text: The Corporation maintains a Cybersecurity Incident Response Plan (the "CSIRP"), which establishes an organizational framework and guidelines intended to facilitate an effective response and handling of cybersecurity incidents that could jeopardize the availability, integrity, or confidentiality of the Corporation's assets. The CSIRP outlines roles and responsibilities, criteria for measuring the severity of a cybersecurity incident, and an escalation framework, including processes for informing the General Counsel and the Board of Directors of material cybersecurity incidents. As described above, management is actively involved in assessing and managing the Bank's material cybersecurity risks. The CITSO and the VP of Information Security primarily lead these efforts. The CITSO, who reports directly to the CEO, is responsible for the oversight of the Corporation's IT operation, including the cybersecurity program, and holds a Bachelor of Science degree in Information Technology and Security and a Master of Science in Information Security and Assurance. He also holds 20 industry recognized Technology and Security certifications. The VP of Information Security reports directly to the CITSO and has responsibility for leadership of the Bank's cybersecurity program. He holds a bachelor's degree in mathematics and computer science, as well as several industry recognized information security certifications.


text: Risk Management and Strategy The Corporation maintains robust processes for assessing, identifying, and managing material risks from cybersecurity threats. The Corporation's cybersecurity program is based on the Federal Financial Institutions Examination Council ("FFIEC") framework which tailors the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to be more financial services focused. The risk of cybersecurity threats is integrated into the Corporation's Enterprise Risk Management ("ERM") program, led by the Corporation's Chief Risk Officer. The ERM program includes an annual risk prioritization process to identify key enterprise risks. Each key risk is assigned a risk owner to establish action plans and implement risk mitigation strategies. The Corporation's cybersecurity threat risk action plan is managed at the enterprise level by the Chief Information Technology & Security Officer (the "CITSO"), the VP of Information Technology, and the VP of Information Security. Risk owners regularly monitor cybersecurity risks and the evolving threat landscape and review and update the cybersecurity threat risk action plan in response to newly identified threats or risk mitigation actions. To oversee and identify cybersecurity threat risks on a day-to-day basis, including from third party service providers, the Corporation maintains a third-party security operations center with round-the-clock monitoring, and the CITSO receives regular reports on industry activity. Management also assesses the cybersecurity proficiency of potential third-party suppliers before utilizing their services. The assessment identifies cybersecurity-related risks and makes recommendations to enhance the security of all new computing services. Management reassesses all suppliers on a regular interval.

companyName: CNB FINANCIAL CORP/PA

ticker: CCNE

secItem: Item 1C


text: The Corporation maintains a Cybersecurity Incident Response Plan (the "CSIRP"), which establishes an organizational framework and guidelines intended to facilitate an effective response and handling of cybersecurity incidents that could jeopardize the availability, integrity, or confidentiality of the Corporation's assets. Pursuant to the CSIRP and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the CITSO and the VP of Information Security primarily lead these efforts.


text: The Corporation works closely with its internal auditors to assess, identify, and manage cybersecurity risks. In addition, the Corporation engages with third party cybersecurity specialists to provide an independent assessment of the Corporation's cybersecurity programs and to prepare a 3-year plan to maintain compliance and operational excellence. Management periodically reviews the 3-year plan and modifies it in response to changes in the threat landscape or otherwise as needed. Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Corporation, including its business strategy, results of operations or financial condition. However, there can be no assurance that the Corporation's security efforts and measures will be effective or that attempted security incidents or disruptions would not be successful or damaging. In addition, although the Corporation maintains cybersecurity insurance to provide some coverage for certain risks arising out of data and network breaches, there can be no assurance that the Corporation' cybersecurity insurance coverage will be sufficient in the event of a cyber attack. See "Item 1A. Risk Factors" above for more information.


text: The Board of Directors is responsible for overseeing the assessment and management of enterprise-level risks that may impact the Corporation. The Audit Committee has primary responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. The boards of directors of the Corporation and the Bank have also established an IT Committee, consisting of at least three independent directors, along with non-voting members from management, including the President and CEO, the Chief Financial Officer, the CITSO, the SVP of Operations, the VP of Information Technology, and the VP of Information Security. The IT Committee assists the boards of directors of the Corporation and CNB Bank in fulfilling their respective governance responsibilities for CNB's information technology and related data security infrastructure under relevant regulatory safety and soundness requirements. Management, including the CITSO, reports on cybersecurity matters regularly to the Board, primarily through the Audit Committee and IT Committee, including an annual report regarding specific risks and mitigation efforts within the Bank and a 3-year cybersecurity threat assessment conducted by third party experts. Management provides benchmarking information and updates on key operational and compliance metrics to the Board of Directors. In addition, cybersecurity training is provided to the full Board of Directors to educate directors on the current cyber threat environment and measures companies can take to mitigate risk and impact of cyber attacks. Several members of the Board of Directors, including the Chairperson of the Audit Committee, also have cybersecurity experience. As described above, management is actively involved in assessing and managing the Bank's material cybersecurity risks. The Corporation's incident response plan provides clear communication protocols, including with respect to members of senior management, which may include the CEO, the CFO, the Board of Directors, the Audit Committee and external legal counsel. In addition, the incident response plan considers communications and reporting to customers, regulators and law enforcement.


text: The CITSO, who reports directly to the CEO, is responsible for the oversight of the Corporation's IT operation, including the cybersecurity program, and holds a Bachelor of Science degree in Information Technology and Security and a Master of Science in Information Security and Assurance. He also holds 20 industry recognized Technology and Security certifications. The VP of Information Security reports directly to the CITSO and has responsibility for leadership of the Bank's cybersecurity program. He holds a bachelor's degree in mathematics and computer science, as well as several industry recognized information security certifications. The VP of Information Technology reports directly to the CITSO and has responsibility for leadership of the Bank's Information Technology program. He holds a bachelor's degree in information technology and has worked in the technology field for 29 years with 17 of those years in a financial institution in various technology management, security, and audit roles.


text: All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. In addition, as a financial services company, we are subject to extensive regulatory compliance requirements, including those established by the Federal Reserve, FDIC, RI Division of Banking and Connecticut Department of Banking. To mitigate the threat to our business and address regulatory requirements, we take a comprehensive approach to cybersecurity risk management and have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. As described in more detail below, we have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. We devote significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Although our "Risk Factors" in Item 1A include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: WASHINGTON TRUST BANCORP INC

ticker: WASH


text: Risk Management and Strategy Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our comprehensive ERM program and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), Center for Internet Security ("CIS") and other applicable industry standards. Our cybersecurity program in particular focuses on the following key areas: Collaboration


text: Our cybersecurity risks are identified and addressed through a comprehensive approach led by our Information Assurance team. The Information Assurance team works collaboratively across the organization to develop strategies for preserving the confidentiality, integrity and availability of Corporation and customer information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made to management and the Audit Committee of the Board of Directors ("Audit Committee") in a timely manner.


text: At least annually, we conduct a cybersecurity risk assessment that considers information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations of our environment by third parties and consultants). The results of the assessment are used to develop plans for, and prioritization of, initiatives to enhance our security controls, and to make recommendations to improve processes.


text: Technical Safeguards We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.


text: Incident Response and Recovery Planning We have established comprehensive incident response and recovery plans and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address and guide our employees, management and the Audit Committee on our response to a cybersecurity incident.


text: Third-Party Risk Management We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and based on risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Education and Awareness Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees of the importance of handling and protecting customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats. We also provide quarterly training updates for our employees, which include social engineering exercises.


text: External Assessments Our cybersecurity policies, standards, processes, and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. For example, we engage with a third-party auditing firm to conduct cyber audits to assess our controls against the NIST Cybersecurity Framework and CIS controls on an annual basis. The results of these assessments are reported to management and Audit Committee. Cybersecurity processes and controls are adjusted based on the information provided from these assessments.


text: Our Board of Directors has overall responsibility for risk oversight, with its committees assisting in performing this function based on their respective areas of expertise. Our Board of Directors has delegated oversight of risks related to cybersecurity to the Audit Committee. The Audit Committee reports the results of their oversight function to the Board of Directors.


text: The Audit Committee directly oversees our cybersecurity program and receives regular reports from management about the status of our control environment based on the CIS controls, and the prevention, detection, mitigation, and remediation of cybersecurity incidents. This reporting also includes information concerning material security risks and information security vulnerabilities, cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.


text: Management's Role Our chief information officer ("CIO"), chief information security officer ("CISO") and chief technology officer ("CTO") have primary responsibility for assessing and managing material cybersecurity risks. Through the ongoing assessments they perform, including third-party assessments, they make recommendations on enhancing the security controls, and the continued maturity of our information technology and information assurance programs.


text: Our CIO joined Washington Trust as CISO in 2016 and has more than 35 years of experience in the financial, technology, auditing, and banking industries. He has expertise in technology deployment, information technology risk management and information security policies and programs. Our current CISO has served in that position since 2018 and is a 27-year employee of Washington Trust. He has extensive experience and expertise in information technology risk management and information security policies and programs. He holds a Bachelor of Science in Computer Information Systems and several certifications, including Certified Information Systems Security Professional and Certified Information Security Auditor. Our CTO has served in that position since 2021 and is a 12-year employee of Washington Trust. He has broad technical experience and expertise in information technology and holds a Bachelor of Science in Information Science and several certifications, including Cisco Certified Network Associate.


text: Incident Response and Recovery Planning We have established comprehensive incident response and recovery plans and continue to regularly test and evaluate the effectiveness of those plans. These plans address the prevention, detection, mitigation, and remediation of incidents, and include appropriate timely incident escalations to be followed during an incident.


text: Our CIO joined Washington Trust as CISO in 2016 and has more than 35 years of experience in the financial, technology, auditing, and banking industries. He has expertise in technology deployment, information technology risk management and information security policies and programs. Our current CISO has served in that position since 2018 and is a 28-year employee of Washington Trust. He has extensive experience and expertise in information technology risk management and information security policies and programs. He holds a Bachelor of Science in Computer Information Systems and several certifications, including Certified Information Systems Security Professional and Certified Information Security Auditor. Our CTO has served in that position since 2021 and is a 13-year employee of Washington Trust. He has broad technical experience and expertise in information technology and holds a Bachelor of Science in Information Science and several certifications, including Cisco Certified Network Associate.


text: Cybersecurity Risk Management and Strategy To protect the confidentiality, integrity, and availability of our critical systems and information, our enterprise risk management framework considers cybersecurity risk alongside other company risks, as part of our overall risk assessment process. We leverage an industry leading framework, the National Institute of Standards and Technology Cybersecurity Framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We assess our maturity against that framework in partnership with an independent firm on at least an annual basis.

companyName: TORO CO

ticker: TTC


text: We assess and manage our cybersecurity risk using various mechanisms, starting with threat intelligence, which provides us a necessary viewpoint to help us identify trends, understand how certain attacks may affect us, and prepare for evolutions in threat actor behavior that may require changes to our security posture. We monitor emerging trends and regulations related to information security, and implement appropriate changes, as needed, to our cybersecurity risk management program.


text: To drive readiness, we perform periodic adversarial testing of our cybersecurity posture through penetration testing, using both internal resources and external expertise, as well as table-top and "red team" exercises to understand where processes or controls may be insufficient based on adversarial techniques. We have also implemented technical security controls, maintenance of certain backup and protective systems, physical and system securities measures, and data security protocols.


text: We maintain established information security policies and processes; deploy regular network and endpoint software updates on all company-managed systems and workstations to detect and prevent, among others, viruses, malicious code, unauthorized access, and phishing attempts; maintain a disaster recovery plan, and perform at least two disaster recovery exercises annually to validate and optimize our recovery efforts in event of a cybersecurity incident; and regularly engage third-party cybersecurity experts to conduct vulnerability assessments and penetration testing on our information networks, systems, and applications.


text: Our internal audit team performs regular assessments of our program and selected components. We also leverage retrospectives from previous cybersecurity incidents to understand weaknesses and to improve our security controls. We assess our critical suppliers regularly for cybersecurity risk and prescribe remediation activities when necessary. As a part of a collaborative defense approach, we regularly participate in multiple cybersecurity forums to share threat intelligence, best practices, and points of caution.


text: We train our employees through annual security training, phishing simulations, and regular communications about timely cybersecurity topics and threats. We have a documented and well-tested cybersecurity incident response plan that guides us in responding, containing, and eradicating cybersecurity threats that have breached our preventative controls. Examples of relevant processes include steps for: assessing the severity of a cybersecurity threat; identifying the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider; implementing cybersecurity countermeasures and mitigation strategies; and remediating and escalating cybersecurity incidents using cross-functional expertise. Our cybersecurity risk management program also includes risk-based processes related to overseeing and identifying cybersecurity risks associated with the use of third-party providers, including processes related to: conducting cybersecurity assessments of third-party service providers, including cybersecurity obligations in contract with third-party service providers; and receiving and responding to notification of cybersecurity incidents of third-party service providers. We regularly practice technical recovery.


text: Cybersecurity risks related to third-party IT providers and solutions are managed as part of our vendor security protocol that includes vendors, software, and cloud-based service providers. We partner with our vendors to minimize the customer data needed to provide services and ensure compliance with regulations. Vendors are reviewed annually to identify any changes to services, data requirements, and associated security and protections. Where applicable, vendors are contractually bound to protect customer data and support enforcement of all regulatory requirements. We proactively evaluate the cybersecurity risk of third-party IT providers and solutions by utilizing a repository of risk assessments and an external monitoring solution that includes threat intelligence to better inform us during contracting and vendor selection processes. When third-party risks are identified, we require those third-parties to agree by contract to implement appropriate security controls or refrain from doing business with them. Security issues are documented, tracked, and periodic monitoring is conducted for third-parties in order to mitigate risk.


text: The Company also contractually requires suppliers, vendors and other third-parties with access to its information technology systems, sensitive business data or personal information to implement and maintain appropriate security controls and contractually restricts their ability to use the Company's data, including personal information, for purposes other than to provide services to the Company, except as required by law.


text: Cybersecurity Governance Our cybersecurity program is led by the Senior Manager of our Enterprise IT Security Risk and Compliance team, who reports to the Managing Director of Enterprise IT. The Senior Manager has over 30 years of IT experience, with over 20 years specializing in cybersecurity. He has strategic and operational responsibility for all aspects of the company's cybersecurity program, including how cyber risks are identified and assessed and how the company prepares for, detects, responds, and recovers from cyber threats. Quarterly cybersecurity program updates and as-needed reporting on cybersecurity incidents are provided to the Chief Executive Officer, Chief Financial Officer, and General Counsel.


text: The Audit Committee of our Board of Directors provides oversight for our cybersecurity program. The Audit Committee receives regular updates from management on the effectiveness of our cybersecurity program, reviews plans on how management will continually advance the program, and receives updates on special topics that help the committee provide effective oversight of the program.


text: Despite our best efforts, we cannot guarantee that our security measures will prevent all potential cybersecurity incidents or breaches. Like most companies, our systems are continually subjected to sophisticated and evolving cybersecurity threats, such as phishing, ransomware, social engineering, and advanced persistent threats. However, to date, we have not been subject to any incidents or successful cyber-attacks that materially impacted our operations or financial condition. Vulnerabilities could lead to significant additional expenses and an adverse effect on our reputation, business, results of operations, financial condition and cash flows. The Company has invested in developing and acquiring cybersecurity capabilities allowing us to monitor threats and manage incident response. We have also developed internal policies to mitigate cybersecurity incidents, including providing clear guidelines for incident classification and response. We recognize the importance of continued monitoring and improvement of our cybersecurity program, and will continue to invest in our security controls, incident response capabilities, and third-party vendor management protocols. Additional information on cybersecurity risks we face is included in Part I, Item 1A, "Risk Factors," which should be read in conjunction with the information in this section.


text: Cybersecurity Risk Management and Strategy To protect the confidentiality, integrity, and availability of our critical systems and information, our enterprise risk management framework considers cybersecurity risk alongside other company risks, as part of our overall risk assessment process. Cybersecurity risks are reviewed at least quarterly by the Enterprise Risk Management and Compliance team and escalated to senior management as appropriate. We leverage an industry leading framework, the National Institute of Standards and Technology Cybersecurity Framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We assess our maturity against that framework in partnership with an independent firm on at least an annual basis.


text: Cybersecurity Governance Our cybersecurity program is led by the Senior Manager of our Enterprise IT Security Risk and Compliance team, who reports to the Managing Director of Enterprise IT. The Senior Manager has over 30 years of IT experience, with over 20 years specializing in cybersecurity. He has strategic and operational responsibility for all aspects of the company's cybersecurity program, including how cyber risks are identified and assessed and how the company prepares for, detects, responds, and recovers from cyber threats. Quarterly cybersecurity program updates and as-needed reporting on cybersecurity incidents are provided to the Chief Executive Officer, Chief Operating Officer, Chief Financial Officer, and General Counsel.


text: The risks associated with the cybersecurity landscape are vast and ever-changing. Additionally, as a financial institution, the Corporation is subject to extensive federal and state regulatory and compliance requirements, many of which are associated with the protection and privacy of customer information. In response, the Corporation has created a layered and adaptable Information Security Program to protect the confidentiality, integrity, and availability of proprietary information and customer data. Continuous assessment and improvement of Information Security procedures and controls remains an integral part of the Corporation's overall risk management strategy and on-going business operations.

companyName: FIRST KEYSTONE CORP

ticker: FKYS


text: Risk Management Oversight and Governance The Corporation's Information Security Officer (ISO), with assistance from the Information Technology team, has the primary responsibility in maintaining, assessing, and updating the Information Security Program and for reporting cyber and information security matters to the Corporation's executive management and Board of Directors. The ISO maintains a presence on a variety of committees that work together to monitor and manage the Corporation's risk profile and approve any changes or enhancements to the risk management strategies, including the Board of Directors IT Committee and Audit Committee, and the Corporation's IT Steering Committee, Enterprise Risk Management Committee, and Vendor Management Committee. At least annually, the ISO also presents to the Board of Directors on the state of the Information Security Program. This includes an overview of the Program's strategy and processes for identifying and mitigating risks, employee security awareness and training efforts, and any enhancements or changes to the program since the previous report.


text: Cybersecurity Risk Management Program The Information Security Program is designed with a defense-in-depth mentality, using a variety of techniques, tools, policies, and procedures to create a layered security posture against the various methods of cybersecurity attack and compromise. The day-to-day management and monitoring of the program's technical aspects are handled by the ISO and the Information Technology team. They are responsible for user access and permissions control, system and network monitoring, vulnerability detection and mitigation, employee security awareness and training, and creating and maintaining technology and information security policies. The Corporation does engage with third parties, including a managed security service provider, to assist with or enhance aspects of the day-to-day Information Security Program. The ISO and IT team are currently in the process of strengthening the overall program by aligning controls and procedures with the Cybersecurity Frameworks established by the Center for Internet Security (CIS) and National Institute of Standards and Technology (NIST).


text: Business Continuity and Incident Response Plans are maintained to ensure that critical business functions maintain uptime or can be restored as quickly as possible in the event that a natural or technological event occurs that impacts the Corporation or any of its service providers. The Information Security Officer and Information Technology Manager work together to maintain these plans and perform testing exercises that ensure the Corporation's back up technologies and procedures are working as intended and are available if the need should arise.


text: To help mitigate risks associated with third party vendors and service providers, the Corporation has implemented an extensive Vendor Management process, overseen by the Vendor Management Committee. All new vendors undergo due diligence analysis by the Corporation's Vendor Management team, including review of their cybersecurity, data and privacy protection, and business continuity practices of those vendors with access to Corporation or customer data. Annual due diligence follow-up reviews are performed for all existing vendors on an ongoing basis and the results are reported to the Vendor Management Committee.


text: Notwithstanding the Corporation's defensive measures and processes, the threat posed by cyber-attacks is extremely serious. The Corporation may not be successful in preventing or mitigating all cybersecurity incidents that could have a material adverse effect on it. While the Company has not, to date, detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, its systems and those of its customers and third-party service providers are under constant threat. It is possible that the Corporation could experience a significant cybersecurity event. The Corporation expects risks and exposures related to cybersecurity attacks to remain high for the foreseeable future. Refer to Item 1A. "Risk Factors" for additional information related to cyber security risks.


text: Cybersecurity Risk Management Program The Information Security Program is designed with a defense-in-depth mentality, using a variety of techniques, tools, policies, and procedures to create a layered security posture against the various methods of cybersecurity attack and compromise. The day-to-day management and monitoring of the program's technical aspects are handled by the ISO and the Information Technology team. They are responsible for user access and permissions control, system and network monitoring, vulnerability detection and mitigation, employee security awareness and training, and creating and maintaining technology and information security policies. The Corporation does engage with third parties, including a managed security service provider, to assist with or enhance aspects of the day-to-day Information Security Program. The ISO and IT team are currently in the process of strengthening the overall program by aligning controls and procedures with the Cybersecurity Frameworks established by the Center for Internet Security (CIS) and Cyber Risk Institute (CRI).


text: Our business is subject to risk from cybersecurity threats and incidents, including attempts to gain unauthorized access to our systems and networks, or those of our managers, venture partners and third-party vendors and service providers, to disrupt operations, corrupt data or steal confidential or personal information and other cybersecurity breaches. Ventas considers cybersecurity risk a serious threat to our assets and our people and has put processes in place designed to mitigate the risk and impact of any such cybersecurity threat or incident.

companyName: Ventas, Inc.

ticker: VTR


text: Risk Management and Strategy As part of our cybersecurity risk management process, we: • Periodically review and implement procedures that endeavor to follow the cybersecurity standards set forth by the National Institute of Standards and Technology, including procedures with respect to evaluation and monitoring of cybersecurity threats and incidents; • Engage third-party security firms to monitor and respond to cybersecurity threats and incidents, including those associated with our use of third-party vendors and service providers, and conduct periodic penetration tests with the aim of identifying and remediating vulnerabilities. • Periodically evaluate and assess cybersecurity risks associated with our use of key third-party business partners, vendors and service providers. However, we do not control the cybersecurity plans and systems put in place by such third parties and we may have limited contractual protections with such third parties, such as indemnification obligations to us, which could cause us to be negatively impacted as a result; • Provide employees with the training, tools and resources designed to protect the Company from cybersecurity threats and incidents and to identify and report such threats and incidents. Our employees receive training and testing on cybersecurity protocols throughout the year, including monthly anti-phishing campaigns, periodic live training programs and mandatory annual training and assessments with passing requirements. Each employee periodically acknowledges that they have read, understood and will abide by the Company's cybersecurity policies; and • Seek to minimize the amount of personal information collected to support business needs and use storage and transfer protocols leveraging encryption of critical information, including confidential or personal information.


text: Our processes for assessing, identifying, and managing material risks from cybersecurity threats and incidents are integrated into our multi-disciplinary enterprise risk management ("ERM") process. Our ERM process is managed through our ERM Committee, which we have established to assess, identify and manage enterprise-wide risks to our Company, and is comprised of personnel from our senior leadership team. The ERM Committee is convened at least quarterly to review and update our top risks, including cybersecurity risks. Existing risks are evaluated for changes, and mitigation strategies are discussed as needed. New risks are discussed and evaluated for consideration as a top risk. Results are discussed with our Board of Directors at quarterly Board meetings as needed.


text: The Company has not identified any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including with respect to our business strategy, results of operations, or financial condition. While we have implemented measures designed to help mitigate the risk from cybersecurity threats and incidents, we cannot guarantee that we or our tenants, managers or business partners will be successful in preventing a cybersecurity incident, which could result in a data center outage, disrupt our systems and operations or the systems and operations of our tenants, managers or business partners, compromise the confidential or personal information of our employees, partners or the residents in our senior housing communities and damage our business relationships and reputation. For example, in November 2023, Ardent became aware of a cybersecurity incident, which Ardent determined to be a ransomware attack and which resulted in disruptions to certain aspects of Ardent's clinical and financial operations. Although we have implemented various measures designed to manage risks relating to these types of events, these measures and the systems supporting them could prove to be inadequate and, if compromised, could become inoperable for extended periods of time, cease to function properly or fail to adequately secure confidential or personal information. See "Risk Factors—Our Legal, Compliance and Regulatory Risks—The occurrence of cybersecurity incidents could disrupt our operations or the operations of the third parties with whom we do business, invest in or lend to, result in the loss of confidential or personal information or damage our or their business relationships and reputation. included in Part I, Item 1A of this Annual Report.


text: Our Board of Directors, directly and through its committees, routinely discusses significant enterprise risks with management and reviews the procedures we have in place designed to manage those risks. At Board and committee meetings, directors engage in analyses and dialogue regarding specific areas of cybersecurity risk, including those identified through our ERM process. In addition to the overall risk oversight function administered directly by our Board, the Audit and Compliance Committee of our Board also exercises oversight over managing the Company's cybersecurity risks. Management briefs the Audit and Compliance Committee at least once a year on cybersecurity controls, protocols, risk assessments and mitigation measures.


text: Our management has primary responsibility for identifying, assessing and managing our exposure to cybersecurity threats and incidents, subject to oversight by our Board of Directors of the processes we establish to assess, monitor and mitigate that exposure.


text: Our Chief Information Officer oversees our Information Technology Team and is responsible for the development and implementation of strategy for our information systems, networks, infrastructure, cybersecurity and data analytics. She has more than 25 years of experience in the field of information technology and is a member of our senior leadership team.


text: If a potentially material cybersecurity threat or incident is identified or discovered, the Company's Information Technology Team will notify our Chief Executive Officer, Chief Financial Officer, General Counsel and other relevant business executives. Our Chief Information Officer will work with the appropriate leaders and employees in any impacted business groups, as well as appropriate personnel in our finance, legal and other impacted departments, to assess the risks to the Company and potential impact while determining appropriate remediation steps.


text: If management determines that a cybersecurity threat or incident could be material to the Company, our management will notify the Audit and Compliance Committee, who will then escalate the risk to our full Board of Directors, depending on management's assessment of the risk.


text: Our business is subject to risk from cybersecurity threats and incidents. Cybersecurity threats and incidents include attempts to gain unauthorized access to our systems and networks, or those of our managers, tenants, borrowers, investments in unconsolidated entities, vendors, suppliers, service providers or other third parties with whom we do business, to disrupt operations, corrupt data or steal confidential or personal information and other cybersecurity breaches. Ventas considers cybersecurity risk a serious threat to our assets and our people and has put processes in place designed to mitigate the risk and impact of any such cybersecurity threat or incident.


text: Risk Management and Strategy As part of our cybersecurity risk management process, we: • Periodically review and implement procedures that endeavor to follow the cybersecurity standards set forth by the National Institute of Standards and Technology, including procedures with respect to evaluation and monitoring of cybersecurity threats and incidents; • Implement, maintain and regularly review incident response plans to manage cybersecurity threats and incidents and further improve our preparedness and response infrastructure. Such plans are informed by our testing and monitoring activities and set forth actions to be taken in responding to and recovering from cybersecurity incidents which include procedures for assessing the severity of such threats and incidents, escalating and disseminating information and containing, investigating and remediating threats and incidents; • Engage third-party security firms to monitor and respond to cybersecurity threats and incidents, including those associated with our use of third-party vendors and service providers, and conduct periodic penetration tests with the aim of identifying and remediating vulnerabilities; • Periodically evaluate and assess cybersecurity risks associated with our use of key third-party business partners, vendors and service providers. However, we do not control the cybersecurity plans and systems put in place by such third parties and we may have limited contractual protections with such third parties, such as indemnification obligations to us, which could cause us to be negatively impacted as a result; • Provide employees with the training, tools and resources designed to protect the Company from cybersecurity threats and incidents and to identify and report such threats and incidents. Our employees receive training and testing on cybersecurity protocols throughout the year, including regular anti-phishing campaigns, periodic live training programs and mandatory annual training and assessments with passing requirements. Each employee periodically acknowledges that they have read, understood and will abide by the Company's cybersecurity policies; and • Seek to minimize the amount of personal information collected to support business needs and use storage and transfer protocols leveraging encryption of critical information, including confidential or personal information.


text: Our processes for assessing, identifying, and managing material risks from cybersecurity threats and incidents are integrated into our multi-disciplinary enterprise risk management ("ERM") process. Our ERM process is managed through our ERM Committee, which we have established to assess, identify and manage enterprise-wide risks to the Company, and is comprised of personnel from our senior leadership team. The ERM Committee is convened at least quarterly to review and update our top risks, including cybersecurity risks. Existing risks are evaluated for changes, and mitigation strategies are discussed as needed. New risks are discussed and evaluated for consideration as a top risk. Results are discussed with our Board of Directors at quarterly Board meetings as needed.


text: As of December 31, 2024, the Company is not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including with respect to our business strategy, results of operations or financial condition. While we have implemented measures designed to help mitigate the risk from cybersecurity threats and incidents, we cannot guarantee that we or our managers, tenants, borrowers, investments in unconsolidated entities, vendors, suppliers, service providers or other third parties with whom we do business will be successful in preventing a cybersecurity incident, or mitigating or remediating a cybersecurity threat, which could result in a data center outage, disrupt our systems and operations or the systems and operations of our managers, tenants, borrowers, investments in unconsolidated entities, vendors, suppliers, service providers or other third parties with whom we do business, compromise the confidential or personal information of our employees, partners or the residents in our senior housing communities and damage our business relationships and reputation. Although we have implemented various measures designed to manage risks relating to these types of events, these measures and the systems supporting them could prove to be inadequate and, if compromised, could become inoperable for extended periods of time, cease to function properly or fail to adequately secure confidential or personal information. See "Risk Factors—Our Legal, Compliance and Regulatory Risks—Cybersecurity threats and incidents could disrupt our operations or the operations of the third parties with whom we do business, invest in or lend to, result in the loss of or unauthorized access to confidential or personal information or damage our or their business relationships and reputation" included in Part I, Item 1A of this Annual Report.


text: Role of our Board of Directors and the Audit and Compliance Committee As part of our Board of Directors' role in overseeing the Company's ERM program, which includes our cybersecurity risk management, our Board is responsible for overseeing management's identification, assessment and management of material cybersecurity risks which may reasonably be expected to impact the Company. While our Board has overall responsibility for enterprise risk oversight, our Board has delegated to the Audit and Compliance Committee responsibility for overseeing risks from cybersecurity threats and incidents. The Audit and Compliance Committee is responsible for overseeing the effectiveness of the Company's cybersecurity risk management initiatives, taking into account the Company's risk exposures. Management briefs the Audit and Compliance Committee at least once a year and our Board as appropriate on cybersecurity controls, protocols, risk assessments and mitigation measures.


text: Role of our Management Our management has primary responsibility for identifying, assessing and managing our exposure to cybersecurity threats and incidents, subject to oversight by our Board of Directors of the processes we establish to assess, monitor and mitigate that exposure.


text: Our Chief Information Officer oversees our Information Technology Team and is responsible for the development and implementation of strategy for our information systems, networks, infrastructure, cybersecurity and data analytics. She has more than 25 years of experience in the field of information technology and is a member of our senior leadership team. Prior to joining Ventas, she spent approximately 12 years at a multinational hospitality public company where, in her most recent role, she was responsible for application management and support of enterprise-wide systems. This role also had responsibility for global service desk support for more than 100,000 employees.


text: If a potentially material cybersecurity threat or incident is identified or discovered, the Company's Information Technology Team will notify our Chief Executive Officer, Chief Financial Officer, General Counsel and other relevant business executives. Our Chief Information Officer will work with the appropriate leaders and employees in any impacted business groups, as well as appropriate personnel in our finance, legal and other departments, to assess the risks to the Company and potential impact while determining appropriate remediation steps.


text: If management determines that a cybersecurity threat or incident could be material to the Company, our management will notify the Audit and Compliance Committee, who will then escalate the risk to our full Board of Directors, depending on management's assessment of the risk. As discussed above, management also provides regular reports to the Audit and Compliance Committee and to our Board as appropriate.


text: RISK MANAGEMENT AND STRATEGY We have a cybersecurity program that is intended to assess, identify, and manage material risks from cybersecurity threats to our business. Our program includes policies and procedures for detection, assessment, response, mitigation, remediation, and reporting of cybersecurity incidents and threats. Overall, our cybersecurity program is a strategic component of our company-wide risk management framework and activities.

companyName: ROSS STORES, INC.

ticker: ROST


text: Our cybersecurity program is led by our Information Technology (IT) team. The IT team is principally responsible for developing, managing, and implementing our cybersecurity risk assessment processes, maintaining and implementing our incident response plans, selecting and implementing security controls, providing cybersecurity training, performing ongoing threat analysis, and responding to cybersecurity threats and incidents. The cybersecurity program also draws upon a combination of industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework, that are designed to help companies measure their security posture, reduce cybersecurity risks, and provide guidance for implementing effective security controls.


text: Our risk management approach and processes for cybersecurity extend to assessing and managing risks from cybersecurity threats associated with our use of third-party service providers, by employing vetting processes, including the conducting of security assessments and monitoring activities, to verify that third-party service providers adhere to our policies and contractual requirements.


text: In addition, we engage and work with a range of third-party advisors, including cybersecurity consultants, legal counsel, and auditors, to help us assess, test, and otherwise assist in the development and review of our cybersecurity processes. These relationships enable us to benefit from specialized knowledge and insights to help inform our cybersecurity strategies.


text: As of April 1, 2024, to our knowledge, our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats or previously identified cybersecurity incidents, but there is no assurance that we will not be materially affected in the future by such risks or future incidents. For more information on our cybersecurity related risks, see ITEM 1A. RISK FACTORS.


text: Our Board of Directors exercises general oversight of our risk management activities, including our cybersecurity program. With respect to risks related to cybersecurity, our Board of Directors has delegated the primary oversight responsibility to the Audit Committee. The Audit Committee, along with management, reports to the full Board of Directors on these matters throughout the year.


text: The Audit Committee receives quarterly cybersecurity reports and engages directly with our management team, including our Chief Capability Officer (CCO), Chief Information Officer (CIO) and Chief Information Security Officer (CISO), on cybersecurity risk management and related risk topics, including incident response and recovery protocols, associate trainings and awareness, recent Company and industry developments, and our related compliance programs and practices. Our cybersecurity program and practices are also evaluated through various internal and third-party audits and assessments, with the results reported to the Audit Committee.


text: Our CIO and CISO are principally responsible for assessing and managing our material risks from cybersecurity threats, reporting to our CCO. They lead efforts to prevent, identify, detect, mitigate, and remediate material cybersecurity risks and incidents through various means, including by receiving alerts and reports produced by security tools deployed in our IT systems. Together, our CIO and CISO have decades of experience in cybersecurity and in retail, including leadership experience in cybersecurity risk management, incident response and recovery, compliance, governance, IT systems and technology, and overall cyber defense methodologies.


text: As of the date of this filing, to our knowledge, our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats or previously identified cybersecurity incidents, but there is no assurance that we will not be materially affected in the future by such risks or future incidents. For more information on our cybersecurity related risks, see ITEM 1A. RISK FACTORS.


text: The Audit Committee receives quarterly cybersecurity reports and engages directly with our management team, including our Chief Information Officer (CIO) and Chief Information Security Officer (CISO), on cybersecurity risk management and related risk topics, including incident response and recovery protocols, associate trainings and awareness, recent Company and industry developments, and our related compliance programs and practices. Our cybersecurity program and practices are also evaluated through various internal and third-party audits and assessments, with the results reported to the Audit Committee.


text: Our CIO and CISO are principally responsible for assessing and managing our material risks from cybersecurity threats. They lead efforts to prevent, identify, detect, mitigate, and remediate material cybersecurity risks and incidents through various means, including by receiving alerts and reports produced by security tools deployed in our IT systems. Together, our CIO and CISO have decades of experience in cybersecurity and in retail, including leadership experience in cybersecurity risk management, incident response and recovery, compliance, governance, IT systems and technology, and overall cyber defense methodologies.


text: Cybersecurity Risk Management and Strategy We have a multilayered framework for detecting, and responding to reasonably foreseeable cybersecurity risks and threats. To protect our information technology ("IT"), systems from cybersecurity threats, we use various tools that help prevent, detect, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. In the event of a material change to our systems or operations, we would assess the internal and external threats to the security, confidentiality, integrity, and availability of our data and systems, along with other material risks to our operations. We leverage technical safeguards intended to protect the Company's information systems from cybersecurity threats, including firewalls, threat monitoring, intrusion prevention and detection systems, anti-malware, access controls, privilege management, network segmentation, asset and end point management, and ongoing system security assessments. We oversee third-party service providers by conducting vendor diligence and reviews on a regular basis. We monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular network scans, system audits, and assessing intelligence feeds. The results of these assessments are used to improve our security posture through remediation efforts.

companyName: TaoWeave, Inc.

ticker: TWAV


text: We have developed an incident management process designed to coordinate the activities to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate any reputational damage.


text: Our business strategy, results of operations, and financial condition have not been materially affected as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity-related risks, see "Item 1A, Risk Factors" in this Annual Report.


text: Oblong's IT team is responsible for assessing and managing cybersecurity risks and has a depth of experience focused on increasing the organization's resilience to security threats and stays current on new developments through monitoring of the cybersecurity landscape. Oblong's IT environment is monitored for potential security threats and security events are investigated and acted on to minimize potential risk to the environment.


text: Oblong's Audit Committee engages in oversight of Oblong's cybersecurity risks and receives regular updates from management on technology and security updates and Oblong's assessment of cybersecurity threats and mitigation plans. The Audit Committee oversees the processes over internal controls and financial reporting that includes controls and procedures that are designed to ensure that significant cybersecurity incidents are communicated to both senior management and the Audit Committee. In the event of a material cybersecurity incident affecting our IT systems or data management, the Audit Committee would promptly work to formulate a mitigation plan and review compliance with such plan, as well as to ensure compliance with any external regulatory or disclosure requirements, including any disclosures of material cybersecurity incidents.


text: Protecting information, including information of our clients, is a top priority. We have expertise, dedicated resources and technology to identify, assess, respond to and mitigate material risks from cybersecurity threats. Our Global Information Security organization (GIS), led by our Chief Information Security Officer (CISO), establishes and maintains our company-wide information security management program and provides guidance for information security activities and controls at Unisys. Through our GIS, we: • establish and maintain corporate information security policies and procedures for identifying, assessing and addressing cybersecurity events; • track and analyze data as it moves through the information systems; • analyze the overall cybersecurity risk to information and systems (including the physical security and cybersecurity); • remediate known cybersecurity vulnerabilities; and • follow evolving information security regulatory guidance for countries in which we operate and adjust internal policies, processes and remediation actions, as necessary.

companyName: UNISYS CORP

ticker: UIS


text: Our process for integrating cybersecurity risk management into our overall risk management system Our overall cybersecurity and privacy strategy is to protect and enable the business. We aim to protect ours and our customers' information and assets to enable agility in the business. Our GIS manages Unisys' cybersecurity risk identification, assessment, response, remediation and mitigation processes, and interfaces with other departments, including business units, the information technology department and enterprise risk management, to facilitate the risk processes and ensure the policies and procedures established by the GIS are integrated into our overall enterprise risk management system. The GIS's processes also work in tandem with the processes maintained by our Global Privacy Office (GPO). Through our GPO, we deploy functional and business unit-specific approaches to data and privacy compliance. Taking into consideration the processes established by the GIS, our GPO has developed a framework of policies, procedures and other initiatives that are implemented across Unisys to help meet data privacy requirements.


text: Our GPO: • is supported by a network of data protection officers, attorneys and privacy specialists across Unisys; • manages privacy management software that is used across Unisys to facilitate privacy impact assessments, record data processing activities and map data flows; and • follows evolving privacy regulatory guidance for countries in which it operates and adjusts standards, as necessary.


text: We have also adopted physical, technological and administrative cybersecurity controls including, among other items: • a dedicated cybersecurity incident response team, the Security Incident Response Team (SIRT), which is comprised of internal resources and an external vendor, Managed Security Services Provider (MSSP). The MSSP triages based on a combination of predetermined rules. When the MSSP has validated a true positive event, it is communicated to the internal SIRT team for deeper investigation and response; • a written policy provided to all associates regarding identification, classification of severity and escalation of cybersecurity incidents; • perimeter and endpoints firewalls, intrusion prevention systems, endpoint detection and response, Attack Surface Management, multi-factor authentication and email protection; • annual and ongoing cybersecurity awareness training for our associates — including regular training on information security and data privacy policies. • routine testing of and training on our IT systems, including test phishing emails and awareness training opportunities; • cybersecurity policies, standards and practices that follow recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards, and follow evolving information security regulatory guidance for countries in which we operate; • automation and alerts via embedded tools and procedures to monitor data and notify us of threats or other potential unauthorized occurrences on or conducted through our systems; • sharing threat intelligence daily with each business unit; • multiple mechanisms by which employees can report cybersecurity and data privacy concerns, including a "Report Phish" button in the email application; • internal audits on our cybersecurity and data privacy practices; • a vulnerability management program designed to protect our external and internal networks and critical assets; • an ongoing process of identifying, assessing, reporting on, managing and remediating cybersecurity vulnerabilities across endpoints, workloads and systems; and • a level of cybersecurity insurance that Unisys believes is appropriate, taking into consideration the material risks from cybersecurity threats.


text: We engage third-party service providers to assist us with our cybersecurity risk management system Third-party cybersecurity experts regularly supplement our cybersecurity risk management efforts, including those we engage to conduct periodic cybersecurity risk assessments. During 2023, Unisys engaged cybersecurity risk experts and external legal counsel to conduct a review of, and advise us on, our cybersecurity risk management processes, current cybersecurity risk environment, leading board governance practices, strategic cyber reporting and cyber resiliency. Following the review, we have further revised our processes for identifying material cybersecurity incidents and enhanced our written policy regarding identification, classification of severity and escalation of cybersecurity incidents.


text: In 2023, Unisys engaged a leading cybersecurity firm to consult on several technical matters relating to cyber resiliency. This resulted in significant changes to our security technical stack and improvements to our processes and organization.


text: Our processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers Unisys recognizes the importance of overseeing and identifying material risks from cybersecurity threats associated with our use of third-party service providers. We have a Third Party Risk Management (TPRM) program, which is integrated into our procurement process and involves cybersecurity risk oversight and identification components. Our TPRM program includes policies and standards requiring that we perform cybersecurity due diligence reviews on our vendors based on the risk profile of a particular supplier or service provider or the service they provide. We also monitor certain of our principal suppliers and service providers on an ongoing basis by conducting additional periodic reviews. Whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect Unisys, including its business strategy, results of operations, or financial condition and if so, how.


text: The information set forth under "Risk Factors" (Part I, Item 1A of this Form 10-K) — "We have been and could be vulnerable to disruption in our IT systems, cybers incidents, security breaches and loss of data (associate and client) that have occurred, and may continue to occur, and have resulted in and could continue to result in the incurrence of significant costs and harm to our business and reputation." — on page 14 of this Annual Report on Form 10-K is hereby incorporated by reference. As of December 31, 2023, our financial condition, results of operations or business strategy have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.


text: Cybersecurity Governance Board Oversight of Risks from Cybersecurity Threats Cybersecurity risk oversight continues to remain a top priority for the Board of Directors. The Board of Directors is responsible for oversight of Unisys' information security program, including compliance and risk management, and the review of cybersecurity risks. The Security and Risk Committee (S&RC), a Board committee comprised entirely of independent directors, assists the Board in these oversight responsibilities.


text: The S&RC's responsibilities include: • reviewing crisis preparedness and incident response plans; • monitoring Unisys' enterprise risk profile and its ongoing and potential exposure to risks of various types; • reviewing summaries of any incidents or activities; • reviewing reports or presentations from management or advisors, including third-party experts, regarding the management of enterprise risk programs; • periodically meeting with the CISO and Chief Privacy Officer (CPO); and • periodically briefing the full Board of Directors on cybersecurity matters.


text: Our S&RC chair previously served as the Chief Information Officer of a large healthcare company from 2011 to 2020 and as a Global Chief Information Officer at another company from 2004 to 2011. Other members of the S&RC have over forty years of executive and operational leadership experience at several global technology and telecommunications companies.


text: Additionally, the A&FC has general oversight over Unisys' cybersecurity as it relates to responsibility for Unisys' internal audit function, including cybersecurity practices, compliance with legal and regulatory requirements and internal control over financial reporting. In November 2023, the A&FC charter was amended to ensure that it, in conjunction with the S&RC, reviews Unisys' cybersecurity and other information technology controls and procedures no less than annually. Management's Role in Assessing and Managing the Company's Material Risks from Cybersecurity Threats.


text: The Disclosure Committee assists in fulfilling our obligations to maintain disclosure controls and procedures and coordinates and oversees the process of preparing our periodic securities filings with the Securities and Exchange Commission. Cybersecurity incidents, based on their severity, are escalated to the Disclosure Committee by the SIRT. The Disclosure Committee is comprised of the Chief Executive Officer (CEO), Chief Operating Officer (COO), Chief Financial Officer, General Counsel, Chief Compliance Officer and Chief Accounting Officer. The COO represents the business units of the company and the CISO reports to the COO. The Disclosure Committee meets on a quarterly basis and more often, if necessary, and invites subject matter experts to meetings, as appropriate. We have policies and procedures in place designed to provide appropriate information of any matters to our Disclosure Committee that should be considered in advance of applicable public filings, including cybersecurity matters, and to address the proper handling and escalation of information to management and the Board of Directors or a committee of the Board of Directors. In addition to the oversight of the Board of Directors, members of our management are responsible for assessing and managing material cybersecurity risks.


text: Our CISO served as the CISO for Hertz Global Holdings, Inc. (Hertz), and prior to joining Hertz, held progressively senior information security roles at Hitachi Vantara LLC, Hewlett-Packard Company, Symantec Corp. and Marketo, Inc.


text: Our CPO previously served as the Global Data Privacy Officer for Hitachi Vantara LLC and prior to that practiced at the law firm of Littler Mendelson, P.C. as an attorney specializing in data privacy among other areas.


text: Our Chief Information Officer (CIO) has over 20 years at Unisys with experience and knowledge of IT infrastructure, systems and operations; and previously our CIO spent two years as the CIO for Whitney, Bradley & Brown, Inc. (n.k.a. Serco Inc.). At Unisys, the CIO partners with our CISO and CPO on cybersecurity risk management matters.


text: Protecting information, including that of our clients, is a top priority. Our overall cybersecurity and privacy strategy is to protect our customers' information and assets as well as ours to enable agility in the business. We have expertise, dedicated resources and technology to identify, assess, respond to and mitigate material risks from cybersecurity threats. Our Global Information Security organization (GIS), led by our Chief Information Security Officer (CISO), manages Unisys' cybersecurity risk identification, detection, assessment, response, mitigation and remediation processes, and interfaces with other departments, including business units, the information technology and legal departments, and enterprise risk management, to facilitate the risk management processes and ensure the policies and procedures established by GIS are integrated into our overall enterprise risk management system. GIS processes also work in tandem with the processes maintained by our Global Privacy Office (GPO).


text: Through our GPO, we deploy functional and business unit-specific approaches to data and privacy compliance sharing threat intelligence daily and collaborate closely with the Corporate Information Technology (CIT) organization to build process and playbooks for cyber-resiliency. Taking into consideration the processes established by GIS and CIT, our GPO has developed a framework of policies, procedures and other initiatives that are implemented across Unisys to help meet data privacy requirements. Our GPO is supported by a network of data protection officers, attorneys and privacy specialists; and manages privacy software that is used across Unisys to facilitate privacy impact assessments. The GPO also records data processing activities, maps data flows and follows evolving privacy regulatory guidance for countries in which we operate and adjusts standards as necessary.


text: Our dedicated cybersecurity incident response team, the Security Incident Response Team (SIRT), is comprised of internal resources and an external vendor, Managed Security Services Provider (MSSP). The MSSP triages and validates true positive events and then communicates to the internal SIRT team for deeper investigation and response.


text: Our physical and technological cybersecurity controls include, among other items: • perimeter and endpoints firewalls, intrusion prevention systems, endpoint detection and response, Attack Surface Management, multi-factor authentication and email protection; • routine testing of and training on our IT systems, including test phishing emails and awareness training opportunities; • automation and alerts via embedded tools and procedures to monitor data and notify us of threats or other potential unauthorized occurrences on or conducted through our systems; • multiple mechanisms by which employees can report cybersecurity and data privacy concerns, including a "Report Phish" button in the email application; • a vulnerability management program designed to protect our external and internal networks and critical assets; • bug bounty capability, enabling ethical hackers to simulate real-world attacks to identify and report vulnerabilities; • secure coding and development; and • security and operations framework and tools.


text: We design and assess our cybersecurity policies, standards and practices following recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. We have established written policies that are provided to all associates regarding identification, classification of severity and escalation of cybersecurity incidents and we provide annual and ongoing cybersecurity awareness training for our associates — including regular training on information security and data privacy policies. We also perform internal audits on our cybersecurity and data privacy practices.


text: We regularly engage third-party cybersecurity experts to supplement our cybersecurity risk management efforts, including those we engage to conduct periodic cybersecurity risk assessments. During 2024, Unisys engaged an external security firm to conduct several cybersecurity tabletop exercises. Additionally, we worked with an audit firm and directed several audits related to cybersecurity.


text: Unisys recognizes the importance of overseeing and identifying material risks from cybersecurity threats associated with our use of third-party service providers. We have a Third Party Risk Management (TPRM) program, which is integrated into our procurement process and involves cybersecurity risk oversight and identification components. Our TPRM program includes policies and standards requiring that we perform cybersecurity due diligence reviews on our vendors based on the risk profile of a particular supplier or service provider or the service they provide. We also monitor certain of our principal suppliers and service providers on an ongoing basis by using an outside-in, hacker perspective of a company's cybersecurity posture through an external service provider. Whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect Unisys, including its business strategy, results of operations, or financial condition and if so, how.


text: The information set forth under "Risk Factors" (Part I, Item 1A of this Form 10-K) — "We have been and could be vulnerable to disruption in our IT systems, cyber incidents, security breaches and loss of data (associate and client) that have occurred, and may continue to occur, and have resulted in and could continue to result in the incurrence of significant costs and harm to our business and reputation." — on page 15 of this Annual Report on Form 10-K is hereby incorporated by reference. As of December 31, 2024, our financial condition, results of operations or business strategy have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.


text: Cybersecurity Governance Board Oversight of Risks from Cybersecurity Threats Cybersecurity risk oversight continues to remain a top priority for the Board of Directors. The Board of Directors is responsible for oversight of Unisys' information security program, including compliance and risk management, and the review of cybersecurity risks. The Security and Risk Committee (S&RC), a Board committee comprised entirely of independent directors, assists the Board of Directors in these oversight responsibilities. Additionally, the Audit and Finance Committee has general oversight over Unisys' cybersecurity as it relates to responsibility for Unisys' internal audit function, including cybersecurity practices, compliance with legal and regulatory requirements, and internal control over financial reporting.


text: The S&RC's responsibilities include monitoring Unisys' enterprise risk profile and its ongoing and potential exposure to risks of various types and reviewing crisis preparedness; incident response plans; summaries of any incidents or activities; and reports or presentations from management or advisors, including third-party experts, regarding the management of enterprise risk program. The S&RC periodically meets with the CISO and Chief Privacy Officer (CPO) and briefs the full Board of Directors on cybersecurity matters.


text: Our S&RC chair has previously served in the role of Chief Information Officer at two large companies for over 15 years. Other members of the S&RC have extensive years of executive and operational leadership experience at several global technology and telecommunications companies. Management's Role in Assessing and Managing the Company's Material Risks from Cybersecurity Threats.


text: The Disclosure Committee, a senior executive leadership committee, assists in fulfilling our obligations to maintain disclosure controls and procedures and oversees the process of preparing our periodic securities filings with the Securities and Exchange Commission. Cybersecurity incidents, based on their severity, are escalated to the Disclosure Committee by the SIRT. The Disclosure Committee is comprised of the Chief Executive Officer, Chief Operating Officer, Chief Financial Officer, General Counsel, Chief Compliance Officer and Chief Accounting Officer. The Disclosure Committee meets on a quarterly basis and more often, if necessary, and invites subject matter experts to meetings as appropriate. We have policies and procedures in place designed to provide appropriate information of any matters to our Disclosure Committee that should be considered in advance of applicable public filings, including cybersecurity matters, and to address the proper handling and escalation of information to management and the Board of Directors or a committee of the Board of Directors. In addition to the oversight by the Board of Directors, members of our management are responsible for assessing and managing material cybersecurity risks. Our CISO has over 34 years of experience in cybersecurity, applications, infrastructure and networks in information security.


text: Our CPO has over 8 years of experience serving as a Global Data Privacy Officer and practicing law specializing in data privacy among other areas.


text: Our Chief Information Officer (CIO) has over 20 years at Unisys with experience and knowledge of IT infrastructure, systems and operations. At Unisys, the CIO partners with our CISO and CPO on cybersecurity risk management matters.


text: We have implemented a layered cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems, networks, and data systems. Our cybersecurity program is generally aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Information Security Team and Governance.

companyName: GARTNER INC

ticker: IT


text: The Audit Committee has the primary responsibility of assisting our Board of Directors in overseeing risk related to cybersecurity matters. The Board and/or the Audit Committee receive quarterly cybersecurity-related reports from our Chief Information Officer (CIO), which may address a wide range of topics, such as: cybersecurity strategy, the threat environment, the status of ongoing information security program initiatives, and information security program metrics. Additionally, we have documented protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported to the Board and/or the Audit Committee.


text: At the management level, our CIO, who reports directly to the CEO, has over 20 years of experience serving in IT management, software development, and technology-based roles across a variety of industries, including publishing, media and entertainment, and financial and insurance services. Our Chief Information Security Officer (CISO), who reports directly the CIO, has extensive cybersecurity knowledge and skills gained from over 15 years of work experience serving in security roles for the Company and a variety of financial service firms. Our CISO is responsible for understanding, managing, and communicating cybersecurity risk internally to our management, and works closely with Legal to oversee compliance with legal, regulatory, and contractual security requirements.


text: Our CISO heads the Information Security Team, which is responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across our business. The Information Security Team covers a wide range of cyber and information security responsibilities. Our CISO also receives reports on cybersecurity threats on an ongoing basis and regularly reviews risk management measures implemented by the Company to identify and mitigate cybersecurity risks. In addition to our internal capabilities, we also engage external consultants, legal counsel, or other third-party advisors to assist with assessing, identifying, and managing cybersecurity risks. Risk Management and Strategy.


text: Cybersecurity risk management, which involves resource commitments and management attention, is overseen both as a critical component of our overall risk management program and as a standalone program. We have implemented a risk-based, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents.


text: Our cybersecurity program uses a layered strategy, relying on technology and human processes to safeguard our client's data at all layers. We embed controls within our business processes and technology development, starting with design and engineering and extending to operations. Our defense-in-depth strategy utilizes numerous layers of security controls, processes, and procedures across our information systems and networks, including but not limited to, vulnerability management, multi-factor authentication (MFA), identity access management (IAM), endpoint security, mobile security, application security, encryption, network security, web security, and event monitoring and logging. Aspects of our program undergo several independent third-party audits and reviews on a regular basis.


text: We maintain a written Information Security Policy, which establishes the foundational components of our cybersecurity program and our high-level security responsibilities over all technologies, facilities and data. When engaging service providers and third-party vendors, we perform due diligence to assess whether these providers have appropriate privacy and security controls, and we generally require these providers to implement appropriate protective measures, and to use confidential information solely for the purposes of performing their services.


text: Additionally, we have adopted a documented Incident Response Plan that applies in the event of a cybersecurity incident to provide a standardized framework for response. In general, our incident response process follows the NIST 800-61 framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation.


text: We have implemented a security training and awareness program for all Gartner employees and third-party contractors. Employees receive security training in connection with onboarding as well as annual awareness and training activities throughout their employment. Further, Gartner carries cybersecurity insurance covering the company and its subsidiaries. Material Cybersecurity Risks, Threats & Incidents.


text: While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Report under the heading "Strategic and Operational Risks – We are exposed to risks related to cybersecurity," which should be read in conjunction with the foregoing information.


text: At the management level, our CIO, who reports directly to the CEO, has over 20 years of experience serving in IT management, software development, and technology-based roles across a variety of industries, including publishing, media and entertainment, and financial and insurance services. Our Chief Information Security Officer (CISO), who reports directly to the CIO, has extensive cybersecurity knowledge and skills gained from over 15 years of work experience serving in security roles for the Company and a variety of financial service firms. Our CISO is responsible for understanding, managing, and communicating cybersecurity risk internally to our management, and works closely with Legal to oversee compliance with legal, regulatory, and contractual security requirements.


text: Risk Management and Strategy We have developed, implemented and maintained robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. These measures are included within our overall risk management process. As part of this process, all detected cybersecurity threats and incidents are logged and escalated to the Chief Information Security Officer ("CISO") and Chief Compliance Officer, who report to our Chief Legal Officer.

companyName: Light & Wonder, Inc.

ticker: LAWIL


text: We follow a formal cybersecurity incident response policy, which provides for use of third-party service providers where circumstances dictate it is necessary. Our cybersecurity incident response policy is aligned with the standards set forth by the International Organization for Standardization ("ISO") and the National Institute of Standards and Technology ("NIST"), and it includes proactive steps to prepare for attempts to compromise our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats and to protect against, detect and respond to cybersecurity incidents, we undertake the below activities: • closely monitor emerging data protection laws and implement changes to our processes designed to comply; • undertake an annual risk assessment and review of our consumer facing policies, business changes and statements related to cybersecurity, or more frequently as needed; • proactively inform our customers of substantive changes related to customer data handling; • conduct annual customer data handling and use requirements training for all our employees and contingent workers; • conduct annual cybersecurity management and incident training for employees and contingent workers involved in our systems and processes that handle sensitive data; • conduct regular phishing email simulations for all employees and all contingent workers with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data in accordance with local laws and regulations; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; and • use an internal well-tested incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident. Where circumstances dictate the use of third-party service providers, such services include regular assessments of our cybersecurity program including cyber maturity assessments and penetration tests; evaluation and approval of our critical business partners and vendors; and participating in incident response processes. As part of our cybersecurity incident response policy, we identify, evaluate and mitigate any risks posed from engaging with any third-party service provider. In 2023 we did not experience any cybersecurity incident that materially affected or was reasonably likely to materially affect our operations, business, results of operations, cash flows or financial condition.


text: Governance and Oversight The Board of Directors is central to oversight of cybersecurity risks. The Board of Directors is composed of members with diverse expertise, including risk management, technology, finance and legal, and they have appropriate access to management and third parties (as deemed necessary), equipping them to oversee cybersecurity risks effectively. Day-to-day cybersecurity monitoring and oversight activities are delegated to management.


text: Our CISO is primarily responsible for assessing, monitoring and managing cybersecurity risks as well as overseeing employee training programs. Our CISO has served in this role since July 2019, has a Master's Degree in Information Security from the University of London, has been working in technology risk management since the early 1990s, holds Certified Information Systems Security Professional status and is a member in good standing of the Institute of Electrical and Electronics Engineers ("IEEE") and the International Information System Security Certification Consortium ("ISC2"). The CISO reports at least annually to the Board of Directors on material cyber risks, including those identified in our business and rising threats, and the current state of L&W's information security and will continue to do so on a regular basis as needed.


text: The CISO and his team evaluate quantitative and qualitative factors to determine if a cybersecurity threat or incident needs to be escalated to other members of management and ultimately to the Board of Directors. The factors evaluated include but are not limited to: actual or potential monetary damages, number of impacted employees or customers, nature of the records compromised, potential impact on customer relationships, public knowledge and likely effect on L&W's reputation. Depending on the severity of the impact on these factors, management, including the CISO, Chief Compliance Officer, Chief Accounting Officer ("CAO") and Chief Legal Officer, meets as part of a management committee to determine if an incident is material. In the event the management committee determines that a cybersecurity incident or threat is material, the incident or threat is elevated and reviewed with our Board of Directors. The management committee reports all incidents requiring a materiality assessment to the Chief Legal Officer, regardless of whether such committee ultimately determines a cybersecurity incident to be material.


text: For additional information regarding how cyber security threats could materially affect or are reasonably likely to materially affect our business strategy, results of operations or financial condition, see the risk factors captioned "Our success depends on the security and integrity of the systems and products we offer, and security breaches, including cybersecurity breaches, or other disruptions could compromise our information or the information of our customers and expose us to liability, which would cause our business and reputation to suffer," "We rely on information technology and other systems, and any failures in our systems or errors, defects or disruptions in our products and services could diminish our brand and reputation, subject us to liability and have disrupted and could disrupt our business and adversely impact our results," and "If we or a company we acquire sustains cyber-attacks or other privacy or data security incidents that result in security breaches, we could suffer a loss of sales and increased costs, exposure to significant liability, reputational harm, regulatory fines or punishment and other negative consequences" under the heading "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K for additional information.


text: Risk Management and Strategy We have developed, implemented and maintained robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. These measures are included within our overall risk management process. As part of this process, all detected cybersecurity threats and incidents are logged and escalated to the Chief Information Security Officer ("CISO") and Chief Compliance Officer, who report to our Chief Legal Officer. Annually or more frequently if needed, the CISO meets with the other stakeholders to assemble the company's Risk Register. Cyber risks are an integral part of this process and the CISO and their team regularly assess the current cyber risk landscape, assess L&W's susceptibility to those cyber risks, and use that analysis as feedback to the overall Risk Register.


text: We follow a formal cybersecurity incident response policy, which provides for use of third-party service providers where circumstances dictate it is necessary. Our cybersecurity incident response policy incorporates recommendations from the International Organization for Standardization ("ISO") and the NIST, and it includes proactive steps to prepare for attempts to compromise our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and to protect against, detect and respond to cybersecurity incidents, we undertake the below activities: • closely monitor emerging data protection laws and implement changes to our processes designed to comply; • undertake an annual risk assessment and review of our consumer facing policies, business changes and statements related to cybersecurity, or more frequently as needed; • proactively inform our customers of substantive changes related to customer data handling; • conduct annual customer data handling and use requirements training for all our employees and contingent workers; • conduct annual cybersecurity management and incident training for employees and contingent workers involved in our systems and processes that handle sensitive data; • conduct regular phishing email simulations for all employees and all contingent workers with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data in accordance with local laws and regulations; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; and • use an internal well-tested incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident. Where circumstances dictate the use of third-party service providers, such services include regular assessments of our cybersecurity program including cyber maturity assessments and penetration tests; evaluation and approval of our critical business partners and vendors; and participating in incident response processes. As part of our cybersecurity incident response policy, we identify, evaluate and mitigate any risks posed from engaging with any third-party service provider. As of December 31, 2024, we are not aware of any cybersecurity incident in the past year that materially affected or was reasonably likely to materially affect our operations, business, results of operations, cash flows or financial condition.