text: Oversee Third-Party Risk Risk assessments are conducted when we onboard new services and new vendors, including third-party vendors, applications, and other technology services, when there are significant changes to IT or security architecture, and when systems handle sensitive data. Third-party risks are documented as part of a risk management process that follows an industry standard framework with a goal of remediation or mitigation.


text: Cybersecurity Threat Risks We have not experienced a cybersecurity incident or data breach that has had a material impact on our operations or financial standing.

companyName: SERVICE CORP INTERNATIONAL

ticker: SCI

secItem: Item 1C


text: The Board of Directors recognizes that an encompassing, effective cybersecurity risk management strategy is essential to sustaining business operations and investor confidence. Our management assumes executive responsibility for assessing, identifying, and managing cybersecurity risks and incidents.


text: Board of Directors Oversight Certain members of the Board of Directors have experience conducting oversight of cybersecurity risk management across different industries, including technology and finance. The Audit Committee is the primary committee responsible for overseeing the company's cybersecurity risks with the Board receiving updates on at least an annual basis.


text: Management's Role in Managing Cybersecurity Risk The Assistant Vice President, Information Technology Security reports to the Vice President of Information Technology and is responsible for briefing the Audit Committee on information security risks. The AVP, IT Security provides comprehensive briefings to the Audit Committee on a regular basis. These briefings highlight various cybersecurity topics, including new cybersecurity threats, incidents, risks, risk management solutions, strategy pivots, or proposed governance changes. The Audit Committee actively participates in cybersecurity-related business decisions.


text: Risk Management Expertise With over 22 years of experience working on information technology and cybersecurity teams, the AVP, IT Security is the lead architect of the company's security infrastructure. In his role, the AVP, IT Security has built and developed effective and lasting information security solutions, establishing a robust framework of technical, administrative and physical controls while providing stakeholders such as executive management, operations leadership and legal counsel clear and constant visibility into rapidly evolving business threats. The AVP, IT Security is responsible for detecting known and potential cybersecurity incidents, leading cybersecurity incident investigations, and ensuring that cybersecurity incidents are reported timely, promptly escalated and resolved in accordance with the Company cybersecurity incident response plan. The AVP, IT Security is a Certified Information Security Manager (CISM) and his cybersecurity expertise is a valuable resource for Company executive leadership and the Board.


text: Monitoring Cybersecurity Incidents The AVP, IT Security manages the information security program responsible for the regular monitoring of our information systems for cybersecurity risks. The monitoring process is led by an experienced team of information security professionals. Advanced security software preemptively detects threats and regular system scans are conducted to identify potential vulnerabilities. The AVP, IT Security regularly receives updates about potential cybersecurity threats and remains informed about the latest threat detection software technologies and new risk management solutions. In the event of a cybersecurity incident, the AVP, IT Security is supported by the cyber security incident response team and the crisis response team. The cyber security incident response plan guides the AVP, IT Security and includes immediate actions to escalate an incident based on its seriousness, to mitigate the impact, and to enact long-term strategies for remediation and prevention of future incidents.


text: Reporting Cybersecurity Risk The AVP, IT Security is responsible for informing executive management of cybersecurity risks and incidents. The AVP, IT Security presents quarterly briefings to the Cyber Security and Data Governance Executive Steering Committee on all issues related to cybersecurity risks and incidents. The Cyber Security and Data Governance Executive Steering Committee includes members from the senior leadership team, such as the Chief Operating Officer, the Senior Vice President of Operations Services and the General Counsel. Our highest levels of management are actively aware and involved in shaping the company's cybersecurity position and analyzing potential risks. Any cybersecurity incident or data breach that is determined to be material will be reported to the Audit Committee and the Board of Directors.


text: Managing Material Risks & Integrated Overall Risk Management Cybersecurity risk management is integrated into our broader enterprise risk management system, and cybersecurity risk is strategically reviewed, monitored and managed alongside other enterprise risks on a regular basis. Our information security program is designed to evaluate, identify, and manage risks from cybersecurity threats and vulnerabilities, including malware, phishing, hacking, social engineering, data breaches, and emerging risks associated with artificial intelligence. Our program is regularly assessed using the NIST Cybersecurity Framework, and mandatory information security training is provided to our employees. Our information security team is empowered to assess and address cybersecurity risks in close collaboration with the operational teams. This forward-thinking strategy ensures that cybersecurity risk management awareness informs each stage of the business decision-making process.


text: Management's Role in Managing Cybersecurity Risk The Assistant Vice President, Information Technology Security, who also functions as the company's data protection officer, reports to the Vice President of Information Technology and is responsible for briefing the Audit Committee on information security risks. The AVP, IT Security provides comprehensive briefings to the Audit Committee on a quarterly basis. These briefings highlight various cybersecurity topics, including new cybersecurity threats, incidents, risks, risk management solutions, strategy pivots, or proposed governance changes.


text: Risk Management Expertise With over 23 years of experience working on information technology and cybersecurity teams, the AVP, IT Security is the lead architect of the company's security infrastructure. In his role, the AVP, IT Security has built and developed effective and lasting information security solutions, establishing a robust framework of technical, administrative and physical controls while providing stakeholders such as executive management, operations leadership and legal counsel clear and constant visibility into rapidly evolving business threats. The AVP, IT Security is responsible for detecting known and potential cybersecurity incidents, leading cybersecurity incident investigations, and ensuring that cybersecurity incidents are reported timely, promptly escalated and resolved in accordance with the Company cybersecurity incident response plan. The AVP, IT Security is a Certified Information Security Manager and his cybersecurity expertise is a valuable resource for Company executive leadership and the Board.


text: Risk Management and Strategy Our business operations depend on the availability, integrity and secure processing, storage, and transmission of confidential and sensitive information, digitally and through interconnected systems, including those of our vendors, service providers and other third parties on which we rely. Consequently, we maintain a formal data protection program, including physical, technical and administrative safeguards, to prevent and mitigate the risks posed by cybersecurity threats and incidents and to identify, analyze, address, mitigate and remediate those incidents that do occur. As part of our program: • we regularly review and update at least annually our standard policies and procedures related to information technology and analyze those policies against the standards and controls that we believe are most relevant to our Company set by organizations such as the National Institute of Standards and Technology (NIST) cybersecurity framework and the International Organization for Standardization (ISO); • we maintain a dedicated cybersecurity team under the direction of our Chief Information Officer (CIO), who has expertise related to data and network security, data governance and risk management; • we regularly test our internal IT controls; • we regularly conduct internal vulnerability assessments as well as third-party penetration tests; • we maintain, and we require our third-party service providers to maintain, security controls designed to ensure the confidentiality, integrity, and availability of our information systems and the confidential and sensitive information we maintain and process, or which is processed on our behalf; • all employees are required to complete periodic trainings that cover security and privacy best practices and company policies; and • we have prepared and regularly review and test our business continuity, disaster recovery and other back-up plans, including as they relate to cybersecurity incidents.

companyName: MUELLER INDUSTRIES INC

ticker: MLI


text: In connection with the design, implementation and testing of our cybersecurity program, we also work, as appropriate, with our accountants, independent assessors, legal counsel and other consultants.


text: We have an incident reporting and escalation process that we believe to be effective in detecting and analyzing cyber incidents as they occur to determine appropriate response action and reporting, including the materiality of any such incidents to our financial condition and operations. This process includes: • continual monitoring of our systems and logs by both internal and outsourced staff; • immediate escalation to and review by our CIO of certain signals, including evidence of external threat actors, ransomware attacks, data exfiltration, identity compromise or unusual requests from management or certain departments; • if deemed appropriate, reporting by our CIO to the Company's senior leadership, which based on the circumstances, may include executive officers and representatives of our accounting, human resources, finance, information technology and legal functions, and consultation with internal and external legal counsel, for further review and determination of the scope and materiality of the incident or incidents, including whether public disclosure is appropriate or required; and • informing our Board of Directors (the "Board") of significant or material cybersecurity incidents, as appropriate.


text: While we, our clients and our vendors are regularly exposed to malicious technology-related events and threats, none of these threats or incidents, either individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this report. In determining materiality, cybersecurity incidents are reviewed not only for potential financial impacts, which could include potential legal and regulatory penalties, stolen assets or funds, system damage, forensic and remediation costs, lost client revenue or litigation costs, but also the breadth and sensitivity of data exposure, data exfiltration, impacts on the ability to operate our business or provide our services, client dissatisfaction, and loss of investor confidence.


text: Our Board actively oversees our risk management activities both directly and through its committees and considers various risk topics throughout the year, including cybersecurity and information security risk management and controls. As part of its oversight function, the Audit Committee of the Board oversees the Company's risk assessment and risk management policies, including related to cybersecurity and the data protection program, and performs an annual review and assessment of the primary operational and regulatory risks facing the Company, their relative magnitude and management's plan for mitigating these risks. At least annually, our CIO reports to the Audit Committee with a comprehensive report addressing a broad range of topics, including significant cybersecurity incidents that have occurred since the last update, the status of projects and initiatives to update our cybersecurity policies and practices, and ongoing efforts to prevent, detect, and respond to internal and external critical threats.


text: Our senior management is responsible for assessing and managing the Company's various exposures to risk, including those related to cybersecurity, on a day-to-day basis, including the identification of risks through a robust enterprise risk management framework and the creation of appropriate risk management programs and policies to address such risks. Our CIO has primary responsibility for managing our cybersecurity program and efforts. Our internal audit team is responsible for the testing and audit of our information-technology internal controls.


text: We believe our information technology team to be well-qualified in this area. These qualifications include professional experience in the field and recent participation in IT and cybersecurity programs organized by leading institutions with expertise in the field.


text: While we, our customers and our vendors are regularly exposed to malicious technology-related events and threats, none of these threats or incidents, either individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this report. In determining materiality, cybersecurity incidents are reviewed not only for potential financial impacts, which could include potential legal and regulatory penalties, stolen assets or funds, system damage, forensic and remediation costs, lost customer revenue or litigation costs, but also the breadth and sensitivity of data exposure, data exfiltration, impacts on the ability to operate our business or provide our services, customer dissatisfaction, and loss of investor confidence.


text: We maintain a cybersecurity program that is aligned with our business and focused on managing risks to our Company. As described below, we have established policies, standards, processes and practices for assessing, identifying and managing material risks from cybersecurity threats, which are integrated into our overall risk management program and governance structure.

companyName: SHERWIN WILLIAMS CO

ticker: SHW


text: We use various controls, technologies, and other processes designed to identify, protect against, detect, respond to and mitigate cybersecurity risks, in alignment with frameworks established by the National Institute of Standards and Technology (NIST). These include, but are not limited to, internal reporting, monitoring and detection tools, threat intelligence, and general and role-based training. We also maintain third party management processes to identify and manage the cybersecurity risks associated with third party service providers. We periodically evaluate and improve the effectiveness of our cybersecurity program internally and by engaging with consultants and other third party advisors to conduct reviews and assessments of our program. These periodic assessments and reviews may include penetration and vulnerability testing, simulations, table-tops, and other exercises.


text: Overseeing the assessment and management of our exposure to various risks, including cybersecurity, is a key oversight responsibility for the Board of Directors. We have an enterprise risk management (ERM) program that includes the processes used to identify, assess, and manage our most significant enterprise risks and uncertainties that could materially impact the long-term health of the Company or prevent the achievement of strategic objectives. These risks are identified, measured, monitored and managed across key risk categories, which include the consideration of cybersecurity risks. Our chief financial officer (CFO) facilitates the Company's ERM program, which includes a formal assessment of the Company's risk environment at least once per year. The ERM program also facilitates the incorporation of risk assessment and evaluation into the strategic planning process and the provision of regular reports to senior management, including our CEO. The Audit Committee assists the Board with its oversight of both the ERM program and cybersecurity risk, providing regular reports to the Board. Our CFO reviews the ERM program with the Audit Committee at least once per year, including reviewing existing risks and significant emerging risks across the Company's key risk categories. In reviewing specific threats and risks with the Board, senior management may incorporate reports from consultants and other third party advisors.


text: Our Chief Information Security Officer (CISO) leads our global cybersecurity program and is responsible for management of our cybersecurity risks. Our CISO reports to our CFO. Our CISO has served in that position since 2022 and has relevant experience in cybersecurity leadership positions, including prior experience as CISO of a public company. The Audit Committee regularly reviews our risk exposures relating to cybersecurity with our CISO and CFO, including the review of the state of the Company's cybersecurity and emerging cybersecurity developments and threats, and the steps management has taken to monitor and mitigate such exposures. Our CISO manages a team of cybersecurity professionals with expertise and experience in information security.


text: Our CISO is informed of cybersecurity incidents by the cybersecurity team's security operations center, which is generally responsible for monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. We have an established process governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident, including for our evaluation of materiality. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and Board of Directors.


text: Despite our efforts to prevent cybersecurity threats and incidents, our systems may be affected by damage or interruption resulting from, among other causes, cyber attacks, security breaches, power outages, system failures or malware (including ransomware and other programs that operate with malicious intent). Disruptions to these systems may impair our ability to conduct business and have a material adverse effect on our business, results of operations and financial condition. Despite the security measures we have in place, our facilities and systems, and those of third parties we rely on or do business with, may be vulnerable to cyber attacks, security breaches, malware (including ransomware and other programs that operate with malicious intent), power outages, system failures, acts of vandalism, human or technical errors or other similar events or disruptions. Any such event involving the misappropriation, loss or other unauthorized disclosure of information, whether impacting us or third parties we rely on or do business with, could result in losses, damage our reputation or relationships with customers and suppliers, expose us to the risks of litigation, regulatory action and liability, disrupt our operations and have a material adverse effect on our business, results of operations and financial condition.


text: To date, we have not experienced a cybersecurity threat or incident that has had a material adverse affect on our business, results of operations and financial condition. We, and third parties we do business with, have experienced cybersecurity attacks and incidents in the past, some of which have resulted in unauthorized access to our information and systems and other disruptions to our business operations, and we could in the future experience similar incidents. See Risk Factors in Item 1A for additional information on cybersecurity risks.


text: We use various controls, technologies and other processes designed to identify, protect against, detect, respond to and mitigate cybersecurity risks, in alignment with the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0. These include, but are not limited to, internal reporting, monitoring and detection tools, threat intelligence and general and role-based training. We also maintain third-party management processes to identify and manage the cybersecurity risks associated with third-party service providers. We periodically evaluate and improve the effectiveness of our cybersecurity program internally and by engaging with consultants and other third-party advisors to conduct reviews and assessments of our program. These periodic assessments and reviews may include penetration and vulnerability testing, simulations, table-tops and other exercises.


text: Overseeing the assessment and management of our exposure to various risks, including cybersecurity, is a key oversight responsibility for the Board of Directors. We have an enterprise risk management (ERM) program that includes the processes used to identify, assess and manage our most significant enterprise risks and uncertainties that could materially impact the long-term health of the Company or prevent the achievement of strategic objectives. These risks are identified, measured, monitored and managed across key risk categories, which include the consideration of cybersecurity risks. Our chief financial officer (CFO) facilitates the Company's ERM program, which includes a formal assessment of the Company's risk environment at least once per year. The ERM program also facilitates the incorporation of risk assessment and evaluation into the strategic planning process and the provision of regular reports to senior management, including our CEO. The Audit Committee assists the Board with its oversight of both the ERM program and cybersecurity risk, providing regular reports to the Board. Our CFO reviews the ERM program with the Audit Committee at least once per year, including reviewing existing risks and significant emerging risks across the Company's key risk categories. In reviewing specific threats and risks with the Board, senior management may incorporate reports from consultants and other third-party advisors.


text: Our Chief Information Security Officer (CISO) leads our global cybersecurity program and is responsible for management of our cybersecurity risks. Our CISO reports to our CFO. Our CISO has served in that position since 2022 and has relevant experience in cybersecurity leadership positions, including prior experience as CISO of a public company. The Audit Committee regularly reviews our risk exposures relating to cybersecurity with our CISO and CFO, including review of the state of the Company's cybersecurity and emerging cybersecurity developments and threats and the steps management has taken to monitor and mitigate such exposures. Our CISO manages a team of cybersecurity professionals with expertise and experience in information security.


text: Our CISO is informed of cybersecurity incidents by the cybersecurity team's security operations center, which is generally responsible for monitoring the prevention, detection, mitigation and remediation of cybersecurity incidents. We have an established process governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident, including for our evaluation of materiality. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and Board of Directors.


text: Despite our efforts to prevent cybersecurity threats and incidents, our systems may be affected by damage or interruption resulting from, among other causes, cyber attacks, security breaches, power outages, system failures or malware (including ransomware and other programs that operate with malicious intent). Disruptions to these systems may impair our ability to conduct business and have a material adverse effect on our business, results of operations and financial condition. Despite the security measures we have in place, our facilities and systems and those of third parties we rely on or do business with, may be vulnerable to cyber attacks, security breaches, malware (including ransomware and other programs that operate with malicious intent), power outages, system failures, acts of vandalism, human or technical errors, or other similar events or disruptions. Any such event involving the misappropriation, loss or other unauthorized disclosure of information, whether impacting us or third parties we rely on or do business with, could result in losses, damage our reputation or relationships with customers and suppliers, expose us to the risks of litigation, regulatory action and liability, disrupt our operations and have a material adverse effect on our business, results of operations and financial condition.


text: To date, we have not experienced a cybersecurity threat or incident that has had a material adverse affect on our business, results of operations and financial condition. We, and third parties we do business with, have experienced cybersecurity attacks and incidents in the past, some of which have resulted in unauthorized access to our information and systems, and other disruptions to our business operations, and we could in the future experience similar incidents. See Risk Factors in Item 1A for additional information on cybersecurity risks.


text: Risk Management and Strategy We have processes in place aimed at assessing, identifying, and managing material risks from cybersecurity threats. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: SIFCO INDUSTRIES INC

ticker: SIF


text: Key elements of our cybersecurity risk management program include: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a formal register documenting and mitigating identified risks, reviewed by management on a quarterly basis; • a data protection team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the regular use of external service providers to independently assess and test security posture, as well as to otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a written cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, including data storage and restoration and disaster recovery plans; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: As reported on Forms 8-K filed January 6, 2023 and February 10, 2023, the Company became aware of unauthorized access to the Company's systems on December 30, 2022. The Company's domestic operations were impacted by the Cyber Incident, which resulted in production delays and delayed shipments due to information access limitations. The Company immediately initiated response protocols and an investigation, engaging cyber security experts to assist with the assessment of the incident and to help determine what data was impacted. The Company has since completed data recovery and restoration from the cyber incident. See Note 12 — Commitments and Contingencies of the Notes to Consolidated Financial Statements.


text: Except for the above incident, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Our Business and Operations."


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and maintains oversight of risk assessment and risk management, including cybersecurity and other information technology risks. In addition, our Board of Directors oversees management's implementation of our cybersecurity risk management program.


text: The Board of Directors receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board of Directors, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant. These presentations may cover a range of topics, including: • the current cybersecurity landscape and best practices for mitigating emerging threats; • progress on cybersecurity projects; • incident reports; • updates from past event(s); and • adherence to regulatory requirements and/or industry standards, as appropriate.


text: Our management team, including our Data Protection Officer and external counsel, are responsible along with the Company's Board of Directors for assessing and managing our material risks from cybersecurity threats. Our Data Protection Officer has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Data Protection Officer has extensive experience in information technology, including prior experience in cybersecurity architecture. We have a diverse information security team, including external consultants, with varying backgrounds and experience and levels of information security certification.


text: Our management team takes steps to remain informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Cybersecurity Governance We recognize the importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. This process is supported by both our management and our Board of Directors.

companyName: SMITH A O CORP

ticker: AOS


text: Our Chief Information Officer (CIO) oversees our information systems and cybersecurity function and reports to our Chief Executive Officer (CEO). She has over 30 years of experience in leading information systems management, strategy, and operational execution, including incident management, prevention, and response. Our Senior Director of Global Information Security (ISD) reports to our CIO and is responsible for the protection and defense of our networks and systems and managing cybersecurity risk. He has over 20 years of experience in managing cybersecurity and related risks, including threat identification, incident response, and defense strategies. Our CIO and ISD are supported by a direct and a cross-functional team of professionals with broad experience and expertise in threat assessment and detection, mitigation technologies, training, incident response, and regulatory compliance.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, which includes our management of information and cybersecurity risk. The full Board receives an update on our cyber risk management process and trends related to cybersecurity at least annually. The Audit Committee of the Board assists the full Board in its oversight of cybersecurity risks and as part of its oversight, the Audit Committee receives reports from management on information systems and security at each meeting, including metrics and controls, and other items from time to time such as risk assessments, security software, and incident response plans.


text: We have also established a committee of our executive leadership team to consider cybersecurity risk, mitigation strategies, and to consider trends and developments in managing the risk. Our CIO and ISD participate on this committee, which meets regularly. We have an established incident response plan led by our CIO and ISD to assess, respond, and report in the event of a cybersecurity incident. Depending on the nature and severity of the incident, the plan requires escalating notifications up to our CEO and our Board.


text: Cybersecurity Risk Management Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program in a similar fashion to other legal, compliance, strategic, operational, and financial risk areas. Our program is guided by cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), although we also look to other standards to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our approach to cybersecurity risk management includes: • Periodic risk assessments designed to help identify significant or potentially material cybersecurity risks to our critical systems, information, and our broader enterprise information technology (IT) environment; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • A multi-layered defense and continuous monitoring strategy employing various tools and testing, and incorporating lessons learned from our defense and monitoring efforts to help prevent future attacks; • Cybersecurity awareness training, including interactive simulations and tabletop exercises for our employees, incident response personnel, senior management, and our Board; • Regular testing by our Internal Audit function of controls related to our financial information systems; and • Information security assessments conducted on third parties with whom we share sensitive electronic data against established cybersecurity frameworks;


text: While we have experienced cybersecurity incidents in the past, to-date none have materially affected the Company or our financial position, results of operations and/or cash flows. We continue to invest in cybersecurity and the resiliency of our networks, including our controls and processes, all of which are designed in an effort to protect our IT systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors – Business, Operational, and Strategic Risks."


text: Our Chief Information Officer (CIO) oversees our information systems and cybersecurity function and reports to our Chief Operating Officer (COO). She has over 30 years of experience in leading information systems management, strategy, and operational execution, including incident management, prevention, and response. Our Senior Director of Global Information Security (ISD) reports to our CIO and is responsible for the protection and defense of our networks and systems and managing cybersecurity risk. He has over 20 years of experience in managing cybersecurity and related risks, including threat identification, incident response, and defense strategies. Our CIO and ISD are supported by a direct and cross-functional team of professionals with broad experience and expertise in threat assessment and detection, mitigation technologies, training, incident response, and regulatory compliance.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, which includes our management of information and cybersecurity risk. The full Board receives an update on our cyber risk management process and trends related to cybersecurity at least annually, or real-time if a material event occurs. The Audit Committee of the Board assists the full Board in its oversight of cybersecurity risks. As part of its oversight, the Audit Committee receives regular reports from management on information systems and security, including metrics and controls at each meeting, and other items at least annually including risk assessments, security software, incident response plans, and key updates to the cybersecurity program and its effectiveness.


text: We have also established a committee of our executive leadership team to consider cybersecurity risks and to consider mitigation strategies in managing the risk. Our CIO and ISD participate on this committee, which meets regularly. We have an established incident response plan led by our CIO and ISD to assess, respond, and report in the event of a cybersecurity incident. Depending on the nature and severity of the incident, the plan requires escalating notifications up to our CEO, Audit Committee and our Board.


text: Cybersecurity Risk Management Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program consistent with other legal, compliance, strategic, operational, and financial risk areas. Our program is guided by cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), although we also look to other standards to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: The Company has a robust cybersecurity program to assess, identify and manage material risk from cybersecurity threats and to prevent, detect and respond to cybersecurity threats, including those associated with the use of third-party service providers. Our approach to cybersecurity risk management includes: • Cybersecurity awareness training, including interactive simulations and tabletop exercises for our employees, incident response personnel, senior management, and our Board; • Periodic risk assessments designed to help identify significant or potentially material cybersecurity risks to our critical systems, information, and our broader enterprise information technology (IT) environment; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • A multi-layered defense and continuous monitoring strategy employing various tools and testing, and incorporating lessons learned from our defense and monitoring efforts to help prevent future attacks; • Regular testing by our Internal Audit function of controls related to our financial information systems; and • Information security assessments conducted on third parties with whom we share sensitive electronic data against established cybersecurity frameworks;


text: While we have experienced cybersecurity incidents in the past, to-date none have materially affected the Company or our financial position, results of operations and/or cash flows. We continue to invest in cybersecurity and the resiliency of our networks, including our controls and processes, all of which are designed in an effort to protect our IT systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Item 1A - Risk Factors.


text: Risk Management and Strategy We acknowledge the significance of cybersecurity in protecting our operations, data, and shareholders' interests, and have made cybersecurity a fundamental component of our overall risk management framework. Our cybersecurity program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. This framework guides our efforts to protect critical assets, identify potential threats, respond to incidents, and strengthen resilience, while simultaneously allowing us to assess and enhance the maturity of our program. The cybersecurity program is informed by our Enterprise Risk Management ("ERM") process and relies on internal and external expertise. We proactively evaluate and refine our security controls by utilizing best practices and threat intelligence to mitigate cyber risks. The Company also utilizes third parties for some cybersecurity services, including managed security services, external penetration testing, and social engineering tests. Additionally, we maintain an incident response plan that aligns with industry standards to ensure timely detection, containment, and remediation of security incidents.

companyName: SMITHFIELD FOODS INC

ticker: SFD


text: Cybersecurity Program Components Our cybersecurity program includes a focus on governance, process, technology and people. Key components include prevention, detection, and response capabilities, employee training programs, threat intelligence monitoring, and the implementation of an array of technologies. For example, to effectively manage cybersecurity risks, we maintain an asset inventory and classify critical systems to ensure appropriate protection measures. Our risk management processes include regular assessments of internal and third-party risks, which are aligned with our ERM strategy. We enforce cybersecurity policies, standards, and governance practices, ensuring they align with regulatory requirements and industry best practices. Additionally, we conduct periodic business impact analyses to strengthen resilience and inform risk-based decision-making.


text: The cybersecurity program incorporates multiple layers of security controls to safeguard our systems and data. Access controls are established based on the principle of least privilege, and all employees engage in cybersecurity awareness training to cultivate a security-conscious culture. We train our employees through periodic security training, phishing simulations and regular communications about timely security topics to enhance their understanding of cybersecurity threats and their ability to identify and escalate potential cybersecurity events. We maintain robust security configuration management and regularly update systems to minimize vulnerabilities. Investments in security technology include vulnerability management tools, malicious software protection, email security, and around-the-clock monitoring.


text: Our cybersecurity team continuously monitors network activity using advanced threat detection tools. Through automated alerts, behavioral analytics, and threat intelligence, security anomalies are identified in a timely manner. Routine vulnerability scanning and independent penetration testing further enhance our ability to detect weaknesses before they can be exploited.


text: We have an established incident response plan that aligns with NIST guidelines, ensuring a structured approach to identifying, containing, eradicating, and recovering from security incidents. The plan includes defined escalation procedures to engage executive leadership and regulatory authorities as necessary. Our cybersecurity team conducts regular incident response exercises to enhance response readiness. Additionally, we have a process in place to perform post-incident reviews to refine processes and prevent recurrence.


text: Recovery strategies are in place and supervised by a crisis management plan to restore critical operations following a cybersecurity event. We maintain secure, redundant backups and regularly test them for integrity and availability. Our recovery strategies prioritize minimizing downtime and rapid service restoration. We strive to incorporate lessons learned from past incidents, strengthening our resilience against future threats.


text: Third-party risk management is a critical component of IT risk management. We evaluate new vendors before onboarding to identify and manage potential risks and establish contractual requirements for security controls and notification. We also strive to monitor emerging risks associated with those third-party service providers. Assessment of these providers includes completing a standardized questionnaire and conducting risk evaluations for financial, reputational, information security, cybersecurity, and business resiliency risks.


text: Impact of Cybersecurity Risks and Threats While some of the Company's third-party service providers have experienced cybersecurity incidents and the Company has experienced threats to its data and systems, as of the date of this report, the Company's management is not aware of any cybersecurity threats or incidents that have materially affected its business strategy, results of operations, or financial condition. While we remain vigilant, there can be no guarantee that we will not be the subject of future threats or incidents. Additional information on cybersecurity risks we face can be found in "Item 1A. Risk Factors—Risks Relating to Our Business and Operations—We are increasingly dependent on information technology, and our business and reputation could suffer if we are unable to protect our information technology systems against, or effectively respond to, cyberattacks, other cyber-incidents or security breaches or if our information technology systems are otherwise disrupted," which should be read in conjunction with the foregoing information.


text: Board of Directors and Audit Committee Our Board of Directors has delegated oversight of the Company's ERM program, including cybersecurity, to the Audit Committee. The Audit Committee receives updates from our Senior Vice President, Information Technology ("SVPIT") and members of our Information Technology Security Services Department regarding our enterprise-wide cybersecurity programs at least on a quarterly basis. These updates may address data management and security initiatives, significant existing and emerging cybersecurity risks, and any material cybersecurity incidents and their impact on the Company and its stakeholders.


text: The Company's management is responsible for identifying, assessing, and managing the Company's exposure to cybersecurity risk. The Company has an internal team that is supported by security technologies, third-party experts, and threat intelligence resources in support of cybersecurity risk reduction. Our SVPIT oversees the team responsible for leading the enterprise-wide information technology strategy, policy, standards, architecture, and processes. This team includes our Information Technology Security Services Department and incorporates input from personnel from different functions, levels, and operating regions to support a high level of visibility and accountability throughout the company and to incorporate multiple vantage points on risks and potential mitigations. Our cybersecurity team also includes our Cybersecurity Operations Center, which is comprised of cybersecurity professionals and is responsible for the detection, analysis, and response to cybersecurity events, including threats and incidents, and is overseen by the Director of Cybersecurity Operations. Our Information Technology Security Services Department is responsible for overseeing the execution of cybersecurity strategy and maturing the Company's cybersecurity posture. Our SVPIT has over 20 years of experience in the IT industry, including change management, cybersecurity, and enterprise architecture. The Information Technology Security Services Department has extensive experience in cybersecurity, including graduate degrees in information security and Certified Information Security Systems Professional certifications.


text: Risk Management and Strategy IT systems and networks are important to our business operations, and we are committed to protecting the privacy, security, and integrity of our data, inclusive of our employee and customer data. We have a comprehensive cybersecurity program in place that is responsible for identifying, preventing, and mitigating data security risks. This program is aligned with the Company's overall Enterprise Risk Management process.

companyName: J M SMUCKER Co

ticker: SJM


text: We actively monitor and update our IT systems and infrastructure to prevent unauthorized access, viruses, phishing, and other security risks. Our cybersecurity program follows the National Institute of Standards and Technology ("NIST") Cybersecurity Framework standards.


text: Our security technology tools and processes provide protection against security breaches and reduce cybersecurity risks. Our cybersecurity incident response plan includes procedures for identifying, containing, and responding to incidents. While we continue to invest in our program and capabilities, we cannot guarantee prevention of all incidents.


text: We depend on IT systems, third-party service providers, and strategic partners to facilitate our business operations. This includes secure handling of personal, confidential, financial, sensitive, proprietary, and other forms of information, as well as enabling our service offerings. Despite continuous efforts to enhance both our and our partners' cybersecurity defenses, we cannot guarantee the protection of all information systems, products, and service technologies.


text: While we face regular cybersecurity threats, including ransomware and data breaches, we have not encountered significant incidents during the year ended April 30, 2024. We believe our security measures are adequate, but we acknowledge the rising sophistication of threats. Despite vigilance, system disruptions or unauthorized disclosures remain possible.


text: Governance and Oversight The Board actively supports strategy and oversees risk management, drawing on a diverse range of experiences, skills, qualifications, and backgrounds. This includes oversight of cybersecurity matters. The Audit Committee, composed entirely of independent Board members, receives quarterly updates on the cybersecurity program, which includes recent developments, program improvements, risk analysis, and an annual update on the Company's scenario-based cybersecurity exercise. The Audit Committee also receives periodic updates as may be needed, including any cybersecurity events that would require notification to the Audit Committee. The Audit Committee provides quarterly updates to the Board on key cybersecurity activities, and cybersecurity is also reviewed at least annually with the Board. In addition, two of our Audit Committee members, including the Chair, hold a CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors.


text: We actively educate our employees about potential cybersecurity threats and actions. Our executive officers and global workforce receive ongoing trainings in response to cyber threats and cybersecurity incidents. We mandate annual completion of our information security training and compliance program, which includes reviewing and acknowledging the Company's information security policy. All employees also participate in regular security awareness training, which includes data protection principles, general end-user security hygiene, and internal phishing simulations. Additional annual training covers information security topics related to our Code of Conduct and Records Management Policies.


text: While we face regular cybersecurity threats, including ransomware and data breaches, we have not encountered significant incidents during the year ended April 30, 2025. We believe our security measures are adequate, but we acknowledge the rising sophistication of threats. Despite vigilance, system disruptions or unauthorized disclosures remain possible.


text: Governance and Oversight The Board actively supports strategy and oversees risk management, drawing on a diverse range of experiences, skills, qualifications, and backgrounds. This includes oversight of cybersecurity matters. The Audit Committee, composed entirely of independent Board members, receives quarterly updates on the Company's cybersecurity program, which includes recent developments, program improvements, risk analysis, and an annual update on the scenario-based cybersecurity exercise. The Audit Committee also receives periodic updates, as needed, including any cybersecurity events that would require notification to the Audit Committee. The Audit Committee provides quarterly updates to the Board on key cybersecurity activities, and cybersecurity is also reviewed at least annually with the Board. In addition, two of our Audit Committee members, including the Chair, hold a CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors.


text: Cybersecurity Risk Management As a financial services institution, Key faces heightened risk of cybersecurity incidents. Risks and exposures related to cybersecurity incidents are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of cybersecurity threats and geopolitical events, as well as due to the expanding use of Internet and mobile banking and other technology-based products and services utilized by us and our clients. To date, Key has not experienced material disruption to our operations, or material harm to our client base, from cyberattacks. However, we have incurred, and may again incur, expenses related to the investigation of cybersecurity incidents involving third-party providers or related to the protection of our clients from identity theft as a result of such incidents. We have also incurred, and may continue to incur, expenses to enhance our systems or processes to protect against cyber or other security incidents. For more information, see "Risk Factors—We and third parties on which we rely (including their downstream service providers) may experience a cyberattack, technology failure, information system or security breach or interruption" in Item 1A. Risk Factors of this report.

companyName: KEYCORP /NEW/

ticker: KEY


text: Key maintains an Information Security Program (the "IS Program") to support the management of information security risk, including cybersecurity risk, across the organization. The IS Program is designed to protect Key's clients, employees, third parties, and assets from threats by managing the confidentiality, availability, and integrity of Key's information assets. Our Chief Information Security Officer ("CISO"), who is also the Enterprise Security Executive, oversees the IS Program and its related policy and has overall responsibility for managing the appropriate identification and ownership of cybersecurity risks. Key's Corporate Information Security Team, under the oversight of the CISO, is responsible for maintaining the IS Program, assessing program-level risks and threats to our information assets, and overseeing the proper level of investment in security resources.


text: The IS Program is designed to provide safeguards for Key's assets through a series of administrative, technical, and physical controls. Key employs a variety of security practices and controls to protect information and assets, including, but not limited to, access controls, vulnerability scans, network monitoring, internal and external penetration testing, monitoring of vendor vulnerability notices and patch releases, scanning of systems and emails for malware and other vulnerabilities, firewalls and intrusion detection and prevention systems, and dedicated security personnel. As described in more detail in "Risk Management — Overview" in Item 7 of this report and in "Cybersecurity Governance" below, Key employs the "Three Lines of Defense" in its risk governance framework. Assessing, identifying, and managing cybersecurity risk across the organization in support of the IS Program is a cross-functional effort that requires collaboration and direction from all lines of defense – the lines of business and support functions (First Line of Defense), Risk Management (Second Line of Defense), and the Risk Review Group (RRG), Key's internal audit function (Third Line of Defense): • First Line of Defense – Lines of Business and Support Functions. Primary responsibility for day-to-day management of cybersecurity risk lies with the senior management of each of Key's lines of business (LOB) and support functions. The LOB and support functions own and manage the individual processes and procedures that are used throughout the IS Program, implement and manage business-specific security controls, and enforce behavioral controls throughout the management structure. • Second Line of Defense – Risk Management. Risk Management oversees risk and monitors the First Line of Defense controls. Operational Risk Management performs review and challenge of controls, monitors the operational risk profile, and ensures Key operates within its operational risk appetite. Compliance Risk Management provides an independent, enterprise-wide function that focuses on compliance with laws, rules, regulations, and guidance applicable to Key. Privacy Compliance, which sits within Compliance Risk Management, provides advisory support, governance, and oversight of privacy-related statutes, regulations, and risks related to Key's customers, employees, and other individuals from who Key collects personally identifiable information. • Third Line of Defense – Risk Review Group. The RRG reviews and evaluates the scope and breadth of security activities throughout Key and the effectiveness of the IS Program. RRG conducts independent internal audits on Key's LOBs, operations, information systems, and technologies. These internal audits provide an independent perspective on Key's processes and risks. Technology risks are evaluated in areas including cybersecurity and information security, data control, acquisition and development, delivery and support, business continuity, and information technology governance. RRG shares the results of its audits with the LOB management, Key's Operational and Compliance Risk Management Groups, the Board's Audit Committee, and banking regulators.


text: As part of its cybersecurity risk management strategy, Key regularly reviews its security and privacy controls in the context of industry standard practices, frameworks, evolving laws, and changing client expectations. Key engages external providers periodically to perform a maturity assessment of the IS Program against industry cybersecurity frameworks. Key also engages external advisors periodically to perform security posture assessments of our environment to proactively identify weakness within our security policy and/or configurations. Summary level results from these assessments are shared to internal stakeholders through Key's Risk Governance committee structure. Key is also subject to cybersecurity and privacy regulatory exams, as required by law for financial institutions.


text: Key has implemented cybersecurity, privacy, and fraud education and awareness programs across the enterprise to educate teammates on how to identify and report cybersecurity and privacy concerns. Employees and contractors with access to assets or data owned or maintained by Key receive mandatory enterprise-wide cybersecurity, privacy, and fraud training on an annual basis.


text: With respect to third party service providers, Key maintains a third party management program that is designed to identify, review, monitor, escalate, and, if necessary, remediate third party information security risks. Key's third party onboarding process includes risk-based due diligence and security-relevant contract language. Risk-based due diligence can also include an assessment of the strength of certain control areas, including, but not limited to, information security management, physical security, network security, platform security, application security, cloud security, encryption management, business resiliency, and privacy. Once a business relationship is established with a service provider, Key performs risk-based periodic reviews of the third party service provider's security programs. In addition to an established governance approval process for new engagements, Key has established a Third Party Management Committee to oversee compliance with Key's Third Party Management Policy and Program.


text: Cybersecurity Governance As described in more detail in "Risk Management — Overview" in Item 7 of this report, the Board serves in an oversight capacity to ensure that Key's risks, including risk from cybersecurity threats, are managed in a manner that is effective and balanced and adds value for our shareholders. The Board's Risk Committee exercises primary oversight over enterprise-wide risk at Key, including operational risk, which includes cybersecurity risk, and provides oversight of management's activities related to cybersecurity risk. The Board's Audit Committee monitors and exercises oversight over cybersecurity risk as part of its joint oversight of operational risk with the Risk Committee. The Board's Technology Committee provides additional oversight of management's activities related to Key's technology strategic investment plan, cybersecurity investments, and major technology vendor relationships and is expected to escalate to the Risk Committee on certain risk management issues.


text: Key's CISO oversees the IS Program and its related policies and is responsible for determining whether relevant security risk information is properly integrated into strategic and business decisions, overseeing the appropriate identification and ownership of security risks, monitoring critical risks, and maintaining the appropriate oversight and governance of information security through associated programs and/or standards. Our CISO has served in various roles in information technology and information security at Key for over 29 years, including serving as Enterprise Security Executive. The CISO holds a B.S.B.A in Management Information Systems.


text: The CISO is responsible for reporting on information security matters, including cybersecurity risk, to the Board. The CISO provides updates to the Audit Committee on cybersecurity matters at each regularly scheduled Committee meeting (six times in 2023). The CISO's update to the Committee generally address the cybersecurity threat landscape, information security trends, strategic initiatives related to information security, and cybersecurity program reviews. The CISO also updates the Risk Committee on cybersecurity matters and on Key's compliance with the Gramm-Leach-Bliley Act on an annual basis and presents the Information Security Policy for approval. The CISO, along with Key's Deputy CISO, also report annually to the Technology Committee to obtain approval on Key's Cyber Strategy and Investment Plan. The CISO provides updates to the Board as needs arise and from time to time.


text: Key's Deputy CISO leads the Corporate Information Security function, including the Cyber Defense Center, Identity & Access Management Operations, Information Security Governance, and Security Architecture and Engineering.


text: The Deputy CISO has over 16 years of cybersecurity and technology risk management experience across financial services and retail, previously served as the Head of Information Security Governance within KeyCorp's Corporate Information Security group, as well as the Head of Cybersecurity and Technology Risk Oversight within KeyCorp's Risk Management group. He holds a bachelor's degree in Finance and Management Information Systems and an


text: The CISO reports to Key's Chief Information Officer who oversees all of Key's shared services for technology, operations, data, servicing, cyber and physical security, and corporate real estate solutions. Our Chief Information Officer, who has served in the role since 2012, has extensive experience overseeing technology and operations delivery for critical enterprise functions and has held various leadership roles during her over 30-year career in the financial services industry.


text: At the management level, our Enterprise Risk Management (ERM) Committee, chaired by the Chief Executive Officer and comprising other senior level executives, including the Chief Information Officer, reports to the Board's Risk Committee and is responsible for managing risk, including cybersecurity risk. The ERM Committee serves as a senior level forum for review and discussion of material operational risk issues, including cybersecurity risk, and receives regular updates from the CISO regarding cybersecurity risk. The ERM Committee directly oversees the Operational Risk Committee, which provides governance, direction, oversight, and high-level management of operational risk, including cybersecurity risk, and includes senior management representation from the LOB and support areas. The CISO is a voting member of the Operational Risk Committee.


text: The Operational Risk Committee also includes subcommittees which, among other things, address security issues and concerns, pursue security-related program enhancements, address fraud trends, provide input on fraud strategy, weigh the impacts of fraud risk on customers, business clients, and the LOB, and cascades awareness of fraud risks across Key.


text: Key also has a Privacy Team led by a Chief Privacy Officer (CPO) who has over ten years of experience in legal, compliance, and risk roles at financial institutions, focusing primarily on data protection and privacy. Our CPO holds an undergraduate degree in finance, a master's degree in business administration, and a juris doctorate. He is licensed to practice law in the state of Ohio and has obtained the CIPP/US certification through the International Association of Privacy Professionals. The CPO and Privacy team have the authority to escalate privacy risks to the Board. The Privacy and Information Security teams work together to implement controls around how personally identifiable information is managed and protected and to comply with applicable laws and regulations.


text: Cybersecurity Incidents When a cybersecurity incident is identified, we follow established processes in our enterprise privacy and cyber incident response plans, which are a supplement to our corporate incident response plan. These plans provide a framework to enable the appropriate personnel to recover operations in the event of a cyberattack and manage incidents impacting banking information, including our clients' and employees' information.


text: Our Core Incident Response Rapid Emergency Assessment and Coordination Team (Core IR REACT) is responsible for responding to incidents, including cyberattacks, performing a preliminary assessment, and engaging additional support team members as necessary. The Core IR REACT team is a multidisciplinary team that is empowered to escalate issues, as appropriate, to our Crisis Management Team (CMT), which includes the CEO and senior executives from Key's LOB and major support areas. The CMT provides overall strategic direction for incident responses and recovery. Incidents are also reported internally to key stakeholders through Key's risk governance committee structure.


text: As discussed above in "Cybersecurity Risk Management," the RRG shares the results of its independent internal audits of security activities at Key and the effectiveness of the IS Program with the line of business management, Key's Operational and Compliance Risk Management Groups, the Board's Audit Committee, and banking regulators. Any identified gaps are risk rated, issued a due date for remediation, and tracked through completion of remediation. Remediation is then verified by the RRG.


text: Cybersecurity Risk Management As a financial services institution, Key faces heightened risk of cybersecurity incidents. Risks and exposures related to cybersecurity incidents are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of cybersecurity threats and geopolitical events, as well as due to the expanding use of Internet and mobile banking and other technology-based products and services utilized by us and our clients, including products and services that utilize the cloud and artificial intelligence (AI), among other emerging technologies. To date, Key has not experienced material disruption to our operations, or material harm to our client base, from cyberattacks. However, we have incurred, and may again incur, expenses related to the investigation of cybersecurity incidents involving third-party providers or related to the protection of our clients from identity theft as a result of such incidents. We have also incurred, and may continue to incur, expenses to enhance our systems or processes to protect against cyber or other security incidents. For more information, see "Risk Factors—We and third parties on which we rely (including their downstream service providers) may experience a cyberattack, technology failure, information system or security breach or interruption" in Item 1A. Risk Factors of this report.


text: Key maintains an Information Security Program (the "IS Program") to support the management of information security risk, including cybersecurity risk, across the organization. The IS Program is designed to protect Key's clients, employees, third parties, and assets from threats by managing the confidentiality, availability, and integrity of Key's information assets. Our Chief Information Security Officer (" CISO "), who is also the Enterprise Security Executive, oversees the IS Program and its related policy and has overall responsibility for managing the appropriate identification and ownership of cybersecurity risks. Key's Corporate Information Security Team, under the oversight of the CISO, is responsible for maintaining the IS Program, assessing program-level risks and threats to our information assets, and overseeing the proper level of investment in security resources.


text: The IS Program is designed to provide safeguards for Key's assets through a series of administrative, technical, and physical controls. Key employs a variety of security practices and controls to protect information and assets, including, but not limited to, access controls, vulnerability scans, network monitoring, internal and external penetration testing, monitoring of vendor vulnerability notices and patch releases, scanning of systems and emails for malware and other vulnerabilities, firewalls and intrusion detection and prevention systems, and dedicated security personnel. As described in more detail in "Risk Management — Overview" in Item 7 of this report and in "Cybersecurity Governance" below, Key employs the "Three Lines of Defense" in its risk governance framework. Assessing, identifying, and managing cybersecurity risk across the organization in support of the IS Program is a cross-functional effort that requires collaboration and direction from all lines of defense – the lines of business and support functions (First Line of Defense), Risk Management (Second Line of Defense), and the Risk Review Group (RRG), Key's internal audit function (Third Line of Defense): • First Line of Defense – Lines of Business and Support Functions. Primary responsibility for day-to-day management of cybersecurity risk lies with the senior management of each of Key's lines of business (LOB) and support functions. The LOB and support functions own and manage the individual processes and procedures that are used throughout the IS Program, implement and manage business-specific security controls, and enforce behavioral controls throughout the management structure. • Second Line of Defense – Risk Management. Risk Management oversees risk and monitors the First Line of Defense controls. Operational Risk Management performs review and challenge of controls, monitors the operational risk profile, and ensures Key operates within its operational risk appetite. Compliance Risk Management provides an independent, enterprise-wide function that focuses on compliance with laws, rules, regulations, and guidance applicable to Key. Privacy Compliance, which sits within Compliance Risk Management, provides advisory support, governance, and oversight of privacy-related statutes, regulations, and risks related to Key's customers, employees, and other individuals from who Key collects personally identifiable information. • Third Line of Defense – Risk Review Group (RRG). The RRG reviews and evaluates the scope and breadth of security activities throughout Key and the effectiveness of the IS Program. RRG conducts independent internal audits on Key's LOBs, operations, information systems, and technologies. These internal audits provide an independent perspective on Key's processes and risks. Technology risks are evaluated in areas including cybersecurity and information security, data control, acquisition and development, delivery and support, business continuity, and information technology governance. RRG shares the results of its audits with the LOB management, Key's Operational and Compliance Risk Management Groups, the Board's Audit Committee, and banking regulators.


text: Key has implemented cybersecurity, privacy, and fraud education and awareness programs across the enterprise to educate teammates on how to identify and report cybersecurity and privacy concerns. Employees and contractors with access to assets or data owned or maintained by Key receive mandatory enterprise-wide cybersecurity, privacy, and fraud training on an annual basis. In addition, our management team from time to time participates in cybersecurity tabletop exercises that simulate cybersecurity incidents. These exercises are intended to test our response to potential incidents and assess the procedures outlined in our incident response playbooks.


text: Key's CISO oversees the IS Program and its related policies and is responsible for determining whether relevant security risk information is properly integrated into strategic and business decisions, overseeing the appropriate identification and ownership of security risks, monitoring critical risks, and maintaining the appropriate oversight and governance of information security through associated programs and/or standards. Our CISO has served in various roles in information technology and information security at Key for over 30 years, including serving as Enterprise Security Executive. The CISO holds a B.S.B.A in Management Information Systems.


text: The CISO is responsible for reporting on information security matters, including cybersecurity risk, to the Board. The CISO provides updates to the Audit Committee on cybersecurity matters at each regularly scheduled Committee meeting (six times in 2024). The CISO's update to the Committee generally address the cybersecurity threat landscape, information security trends, strategic initiatives related to information security, and cybersecurity program reviews. The CISO also updates the Risk Committee on cybersecurity matters and on Key's compliance with the Gramm-Leach-Bliley Act on an annual basis and presents the Information Security Policy for approval. The CISO, along with Key's Deputy CISO, also report annually to the Technology Committee to obtain approval on Key's Cyber Strategy and Investment Plan. The CISO provides updates to the Board as needs arise and from time to time.


text: Key's Deputy CISO leads the Corporate Information Security function, including the Cyber Defense Center, Identity & Access Management Operations, Information Security Governance and Data Protection, and Security Architecture, Engineering and Platform Operations. The Deputy CISO has over 17 years of cybersecurity and technology risk management experience across financial services and retail, previously served as the Head of Information Security Governance within KeyCorp's Corporate Information Security group, as well as the Head of Cybersecurity and Technology Risk Oversight within KeyCorp's Risk Management group. He holds a bachelor's degree in Finance and Management Information Systems and an MBA.


text: The Company's approach to risk management is designed to identify, assess, prioritize, and manage significant risk exposures that could affect the Company's ability to execute its corporate strategy and fulfill its business objectives. The Company manages enterprise risk through its Risk Management Committee ("RMC") chaired by the Company's Vice President of Compliance, Risk and Audit with direct oversight from the Company's General Counsel. The RMC, which is made up of senior leadership across a variety of business functions, defines the Company's enterprise risk framework based upon analysis of industry and peer benchmarking as well as company-specific data analysis.

companyName: SONOCO PRODUCTS CO

ticker: SON


text: As a component of the Company's enterprise risk management program, the Company's cybersecurity risk management program outlines the Company's cybersecurity risk management practices and capabilities, including the division of responsibilities for reviewing the Company's cybersecurity risk exposure and risk tolerance, tracking emerging information risks, and ensuring proper escalation of certain key risks for periodic review by the Board and its committees.


text: Cybersecurity risk is evaluated within the population of all enterprise risks in the framework and is included in assessments overseen by the RMC that identify the risks of highest priority to the Company. For these highest priority risks, including cybersecurity risks, the RMC designates risk owners, sets common reporting processes and monitors risk mitigation and treatment strategies to support business continuity.


text: The Company's cybersecurity risk management program leverages the National Institute of Standards and Technology Cybersecurity Framework for identifying, assessing, and managing material risks from cybersecurity threats. This approach combines prevention and detection techniques, informed by internal and external sources, to identify and analyze potential threat activities. When a threat is identified, a cyber incident response plan outlines the Company's procedures for containing, remediating, and recovering from the cybersecurity incident. Cybersecurity tenets are also incorporated into the Company's technology policies.


text: The Company's cybersecurity risk management program focuses on vulnerability management, access management, and user awareness training. Among other things, the Company implements scheduled patching and system updates, proactively scans for vulnerabilities, and engages qualified third-party experts to assess the Company's information technology infrastructure and identify vulnerabilities and opportunities for continued focus and improvement. When vulnerabilities are identified, the Company's information technology ("IT") management team receives reports that assess each vulnerability and track progress in remediating that vulnerability. The IT management team also collaborates with supply chain management and the Company's third party risk management program to onboard and monitor key third-party service providers to address the potential risk of cybersecurity threats through the use of such third parties. Annual cybersecurity training is mandatory for all users with access to the Company's IT systems, and the Company conducts monthly tests to promote phishing awareness. In addition to these prevention methods, the Company seeks to detect potential threats through external intelligence and monitoring solutions. External commercial or governmental agencies are also engaged to assess potential threat activity relevant to the Company. The Company also monitors server and endpoint devices across the organization to detect signs of a cyberattack.


text: The Company has implemented and maintains an information security incident response plan ("IR Plan"), which includes processes to assess, escalate, contain, investigate, and remediate cybersecurity incidents. Upon notification of a potential cybersecurity threat, management defines the threat based on its nature as an information security event, alert, incident, or breach, and all cybersecurity incidents are categorized by level of severity based on the impact of the incident to the Company's operations. A technical incident response team is responsible for technical response activities, including information gathering and forensic analysis, containment, and remediation efforts. The Company's Crisis Management Team drives the Company's enterprise-level crisis response process, leads decisions around response strategies, coordinates resources required to execute such strategies, and oversees all cybersecurity incidents categorized as Critical and High.


text: Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2023, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors – Risks Related to Information Technology and Cybersecurity" for more information on the Company's cybersecurity-related risks. Governance.


text: The Company's day-to-day management of cybersecurity risks is led by the Chief Information Security Officer ("CISO") with direct oversight from the Chief Information Officer ("CIO"). The Company's IR Plan includes a defined escalation matrix for critical or high severity information security events involving notifications to the CISO and CIO, who further escalate critical or high severity events to the Company's Crisis Management Team, which consists of senior management from IT, including the CIO and CISO, Human Resources, Risk and Internal Audit, Marketing and Communications, Legal and Finance. The Crisis Management Team further elevates sufficiently critical and high severity events to the Company's Cyber Incident Review Committee ("CIRC"), which consists of the CIO, Chief Financial Officer, Chief Accounting Officer, VP of Investor Relations, VP of Compliance, Risk and Audit, and General Counsel, or their delegates. Additional senior management from relevant business units are added to the CIRC as needed based on the nature of identified cybersecurity incidents. The CIRC preliminarily evaluates whether an incident is material and provides a proposal to the CEO and CFO, who work in consultation with the committee to make a final determination of materiality. Such determination is communicated to the Audit Committee of the Board.


text: The Company's Crisis Management Team has relevant expertise and experience to assess and remediate cyber threats. The CIO has over 17 years of experience in information technology and security, and the CISO has 31 years of information technology experience and 11 years of information security experience.


text: As part of its broader oversight activities, the Board oversees risks from information security threats and other risks identified by the RMC, both directly and by way of delegation to the Audit Committee. As reflected in its charter, the Audit Committee oversees and specifically discusses the guidelines and policies by which the Company assesses and manages its cybersecurity risk exposures, as well as the steps management has taken to monitor and control such exposures. The Audit Committee also oversees the Company's internal control over financial reporting, including with respect to financial reporting-related information systems. In addition to any communications of specifically identified cybersecurity events, the Audit Committee receives and discusses quarterly updates on cybersecurity activities, including review of annual external assessment results, training compliance and discussion of cybersecurity risks and resolutions, and is responsible for elevating significant matters to the full Board as events arise. The Board receives an annual update and provides feedback on the Company's cybersecurity governance processes, risk management plan, and any significant activities related thereto, and also reviews risk management practices in the course of its review of the Company's corporate strategy, business plans, Board committee reports, and other presentations. In addition to the ordinary-course Board and Audit Committee reporting and oversight described above, the Company also maintains disclosure controls and procedures designed for prompt reporting to the Board and timely public disclosure, as appropriate, of material events covered by our risk management framework, including information security risks.


text: Cybersecurity risk is evaluated within the population of all enterprise risks in the framework and is included in assessments overseen by the RMC that identify the risks of highest priority to the Company. For these highest priority risks, including cybersecurity risks, the RMC designates risk owners, sets common reporting processes, and monitors risk mitigation and treatment strategies to support business continuity.


text: Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2024, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors – Risks Related to Information Technology and Cybersecurity" for more information on the Company's cybersecurity-related risks. Governance.


text: The Company's day-to-day management of cybersecurity risks is led by the Chief Information Security Officer ("CISO") with direct oversight from the Chief Information Officer ("CIO"). The Company's IR Plan includes a defined escalation matrix for critical or high severity information security events involving notifications to the CISO and CIO, who further escalate critical or high severity events to the Company's Crisis Management Team, which consists of senior management from IT, including the CIO and CISO, Human Resources, Risk and Internal Audit, Marketing and Communications, Legal, and Finance. The Crisis Management Team further elevates sufficiently critical and high severity events to the Company's Cyber Incident Review Committee ("CIRC"), which consists of the CIO, Chief Financial Officer, Chief Accounting Officer, VP of Investor Relations, VP of Compliance, Risk and Audit, and General Counsel, or their delegates. Additional senior management from relevant business units are added to the CIRC as needed based on the nature of identified cybersecurity incidents. The CIRC preliminarily evaluates whether an incident is material and provides a proposal to the CEO and CFO, who work in consultation with the committee to make a final determination of materiality. Such determination is communicated to the Audit Committee of the Board (the "Audit Committee").


text: The Company's Crisis Management Team has relevant expertise and experience to assess and remediate cyber threats. The CIO has over 18 years of experience in information technology and security, and the CISO has 32 years of information technology experience and 12 years of information security experience.


text: Cybersecurity is a critical component of Southern Company's risk management program. The Southern Company system has implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the Southern Company system's ability to fulfill critical business functions, including energy delivery service failures, and on the confidentiality, integrity, and availability of the Southern Company system's information systems.

companyName: SOUTHERN CO GAS


text: Board of Directors The Southern Company Board of Directors (Board), along with certain committees (primarily the Audit Committee of the Board) oversees the Southern Company system's enterprise risk management process. The Board devotes significant time and attention to overseeing cybersecurity risk, and the Southern Company system's approach to cybersecurity governance establishes oversight throughout the enterprise. The Board has delegated the primary responsibility to oversee cybersecurity matters to the Business Security and Resiliency Committee (BSRC) of the Board. Having a committee like the BSRC, focused on and dedicated to security, is a strong governance practice. Comprised solely of independent members of the Board, the BSRC is charged with oversight of risks related to cybersecurity, physical security, and operational resiliency. The BSRC includes directors with an understanding of cyber issues. The BSRC meets at every regular Board meeting and when needed in the event of a specific threat or emerging issue. The Chair of the BSRC regularly reports to the Board in connection with key matters the BSRC considered. The BSRC routinely receives presentations on a range of topics, including the threat environment and vulnerabilities and risks, policies, practices, technology trends, and regulatory developments, from the Chief Information Security Officer (CISO) and the legal organization and, as needed, the Chief Information Officer (CIO). The CISO reports to the BSRC at each regular committee meeting. Protocols have been established by which certain cybersecurity incidents are escalated internally and, where appropriate, reported to the BSRC, and ongoing updates regarding any such incident are provided until it has been resolved. See "Incident Response" herein.


text: The Southern Company system has implemented a cross-functional, risk-based, "defense-in-depth" approach to preventing, detecting, identifying, mitigating, responding to, and recovering from cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Overall network efforts are led by the CISO and the Technology Security Organization (TSO), the organization responsible for implementing, monitoring, and maintaining cybersecurity practices across the Southern Company system, and aided by the Executive Vice President of Operations and the Energy Management System and Generation organization. The CISO meets regularly with the CIO and the Chief Executive Officer and reports regularly to committees of the Board to discuss risk management measures implemented to identify and mitigate data protection and cybersecurity risks. Security and resiliency are emphasized through business assurance, enterprise risk management, and incident response plans designed to identify, evaluate, and remediate incidents when they occur. Among other things, the Cybersecurity Incident Response Plan (CIRP) establishes a team comprised of the CISO, the Deputy CISO, the Director of the Digital Defense Center, and members of the legal and compliance organizations to evaluate emerging cyber threats and escalate to executive management and business units as appropriate. Plans, policies, and technologies are regularly updated and training exercises and crisis management preparedness activities are conducted to test effectiveness.


text: The CISO works closely with the legal and compliance organizations, as well as the relevant business units, to help ensure broad oversight of and compliance with legal, regulatory, and contractual cybersecurity requirements. The CISO has extensive cybersecurity knowledge and skills gained from over 30 years of work experience within the Southern Company system. The CISO receives reports on cybersecurity threats from a variety of sources both internally and externally on an ongoing basis and regularly reviews risk management measures implemented to identify and mitigate cybersecurity risks. Briefings to the Board on cybersecurity matters include annual briefings to the Audit Committee and the Operations, Environmental, and Safety Committee in addition to briefings to the BSRC at each of its regular meetings (at least five times annually).


text: Internal Cybersecurity Team The TSO, led by the CISO, is responsible for the implementation, monitoring, and maintenance of the cybersecurity and data protection practices across the Southern Company system. The Southern Company system also relies on a Data Privacy and Protection team in the compliance organization, as well as the internal audit organization, to work with the TSO on data protection policies and practices. Multiple experienced information security leaders with internal and external security experience responsible for various parts of the business report to the CISO, each of whom is supported by a team of trained cybersecurity professionals. In addition to these internal cybersecurity capabilities, external auditors and security companies are regularly engaged to assist with assessing, testing, identifying, and managing cybersecurity, including through penetration testing, vulnerability testing, and other technical evaluations.


text: Risk Management and Strategy Although many of the networks are segmented, overall network security is a centralized shared service across the Southern Company system, led by the TSO and the CISO. Recognizing that no single technology, process, or business control can effectively prevent or mitigate all risks related to cyber threats, multiple technologies, processes, and controls, all working independently but as part of a cohesive strategy, are employed to reduce risk. Southern Company system exposure and defenses are regularly tested through auditing, penetration testing, vulnerability testing, and other exercises designed to assess effectiveness.


text: The Southern Company system emphasizes both security and resiliency through business assurance and incident response plans designed to identify, evaluate, and remediate incidents when they occur. A 24/7 security operations center is also utilized, which facilitates real-time situational awareness across the cyber-threat environment, and a robust insider threat protection program that leverages cross-function information sharing to assess insider threat activity is employed. The Southern Company system regularly reviews and updates its plans, policies, and technologies and conducts regular training exercises and crisis management preparedness activities to test their effectiveness. In addition, a security awareness program for the Southern Company system's employees has also been implemented, which is designed to educate and train employees at least annually, or more often as needed, about risks inherent to human interaction with information and operational technology.


text: The Southern Company system's cybersecurity program is increasingly leveraging intelligence-sharing capabilities about emerging threats within the energy industry, across other industries, with specialized vendors, and through public-private partnerships with U.S. government intelligence agencies. By engaging with both the Electricity Information Sharing and Analysis Center and the Downstream Natural Gas Information Sharing and Analysis Center, the Southern Company system benefits from quality analysis and rapid sharing of security information across the energy sector. Such intelligence helps to allow for better detection and prevention of emerging cyber threats before they materialize. Just as it tests its policies and plans internally, the Southern Company system also engages in external exercises such as the bi-annual GridEx Security Exercise to evaluate and address the preparedness of the industry as a whole.


text: Many cybersecurity policies and standards across the Southern Company system are governed by multiple regulatory requirements. Portions of these policies and standards are audited by the FERC, the Transportation Security Administration, and the NRC, as appropriate, and are periodically evaluated by third parties such as cybersecurity insurance carriers. Certain members of senior management have high-level security clearances to facilitate access to critical information, and the Southern Company system participates in pilot programs with industry and the U.S. government to share additional information and strengthen cybersecurity and business resiliency.


text: The Southern Company system also employs systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider, or customer or otherwise implicating the third-party technology and systems used. Among other things, the Southern Company system has established a Vendor Security Incident Working Group to address such third-party security incidents, including following up with the third party as appropriate and taking steps to mitigate any impact to systems. The Vendor Security Incident Working Group includes members of the internal cybersecurity teams to address any incidents that may invoke the CIRP. Additionally, the Southern Company system typically imposes contractual obligations on vendors and other third-party business partners related to privacy, confidentiality, and data security based on their access to the Southern Company system's data and systems. The Southern Company system also maintains insurance coverage for cyber incidents; the scope of coverage and fitness of coverage is evaluated each year.