text: Ball's Chief Information Security Director (CISD) reports to the Senior Vice President and Chief Information Officer (CIO) and leads the company's cybersecurity team. The CISD is responsible for overseeing cybersecurity, including assessing and managing cybersecurity risk, and together with the CIO, providing comprehensive briefings to the executive leadership team with respect to the cybersecurity program and emerging or potential cybersecurity risks. The cybersecurity team has extensive experience selecting, deploying, and operating cybersecurity technologies, strategies and processes, and couples this knowledge with the use of external experts to protect the company from cyber threats. In the event of a cyber incident, our cross-functional response team will enact our incident response plan, and notify appropriate levels of management, including the executive leadership team, disclosure committee, and Board of Directors, as appropriate.


text: Our Board of Directors oversees our company's cybersecurity and information technology strategies. Annually, the CIO briefs the Board of Directors on the company's cybersecurity posture and the effectiveness of its risk management strategies.

companyName: BALL Corp

ticker: BALL

secItem: Item 1C


text: Communication, Coordination and Disclosure: The Company promotes awareness and surveillance over cybersecurity risk at all levels of the organization, including staff, senior management and our Board of Directors.

companyName: Farmland Partners Inc.

ticker: FPI


text: Our Board of Directors oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. Our Board of Directors receives presentations on cybersecurity issues and developments as needed. Our Board of Directors also will receive prompt and timely information regarding any cybersecurity incident that meets established reporting materiality thresholds, as well as ongoing updates regarding such incident until it has been addressed. The Company evaluates the materiality of a cybersecurity incident based on the overall impact of the event, which depends on a number of factors including, but not limited to, the financial impact of the incident and the type of information involved. At least once each year, our Board of Directors discusses the Company's approach to cybersecurity risk management with the Company's President and Chief Executive Officer and General Counsel.


text: The Company's President and Chief Executive Officer, Luca Fabbri, is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program and incident reporting, in partnership with other business leaders across the Company. In the event there is a material cybersecurity breach or incident, Mr. Fabbri works in coordination with the Company's General Counsel, Christine Garrison, to assess and respond, including by reporting the breach or incident to our Board of Directors and/or applicable regulatory authorities, as necessary or required. Mr. Fabbri has a high level of exposure to cybersecurity oversight through his current and previous work in the technology sector. Mr. Fabbri has served in various roles in information technology and information security for over 30 years, including serving as a consultant with Elk Creek Ventures Inc. from 2003 to 2012, through which he provided consulting services in technology, and serving as co-founder and vice president of engineering of Co3 Systems Inc., an enterprise software company in the cybersecurity space that is now part of IBM, from 2010 to 2011. Mr. Fabbri also co-founded a software company called HomeSphere, for which he served as senior vice president and chief financial officer from 2000 to 2002, and currently serves on the board of directors of Basil Systems Inc., a healthcare software company. Mr. Fabbri, Ms. Garrison and the Company's Chief Financial Officer each hold degrees in their respective fields, and each have over 15 years of experience with managing risks at the Company and in environments similar to the Company's, including risks arising from cybersecurity threats.


text: Mr. Fabbri, in coordination with our Board of Directors, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. Mr. Fabbri and Ms. Garrison monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to our Board of Directors and applicable regulatory authorities when appropriate.


text: The Company has established a risk committee (the " Risk Committee ") consisting of executive officers, including the Company's Chief Information Security Officer ("CISO"), that is directly responsible for the Company's risk management process. The Company's cybersecurity policies, standards, and practices are integrated into the Company's risk management process. The Board oversees information technology, data security, and cybersecurity risk management through regular reports and presentations from the CISO and other management members. The Risk Committee meets at least annually to define and improve the risk-mapping process and considers any updates at least quarterly. In addition, the Risk Committee presents comprehensive reports directly to the Board at least annually through the enterprise risk management matrix, which, as described below, is reviewed by the Audit Committee.

companyName: COMFORT SYSTEMS USA INC

ticker: FIX


text: Incident Response and Recovery Planning: Together with the MSP, we have established a written information security incident response plan that addresses the response to a cybersecurity incident, which is tested and evaluated on a regular basis.

companyName: CTO Realty Growth, Inc.

ticker: CTO


text: Together with the MSP, we engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The MSP regularly assesses our cybersecurity measures, including information security maturity, and regularly reviews our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and we will adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our Senior Vice President, Chief Financial Officer and Treasurer, Senior Vice President, General Counsel and Corporate Secretary, and Senior Vice President and Chief Accounting Officer work collaboratively with the MSP to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with a written information security incident response plan that we have adopted. These members of our management team, together with the MSP, monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and will report such threats and incidents to the Audit Committee when appropriate.


text: Our Senior Vice President, Chief Financial Officer and Treasurer, Senior Vice President, General Counsel and Corporate Secretary, and Senior Vice President and Chief Accounting Officer each hold degrees in their respective fields, and have approximately 20 years or more of experience managing risks at the Company and similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees and is regularly updated on management's design, implementation and enforcement of our cybersecurity risk management program. The Audit Committee is composed of board members with varied expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks.

companyName: SIMON PROPERTY GROUP L P


text: The Company's Chief Information Security Officer (" CISO ") is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Company's Chief Risk Officer ("CRO"), who oversees and supervises the risk function, including the information security, compliance, legal, operational (which includes business continuity, model risk, and third party risk functions) and enterprise risk areas. Our CISO has over 20 years of experience in information technology leadership, eight years of which is experience in leading information security oversight, and others on our information security team have various information security degrees and certifications within applicable disciplines. Our CISO receives reports from our information security team on a regular basis and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: SouthState Bank Corp

ticker: SSB


text: We have continued to expand investments in information security and cybersecurity, including providing additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging third-party cybersecurity experts. For example, in 2023, the Bank engaged a third-party cybersecurity consultant to conduct a review of the Company's information security and cybersecurity program in relation to overall threat trends and specific factors affecting the Bank's cyber risk profile, and in 2024, a third-party cybersecurity consultant reviewed the Company's vulnerability management program These reviews assisted management in enhancing the Company's cyber-risk reduction efforts, including updating Bank's cybersecurity strategy and program. The Company also maintains cybersecurity insurance provided by carriers that can provide additional technical, legal, and consultation services in the event of a security event that requires additional staff or expertise, including attorneys, forensic accountants, and public relations professionals, among others. In addition to assessing our own cybersecurity preparedness, we also identify, evaluate and manage cybersecurity risks associated with use of third-party vendors and service providers. Our third-party risk function conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. Our information security area regularly reviews third-party vendors and service providers, including their System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor or service provider is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess its cybersecurity preparedness and assess our relationship on that basis. The frequency and granularity of our review of third-party vendors and service providers is based on an assigned risk rating for each third-party vendor and service provider. Our assessment of risks associated with use of third-party vendors and service providers is part of our overall cybersecurity risk management framework.


text: The Board has ultimate oversight responsibility for the Company's risk management and recognizes the importance of protecting the data provided by the Company's customers and employees and devotes considerable time and attention to overseeing the strategies the Company employs to protect our data and systems and to mitigate against cybersecurity risk. A cybersecurity expert chairs the Risk Committee and provides technology-related insight and guidance to the Company. As part of the Risk Committee's responsibility for monitoring key business and regulatory risks, the Risk Committee receives from both our Chief Information Officer and CISO quarterly reports and materials which include a review of cybersecurity and information technology key risk indicators, test results and related remediation, and any recent cybersecurity threats or incidents and how the Company is managing those threats or incidents. The Risk Committee also periodically reviews reports on the threat environment, vulnerability assessments, results of penetration testing, and potential cybersecurity and data privacy incidents, as well as information on ongoing employee training relating to data privacy and cybersecurity and how to protect data against cyber threats. Further, on a quarterly basis, our CRO presents to the Risk Committee updates from our Director of Enterprise and Operational Management on the Company's business continuity program, which covers, among other things, outages and incidences and disaster recovery and business continuity testing. The Risk Committee also approves the annual risk assessment required by the Gramm-Leach-Bliley Act. Moreover, the CISO follows a risk-based escalation process to notify the Risk Committee outside of the cycle of regular updates when management has identified an emerging risk or material issue related to cybersecurity. The Risk Committee also reports material cybersecurity risks to the full Board, based on our CISO's assessment of risk. In addition, the Audit Committee reviews reports of the Company's internal audit department's periodic audits of our information security area and various components thereof.


text: We face a number of cybersecurity risks in connection with our business and we have, from time to time, experienced threats to and incidents involving our data and systems. For more information about the cybersecurity risks we face, see the risk factors captioned "We are subject to complex and evolving laws, regulations, rules, standards and contractual obligations regarding data privacy and cybersecurity, which could increase the cost of doing business, compliance risks and potential liability " and " We face cybersecurity risks from cyber-attacks, information security breaches and other similar incidents that could result in the disclosure of confidential and other information (including personal information), adversely affect our business or reputation, and create significant legal and financial exposure. " In Item 1A- Risk Factors.


text: We have strategically integrated cybersecurity risk management into our broader enterprise risk management function to promote a company-wide culture of cybersecurity risk management. Our board of directors has general oversight responsibility for our enterprise risk management function, which includes specific areas of focus including competitive, economic, operational, financial (accounting, credit, liquidity and tax), legal, compliance, information technology security programs (including cybersecurity), ESG/corporate social responsibility, political and reputational risks. Our board of directors has delegated oversight of certain of these areas to the committees of our board of directors, including delegating the oversight of our information technology security programs (including cybersecurity) to the risk committee of our board of directors (the " Risk Committee "). We believe this division of risk management-related roles to the committees of our board of directors fosters an atmosphere of significant involvement in the oversight of risk at the board level and complements our risk management policies. The oversight responsibility of our board of directors is facilitated by a management report process that is designed to provide both visibility and transparency to our board of directors about the identification, assessment and management of critical risks and management's risk mitigation strategies.

companyName: Ryman Hospitality Properties, Inc.

ticker: RHP


text: Our CIO and our Vice President of IT ("VP of IT") are primarily responsible for our overall information security, strategy, policy, security engineering, operations and cybersecurity threat detection and the management of cybersecurity risks. Our CIO and VP of IT, collectively, have over fifty years of experience working in the information technology and cybersecurity field and have extensive experience assessing and managing cybersecurity and information technology programs and cybersecurity risk. Our CIO and VP of IT hold degrees in the information technology and cybersecurity fields, as well as hold certain cybersecurity and other relevant technology certifications. The CIO meets with our Chief Executive Officer ("CEO"), on a weekly basis, and the CFO, on a monthly basis, to discuss all relevant business risks, including cybersecurity risks and threats. In addition to regular reports from our CIO and vice president of internal audit regarding our program for managing our information security risks, including data privacy and protection risks we face, the CIO and VP of IT also meet quarterly with the Risk Committee to inform them of current cybersecurity risks and threats, as well as cybersecurity enhancement projects. Our full board of directors receives an annual update regarding the current cybersecurity environment from our CIO, which may include presentations from external consultants. Our Enterprise Risk Management ("ERM") committee, which includes several members of senior management, including our CFO, our CIO, and a Certified Information Systems Auditor, also presents all of our top organizational and operational risks, including information security-related risks, focus areas and accomplishments throughout our various businesses, to the Risk Committee on a quarterly basis.


text: We promote a culture of cybersecurity compliance throughout our organization, including required monthly cybersecurity training for all employees with company accounts and annual training for service-related employees on cybersecurity related topics, including social engineering (e.g., phishing, vishing and smishing), ransomware, denial of service or information, and other security breach tactics. We conduct quarterly ERM discussions where top risk owners discuss how risks have changed and how such risks are being addressed with approaches designed to mitigate such risks. In addition to assessing our own cybersecurity preparedness and as part of our overall cybersecurity risk management framework, we also consider and evaluate cybersecurity risks associated with our use of third-party service providers. We perform a formal System and Organization Controls ("SOC") review process annually on our financially significant third-party service providers, which includes our internal assessment of complementary user entity controls. All other material third-party service providers undergo assessment as a contract is entered into or renewed to ensure cybersecurity alignment. Our internal audit group meets regularly with management team members of Marriott, our third-party hotel manager, to assess security applications compliance. We also regularly meet with management team members of Marriott to understand system upgrades, changes and associated risks with third-party managed applications. In addition, we generally require our third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations.


text: We currently maintain a cybersecurity insurance policy that provides coverage for security incidents and periodically meet with our insurer to discuss emerging trends in cybersecurity. We do not believe that any risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, notwithstanding the programs, policies and procedures described above, there can be no assurance that we or businesses with which we interact will not experience a cybersecurity incident that materially affects us in the future. For more information about the cybersecurity risks we face, see the risk factor entitled "Cybersecurity incidents, including the failure to protect the integrity or availability of IT systems or the security of confidential information, or the introduction of malware or ransomware, could harm our business." in Item 1A. Risk Factors of Part I of this Annual Report on Form 10-K.


text: Cybersecurity Risk Management and Strategy Due to our structure as a REIT, the cybersecurity program, processes, and strategy described in this section are limited to the corporate systems, service providers, and information services belonging to or supporting the REIT. In order to maintain REIT status, the Company does not operate or manage its hotels. We lease each of our hotels to the TRS Lessee or one of its subsidiaries, which engages with third-party eligible management companies to operate and manage all aspects of the properties; and those third-party managers, in turn, rely on systems that they manage directly or indirectly (through their own service providers), including but not limited to reservation systems, billing, building and property management systems, point-of-sale systems, and financial transactions and records that store and process proprietary or personal information. In light of this structure, we do not have actual or contractual access to the systems or information maintained by the third-party managers, and we must instead rely on such managers' programs and processes to protect the properties in which we invest from risks associated with cybersecurity threats.

companyName: Sunstone Hotel Investors, Inc.

ticker: SHO


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident.


text: Our program is informed by the International Standards Organization ("ISO") 27000, ISO 27001, and National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the ISO 27000, ISO 27001 and NIST CSF as guides to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: an information technology department principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: cybersecurity awareness training of our employees and senior management; and business continuity, contingency, and recovery plans, including a cybersecurity incident response plan with procedures for responding to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with, or effective in protecting our systems and information.


text: Our management team, including our chief financial officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel, our external information technology support, and our retained external cybersecurity consultants. Our information technology department has over 20 years of experience developing and implementing computer infrastructure, including cybersecurity and audit compliance. We seek to use the latest security technologies from leading vendors to help secure our network and to regularly monitor and assess alerts and threat levels. The information technology department possesses various industry certifications and continuously refreshes skills through relevant training.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from IT security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risks from cybersecurity threats or incidents (cybersecurity risks) are assessed, identified and managed by the Company in a manner that is consistent with leading cybersecurity frameworks, including the National Institute of Standards and Technology Cybersecurity Framework (NIST Framework). The Company's approach to cybersecurity risk management is generally based on the six core functions contained within the NIST Framework organizing structure: identify, protect, detect, respond, recover and govern.

companyName: RLI CORP

ticker: RLI


text: The IT security department is responsible for the day-to-day assessment and management of cybersecurity risks, including efforts to prevent and, if necessary, mitigate the effects of a cybersecurity incident. The Company's IT security department operates under general oversight of the Company's chief information officer (CIO), who also serves as the Company's chief information security officer (CISO). The Company's CIO has 27 years of technology and technology leadership experience, including 14 years serving as a CISO, in the insurance industry. The head of the Company's IT security department, who reports to the CIO, holds a Certified Information Systems Security Professional designation from the Information Security Certification Consortium, has 20 years of experience in the insurance industry and has served in IT security-related roles for 24 years.


text: Management oversight of cybersecurity risks is provided primarily through the Company's Technology Committee, which is chaired by the Company's CIO and comprised of members of senior management. The Technology Committee's responsibilities include general oversight of cybersecurity-related matters, maintenance of the cybersecurity and data privacy programs and oversight of the Company's cybersecurity incident response plan. Technology risk, including cybersecurity risk, is also integrated into the Company's enterprise risk management process. The Company's Risk Committee, chaired by the CEO and comprised of members of executive management, identifies the Company's material risks and reviews the strategies, processes and controls in place to facilitate the understanding, identification, prevention, measurement, reporting and mitigation of those risks. The Risk Committee meets quarterly and reviews the Technology Committee's current assessment of cybersecurity risks.


text: Through 2024, the RLI Corp. Board of Directors provided oversight for cybersecurity risks primarily through its Audit Committee. In February 2025, the charter of the Finance & Investments Committee was revised to include overall enterprise risk management oversight, including oversight of cybersecurity risk. The committee was renamed the Finance & Risk Committee (FRC). The Company's CIO, along with the head of the Company's IT security department, presents quarterly to the designated committee on cybersecurity risks and the Company's strategies to assess and manage those risks. Additionally, the board receives periodic updates on emerging cybersecurity issues and developments through director education provided by the Company and third-party experts, detailed reviews provided by the CIO and the Company's head of IT security on select cybersecurity topics, and periodic "table top" simulations of a cybersecurity event.


text: The Company maintains a Cybersecurity Incident Response Plan (CIRP) providing a framework for identifying, evaluating and escalating potential or actual cybersecurity events. The CIRP assigns responsibilities and provides a workflow between the Company's IT security department; the Company's Technology Committee; and the board of directors regarding the detection, assessment and response to a cybersecurity event.


text: The Company's internal audit department routinely engages third-party cybersecurity consultants to conduct network security audits. The Company also engages other third-party consultants in a number of areas to support the assessment, identification and management of cybersecurity risks, including risk assessments, log monitoring, threat intelligence, system penetration testing, training and incident response, among others. The Company performs cybersecurity due diligence and monitoring of third-party vendors, which may include the review of System and Organization Control (SOC) reports or the results of a security questionnaire, to identify the cybersecurity controls and protections maintained by a third party.


text: Our Board of Directors oversees our risk management process, including risks from cybersecurity threats. Our Board of Directors reviews strategic risk exposure, and members of our management are responsible for addressing the material risks we face on a day-to-day basis. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole as well as through our Audit Committee. Our Board and our Audit Committee receive updates annually and more frequently as deemed necessary from our management on cybersecurity.

companyName: GENCO SHIPPING & TRADING LTD

ticker: GNK


text: Our Chief Financial Officer, our Internal Audit Director and our external Information Technology department are primarily responsible to assess and manage material risks from cybersecurity threats and oversee key cybersecurity policies and processes. They are informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Chief Information Manager of our Information Technology department has 36 years of experience in the design, implementation, and support of information technology infrastructures with significant expertise in information technology forensics. He is assisted by two network engineers with 27 years of information technology experience with a focus on information technology forensics.


text: We conduct regular risk assessments to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. As part of our risk management process, we may engage third party experts to help identify and assess risks from cybersecurity threats. For example, an outside consulting firm conducts a National Institute of Standards and Technology and International Organization for Standardization based cybersecurity capability maturity assessment every two years, which is reviewed with our Chief Financial Officer. We also perform penetration tests, data recovery testing, security audits and risk assessments throughout the year. We hold quarterly online cybersecurity trainings for our employees. Our risk management process also encompasses cybersecurity risks associated with our use of third-party service providers. Following these risk assessments, we design, implement, and maintain safeguards intended to minimize the identified risks; address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards.


text: While we develop and maintain protocols, controls, and systems, that seek to prevent cybersecurity incidents from occurring, we must constantly monitor and update these protocols, controls, and systems in the face of sophisticated and rapidly evolving attempts to overcome them. The occurrence of cybersecurity incidents could cause a variety of material adverse impacts on our business, although no such incident has had any such impact to date. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this report, including the risk factor entitled "Security breaches and other disruptions to our information technology infrastructure could interfere with our operations and expose us to liability" and Item 1, "Business – Environmental and Other Regulations – Safety Management System Requirements" in this report.


text: In the ordinary course of our business, we collect, use, store, and transmit confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our IT systems is important to our operations and business strategy. We understand the growing challenges associated with cybersecurity threats and have established a strong cybersecurity program intended to continue to monitor and improve our cybersecurity posture.

companyName: Protagonist Therapeutics, Inc

ticker: PTGX


text: Risk Management Approach We have documented cybersecurity policies and standards, and we assess risks from cybersecurity threats and monitor information systems for potential cybersecurity issues. These processes are managed and monitored by a dedicated cybersecurity team, including third-party service providers, and led by our Head of IT, and include mechanisms, controls, technologies, systems, and other processes designed to help prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and help maintain a stable information technology environment. For example, we use processes, tools and external services to conduct regular vulnerability testing, penetration testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, CROs, and other contractors and suppliers.


text: We work to maintain a strong cybersecurity posture through a multi-layered approach. Our endpoint detection and response ("EDR") system helps monitor and analyze endpoint devices, and is designed to assist us in quickly identifying and responding to emerging threats. Complementing our EDR capabilities, our managed detection and response service assists with threat monitoring, proactive threat hunting, and rapid incident response. Furthermore, we employ data loss prevention tools to help enforce strict data security policies, prevent unauthorized access and protect the transmission of sensitive information. These integrated technologies help us to detect, mitigate, and respond to cyber threats, with the goal of minimizing potential disruptions to our business operations.


text: We have an incident response plan designed to help quickly detect, contain and remediate cybersecurity incidents. This plan outlines clear escalation procedures, roles and responsibilities to help us respond in a timely manner to potential threats. We also conduct regular employee training on matters such as phishing and email security best practices, among other topics. In addition, we consult with outside advisors and experts when appropriate to assist with assessing, identifying, and managing cybersecurity risks, including to help anticipate future threats and trends, and their impact on our risk environment.


text: Our current Head of IT reports directly to our Chief Financial Officer and has over twenty years of experience managing information technology and cybersecurity matters, holds a Master of Science degree in Telecommunications and Computer Networks and is Project Management Professional, Certified Scrum Master and IT Infrastructure Library certified. We have established a cybersecurity council, facilitated by the Head of IT, which includes senior leadership from various departments. The council meets quarterly to review cybersecurity strategies, assess emerging threats, and receive updates on regulatory and industry best practices.


text: Our Board as a whole has oversight for the most significant risks facing us and for our processes to help identify, prioritize, assess, manage, and mitigate those risks, including oversight of cybersecurity risks. Our Board receives at least two updates each year on cybersecurity and information technology matters and related risk exposures from our Head of IT as well as other members of our senior leadership team.


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have identified and mitigated certain known cybersecurity threats, which we determined are not reasonably likely to materially affect us and have strengthened our cybersecurity ecosystem. However, cybersecurity attack techniques change frequently, and with increased volume and sophistication of such attacks, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents that could materially affect us. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors - Significant disruptions of information technology systems or cybersecurity incidents could adversely affect our business."


text: Cybersecurity Governance and Oversight Our Cybersecurity Risk Mitigation Practices are managed on a day-to-day basis by members of our Information Security Steering Committee, or the Committee, and are overseen by our Board of Directors. The Committee is composed of senior management, including our Chief Information Officer and Chief Financial Officer, and senior vice presidents from various areas of the organization including IT, compliance, legal, operations and human resources, including the Vice President of Information Security and Compliance. The Vice President of Information Security and Compliance has over 40 years of IT experience and is a certified information systems security professional. The Chief Information Officer has over 10 years of experience managing cybersecurity, data protection, and incident management teams, and over 20 years of experience managing compliance and regulatory processes and controls.

companyName: PC CONNECTION INC

ticker: CNXN


text: As part of the administration of our Cybersecurity Risk Mitigation Practices, the Committee is tasked with managing and mitigating our exposure to cybersecurity threats, creating our cybersecurity policies, and establishing short and long-term cybersecurity goals and objectives that are designed to protect our information systems. The Committee is also responsible for planning ordinary course security projects and initiatives aimed at ensuring that our organizational leaders are informing our employees about our cybersecurity policies and about cybersecurity basic practices. On a periodic basis, the Committee meets to review the performance and effectiveness of our Cybersecurity Risk Mitigation Practices.


text: Members of the Committee will present the results of the periodic performance and effectiveness review to our Board of Directors, who oversee our risk management processes directly and through its committees. These results, along with other cybersecurity topics including updates on previously identified material cybersecurity threats or incidents, are presented at regularly scheduled meetings. Members of the Committee will also notify our Board of Directors between such meetings regarding significant new or updates to ongoing cybersecurity threats or incidents.


text: Cybersecurity is an integral part of risk management at our company. We have engaged a third-party cybersecurity firm along with our information technology director to monitor the cybersecurity risk facing our company and provide quarterly update to the Board of Directors (the "Board"). Cybersecurity is overseen by the Board and the Audit Committee of the Board (the "Audit Committee"). Pursuant to its charter, the Audit Committee has the responsibility and duty to review and discuss with management on a regular basis our company's programs, policies and procedures related to information security and data protection, including data privacy and network security, as they relate to financial reporting. The Board and the Audit Committee receive reports on cybersecurity from management at least quarterly and more often as needed. These reports on cybersecurity typically encompasses the nature and threats, defense and detection capabilities, and training activities at our company.

companyName: LTC PROPERTIES INC

ticker: LTC


text: We routinely provide education, such as simulated phishing campaigns, to our employees to mitigate material risks from cybersecurity threats. This education includes cybersecurity training for new employees and training modules sent monthly to all employees. We also use various authentication technologies and third-party monitoring to mitigate material risks from cybersecurity threats. We annually retain a third-party vendor to test our information systems security and we annually review information systems security protocols of our vendors that interact with our financial data. We maintain insurance coverage that may, subject to policy terms and conditions, including deductibles, cover particular aspects of cybersecurity risk, such as data breaches, ransomware, social engineering and computer system fraud. However, it is possible such coverage may not fully insure all future costs or losses associated with all types of cybersecurity incidents such as ransomware.


text: As of the date of this report, we are not aware of any known cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, as discussed under Part I, Item 1A. "Risk Factors, specifically the risks titled " Disruptions to our operational systems could adversely impact our operations, our ability to report financial results and our business" and "Security breaches, cyber security attacks or other disruptions to our information technology systems and networks could adversely impact our operations or compromise the confidentiality of private customer data or our own proprietary information, " the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner, which could materially affect us, including our business operations, results of operations or financial condition.

companyName: Primoris Services Corp

ticker: PRIM


text: Our employees are also an important part of protecting our digital and technical environment. A key area of the cybersecurity program is the education of employees regarding cybersecurity using security awareness training, security bulletins and phishing simulations to reinforce training on a quarterly basis. Security awareness training covers all network users. On an annual basis an Acceptable Use Policy ("AUP") is distributed to employees through our Security Awareness Training System for understanding and acknowledgement. Additionally, all new employees are provided the AUP through the Security Awareness System included with initial security training upon being granted access to our network. Additionally, all new employees are provided the AUP by Human Resources and receive initial security training upon being granted access to our network.


text: Risk Management Systems and Processes To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk management program is administered by the Company's legal and internal audit functions, and facilitates the process of identifying and assessing cybersecurity threat risks, as well as monitoring the effectiveness of our risk mitigation efforts. During the year, our senior management periodically identifies the cybersecurity risks facing the Company and reviews our mitigation plans related to these risks. These senior leaders conduct an evaluation of the severity of these identified risks and any changes to the risk level or the Company's mitigation efforts since the prior evaluation. The severity of risks is measured based upon the potential adverse impact that could result, the immediacy of the threat and the availability of mitigating factors, among other elements. Management may consult with outside consultants, such as legal counsel or cybersecurity advisors, in assessing risks and developing mitigation plans. The Audit Committee of the Board regularly receives reports from such outside experts in response to emerging or higher risk areas.

companyName: GLAUKOS Corp

ticker: GKOS


text: We also have specific cybersecurity risk assessment processes which help identify our cybersecurity threat risks, including a comparison of our processes to industry standards as well as periodic third-party assessments of our programs. We compare our Information Security Program with industry standards including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and ISO 27001. In order to enhance internal expertise, members of our Global Technology Systems (GTS) department maintain various cybersecurity-related certifications. We also maintain written incident response and security policies that seek to ensure we are protected and ready to respond should a security incident occur. Incidents are investigated and analyzed for potential impact. If any potential impact is determined to present, the appropriate departments, key employees, and executive management team members are notified as part of the incident response process. Our incident response plan coordinates the activities we would take to respond to and recover from cybersecurity incidents, which include processes to triage, assess severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate potential liability and reputational damage. If appropriate, incidents may be reported to senior management, the Audit Committee or the full Board.


text: require employees, as well as contractors who have access to our systems or the data of our employees or customers, to treat information as confidential; performed internal audits of our use of single sign-on and multifactor authentication for key information systems;


text: Threats from Third Party Service Providers Our processes also address cybersecurity threat risks associated with our use of third-party software and system providers. Third-party risks are included within our enterprise risk management assessment program, which is discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers.


text: We perform diligence on high-risk third-parties that provide us software or have access to our systems or highly sensitive information, and monitor cybersecurity threat risks identified through such diligence. New software is evaluated for risk and approved by our internal Software Approval Board before purchase or installation on our systems. We formed a Software Approval Board, which is made up of cross-functional members from Quality, Internal Audit, Information Security, Business Systems, and R&D, to help determine risk and impact of any potential newly proposed software. Additionally, we generally require those high risk third parties to agree by contract to manage their cybersecurity risks in specified ways. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: We are not aware of any material cybersecurity incidents that have occurred in the last three fiscal years, and the expenses we have incurred from cybersecurity incidents were immaterial, including penalties and settlements, of which there were none.


text: The Audit Committee of our Board is responsible for the oversight of risks from cybersecurity threats. At least twice a year, the Audit Committee receives a report from the head of Information Security of our cybersecurity threat risk management and mitigation strategy covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and potentially material cybersecurity threat risks or incidents, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives information describing current and emerging material cybersecurity threat risks, and describing the Company's plans to mitigate those risks, and discusses such matters with our head of GTS and other members of senior management. Potential material cybersecurity threat risks are also considered during separate Board discussions of important matters like enterprise risk management. Two members of our Board, including one member of the Audit Committee, have earned cybersecurity certifications to help them identify cybersecurity threats and oversee management's efforts to manage and mitigate them.


text: Management Oversight While the Audit Committee reviews and oversees the Company's information security efforts, senior leadership is responsible for the day-to-day management of cybersecurity risk and the design and implementation of policies, processes and procedures to identify and mitigate this risk. Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Legal department and our Internal Audit department, working with our GTS department. Members of this team include a Certified Information Systems Auditor (CISA), a Certified Information Security Manager (CISM), a Certified Data Privacy Solutions Engineer (CDPSE), Certified Information Systems Security Professionals (CISSP), as well as members of ISACA and ISC2 industry organizations. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: Index to Financial Statements We have integrated aspects of our cybersecurity risk management processes into our overall risk management program through, for example, common methodologies, reporting channels and governance processes that apply across the overall risk management program to other risk areas.

companyName: DIGITAL REALTY TRUST, INC.

ticker: DLR


text: Our cybersecurity risk management processes include, but are not limited to: independent maturity assessments designed to help identify significant cybersecurity risks to our IT environment and systems;


text: We have not identified risks from known cybersecurity threats as a result of any prior cybersecurity incidents that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face complex risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—We and our third-party providers are vulnerable to cyberattacks and security breaches that could materially disrupt or compromise our operations, data and results." There can be no assurance that our cybersecurity risk management processes, including our policies, controls or procedures, will be fully implemented as currently anticipated, complied with or effective in protecting our systems and information or in allowing us to recover from a cybersecurity incident.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, computer hardware and software, and our critical data, which includes proprietary, confidential and sensitive data, including, without limitation, personal data (such as health-related data), intellectual property and trade secrets, referred to collectively as Information Assets. Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business.

companyName: BICYCLE THERAPEUTICS PLC

ticker: BCYC


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor titled: Cyber-attacks, failures in or interruptions of, or other compromise of our information technology systems, or those of third parties with whom we work, or our data could result in adverse consequences that materially affect our business, including without limitation, regulatory investigations or actions, litigation, fines and penalties, information theft, data corruption, harm to our reputation and brand, significant disruption of our business operations and other adverse consequences.


text: Our cybersecurity risk management strategy relies on input from management, including our Vice President, Head of Computational & Structural Science, who reports directly to our Chief Technology Officer, and has over 10 years of experience in developing and implementing cybersecurity strategies for companies in the biopharmaceutical industry, as well as our Chief Financial Officer and Chief Legal Officer and General Counsel. We have also formed an Information Risk Assessment Committee, or IRAC, consisting of senior members of the finance, legal, operations and information technology functions, to oversee the management of information security as a whole, including integrating cybersecurity considerations into the company's overall risk management strategy, and for communicating key priorities to employees. The IRAC meets on a regular basis, generally quarterly, to discuss cybersecurity risk and to review our cybersecurity program.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our incident response team, which includes, but is not limited to, our Vice President, Head of Computational & Structural Science, Chief Legal Officer and General Counsel and Chief Financial Officer. In addition, our incident response processes include reporting to the Audit Committee of the board of directors for certain cybersecurity incidents.


text: Our board of directors oversees our risk management strategy with respect to cybersecurity threats. The board, through its Audit Committee, holds regular meetings, at least quarterly, to discuss issues including our cybersecurity threats. The meetings involve presentations and reports from our management, including our Vice President, Head of Computational & Structural Science, concerning our significant cybersecurity threats and risks and the processes we have implemented to address them.


text: In February 2024, we chartered the Information Systems, Data and Cybersecurity Governance Committee (the "Cybersecurity Committee"), which is comprised of the Company's business unit leaders and is responsible for the management of our cyber risk exposure and monitoring the effectiveness of the cybersecurity program. The Cybersecurity Committee reports the progress of cyber risk reduction initiatives to our senior leadership and the Audit Committee on a periodic basis.

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: Cyber Risk Exposure Our top cyber risks have been grouped into genericized categories to avoid disclosure of sensitive information but include sufficient detail for a reasonable investor to understand our cyber risks and maintain confidence we act in good faith to reduce our cyber risk exposure. In the fourth quarter of 2024, we performed a risk analysis of all critical assets, determining the following are our current top cyber risks, none of which are material: Compromise to the confidentiality of intellectual property. Compromise to the confidentiality and integrity of financial records. Compromise to the confidentiality of employee records. Compromise to the confidentiality, integrity, and availability of core business systems. Compromise to the confidentiality, integrity, and availability of critical third-party vendors supporting the continuity of business operations.


text: Cybersecurity Risk Management Program We recognize the importance of maintaining the integrity of our information technology systems and safeguarding the confidential business and personal information we receive and store about our employees, customers and suppliers. We have a cybersecurity risk management program in place to identify, assess, and manage risks from cybersecurity threats. Our cybersecurity risk management program is designed to employ industry best practices across our operations and business functions, including monitoring and analysis of the threat environment, vulnerability assessments, and third-party cybersecurity risks; detecting and responding to cyber attacks, cybersecurity incidents, and data breaches; cybersecurity crisis preparedness, incident response plans, and business continuity and disaster recovery capabilities; and investments in cybersecurity infrastructure and program needs. Among the key features of our program are:

companyName: TopBuild Corp

ticker: BLD


text: Strategic engagements of consulting firms and legal advisors to advise the Board and our executive officers regarding the structure and oversight of our cybersecurity risk management program, cyber strategy framework evolution, risk-based assessments, incident response services, and cyber technology;


text: Ongoing cybersecurity training for employees; and Periodic testing of incident response procedures. In addition to the third parties described above, we regularly engage consultants, advisors, service providers and other third parties to help test, develop and manage our cybersecurity risk management program.


text: Incident Response Procedures We have in place a cyber incident response plan outlining procedures to follow in the event of a cybersecurity incident. Under the plan, we established a cross-functional critical response team (CRT) with expertise in various subject matter areas responsible for initiating and leading our incident response procedures. The CRT is under the direction of our Chief Information Officer and is comprised of our Director of Information Technology, Chief Accounting Officer, Assistant General Counsel and Chief Compliance Officer, Senior Manager of Risk and Insurance, and certain other members of management. The plan provides that our CRT will conduct an impact assessment in the event of a cybersecurity incident meeting pre-established criteria, or which may otherwise impact the operations or finances of the Company. If any such cybersecurity incident is determined by the CRT to have the potential to materially impact the Company, such event would be elevated for further review and assessment by a senior leadership team consisting of our Chief Executive Officer, Chief Financial Officer, General Counsel and other members of our executive leadership team. Under certain circumstances, such review and assessment would include reporting to and oversight of the Board.


text: Our full Board is responsible for oversight of risks from cybersecurity threats, including our cybersecurity risk management program. In carrying out its oversight responsibilities, the Board receives regular cybersecurity program updates and quarterly scorecard assessments from our Chief Information Officer, which cover topics related to information security, privacy and cyber risks, and our risk management processes, including the status of any recent cybersecurity events meeting specified criteria, the emerging threat landscape, and the status of capital investments in our information security infrastructure.


text: At a management level, our cybersecurity risk management program is led by our Chief Information Officer, who reports to our Chief Executive Officer. Under our Chief Information Officer's leadership, the cybersecurity team implements and provides governance and functional oversight for cybersecurity controls and services. The team's credentials include Certified Chief Information Security Officer, Certified Information Security Manager and Certified Information Systems Security Professional.


text: To help identify, assess, and manage risks from cybersecurity threats, we have integrated cybersecurity risk management into our broader, Company-wide enterprise risk management (ERM) evaluation and strategy process, which is led by our executive officers, overseen by the Audit Committee of the Board, and reviewed annually by the full Board. Our ERM process takes a top-down, enterprise view of material risks impacting our Company, including credit, liquidity, strategy, cybersecurity, and operational risks, and is an ongoing process consisting of risk identification, risk rating, analysis and action plans, and reporting and monitoring. Employees responsible for assessing identified risks deliver an update quarterly to our senior leadership team, which consists of our Chief Executive Officer, Chief Financial Officer, Chief Information Officer, General Counsel, Chief Human Resources Officer, Chief Growth Officer, and Vice President of Supply Chain. Status updates with respect to these risk areas are delivered quarterly by management to the Audit Committee of the Board, and full risk assessment results are presented by management annually to the full Board.


text: Our risk management program is designed to identify, assess, manage, and mitigate risks across various aspects of our Company, including, but not limited to, financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats.

companyName: National Bank Holdings Corp

ticker: NBHC


text: The Company's cybersecurity risk management program consists of a layered cybersecurity approach and is organized pursuant to prevailing guidance such as the Federal Financial Institutions Examination Council, including its underlying handbooks and assessment tools, and incorporates guidance issued by the National Institute of Standards and Technology and the Cybersecurity Infrastructure and Security Agency. The Company's cybersecurity risk management program is designed to ensure the Company's data, information systems, networks and devices are appropriately protected from a variety of threats and that our third parties with access to the Company's data take similar precautions. Regular risk assessments are conducted to validate control requirements and ensure that the Company's information is protected at a level commensurate with its sensitivity and value. Preventative and detective security controls are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission to ensure the confidentiality, integrity, and availability of Company information. These controls include, but are not limited to, access control, data encryption, data loss prevention, incident response, security monitoring, third-party risk management, and vulnerability management.


text: The Company's cybersecurity risk management program and strategy are regularly assessed by consultants, regulatory authorities, and external auditors. The Company's Enterprise Risk Management department also plays a crucial role in monitoring the program by internally conducting regular cyber maturity assessments. Cybersecurity processes are adjusted as needed based on the information gathered from these internal and external assessments to ensure that the program is aligned with the Company's business objectives, is designed to address evolving cybersecurity threats, satisfies regulatory requirements, and conforms with industry standards.


text: The Company, through its Enterprise Risk Management, Enterprise Technology, and Internal Audit departments, actively maintains and monitors various systems, controls and surveillance measures that are intended to mitigate cybersecurity risks including:


text: Annual network and penetration testing by reputable third parties to evaluate the Company's suite of security controls and tools and identify potential vulnerabilities. Regular cybersecurity and information security awareness training for associates, supplemented with recurring social engineering tests. Conducting regular cyber maturity assessments to ensure the Company is prepared to manage and respond to cybersecurity threats.


text: Recurring audit and oversight of all critical third parties within the Company's digital ecosystem to identify risks and adverse trends and monitor their compliance with our cybersecurity requirements. Use of external subject matter experts to provide threat intelligence and updates on trends and emerging schemes.


text: Carrying out regular trainings and tests, including phishing simulation tests, to ensure the Company's associates remain vigilant with regards to cybersecurity threats.


text: Annual testing from a business continuity perspective, including annual business impact analysis reviews, annual testing of all critical departments, systems and third parties, and established back-up, replication, and restoration to help ensure continuity of operations.


text: Our internal systems, processes, and controls are designed to mitigate loss from cyberattacks and, if necessary, remediate any potential damage. While we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected the Company's business, financial condition, and results of operations. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it will not be able to anticipate all cybersecurity breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A Risk Factors.


text: The Company's Board of Directors is charged with overseeing the establishment and execution of the Company's Risk Management program and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Consistent with this responsibility, the Board has delegated primary oversight responsibility over the Company's risk management program, including oversight of cybersecurity risk management, to the Audit & Risk Committee of the Board.


text: The Company's Chief Risk Management Officer reports directly to the CEO and chairs the Company's management-level Enterprise Risk Management Committee, through which the Company's executive team manages and oversees the Company's entire risk management program, including cybersecurity risk management. In addition, the Company's Chief Information Security Officer ("CISO") reports directly to the Chief Risk Management Officer and works in tandem with the Company's Enterprise Technology Department. The Enterprise Technology department is responsible for the Company's information systems and for building and maintaining cybersecurity defenses within the Company's technology systems. The Company's Chief Technology Officer ("CTO") reports directly to the CEO and leads the Enterprise Technology Department. Collectively, the Enterprise Technology and Enterprise Risk Management Departments work together to oversee the day-to-day management and implementation of the Company's cybersecurity risk management program.


text: The Company's Internal Audit Department, including third parties engaged by Internal Audit, evaluate the overall effectiveness of the Bank's cybersecurity risk management strategy which is reported to the Audit & Risk Committee of the Board. In addition, the Enterprise Technology and Enterprise Risk Management Departments provide reports to the Audit & Risk Committee of the Board discussing items such as the Departments' efforts to prevent, detect, mitigate, and potentially remediate cybersecurity risks, cybersecurity status updates, and current cybersecurity trends in the banking industry. Finally, the Company's Board participates in training at least annually on the Directors' role in managing cybersecurity risks.


text: The Company's CISO has over 15 years of prior work experience, which includes managing information security and operational risk, developing cybersecurity strategy and incident responses, implementing effective information and cybersecurity programs, preventing fraud and social engineering, and ensuring business continuity and proper third party management. The Company's CTO has over 25 years of prior work experience in cybersecurity and data center management and design, 16 years of which has been devoted to the financial and banking sectors. The Enterprise Technology Department is comprised of a team of subject matter experts in security operations, network architecture, cyber and information security governance and cybersecurity/network operations.


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: risk metrics and self-assessments designed to help identify cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;

companyName: Walker & Dunlop, Inc.

ticker: WD


text: a Cybersecurity & Technology Risk Committee, comprised of technology and business leaders, that provides risk advisory and general guidance regarding new and modified information security controls;


text: The Audit and Risk Committee receives quarterly reports from our Chief Information Security Officer ("CISO") and our Chief Information Officer on our cybersecurity risks and meets in executive session with our CISO following such reports. In addition, management updates the Audit and Risk Committee, as necessary, regarding significant cybersecurity incidents. The Audit and Risk Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: In 2024, we created a new position for a full time Chief Risk Officer. Our Chief Risk Officer has primary responsibility for our enterprise risk management program and works with our CISO in the oversight of our cybersecurity risk management program.


text: Our management team, including our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. Our information technology risk committee is comprised of senior managers in our information technology, loan origination, loan servicing, accounting, and legal groups that meet monthly to review information security risks and the development and implementation of policies and procedures and other controls to mitigate cybersecurity and other information security risks. Our CISO provides a report to our management risk committee on the activities of the information technology risk committee, which committee, in turn, reports regularly to the full Board on its activities.


text: The CISO manages a team of employees, which has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained managed service providers. The CISO brings over 30 years of technology, cybersecurity, and risk management experience from the finance and healthcare industries. His work experience includes the design, implementation, and oversight of control and governance frameworks in complex, hybrid-cloud, and data intensive environments operating in highly regulated entities in the financial services and healthcare insurance industries.


text: Our information security management team is informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including managed service providers engaged by us, and alerts and reports produced by security tools deployed in our information technology environment.


text: Cybersecurity Governance. Our chief information officer, who leads our IT department, oversees our cybersecurity program. Our chief information officer has twenty-nine years of IT experience. Our chief information officer reports to our chief financial officer. As part of our company's risk management function, our chief information officer provides periodic updates about our cybersecurity risk profile to our executive leadership team. We have an incident response program that provides for the prompt escalation of certain cybersecurity incidents to certain members of management, including our chief financial officer and our general counsel, so that decisions regarding disclosure and reporting of such incidents can be made in a timely manner.

companyName: B&G Foods, Inc.

ticker: BGS


text: Despite our ongoing efforts to continuously improve our ability to prevent and minimize the impact of future cyber incidents, we cannot assure you that we or any third party with whom we do business will not be the subject of future threats or incidents. While the February 2023 cyberattack and our remediation efforts did not have, and other cyberattacks experienced by third parties with whom we do business have not had, a material adverse impact on our consolidated financial position, results of operations or liquidity, we cannot assure you that in response to a future cyberattack we or any third party with whom we do business will be able to restore our respective systems so quickly and with minimal disruption to our or their business operations and without our incurring material costs or loss of net sales. In addition, the mishandling or inappropriate disclosure of non public sensitive or protected information could also lead to the loss of intellectual property, negatively impact planned corporate transactions or damage our reputation and brand image. Misuse, leakage or falsification of legally protected information could also result in a violation of data privacy laws and regulations and have a negative impact on our reputation, business, financial condition and results of operations.


text: At UFP Industries, we recognize the importance of managing cybersecurity risks to protect our operations, data, and stakeholders. Our program is aligned with industry-recognized frameworks, including the NIST Cybersecurity Framework and CIS Top 18 Security Controls. We employ a structured approach to identify, assess, and manage potential threats, ensuring our defenses are proactive and multi-layered. Regular reviews and third-party assessments help us adapt to evolving risks, while our incident response plan and business continuity strategies are designed to minimize any operational impact from cybersecurity incidents. Risk Management and Strategy.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: Risks from Cybersecurity Threats. Information relating to risks from cybersecurity threats is included in this report in Item 1A under the caption " Cybersecurity breaches or other failures in our information technology systems could disrupt our business." Our cybersecurity risk management program is designed to evaluate material threats and vulnerabilities throughout the organization and their potential impact on our operations, data, and stakeholders. Our program is reviewed and updated regularly to address emerging risks, following the NIST Cybersecurity Framework, NIST Risk Management Framework, and CIS Top 18 Security Controls.


text: Identify We assess our critical operational assets and those that may attract threat actors, identifying any cyber activities that could diminish asset value, hinder operational capabilities, or covertly grant access to threat actors.


text: Assess We evaluate the exposure of our assets to identified cyber risks and determine the potential operational or reputational impact if access or utilization is compromised. This assessment includes determining the materiality of these risks based on their potential impact.


text: Manage We have implemented a multi-layered defense strategy designed to secure asset access and prevent unauthorized access. We prioritize our defenses based on cost-effectiveness and risk reduction potential, using administrative, procedural, and technical controls.


text: To improve our cybersecurity posture, we regularly engage third-party consultants for penetration testing, risk assessments, and control audits. We also monitor third-party service providers, particularly those with access to sensitive data, through contractual and oversight mechanisms designed to mitigate and monitor risks continuously.


text: We work proactively to prevent, detect, and minimize the impact of cybersecurity incidents through a structured incident response plan. This plan is tested and reviewed regularly with simulated incidents. We maintain business continuity, contingency, and recovery plans designed to maintain resilience during incidents. Lessons learned from past incidents are integrated into our governance, policies, and technology to strengthen our defenses.


text: As of this filing, we have not experienced any cybersecurity breach that has materially impacted our business or financial condition, nor have we identified any risks from cybersecurity threats that have materially impacted or are reasonably likely to materially impact us, including our business strategy, results of operations, or financial condition. However, we recognize that our operations involve the collection, transmission, and storage of sensitive data, which may expose us to cybersecurity threats, including unauthorized access and cyberattacks. We remain committed to identifying and managing these risks as part of our business strategy and operations. Board of Directors and Management Governance.


text: Management's Role. Primary responsibility for risk management, including cybersecurity risks, lies with management. Our management team actively assesses and manages material cybersecurity risks through a structured framework. The CIO and Director of Cybersecurity lead our efforts in managing these risks:


text: CIO. With over 20 years of experience in the information technology space, the CIO brings expertise and strategic insight to cybersecurity, compliance, enterprise architecture, systems resilience, and digital transformation to UFP Industries.


text: Director of Cybersecurity. With over 30 years of experience in the information technology space, including systems architecture, management, and cybersecurity risk management, the Director reports directly to the CIO and is responsible for day-to-day cybersecurity operations.


text: Our cross-functional cybersecurity team, composed of experts with decades of combined experience, supports the CIO and Director in implementing our cybersecurity program. This team consults with legal, HR, and IT specialists to assess the materiality of cybersecurity risks and incidents, using a well-established Incident Response Plan that includes clear escalation measures.


text: Board of Directors Oversight. The role of the Board of Directors with respect to our cybersecurity program is one of oversight of management, and the Board has delegated primary oversight authority over the program to the Audit Committee. The Audit Committee oversees these risks as outlined in its Charter, which mandates reviewing the company's information technology framework, practices, and implemented controls to monitor and mitigate IT risks.


text: The Audit Committee meets quarterly and receives reports and briefings from the CIO, Director of Cybersecurity, and the cybersecurity team on emerging threats, risk status, and mitigation strategies. The Committee engages with the cybersecurity team to increase their understanding of the specific issues facing the Company and to challenge the team as appropriate. The Committee also may consult external cybersecurity experts as needed to fulfill its oversight role. The Audit Committee regularly reports to the Board on matters addressed during the Committee's quarterly meetings, including any material cybersecurity risks or developments. Processes for Monitoring and Mitigating Cybersecurity Risks and Incidents. Regular network and system monitoring for potential threats. Regular vulnerability assessments and penetration testing. Implementation of technical controls such as firewalls, intrusion detection systems, and encryption. Employee training and awareness programs. Incident response plans designed for swift and effective mitigation. Software and vendor risk assessments. Vulnerability management solutions prioritizing patching based on risk. Privileged account management solutions for administrative access.


text: These measures aim to prevent, detect, and respond to cybersecurity incidents effectively. They are regularly reviewed and updated to adapt to evolving threats.


text: In the event of an incident, our Incident Response Plan, which takes into account the perceived materiality of the incident with an appropriate escalation matrix, guides our response. Incident reports are compiled, reviewed by management, and shared with the CIO, CFO, the Audit Committee, and other key leaders, as appropriate, for resource allocation and risk mitigation planning.


text: Our cybersecurity governance committee led by our management team and our CIO with 16 years of experience in cybersecurity and a CISSP certification, bears the primary responsibility for assessing and managing material cybersecurity risks. Regular meetings are held to review security performance metrics, identify security risks, assess the status of security enhancements, and make recommendations on security policies, procedures, service requirements, and risk mitigation strategies.

companyName: ICAHN ENTERPRISES L.P.

ticker: IEP


text: We have an enterprise-wide information security program designed to identify, protect against, detect, respond to and recover from cybersecurity risks, threats and events. Our cyber risk management system contributes significantly to the overall resilience and integrity of our business by, among other things, integrating the risk identification process in all major company initiatives and deployment processes, implementing a unified approach to managing both digital and traditional business risks, making continuous improvements and regularly reporting to management and the Board of Directors as a whole to ensure accountability.

companyName: EchoStar CORP

ticker: SATS


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We and certain third parties conduct regular reviews and tests of our information security program and also leverage, among other things, audits, tabletop exercises, penetration and vulnerability testing, cybersecurity maturity assessments, simulations and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. In addition, we evaluate third-party risks and perform third-party risk management to assess, identify and mitigate risks from third parties such as vendors, suppliers and other business partners.


text: We have experienced cyber-attacks or other malicious activities that disrupted our business in the past. Any future failure or disruption of our information technology infrastructure and communications systems or those of third parties that we use in our operations could harm our business in the future.


text: The Chief Information Security Officer (" CISO ") leads our information security organization responsible for overseeing our information security program. Our CISO has over 25 years of experience in various roles involving information security, including risk management and security leadership. Team members who support our information security program have relevant education, professional certifications and industry experience, including but not limited to, holding similar positions at large technology companies. The team provides regular reports, no less frequently than monthly, to senior management and other relevant teams, including, but not limited to, the Chief Executive Officer ("CEO"), Chief Operating Officer ("COO"), Chief Information Officer ("CIO") and Chief Legal Officer ("CLO").


text: We anticipate that we will continue to evaluate and address as needed our cybersecurity risk management, policies, structure, strategies and governance to meet our needs.


text: Cyber Risk Management and Strategy We have processes for assessing, identifying and managing cybersecurity risks, which are informed by industry standards and built into our overall enterprise risk management f unction and are designed to help protect our information assets and operations from internal and external cyber threats, and to protect employee, collaborator and patient information from unauthorized access or attack.

companyName: Scholar Rock Holding Corp

ticker: SRRK


text: We maintain a team of internal and external information technology specialists who are responsible for the design, implementation, and operation of our information technology ecosystem and cybersecurity governance processes. We engage with certain external parties, including consultants, computer security firms and risk management advisors, peer companies, and industry groups in an effort to enhance our cybersecurity oversight and risk management strategy. We also use security technologies, including third-party solutions and monitoring tools that are designed to identify and mitigate cybersecurity risks. Further, we regularly engage third parties to conduct penetration testing, security assessments and tabletop exercises. We also engage a virtual chief information security officer ("vCISO") to support and advise on our cybersecurity program. We have a process to consider the internal risk oversight programs of critical third-party service providers, including through security questionnaires and contractual requirements, as appropriate. In addition, in an effort to deter and detect cyber threats, we have implemented an annual training program to provide employees with data protection, cybersecurity and incident response and prevention training.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents. For more information, please see the section entitled "Risk Factors."


text: Governance Related to Cybersecurity Risks The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management, including from our Vice President, Information Technology (the "VP of IT"), regarding cybersecurity matters, such as relevant cybersecurity risk assessments, as applicable. We have established a process for the Audit Committee to be notified in the event of significant cybersecurity threats or incidents.


text: The VP of IT leads the operational oversight of company-wide cybersecurity strategy, policies, processes, and support staff. Additionally, the VP of IT works across all relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The VP of IT reports and provides regular updates to the Chief Operations Officer and Chief Financial Officer on the cybersecurity program as well as periodic updates to executive management, as needed. Our VP of IT has worked in the information technology field for over 20 years at biotechnology companies including publicly-traded organizations.


text: Social Engineering: Social engineering tactics involve manipulating individuals into divulging confidential information or performing actions that compromise security, often through psychological manipulation or deception. International Seaways, Inc.

companyName: International Seaways, Inc.

ticker: INSW


text: Data Breaches: Unauthorized access to sensitive data, such as business strategy, financial records, or operational data, can lead to financial loss, legal repercussions, and damage to the organization's reputation.


text: End Point Security: We allow access to all information assets only from authorized and standard devices ("endpoints"). All endpoints have a next-generation anti-virus tool installed that uses a combination of artificial intelligence, behavioral detection, and machine learning algorithms to anticipate and prevent known and unknown threats. All endpoints also have an extended detection and response ("XDR") tool installed that provides a proactive approach to threat detection and response by collecting and correlating data across multiple security layers. Alerts from all these tools are actively monitored and appropriate alerts/escalations are issued.


text: See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for more information on our cybersecurity-related risks. International Seaways, Inc.


text: Board of Directors The Corporate Governance and Risk Assessment Committee (the " Governance Committee ") of the Board of Directors is primarily responsible for the oversight of risks from cybersecurity threats. To fulfill this responsibility, the Governance Committee receives regular updates, at least quarterly about the Company's cybersecurity risks and mitigation program from management, specifically the CISO. The Chairman of the Governance Committee provides quarterly reports of such updates to the full Board of Directors. The CISO's quarterly report to the Governance Committee contains updates to the cybersecurity risk register, summaries of any material cybersecurity threats or incidents and responses thereto, updates on cybersecurity trends and the results of any assessments performed. The quarterly reports also include changes to cybersecurity processes, products and third-party service providers, third-party cybersecurity risk reviews, and regulatory changes.


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business are identified and addressed through a multi-faceted approach that consists of third-party assessments, testing of our information systems and information technology security. To defend against, detect and respond to cybersecurity incidents, we, among other things: have enabled regular monitoring of our environment by a combination of external partners and internal security tools, conduct regular employee trainings, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.

companyName: uniQure N.V.

ticker: QURE


text: Consistent with our cybersecurity risk management policies and controls, we have prepared and implemented an incident response plan with several components, including: (i) engagement of a third party security operations center for regular vulnerability scanning and technical monitoring of our systems, (ii) detection and analysis of cybersecurity incidents that present risk of unauthorized access to company assets, including the escalation and triaging of incidents that present acute risks to our business, (iii) containment, eradication and data recovery, and (iv) post-incident analysis. Such incident responses are overseen by leaders from our information technology, finance, legal and compliance teams.


text: Trinseo's business and production operations rely on secure access, processing, storage, and transmission of company confidential and personal identifiable information within various technology platforms. The Company has processes in place to monitor, identify, assess and respond to material risks from cybersecurity threats. We maintain a cyber risk management program to identify, protect, detect, respond and recover from cyber threats and incidents. Our cybersecurity risk management and internal controls programs are aligned to ISO 27001 Standards and the National Institute of Standards and Technology (NIST) framework.

companyName: Trinseo PLC

ticker: TSEOF


text: Our cybersecurity program is managed by a dedicated Chief Information Security Officer ("CISO"). Our CISO has formal education in information technology and extensive cybersecurity program management experience with over three decades of diverse experience in the chemicals and manufacturing industries and maintains various information security certifications. Our CISO is accountable for the enterprise-wide cybersecurity strategy for both information technology (IT) and operations technology (OT), including significant third-party risks. The cybersecurity team, led by our CISO, is responsible for policies, standards, architecture, tools, training and processes to keep Trinseo secure. Our CISO provides regular updates to our Digital Steering or Cybersecurity Steering management committees.


text: Our Board of Directors has ultimate oversight of cybersecurity risk and our CISO provides periodic reports and updates concerning our cybersecurity program to the Board, as well as our Chief Executive Officer and other members of our senior management, as appropriate. Cybersecurity reports to the Board generally occur at least annually, with updates as deemed necessary by our CISO or, senior management. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information network and data security, assessments of the information security program, and the emerging threat landscape.


text: The Audit Committee is responsible for oversight of the Company's Incident Response Plan, including evaluation of material incidents, response and other related actions, and SEC reporting obligations, which is reviewed at least annually, or as circumstances warrant.


text: We engage third-party advisory firms to conduct assessments of the maturity of our security program and, among other measures, work to be Payment Card Industry compliant where required. We also maintain incident response procedures and business continuity and contingency plans and periodically hire third parties to conduct vulnerability analyses. We also compare our processes to standards set by the National Institute of Standards and Technology and/or International Organization for Standardization, as appropriate.

companyName: Norwegian Cruise Line Holdings Ltd.

ticker: NCLH


text: The Technology, Environmental, Safety and Security Committee of our Board of Directors oversees our programs and policies related to data protection and cybersecurity and receives updates on related risks from our Chief Information Security Officer on at least an annual basis, and more often as the circumstances require. The Audit Committee of our Board of Directors also receives updates, at least annually, from our Chief Information Officer and/or Chief Information Security Officer regarding cybersecurity and other information system compliance matters that may pose risks to our financial reporting or operations.


text: The Technology, Environmental, Safety and Security Committee of NCLH's Board of Directors oversees our programs and policies related to data protection and cybersecurity and receives updates on related risks from our Chief Information Security Officer on at least an annual basis, and more often as the circumstances require. The Audit Committee of our Board of Directors also receives updates, at least annually, from our Chief Information Officer and/or Chief Information Security Officer regarding cybersecurity and other information system compliance matters that may pose risks to our financial reporting or operations.

companyName: NCL CORP Ltd.