareness program that educates and tests employees on how to avoid and identify cybersecurity risks. • A Cyber Security Insurance Policy that covers insurance, incident response, incident mitigation, and legal support.


text: The Company engages reputable third-party assessors to conduct various independent risk assessments on a regular basis, including but not limited to maturity assessments and various other tests. Following a defense-in-depth strategy, the Company leverages both in-house resources and third-party service providers to implement and maintain processes and controls to manage the identified risks.


text: Our vendor management program is designed to ensure that our vendors meet our cybersecurity requirements and manage our third-party risks. This includes conducting periodic risk assessments of critical vendors, requiring vendors to implement appropriate cybersecurity controls, and monitoring vendor compliance with our cybersecurity requirements.


text: Security controls are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission to ensure the confidentiality, integrity, and availability of Bank's and customers' information. These controls include, but are not limited to, access control, data encryption, data loss prevention, incident response, security monitoring, third party risk management, and vulnerability management.


text: The Company's cybersecurity risk management program and strategy are regularly reviewed and updated to ensure that they are aligned with the Bank's business objectives and are designed to address evolving cybersecurity threats and satisfy regulatory requirements and industry standards.


text: The Company's Board of Directors is charged with overseeing the establishment and execution of the Company's risk management framework and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Consistent with this responsibility, the Board has primary oversight of cybersecurity risk and cybersecurity risk management and receives reporting from management about material risks from cybersecurity threats. All members of the Board of Directors receive regular updates on cybersecurity risks and incidents from the Information Security Officer ("ISO") and Chief Information Officer ("CIO") and annual security awareness training. The Information Security department consists of cybersecurity professionals who assess, identify, and manage cybersecurity risks and are responsible for implementing and maintaining the Company's cybersecurity risk management program.


text: Oaktree maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated into Oaktree's overall risk management processes and focuses on the corporate information technology environment.

companyName: Brookfield Oaktree Holdings, LLC

ticker: OAK-PA


text: The underlying controls of the cyber risk management program are designed to meet Oaktree's business requirements, security risks and organization profile, and leverages many elements of the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization Standardization ("ISO") 27001 Information Security Management System Requirements. The Internal Audit team conducts an annual internal audit of the Company's cyber risk management program utilizing the services of a third-party provider. Additionally, Oaktree hires a third party provider to conduct an annual penetration test of Oaktree's systems. Oaktree has developed and implemented controls and processes to oversee and manage its engagements with third-party vendors. These procedures encompass pre-engagement due diligence efforts and the ongoing monitoring of the third-party vendors that are considered to be high-risk. Although these controls and processes are designed to mitigate risks associated with third-party engagements, they do not guarantee the elimination of all potential risks. The effectiveness of these controls and processes is dependent on a variety of factors, some of which are outside our control.


text: A third party Managed Security Service Provider (MSSP) manages Oaktree's Security Operations Center to provide 24/7 monitoring of its global systems and to coordinate the investigation of alerts of potential security incidents. Alerts are then escalated to the Oaktree Cybersecurity team for investigation and remediation, if necessary. Cyber partners are a key part of Oaktree's cybersecurity infrastructure. Oaktree partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. Oaktree engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in Oaktree's environment. A Managing Director in Oaktree's information technology department heads Oaktree's cybersecurity team. This individual reports to Oaktree's Chief Information Officer. and is responsible for assessing and managing Oaktree's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of collective experience selecting, deploying and operating cybersecurity technologies, initiatives and processes and relies on threat intelligence as well as other information obtained from governmental, public and private sources, including external consultants engaged by Oaktree.


text: The head of Oaktree's cybersecurity team has substantial information technology and cybersecurity experience, with a career spanning over 30 years in managing global IT operations in a wide range of areas, including, but not limited to, cybersecurity, IT governance, controls, compliance, data center operations, network engineering and cloud computing.


text: The audit committee of the board of directors oversees Oaktree's cybersecurity program. The cybersecurity team briefs the audit committee on the effectiveness of Oaktree's cyber risk management program. The Internal Audit team also shares the results of its annual cybersecurity audits with the audit committee.


text: Oaktree faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. Oaktree has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, we are not currently aware of any current or past cyberattacks or other incidents that, individually or in the aggregate, have materially affected, or are reasonably likely to materially affect, Oaktree's business, business strategy, financial condition, results of operations, or cash flows. See "Risk Factors – Risks Relating to Our Business – Oaktree's failure to maintain the security of its information and technology networks, including personal data and client information, intellectual property and proprietary business information could have a material adverse effect on us."


text: A third party Managed Security Service Provider (MSSP) manages Oaktree's Security Operations Center to provide 24/7 monitoring of its global systems and to coordinate the investigation of alerts of potential security incidents. Alerts are then escalated to the Oaktree Cybersecurity team for investigation and remediation, if necessary. Cyber partners are a key part of Oaktree's cybersecurity infrastructure. Oaktree partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. Oaktree engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in Oaktree's environment. A Managing Director in Oaktree's information technology department heads Oaktree's cybersecurity team. This individual reports to Oaktree's Chief Information Officer, and is responsible for assessing and managing Oaktree's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of collective experience selecting, deploying and operating cybersecurity technologies, initiatives and processes and relies on threat intelligence as well as other information obtained from governmental, public and private sources, including external consultants engaged by Oaktree.


text: We recognize the importance of developing, implementing, and maintaining strong cybersecurity measures to help maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property.

companyName: Neurogene Inc.

ticker: NGNE


text: Our cybersecurity program focuses on the following areas: • Vigilance: Our threat operations help identify, prevent, and respond to cybersecurity incidents pursuant to our response and recovery plans. • Systems Safeguards: We use firewalls, intrusion systems, anti-malware, and access controls, and aim to continue to improve these safeguards through vulnerability assessments and threat intelligence. • Third-Party Risk Management: We manage risks from third-party vendors and service providers by conducting due diligence and periodic audits of key vendors. • Training: Mandatory periodic trainings for employees to reinforce our information security policies and practices. • Incident Response and Recovery Planning: We maintain and regularly test plans for responding to and recovering from cybersecurity incidents. • Communication, Coordination and Disclosure: Cross-functional teams, including the Board, address cybersecurity threats, with timely management decisions on incident disclosure and reporting.


text: We have implemented processes designed to help assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a hybrid information technology team consisting of Managed Services and Managed Security Services partners, which is led by our Vice President and Head of IT, and include mechanisms, controls, technologies, systems, and other processes designed to help prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data. In addition, we consult with outside advisors and experts on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment.


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. We continue to extend our cybersecurity capabilities, with advanced cybersecurity technology, processes and resources, that are designed to help us to actively identify, protect, detect, respond to, and recover from risks and threats, but nonetheless we have in the past been subject to cyberattacks and continue to face cybersecurity risk threats. Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us. However, cybersecurity attack techniques change frequently, and with increased volume and sophistication of such attacks, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents that could materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our systems, or those of any of our CROs, manufacturers, other contractors, third party service providers or consultants or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of its proprietary or confidential data, employee data or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to its brand and material disruption of our operations."


text: Our Vice President and Head of IT, who reports into the finance organization, has over 28 years of experience managing information technology and cybersecurity matters. He works collaboratively with outside consultants, including our Managed Services and Managed Security Services partners, to protect our information systems from cybersecurity threats and to promptly respond to cybersecurity incidents. He provides regular updates to the President and Chief Financial Officer regarding our efforts to monitor, prevent, detect, mitigate and remediate cybersecurity threats.


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board of Directors to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our President and Chief Financial Officer. The Board of Directors also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Cybersecurity Governance KKR has a Chief Information Security Officer (the "KKR CISO"), who leads an information security team (the "KKR information security team") that is responsible for information security at KKR's asset management business, including its cybersecurity strategy and program, which includes, among other things, annual employee training about cybersecurity risks and new employee onboarding about KKR's security policies. The KKR information security team's mandates can be broadly grouped into three categories: (i) operations and engineering, (ii) threat detection and response and (iii) governance.

companyName: KKR & Co. Inc.

ticker: KKR


text: The KKR information security team members have a variety of relevant skill sets and expertise. For example, prior to joining KKR, KKR's CISO was the CISO at another large financial institution where he was responsible for their global information security program. KKR's CISO also has prior experience in various information security roles, including security architecture, application security, engineering and operations. He holds a Bachelor of Science in computer science from the New York University Polytechnic School of Engineering, is a Certified Information Systems Security Professional (CISSP) and holds a Series 99 – Operations Professional Exam certification. In addition, KKR information security team members have various backgrounds in information security, including in financial services and critical infrastructure, and the team maintains various levels of certifications – including CISSP, GIAC security operations certification, certified information security manager, and other certifications focused on specific technologies.


text: The KKR CISO chairs the technology and information security risk committee for KKR's asset management business, which consists of employees from the firm's technology group and other groups, including risk, legal and compliance. The technology and information security risk committee is responsible for overseeing the cybersecurity risk environment for KKR's asset management business, which includes identifying and monitoring KKR's technology risks, including those related to information security, business disruption, fraud and privacy related risks, and also promoting cybersecurity awareness at the firm. The technology and information security risk committee reports to KKR's risk and operations committee, which consists of senior level employees of KKR who focus on KKR's overall operations and enterprise risk management, including the Chief Operating Officer, Chief Compliance Officer, Chief Legal Officer and Chief Financial Officer. Periodically, including at least annually and more often as circumstances may require, management will present to the Audit Committee and the Risk Committee of our Board of Directors on various topics relating to KKR's technology risks, including KKR's cybersecurity program (including the results of an annual cybersecurity table top exercise), cybersecurity issues (including those relating to data protection, insider threats, regulatory changes, and geopolitical cyber threat management), and risk management (including the results of periodic technology audits).


text: KKR also has a Chief Information Security Officer dedicated to our insurance business (the "GA CISO"), who has more than 20 years of experience in various information security and technology roles. The GA CISO leads an information security team that is focused on overseeing the cybersecurity strategy and program for Global Atlantic. The GA CISO reports periodically, including at least annually and more often as circumstances may require, to the risk committee of Global Atlantic's board of directors (whose members include non-executive directors unaffiliated with KKR) and members of KKR's risk and operations committee. The GA CISO also provides ad hoc reporting to Global Atlantic's management-level committees and Global Atlantic's board of directors and its risk committee. Material information affecting our insurance business is also reported by the GA CISO or his or her designee to KKR's risk and operations committee, certain members of which would, as appropriate, report such material information to our Board of Directors or its Audit Committee or Risk Committee.


text: Cybersecurity Risk Management and Strategy KKR's asset management business has a cybersecurity incident response plan as a key component of its cybersecurity program, which is generally incorporated as part of our enterprise risk management program. The KKR CISO and KKR's Chief Compliance Officer co-chair a cybersecurity incident response team ("KKR CIRT"), which aims to manage and mitigate the risk and impact of cybersecurity breach events at KKR's asset management business, including those arising from third-party service providers, including those providers that have access to KKR's customer and employee data. Cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities.


text: Members of the KKR CIRT include members of the firm's legal, technology, compliance, risk, public affairs, fundraising and finance groups. KKR has established a notification decision framework to determine when the KKR CIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including the risk and operations committee, senior members of management, and our Board of Directors or its committees.


text: The KKR information security team undertakes a variety of measures to monitor and manage the cybersecurity risks of KKR's asset management business. For example, the KKR information security team monitors our technology infrastructure with tools designed to detect suspicious behavior. Our technology platforms and applications are designed to enable us to monitor user and network behavior at KKR's asset management business, identify threats using certain analytics, and mitigate attacks across various layers of the enterprise. The KKR information security team conducts regular internal and external audits with third-party cybersecurity experts to identify and evaluate potential weaknesses in our cybersecurity systems. Some of these third-party monitoring functions continue throughout the year while other third-party security experts are periodically retained to audit specific areas of the cybersecurity program. In addition, the KKR information security team conducts periodic phishing simulations, and they also conduct periodic employee training on KKR's security policies and controls and provide other security trainings as part of new employee onboarding.


text: KKR also has a cybersecurity incident response plan that is specific to our insurance business. The plan sets forth the roles and responsibilities of the Global Atlantic incident response team, which is comprised of Global Atlantic employees representing key business functions at our insurance business. Global Atlantic utilizes several mechanisms to monitor and manage the cybersecurity risks of our insurance business, including to prevent, and prepare to respond to, an incident. This includes maintaining relationships with external incident response organizations, performing periodic cybersecurity risk assessments, overseeing and monitoring risks from cybersecurity threats associated with third-party service providers, and ensuring that Global Atlantic employees complete security awareness training relating to cybersecurity best practices. Global Atlantic also has a cybersecurity notification framework in place to determine when appropriate notifications and escalations are required to be provided to the senior members of Global Atlantic's management, members of Global Atlantic's board of directors and members of KKR's risk and operations committee, certain member of which would, as appropriate, report such information to our Board of Directors or its Audit Committee or Risk Committee.


text: As of the date of this filing, we do not believe that our business strategy, results of operations or financial conditions have been materially affected by any cybersecurity incidents for the reporting period covered by this report. However, institutions like us, as well as our employees, service providers and other third parties, have experienced information security and cybersecurity attacks in the past and will likely continue to be the target of increasingly sophisticated cyber actors. For a discussion of how risks from cybersecurity threats may affect us, see "Part 1. Item 1A. Risk Factors—Risks Related to Our Business—Cyber-security failures and data security breaches may disrupt or have a material adverse impact on our businesses, operations and investments" in this Annual Report on Form 10-K.


text: Cybersecurity Governance KKR's Chief Information Security Officer (the "KKR CISO") leads an information security team (the "KKR information security team") whose responsibilities include securing data from unauthorized use or access. The cybersecurity strategy and program at KKR's asset management business includes, among other things, annual employee training about cybersecurity risks and new employee onboarding about KKR's security policies.


text: Prior to joining KKR, KKR's CISO was the CISO at another large financial institution where he was responsible for their global information security program. KKR's CISO also has prior experience in various information security roles, including security architecture, application security, engineering and operations. He holds a Bachelor of Science in computer science from the New York University Polytechnic School of Engineering, is a Certified Information Systems Security Professional (CISSP) and holds a Series 99 – Operations Professional Exam certification.


text: The KKR CISO is a member of the firm's Operational Risk Committee. The Operational Risk Committee is comprised of senior employees from across our asset management business and operating functions. The committee focuses on significant operating and business risks, which includes among others, regulatory, cybersecurity, operational, geopolitical, and reputational risks, and is responsible for ensuring risks are identified, assessed, managed and mitigated effectively. The cybersecurity risk environment for KKR's asset management business, which includes identifying and monitoring KKR's technology risks, including those related to information security, business disruption, fraud and privacy related risks, and also promoting cybersecurity awareness at the firm. The Operational Risk Committee reports to KKR's Risk and Operations Committee, which is comprised of senior employees from across our asset management and insurance businesses and operating functions. KKR's Risk and Operations Committee includes our Chief Financial Officer, Chief Operating Officer, Chief Legal Officer and General Counsel, Chief Compliance Officer. At least annually, management will present to the Audit Committee and the Risk Committee of our Board of Directors on various topics relating to KKR's technology risks, including KKR's cybersecurity program, the current cybersecurity threat landscape, and risk management.


text: KKR also has a Chief Information Security Officer dedicated to our insurance business (the "Global Atlantic CISO"), who has more than 20 years of experience in various information security and technology roles. The Global Atlantic CISO leads an information security team that is focused on overseeing the cybersecurity strategy and program for Global Atlantic, which includes, among other things, annual employee training about cybersecurity risks and new employee onboarding about Global Atlantic's security policies. The Global Atlantic CISO reports at least annually to the operations & technology committee of Global Atlantic's board of directors (whose members include non-executive directors unaffiliated with KKR) and members of KKR's Risk and Operations Committee. The Global Atlantic CISO also provides ad hoc reporting to Global Atlantic's management-level committees and Global Atlantic's board of directors and its risk committee. Material information regarding information security affecting our insurance business is also reported to KKR's Risk and Operations Committee and to the Audit Committee or Risk Committee of KKR's Board of Directors.


text: Cybersecurity Risk Management and Strategy KKR's asset management business has a cybersecurity incident response plan, which was developed taking into account industry standard guidance provided by institutes such as the National Institute of Standards and Technology. This plan is a key component of the cybersecurity program, which is generally incorporated within our enterprise risk management framework. The KKR CISO and KKR's Chief Compliance Officer co-chair a cybersecurity incident response team ("KKR CIRT"), which aims to manage and mitigate the risk and impact of cybersecurity breach events at KKR's asset management business, including those arising from third-party service providers, including those providers that have access to KKR's customer and employee data. Cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform cybersecurity-related diligence on third parties that have access to our systems, data or facilities. In addition to the KKR CISO and our Chief Compliance Officer, the KKR CIRT includes members of the firm's legal, technology, compliance, risk, public affairs, human capital and finance groups. KKR has established a notification decision framework to determine when the KKR CIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including the Risk and Operations Committee, senior members of management, and our Board of Directors or its committees.


text: The KKR information security team undertakes a variety of measures to monitor and manage the cybersecurity risks of KKR's asset management business. Our technology platforms and applications are designed to enable us to monitor user and network behavior at KKR's asset management business, identify threats using certain analytics, and mitigate attacks across various layers of the enterprise. The KKR information security team conducts regular internal and external audits with third-party cybersecurity experts to identify and evaluate potential weaknesses in our cybersecurity systems. In addition, the KKR information security team conducts periodic phishing simulations, as well as periodic employee training on KKR's security policies and controls and provides other security trainings as part of new employee onboarding.


text: KKR also has a cybersecurity incident response plan that is specific to our insurance business. The plan sets forth the roles and responsibilities of the Global Atlantic incident response team, which is comprised of Global Atlantic employees representing key business functions at our insurance business and is overseen by the Global Atlantic CISO. Global Atlantic utilizes several mechanisms to monitor and manage the cybersecurity risks of our insurance business, including to prevent, and prepare to respond to, an incident. This includes maintaining relationships with external incident response organizations, performing periodic cybersecurity risk assessments, overseeing and monitoring risks from cybersecurity threats associated with third-party service providers, and ensuring that Global Atlantic employees complete security awareness training relating to cybersecurity best practices. Global Atlantic also has a cybersecurity notification framework in place to determine when appropriate notifications and escalations are required to be provided to senior members of Global Atlantic's management, members of Global Atlantic's board of directors and members of KKR's Risk and Operations Committee, certain members of which would, as appropriate, report such information to our Board of Directors or its Audit Committee or Risk Committee.


text: As of the date of this filing, we do not believe that our business strategy, results of operations or financial conditions have been materially affected by any cybersecurity incidents for the period covered by this report. However, institutions like us, as well as our employees, service providers and other third parties, have experienced information security and cybersecurity attacks in the past and will likely continue to be the target of increasingly sophisticated cyber actors. For a discussion of how risks from cybersecurity threats may affect us, see "Part 1 Item 1A. Risk Factors—"Risks Related to Our Business—Cybersecurity failures and data security breaches may disrupt or have a material adverse impact on our businesses, operations and investments."


text: We take a defense-in-depth approach, leveraging multiple, layered security measures, to protect our data, our customers' data, our infrastructure, and our employees. We embed data protection throughout our operations and information technology programs, relying on multiple and various controls to prevent and detect threats, with the goal of safeguarding our assets, data and personnel.

companyName: InterDigital, Inc.

ticker: IDCC


text: InterDigital evaluates cybersecurity risks as part of our overall enterprise risk management. A steering committee of senior executives meets quarterly to evaluate any changes to the Company's exposure to cybersecurity risks, discuss potential mitigation plans and provide updates on mitigation efforts already underway. Our cybersecurity team keeps up to date on the latest threats and risks through multiple channels and is also involved in evaluating risks associated with any new proposed service providers. The Company employs a Director of Cybersecurity & Networks, reporting directly to our CIO, who manages our cybersecurity team that is comprised entirely of security professionals with industry recognized top tier certifications. The cybersecurity team within IS is responsible for assessing and managing risks and informing/gaining feedback from the cybersecurity steering committee.


text: Additionally, InterDigital's team of dedicated cybersecurity experts/professionals maintain a comprehensive set of cybersecurity policies and standards, including a security incident response framework. The framework is a set of coordinated procedures and tasks that the InterDigital incident response team executes to ensure timely and accurate reporting and resolution of computer security incidents. The framework details who, how and when appropriate persons or committees, including the Audit Committee are kept informed on the status of potential cybersecurity incidents. A summary of recent incidents is also presented by the Chief Information Officer ("CIO") at each regular Audit Committee meeting. Our policies and standards were developed in collaboration with a wide range of disciplines, such as information technology, cybersecurity, legal, compliance and business. Our cybersecurity strategy and policies are continually reassessed to ensure they attempt to identify and proactively address the constant changes in the global threatscape, including through the use of tabletop exercises. Decision makers such as the CIO, executive team, and Audit Committee are regularly kept up to date on cybersecurity trends. Ongoing collaboration with stakeholders throughout the business also helps to build continued awareness and visibility of future needs.