text: Bank policies and processes are designed such that the board would receive prompt and periodic information from management or the Security Governance Committee on any cybersecurity or information security incident or threat that may pose significant risk to the Bank and would continue to receive regular reports on any incident or threat until its conclusion. The Bank's Enterprise Risk and Operations Committee also receives regular presentations and reports throughout the year on cybersecurity and information security addressing a broad range of topics, including updates on technology trends, regulatory developments, legal issues, policies and practices, information security resources and organization, the threat environment and vulnerability assessments, and specific and ongoing efforts to prevent, detect, and respond to potential gaps, internal and external incidents and critical threats. At least quarterly, or more often, as necessary, the Enterprise Risk and Operations Committee discusses cybersecurity and information security risks with the Bank's chief information officer and chief information security officer.


text: The Bank's board annually reviews and approves the Bank's risk management policies. The Bank develops mitigation plans, monitors tactical implementation, and engages in detailed gap analysis, risk assessments and monitors remediation plans to close any outstanding gaps, all of which are overseen by the Bank's Security Governance Committee. Cybersecurity risk management is integrated with the Bank's overall risk management framework overseen by the Bank's board. Bank policies establish administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Bank information in accordance with Finance Agency regulations and applicable laws. The Bank's cyber incident response plan determines how cybersecurity threats and incidents are identified, classified, escalated, and reported to senior management and the board. The cyber incident response plan also stipulates management's materiality assessment of the threat or incident for the purposes of public disclosure. The Bank's cyber incident response plan includes third party cybersecurity incidents and threats.

companyName: Federal Home Loan Bank of Atlanta

secItem: Item 1C


text: The business continuity management program is designed to oversee and implement resilience, continuity, and response capabilities to safeguard employees, products and services, minimize financial losses and the impact to service to members during a disruption event. A disruption event includes the unavailability of information technology assets due to cybersecurity threats or incidents and other unintentional events like fire, power loss, and other technical incidents such as hardware failures. The business continuity management program provides planning for the restoration of facilities, communications, information technology systems, personnel, and other components necessary for the continuity of critical Bank processes. The business continuity management policy is overseen by the board.


text: The Bank retains external consultants to assist in the development and monitoring processes for assessing, identifying, and managing cybersecurity incident and threat risk. The Bank engages third-party services to conduct evaluations of security controls, whether through penetration testing, independent audits or consulting on practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. The Bank also requires subcontractors to report on cybersecurity incidents so the Bank can assess their impact. As part of the Bank's vendor management process, the Bank undertakes due diligence of third-party systems with whom the Bank will interact, including risk profiling and classification, in addition to requiring data protection covenants in its vendor agreements. The Bank's vendor risk management program includes regular reviews and oversight of all service providers in accordance with a risk profile classification. The Bank reviews vendor performance, relevant technologies utilized by vendors and promotes escalation of any unsatisfactory reviews, as part of Bank's continuous assessment of its vendors.


text: During the period covered by this report, risks from cybersecurity incidents or threats did not have a material impact on the Bank's strategy, results of operations, or financial condition. The Bank has experienced cybersecurity incidents and threats in the past, none of which have had a material effect on the Bank's financial condition or results of operations. Cybersecurity incidents may occur in the future and any such cybersecurity incident could result in significant adverse impact to the Bank, the Bank's members, and their customers. The Bank is prepared to assess materiality of any such cybersecurity incident from several perspectives including, but not limited to, the Bank's ability to continue to service its members and protect the privacy of their data entrusted to the Bank, lost revenue, disruption of business operations, increased operating costs, litigation, and reputational harm.


text: Cybersecurity Governance The Bank's board of directors devotes significant time and attention to data and systems protection, including cybersecurity and information security risk. The board of directors Enterprise Risk and Operations Committee (EROC) oversees the Bank's information security program through setting of policies and the Bank's risk management framework and has oversight of the cybersecurity risk management efforts which include risks from cybersecurity threats and has assigned specific controls for the mitigation, monitoring and reporting associated with those risks. The board also oversees management's approach to staffing, and processes and practices to gauge and address cybersecurity and information security risk. The board receives reports on management of cybersecurity risk and implementation of cybersecurity risk management as well as presentations and reports on cybersecurity effectiveness assessments and monitoring updates, along with management's recommendations regarding Bank's information security policies.


text: The Bank's Security Governance Committee is led by the chief information security officer and has a cross-functional membership comprised of representatives from the Bank's operational risk, information security, information technology, legal, operations, and other departments that provide both operational, specialized, technical and multidisciplinary expertise to the committee. The committee has integrated oversight of the information security program, the physical security program, and is responsible for reviewing security policies and procedures, security exceptions and violations, the processes and standards to implement the policies and procedures defined in the cybersecurity risk management program, the Bank's cyber incident response plan, the security awareness program and implementation reports, and for providing guidance and monitor progress on major information security projects, and regulatory changes and requirements.


text: T he Security Governance Committee meets regularly and receives prompt and periodic information, as needed or applicable pursuant to Bank policies and plans, from the Information Security Department which in turn provides periodic, regular and prompt reporting to senior management. Reports include topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, project development and implementation, any cybersecurity incidents or threats occurred, as well risk assessment, management and monitoring updates, as applicable and as needed.


text: Cybersecurity Risk Management Cybersecurity is critical to supporting our business and protecting our customers in an increasingly complex environment. We face a variety of cybersecurity threats including attacks that are common to most industries, such as ransomware and denial-of-service, as well as attacks from advanced and highly organized adversaries targeting financial services companies. Our information systems have from time to time experienced such attacks despite our best efforts to prevent them. Our customers, suppliers, and other third parties also face similar cybersecurity threats, and a cybersecurity incident impacting any party could have a material impact on our operations, performance, or operating results. None of these threats or incidents have to date materially affected our business strategy, results of operations, or financial condition. However, we cannot assure that any future security breaches will not occur or that any such events that have occurred or may occur in the future will not result in material harm to our business, operations, reputation or profitability. These threats and related risks highlight the importance of allocating resources to protect the Company and our customers.

companyName: HOME BANCSHARES INC

ticker: HOMB


text: The Information Security Program is led by the Chief Information Security Officer ("CISO"), who reports to the Chief Risk Officer. The Chief Risk Officer has oversight of the Company's risk management framework, which includes the Information Security Program. The CISO provides program oversight and direction, including adjustments in response to changes in technology, threats, business processes, and regulatory or statutory requirements. The CISO works collaboratively with information technology staff, operational management, and functional stakeholders to implement a program designed to protect our information systems from cybersecurity threats and promptly respond to potential cybersecurity incidents. The CISO has over 24 years of experience in the fields of information technology and cybersecurity, most at a Fortune 500 global technology company, and maintains multiple professional cybersecurity certifications.


text: Our Information Security Program consists of several elements including: • Incident Monitoring and Response. We have 24x7 security cybersecurity monitoring, which utilizes both third-party cybersecurity experts and leading tools to monitor activity in our information systems. We also maintain an incident response plan and playbooks that define our response to a cybersecurity incident, including a cross-functional incident response process that includes key stakeholders such as senior leaders and legal, and leverages our technological resources and third-party service providers. Through ongoing communication with these teams, the CISO monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents in real time, and reports such incidents to leadership when appropriate pursuant to internal guidelines governing the reporting of such events. • Threat and Vulnerability Management. We maintain a threat and vulnerability management program that leverages multiple data sources to proactively identify, assess, and mitigate changing cybersecurity risks. This program incorporates vulnerability scanning and threat intelligence capabilities, which are in place to help safeguard information assets. We also share and receive threat intelligence with government agencies, the Financial Services Information Sharing and Analysis Center ("FS-ISAC") and cybersecurity vendors and leaders in the cybersecurity industry. • Infrastructure and Data Protection. We have technical and organizational safeguards that are designed to protect our networks, systems, and data from cybersecurity threats, including: firewalls, intrusion prevention and detection systems, network and endpoint anti-malware protections, and access controls such as privileged access management. Our information security and information technology teams collaborate regularly to assess the security of current and future infrastructure changes. • Third-Party Risk Management. We run a third-party risk management program designed to identify and manage risks, including cybersecurity risks, involving our third-party providers. This includes performing due diligence and assessment of each provider's cybersecurity posture as well as periodic re-assessments. • Security Training and Awareness. We provide ongoing education and training to employees regarding cybersecurity threats and the role they play in helping prevent and detect these threats. This includes regular phishing simulations, with training provided for any failures, as well as periodic communications via the internal company portal concerning threats, best practices, and technology changes to improve security. We also work with the Company marketing department to periodically publish articles on our website to raise security awareness with our customers.


text: Our cybersecurity program is evaluated regularly by both the internal audit function as well as third-party audit firms. These audits help ensure our program is appropriate to address the changing threat landscape and aligns to industry standards such as the National Institute of Standards and Technology Cybersecurity Framework, as well as other legal and regulatory guidance including the Federal Financial Institutions Examination Council Cybersecurity Assessment Tool, Conference of State Bank Supervisors Ransomware Self-Assessment Tool, the Gramm-Leach-Bliley Act and the Sarbanes-Oxley Act. Controls are reviewed for adequacy and design at least annually, and both internal and third-party audits aid in identifying areas for continued focus, providing assurance that controls are appropriately designed and operating effectively. Additionally, we meet regularly with examiners from the Federal Reserve and the Arkansas State Bank Department to review our cybersecurity program and discuss the changing threat landscape.


text: Our cybersecurity personnel maintain current knowledge through training, obtaining professional certifications, and participation in industry groups such as FS-ISAC, American Bankers Association and Mid-Sized Banking Coalition of America. Company cybersecurity personnel expand and test their knowledge of cyber threats and countermeasures through additional on-the-job training and periodic simulated exercises to practice their response to real-life threats. We maintain a training budget and personnel are encouraged to obtain formal training and industry-approved certifications as appropriate for their roles and responsibilities. Some of the certifications held by our information security personnel include CERT Insider Threat Program Manager, GIAC Information Security Professional, GIAC Security Leadership, GIAC Continuous Monitoring, GIAC Certified Forensic Analyst, CompTIA Security+ and ISC2 Certified Information Systems Security Professional.


text: Board Oversight and Governance Our Board of Directors (the "Board"), in conjunction with management, is responsible for assessing which risks are warranted and acceptable, based on management's ability to: • identify and understand such risks; • measure the degree of exposure to such risks; • monitor the changing nature of the risk and related exposure; and • develop and implement processes and procedures to control such risks.


text: The Board and management define risk tolerances in the policies of the Company. The Board maintains oversight of risks from cybersecurity related threats, through various committees including the Audit and Risk Committee and the bank's Executive Risk Committee. The CISO reports to the Executive Risk Committee. The CISO provides periodic reports to directors that permit them to measure management's compliance with the defined risk limits and to gauge the changing nature of risk inherent in the Company's chosen lines of business and operations and as a result of changing factors within the Company, such as management and personnel changes, and technology changes. This includes an annual program update to the Executive Risk Committee and the Board. All Board members undergo annual cybersecurity training by third-party cybersecurity experts on cybersecurity threats, industry trends, and other topics relevant to financial institutions. This training and their overall knowledge of the financial industry provides a solid foundation for understanding cyber risk and their oversight responsibility.


text: Executive Risk Committee. The Executive Risk Committee ("ERC") is responsible for oversight of our bank subsidiary's enterprise risk management framework and overall risk management practices and includes members of our Board, the board of directors of our bank subsidiary, and both executive and senior level management of the bank. The ERC oversees the policy review and approval program based upon the risk appetite of the Board, assists in the development and monitoring of risk identification and escalation processes, ensures that ongoing monitoring is in place to identify risks that could affect the achievement of the Company's key strategic goals and objectives, and ensures that the Board has the proper information to adequately assess the risks facing the Company. Cybersecurity reports and issues are presented at least quarterly to the ERC.


text: Information Technology/Security Committee. The Information Technology/Security Committee ("ITSC") is a management level committee that serves at the direction of the Board and provides oversight of the Company's information technology and information security programs. The members of the ITSC include management and leaders with an expansive background in information technology and cybersecurity. The ITSC meets monthly to review information security and information technology reports and issues. It reports meeting minutes to the Board and ensures the Board has the proper information to adequately assess the risks facing the Company by maintaining oversight of: • effective strategic information technology and information security planning and performance; • major projects, priorities, and overall performance; • the adequacy and allocation of resources; and • the risks involved with the information technology and information security functions.


text: The Information Security Program is led by the Chief Information Security Officer ("CISO"), who reports to the Chief Risk Officer. The Chief Risk Officer has oversight of the Company's risk management framework, which includes the Information Security Program. The CISO provides program oversight and direction, including adjustments in response to changes in technology, threats, business processes, and regulatory or statutory requirements. The CISO works collaboratively with information technology staff, operational management, and functional stakeholders to implement a program designed to protect our information systems from cybersecurity threats and promptly respond to potential cybersecurity incidents. The CISO has over 25 years of experience in the fields of information technology and cybersecurity, most at a Fortune 500 global technology company, and maintains multiple professional cybersecurity certifications.


text: Our cybersecurity program is evaluated regularly by both the internal audit function as well as third-party audit firms. These audits help ensure our program is appropriate to address the changing threat landscape and aligns to industry standards such as the National Institute of Standards and Technology Cybersecurity Framework, Conference of State Bank Supervisors Ransomware Self-Assessment Tool, the Gramm-Leach-Bliley Act and the Sarbanes-Oxley Act. Controls are reviewed for adequacy and design at least annually, and both internal and third-party audits aid in identifying areas for continued focus, providing assurance that controls are appropriately designed and operating effectively. Additionally, we meet regularly with examiners from the Federal Reserve and the Arkansas State Bank Department to review our cybersecurity program and discuss the changing threat landscape.


text: The Board and management define risk tolerances in the policies of the Company. The Board maintains oversight of risks from cybersecurity related threats, primarily through the Audit and Risk Committee and the directors that serve on the bank's Executive Risk Committee. The CISO reports to the Executive Risk Committee. The Company's Information Technology/Security Committee and the CISO provide periodic reports to directors that permit them to understand the cybersecurity risk landscape, assess the Company's strategies and resources for addressing cybersecurity threats, measure management's compliance with the defined risk limits and gauge the changing nature of risk inherent in the Company's chosen lines of business and operations and as a result of changing factors within the Company, such as management and personnel changes, and technology changes. This includes an annual program update to the Executive Risk Committee and the Board. All Board members undergo annual cybersecurity training by third-party cybersecurity experts on cybersecurity threats, industry trends, and other topics relevant to financial institutions. This training and their overall knowledge of the financial industry provides a solid foundation for understanding cyber risk and their oversight responsibility.


text: Cybersecurity Risk Management and Strategy We are subject to the risk of a cybersecurity incident. A cybersecurity incident is an unauthorized occurrence, or a series of related unauthorized occurrences, through information systems that jeopardizes the confidentiality, integrity, or availability of our information systems or any information residing therein. Information systems are any electronic information resources, owned or used by us, including physical or virtual infrastructure controlled by such information resources, or their components, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information to maintain or support our operations. For additional information, see Item 1A Risk Factors for a description of cybersecurity incident risk.

companyName: Federal Home Loan Bank of Indianapolis


text: We have a cybersecurity risk management framework for assessing, identifying, and managing material risks from cybersecurity incidents that is designed to protect the confidentiality, integrity, and availability of our information technology assets and data. Cybersecurity risk management is part of our enterprise risk management program. We have implemented processes for assessing, identifying, and managing material risks from cybersecurity incidents that may directly or indirectly impact our business strategy, results of operations, or financial condition. Those processes include the development, approval and implementation of our Enterprise Information Security Policy ("EISP"), Information Security Standards, Information Security Incident Response Plan ("ISIRP") and Business Continuity Management Policy.


text: The EISP is our core policy for assessing, identifying and managing cybersecurity risks, and it applies to all employees, contractors, temporary employees, and other parties doing business on behalf of or in support of the Bank who, by the nature of their work, have access to our information assets and systems. Broadly, it establishes the administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Bank information in accordance with the applicable law. To do this, the EISP, among other provisions: • allocates key responsibilities, including the responsibilities of our chief information security officer ("CISO") and our Chief Risk Officer ("CRO") related to cybersecurity risk management; • establishes a security education, training and awareness program, which is intended to influence development of skills and habits to safeguard our information assets; • establishes a risk-based vulnerability management program; • mandates and establishes standards for periodic penetration testing; • provides controls and minimum standards regarding physical security (e.g., systems are located behind locked doors) and operational security (e.g., monitoring existing and emerging threats); • mandates the development, acquisition and maintenance of systems with appropriate security controls (e.g., maintaining appropriate configuration management and control processes and maintaining appropriate patch management processes); and • mandates the adoption of industry standards to address business requirements within a cybersecurity framework that leverages both the National Institute of Standards and Technology framework and the Center for Information Security Controls in measuring the maturity of our information security program and its adoption of best practices.


text: Our Information Security Standards provide rules for the implementation of the EISP. These standards provide greater granularity on the Bank's requirements for the establishment, maintenance and continuous improvement of our information security program.


text: The ISIRP determines how information security incidents are identified, classified, and escalated, including for the purposes of reporting, and providing relevant information to the board of directors. The ISIRP also supports management's assessment of incident materiality.


text: The ISIRP also includes action plans for responding to third-party cybersecurity threats and incidents. We undertake due diligence of third-party systems with which we interact, in addition to requiring data protection covenants in the related third-party provider agreements, as appropriate. Our vendor management program includes ongoing monitoring and oversight of the third-party providers, including performance and information security reviews utilizing System and Organization Control reports, when available, and risk based re-assessment of high inherent-risk third-party providers on an annual basis. Any unsatisfactory reviews are escalated for consideration of appropriate steps to appropriately manage the related risk.


text: We leverage certain third-party providers to support our security event monitoring. In addition, certain third parties support our vendor security due diligence process. We may retain assessors, consultants, auditors, etc. to assist in the development/creation/monitoring of those processes for assessing, identifying, and managing cybersecurity incident risk.


text: Our business continuity program includes the maintenance of resources necessary to protect us from potential loss during a disruption, which includes the unavailability of information technology assets due to unintentional events like fire, power loss, and other technical incidents such as hardware failures. The business continuity program includes, among other items, business impact analysis for developing effective plans and a disaster recovery plan to respond, recover, resume, and restore technology assets critical for us to operate.


text: During the period covered by this report, we have not experienced any cybersecurity incidents that have had a material effect on our financial condition or results of operations. We assess the materiality of any cybersecurity incident from several perspectives including, but not limited to, our ability to continue to service our members and protect private information, lost revenue, disruption of business operation, increased operating costs, litigation, and reputational harm.


text: Cybersecurity Governance Our board provides oversight of our risk management program, which includes cybersecurity risk management, via its Risk Oversight Committee. Among its responsibilities, the Risk Oversight Committee reviews and discusses, from a risk oversight point of view, reports on the Bank's current and emerging security risks, the metrics used to monitor security risks and management's views on the acceptable and appropriate levels of security risk. The Risk Oversight Committee also reviews and makes recommendations to the board regarding the approval of the EISP.


text: Our board's Security and Technology Committee ("STC") reviews the overall status of management's information security program, including any significant issues, significant emerging risks, strategies, and other information to ensure that information security management practices appropriately address potential risks. It is also responsible for the exposure and containment of technology risks, including security risks.


text: In addition, our board and/or the STC receives regular presentations and reports throughout the year on cybersecurity and information security risk. These presentations and reports address a broad range of topics, including updates on technology trends, regulatory developments, legal issues, policies and practices, information security resources and organization, the threat environment and vulnerability assessments, and specific and ongoing efforts to prevent, detect, and respond to internal and external incidents and critical threats. In addition, the CISO provides prompt and timely information on any cybersecurity or information security incident that may pose significant risk to us and continues to provide regular reports on any such incident until its conclusion.


text: Under the management and direction of the Chief Information Officer, the CISO is responsible for assessing and managing our material risks from cybersecurity threats. The CISO also has a dotted line reporting relationship to the CRO for purposes of informing the CRO on related risks. The cybersecurity risk management function under the CRO is responsible for identifying, assessing and evaluating cybersecurity risks and monitoring and tracking cybersecurity risk mitigation strategies.


text: The CISO leads an Information Security Steering Committee ("ISSC") which convenes expertise from areas beyond the information security and technology departments, including risk, legal and operations, or other departments, as necessary. Accordingly, the ISSC provides for an interdisciplinary expertise in the implementation of our cybersecurity risk management framework. The CISO reports on behalf of the ISSC to management's Risk Committee. These reports include information on topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, and any cybersecurity incidents.


text: The CISO and the CRO are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents with the support of our information security department.


text: Our information security department, which is led by the CISO, is comprised of specialized professionals who are responsible for the day-to-day, hands-on management of the cybersecurity risk and who handle the processes and procedures to mitigate and implement protective, proactive and reactive measures to protect us against those risks. The department is responsible for developing, documenting, and approving our technical information security control standards, guidelines, and procedures designed to preserve the confidentiality, integrity, and availability of our information technology assets and data.


text: Our CISO holds a degree in information systems design and analysis and advanced degrees in telecommunications and information technology management. He has over 24 years of experience leading Information Security teams and over a decade as a senior leader within Information Security.


text: For additional information, see Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations - Risk Management.


text: We have a cybersecurity risk management program for assessing, identifying, and managing material risks from cybersecurity incidents that is designed to protect the confidentiality, integrity, and availability of our information technology assets and data. Cybersecurity risk management is integrated into the overall enterprise risk management program. We have implemented processes for assessing, identifying, and managing material risks from cybersecurity incidents that may directly or indirectly impact our business strategy, results of operations, or financial condition. Those processes include the development, approval and implementation of our Enterprise Information Security Policy ("EISP"), Information Security Standards, Information Security Incident Response Plan ("ISIRP") and Business Continuity Management Policy.


text: The EISP is our core policy for assessing, identifying and managing cybersecurity risks, and it applies to all employees, contractors, temporary employees, and other parties doing business on behalf of or in support of the Bank who, by the nature of their work, have access to our information assets and systems. Broadly, it establishes the administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Bank information in accordance with the applicable law. To do this, the EISP, among other provisions: • allocates key responsibilities, including the responsibilities of our chief information security officer ("CISO") and our Chief Risk and Compliance Officer ("CRCO") related to cybersecurity risk management; • establishes a security education, training and awareness program, which is intended to influence development of skills and habits to safeguard our information assets; • establishes a risk-based vulnerability management program; • mandates and establishes standards for periodic penetration testing; • provides controls and minimum standards regarding physical security (e.g., systems are located behind locked doors) and operational security (e.g., monitoring existing and emerging threats); • mandates the development, acquisition and maintenance of systems with appropriate security controls (e.g., maintaining appropriate configuration management and control processes and maintaining appropriate patch management processes); and • mandates the adoption of industry standards to address business requirements within a cybersecurity program that leverages both the National Institute of Standards and Technology program and the Center for Information Security Controls in measuring the maturity of our information security program and its adoption of best practices.


text: Our board's Security/Technology Committee reviews the overall status of management's information security program, including any significant issues, significant emerging risks, strategies, and other information to ensure that information security management practices appropriately address potential risks. It is also responsible for the exposure and containment of technology risks, including security risks.


text: In addition, our board and/or the Security/Technology Committee receives regular presentations and reports throughout the year on cybersecurity and information security risk. These presentations and reports address a broad range of topics, including updates on technology trends, regulatory developments, legal issues, policies and practices, information security resources and organization, the threat environment and vulnerability assessments, and specific and ongoing efforts to prevent, detect, and respond to internal and external incidents and critical threats. In addition, the CISO provides prompt and timely information on any cybersecurity or information security incident that may pose significant risk to us and continues to provide regular reports on any such incident until its conclusion.


text: Under the management and direction of the Chief Information Officer, the CISO is responsible for assessing and managing our material risks from cybersecurity threats. The CISO also has a dotted line reporting relationship to the CRCO for purposes of informing the CRCO on related risks. The cybersecurity risk management function under the CRCO is responsible for identifying, assessing and evaluating cybersecurity risks and monitoring and tracking cybersecurity risk mitigation strategies.


text: The CISO leads an Information Security Steering Committee ("ISSC") which convenes expertise from areas beyond the information security and technology departments, including risk, legal and operations, or other departments, as necessary. Accordingly, the ISSC provides for an interdisciplinary expertise in the implementation of our cybersecurity risk management program. The CISO reports on behalf of the ISSC to management's Risk Committee. These reports include information on topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, and any cybersecurity incidents.


text: The CISO and the CRCO are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents with the support of our information security department.


text: Our CISO holds a degree in information systems design and analysis and advanced degrees in telecommunications and information technology management. He has over 25 years of experience leading Information Security teams and over a decade as a senior leader within Information Security.


text: The Bank relies heavily on its information systems and other technology to conduct and manage its business and, as a result, it is subject to cybersecurity threat risk. Cybersecurity threats include potential unauthorized occurrences on or conducted through the Bank's information systems that may result in adverse effects on the confidentiality, integrity, or availability of its information systems or any information residing therein. Cybersecurity threat risks include, but are not limited to, malicious software or the exploitation of vulnerabilities, social engineering (e.g., phishing), denial-of-service attacks, viruses, and/or malware. As further described below, the Bank has implemented processes for assessing, identifying, and managing material risks from cybersecurity threats that are designed to protect the confidentiality, integrity, and availability of its information technology assets and data.

companyName: Federal Home Loan Bank of Dallas


text: Cybersecurity Risk Management and Strategy The Bank's approach to cybersecurity risk management relies upon having the right people, processes, and technology in place to identify, protect, detect, respond, and recover from cybersecurity threats/incidents. The Bank's cybersecurity program aligns with industry standards, specifically the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the NIST 800-53 control framework. The effectiveness of the Bank's cybersecurity program is measured through internal and external audits, Finance Agency regulatory oversight and other third-party control and compromise assessments such as periodic penetration tests and various security assessments. In addition, the Bank's cybersecurity program includes processes and technologies that enhance its ability to detect and respond to cybersecurity threats, including the use of automation, threat intelligence feeds, robust incident response procedures and frequent vulnerability scans and remediation. The Bank's Vulnerability Management Group, which is comprised of members from Information Technology ("IT") Security, IT Infrastructure and Operational Risk Management, meets regularly to discuss details of the Bank's vulnerability management program including, but not limited to, current threats and vulnerabilities, patching status, upcoming technology changes, and current issues or concerns, if any.


text: The Bank's IT Security Program and policies establish safeguards to protect data and information that is used by the Bank's employees, independent contractors, and vendors. The goal of the Bank's cybersecurity risk management processes is to maintain and safeguard the confidentiality and integrity of the Bank's data, and to ensure system availability to protect against cybersecurity threats and vulnerabilities. The Bank maintains IT security policies that are reviewed at least annually and approved by the Bank's Chief Information Officer ("CIO"), appropriate management committees and, for its critical policies, the Bank's Board of Directors. To help ensure the effectiveness of the Bank's IT security policies, all employees are required to participate in annual IT security training and to review and acknowledge the Bank's IT security policies.


text: The Bank maintains an Enterprise Risk Management Framework which is updated and approved at least annually by its Board of Directors. The framework outlines the methodology and elements that are used to manage Bank-wide risks, including cybersecurity risks, and it assigns responsibilities for the Bank's enterprise risk management. The Bank's IT Security department measures cybersecurity risks by way of risk assessments that utilize a scale which includes both the likelihood and impact of risk occurrence. The scale used to measure likelihood and impact is tied to the criteria contained in the Bank's Enterprise Risk Management Framework.


text: The Bank also maintains Incident Response policies and procedures that are invoked in the event of a security breach or incident and which provide, among other things, guidance for the purpose of managing and executing the appropriate level of communication to executive management, the Board of Directors, government agencies, and/or the Finance Agency.


text: The Bank has a Business Continuity Program that sets forth the actions that would be taken to recover business processes in a timely manner in the event of a disruption. The Bank regularly tests its Business Continuity Plan to ensure its relevance and viability. Representatives from the Bank's Business Continuity team work closely with the Bank's business units and IT to help ensure that critical resources are available in the event of an interruption. To ensure its preparedness, the Bank updates its Business Continuity Plan semiannually. In addition, the Bank evaluates and analyzes threat scenarios, and it conducts periodic exercises to demonstrate the Bank's ability to run production systems from an alternate location and to seamlessly return to using production systems at its primary operations centers.


text: The Bank's vendors are subject to a formal vendor management process which includes an assessment of vendor risks (including cybersecurity risks) and ongoing monitoring. When warranted, the Bank seeks independent third-party reports related to the performance of its vendors, such as System and Organization Controls ("SOC") reports that are issued in accordance with Statement on Standards for Attestation Engagements No. 18.


text: While risks from cybersecurity threats have not materially affected nor are they currently expected to materially affect the Bank's business strategy, financial condition or results of operations, the Bank has invested and expects to continue to invest significant resources to maintain and enhance its cybersecurity program.


text: Cybersecurity Governance The Bank's cybersecurity program is managed by its Chief Information Security Officer ("CISO") with oversight from executive management and the Bank's Board of Directors. The CISO reports to both the Bank's CIO and its Chief Risk Officer ("CRO").


text: The Bank's CISO has over 20 years of experience serving in various IT roles, and he maintains a number of technology and cloud certifications, including the Certified Information Systems Security Professional certification.


text: The Bank's IT Infrastructure team, led by the Director of Cloud Infrastructure, is responsible for the hands-on configuration and patch management of the Bank's information systems to ensure the security, reliability, and availability of those systems. The team is comprised of information system and cloud professionals that hold various certifications in systems administration and cloud computing.


text: The Bank's Operational Risk Oversight Committee ("OROC"), led by the CRO, provides oversight of the Bank's operational risk, including cybersecurity risk. OROC meets quarterly and is comprised of senior leaders from the IT (including Security), Legal, Accounting, and Operational Risk Management departments, among others. In addition, matters of cybersecurity importance relating to specific IT projects are discussed and addressed in the Bank's Information Technology Steering Committee, which is led by the CIO and is comprised of senior leaders from across the Bank.


text: The Bank's CISO provides quarterly reports to OROC which include vulnerability management and security incident metrics, the status of security awareness training (including phish-testing results), and the status of any risk-accepted items and remediations. The quarterly reports also include any significant findings from audits, third-party security assessments, and penetration tests. Monthly, the CISO briefs the CRO, CIO, and the Bank's Chief Executive Officer regarding any significant IT security items.


text: The Bank's CISO periodically updates the Board of Directors regarding the Bank's cybersecurity program, including current risks and metrics, the evolving external threat landscape and the results of the Bank's security awareness training. The Risk Management Committee of the Board of Directors, the Board committee that is primarily responsible for the oversight of risks from cybersecurity threats, is briefed quarterly on cybersecurity risks and receives information and metrics that are similar to the information and metrics provided to OROC. In addition, the Board's Strategic Planning, Operations and Technology Committee is briefed, as needed, on security matters relating to specific IT projects.


text: Monthly, the Board of Directors receives an IT status dashboard which includes, among other things, IT security metrics regarding phish-training and vulnerability management.


text: Annually, the CISO prepares the Bank's Annual State of Security report which is provided to executive management, OROC, and the Board of Directors. The report provides data on, and insights into, the top security concerns facing the Bank, such as shifts in the threat landscape, high-priority threats, and trends affecting the banking industry, in addition to security-specific technology changes which have occurred during the current year that could impact the overall risk to the Bank. The report also includes an assessment of the upcoming threats that the Bank could potentially face over the course of the next year and includes recommendations designed to mitigate those threats.


text: Cybersecurity Risk Management and Strategy The Bank's approach to cybersecurity risk management relies upon having the right people, processes, and technology in place to govern, identify, protect, detect, respond, and recover from cybersecurity risks/threats/incidents. The Bank's cybersecurity program aligns with industry standards, specifically the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the NIST 800-53 control framework. The effectiveness of the Bank's cybersecurity program is measured through internal and external audits, Finance Agency regulatory oversight and other third-party control and compromise assessments such as periodic penetration tests and various security assessments. In addition, the Bank's cybersecurity program includes processes and technologies that enhance its ability to detect and respond to cybersecurity threats, including the use of automation, threat intelligence feeds, robust incident response procedures and frequent vulnerability scans and remediation. The Bank's Vulnerability Management Group, which is comprised of members from Information Technology ("IT") Security, IT Infrastructure and Operational Risk Management, meets regularly to discuss details of the Bank's vulnerability management program including, but not limited to, current threats and vulnerabilities, patching status, upcoming technology changes, and current issues or concerns, if any.


text: We are highly dependent on information technology in the operation of our various businesses. Cybersecurity is an integral part of our operations and is a focus of all employees, including senior management, and our board of directors.

companyName: Fidelity National Financial, Inc.

ticker: FNF


text: Risk Management and Strategy We assess, identify and manage cybersecurity risks through various processes within our Enterprise Risk Management Program and Information Security Program. We focus on all areas of cybersecurity, including threat and vulnerability management, security monitoring, identity and access management, phishing awareness, risk oversight, third-party risk management, disaster recovery and continuity management. We have established policies, including those related to privacy, information security and cybersecurity, and we employ a broad and diversified set of cybersecurity risk monitoring and risk mitigation techniques. Internal audits, external audits, and self-assessments are conducted to assess the effectiveness and maturity of our Enterprise Risk Management Program and Information Security Program.


text: Our employees are one of our strongest assets in protecting our customers' information and mitigating cybersecurity risk. We maintain comprehensive and tailored training programs that focus on applicable privacy and cybersecurity requirements. Additionally, we make strategic investments in cybersecurity to protect our customers and information systems, including both capital expenditures and operating expenses for hardware, software, personnel and consulting services.


text: Our processes to assess, identify and manage cybersecurity risks, including cybersecurity risks related to the use of third-party service providers, are fully integrated into our Enterprise Risk Management Program. In some circumstances we use third-party service providers to provide expertise and to monitor utilization of specific cyber tools, and in certain cases, to supplement staffing services. Through our vendor risk management process, these vendors undergo various assessments such as financial, reputational, contractual and informational security. These assessments are performed to ascertain that these vendors meet our policy requirements relative to the services they perform on our behalf.


text: To further reduce the residual risk associated with cybersecurity, we maintain Miscellaneous Professional Liability Insurance, which provides coverage for cybersecurity incidents. The deductible limits on these policies are determined by a corporate insurance risk management group and executive management at least on an annual basis. This group determines appropriate coverage levels and deductibles for each policy based on tolerance and weighs the coverage against the premium for the policy.


text: Management's Role in Assessing and Managing Cybersecurity Risk Our Corporate Information Security Group is led by our Chief Information Security Officer (CISO) who is responsible for our information security strategy. This strategy includes policy management, security engineering, identity and access management, vulnerability management and cyber threat detection and response through our Security Operations Center. Our CISO has extensive information technology and program management experience as do many of our employees in our information security group. Our CISO, as well as others in our information security group, hold certifications such the Certified Information System Security Professional certification. We believe cybersecurity is a shared responsibility throughout the organization and thus we also manage cybersecurity risks, through a cross-functional committee of members of senior management known as the Enterprise Risk Steering Committee, which includes the CISO. The diversity of this group allows for identification of key enterprise risks from strategic, operational, financial, legal, information technology, and compliance perspectives. These individuals receive reporting on our cybersecurity programs and also participate in table-top exercises relating to potential security incidents. The CISO is also the primary point of contact for reporting information security incidents and for coordinating information security activities including incident response and digital forensics. Our CISO reports to our Chief Security Officer who also has extensive experience in the information security space.


text: Board Oversight of Cybersecurity Our board has a strong focus on cybersecurity. Our approaches to cybersecurity and privacy risk are overseen by the audit committee. At each regular meeting of the audit committee of our board of directors, our Chief Risk Officer, Chief Compliance Officer, Chief Security Officer, Chief Information Security Officer and Chief Audit Officer provide reports relating to existing and emerging cyber and data security risks, as well as reports on the Company's risk assessments and security incidents. Our audit committee chairman reports on these discussions to our board of directors on a quarterly basis. "See Item 1A Risk Factors for discussion of material risks faced by the Company, including risks related to cybersecurity."


text: 2023 Cybersecurity Incident On November 19, 2023, we became aware of a cybersecurity incident that impacted certain of our systems. We promptly commenced an investigation, retained leading experts to assist the Company, notified law enforcement authorities, regulatory authorities and other stakeholders and followed our incident response plans. In addition, we took containment measures such as blocking access to certain of our systems resulting in varying levels of disruption to our businesses. The incident was contained on November 26, 2023.


text: We completed our forensic investigation on December 13, 2023. We determined that an unauthorized third-party accessed certain of our systems, deployed a type of malware that is not self-propagating, and exfiltrated certain data. We have no evidence that any customer-owned system was directly impacted in the incident, and no customer has reported that this has occurred. The last confirmed date of unauthorized third-party activity in our network occurred on November 20, 2023.


text: We have identified and analyzed the nature and scope of the affected systems and data. We have notified our affected customers and applicable state attorneys general and regulators, and approximately 1.3 million potentially impacted consumers; are providing credit monitoring, web monitoring, and identity theft restoration services; and are fielding questions from customers. We are continuing to coordinate with law enforcement, our customers, regulators, advisors and other stakeholders. We have been named as a defendant in several lawsuits related to this incident. The Company will vigorously defend itself against any litigation filed related to this incident. At this time, we do not believe that the incident will have a material impact on the Company.


text: We are highly dependent on information technology in the operation of our various businesses. Cybersecurity is an integral part of our operations and is a focus of all employees, including senior management and our board of directors.


text: Risk Management and Strategy We assess, identify and manage cybersecurity risks through various processes within our Enterprise Risk Management Program and Information Security Program. We focus on all areas of cybersecurity, including threat and vulnerability management, security monitoring, identity and access management, phishing awareness, risk oversight, third-party risk management, disaster recovery and continuity management. We have established policies, including those related to privacy, information security and cybersecurity, and we employ a broad and diversified set of cybersecurity risk monitoring and risk mitigation techniques. Internal audits, external audits and self-assessments are conducted to assess the effectiveness and maturity of our Enterprise Risk Management Program and Information Security Program.


text: Management's Role in Assessing and Managing Cybersecurity Risk Our Corporate Information Security Group is led by our Chief Information Security Officer ("CISO") who is responsible for our information security strategy. This strategy includes policy management, security engineering, identity and access management, vulnerability management and cyber threat detection and response through our Security Operations Center. Our CISO has extensive information technology and program management experience as do many of our employees in our information security group. Our CISO, as well as others in our information security group, hold certifications such the Certified Information System Security Professional certification. We believe cybersecurity is a shared responsibility throughout the organization and thus we also manage cybersecurity risks, through a cross-functional committee of members of senior management known as the Enterprise Risk Steering Committee, which includes the CISO. The diversity of this group allows for identification of key enterprise risks from strategic, operational, financial, legal, information technology and compliance perspectives. These individuals receive reporting on our cybersecurity programs and also participate in table-top exercises relating to potential security incidents. The CISO is also the primary point of contact for reporting information security incidents and for coordinating information security activities including incident response and digital forensics. Our CISO reports to our Chief Security Officer who also has extensive experience in the information security space.


text: Board Oversight of Cybersecurity Our board has a strong focus on cybersecurity. Our approaches to cybersecurity and privacy risk are overseen by the audit committee. At each regular meeting of the audit committee of our Board of Directors, our Chief Risk Officer, Chief Compliance Officer, Chief Security Officer, Chief Information Security Officer and Chief Audit Officer provide reports relating to existing and emerging cyber and data security risks, as well as reports on the Company's risk assessments and security incidents. Our audit committee chairman reports on these discussions to our board of directors on a quarterly basis. See Item 1A Risk Factors for discussion of material risks faced by the Company, including risks related to cybersecurity.


text: We completed our forensic investigation on December 13, 2023. We determined that an unauthorized third-party accessed certain of our systems, deployed a type of malware that is not self-propagating and exfiltrated certain data. We have no evidence that any customer-owned system was directly impacted in the incident, and no customer has reported that this has occurred. The last confirmed date of unauthorized third-party activity in our network occurred on November 20, 2023.


text: We have identified and analyzed the nature and scope of the affected systems and data. We have notified our affected customers and applicable state attorneys general and regulators, and approximately 1.3 million potentially impacted consumers; are providing credit monitoring, web monitoring and identity theft restoration services; and are fielding questions from customers. We are continuing to coordinate with law enforcement, our customers, regulators, advisors and other stakeholders. We have been named as a defendant in several lawsuits related to this incident. The Company will vigorously defend itself against any litigation filed related to this incident. This incident did not have a material impact on the Company.


text: The business of the Company is managed with the oversight of the Board of Directors. The Board of Directors has delegated to the Audit Committee the responsibility to discuss guidelines and policies governing the process by which our senior management and the relevant departments and functions of the Company assess and manage our exposure to risk. As part of that responsibility, the Audit Committee regularly reviews our exposure to cybersecurity risk, the effectiveness of our cybersecurity, and the knowledge, experience and capabilities of the Audit Committee and management with respect to cybersecurity and cybersecurity risk. The Company's Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") provide regular briefings to the Audit Committee, including on current and emerging cybersecurity threats, ongoing priorities and strategies to mitigate cybersecurity risk, and compliance with various regulations. In addition, our CIO and CISO periodically update the Board of Directors regarding the Company's cybersecurity efforts.

companyName: Brookdale Senior Living Inc.

ticker: BKD


text: The CISO who reports to the CIO has primary responsibility for assessing, monitoring, and managing our cybersecurity risks. The CIO, in turn, reports directly to our President and Chief Executive Officer. Our CISO oversees our cybersecurity governance programs, tests our compliance with standards, takes action to mitigate known risks, and leads our cybersecurity associate training program. Our CISO has over 10 years' experience leading large complex healthcare cybersecurity programs and holds Certified Information Systems Security Professional ("CISSP") and Certified Information Systems Auditor ("CISA") certifications in good standing. Our CIO is a member of our executive leadership team, having overall responsibility for all aspects of our information systems, including technology, data, and security. The focus of the CIO includes strategic use of technology to support execution on our strategic priorities and our longer-term growth plans, while also balancing risk. Our CIO has over 25 years' experience leading large complex healthcare organizations through successful transformation while developing and strengthening an effective cybersecurity program.


text: The CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques, including through attending educational programs and monitoring alerts from third-party vendors and government agencies. The CISO implements and oversees processes for the regular monitoring of our information systems. In the event of a cybersecurity incident, the CISO is equipped with a written incident response plan.


text: Failure to maintain the security and functionality of our information systems and data, to prevent a cybersecurity attack or breach, or to comply with applicable privacy and consumer protection laws, including HIPAA, could adversely affect our business, reputation, and relationships with our residents, associates, and referral sources and subject us to remediation costs, government inquiries, and liabilities, any of which could materially and adversely impact our revenues, results of operations, and cash flow. Further information is discussed in "Item 1A. Risk Factors." To date, the aforementioned cybersecurity risks and any incidents that we, or our third-party vendors, have experienced have not materially affected us, including our business, strategy, results of operations, or financial condition.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we have engaged external experts and rely on software support from third-party vendors to assist with evaluating, monitoring, and testing our information technology systems. These relationships enable us to leverage specialized knowledge and insights, to help ensure our cybersecurity strategies and processes remain effective. Our collaboration with these third parties includes regular audits, routine system monitoring, threat assessments, and consultation on potential security enhancements. We require third-party service providers with access to personal, confidential, or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.


text: Risk Management and Strategy At eHealth, information security is everyone's responsibility, and we value the trust our customers and business partners place in us to protect their sensitive information. We have established policies and processes for assessing, identifying, and managing risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes.

companyName: eHealth, Inc.

ticker: EHTH


text: We are subject to various federal and state privacy and security laws, regulations, and requirements. These laws govern the collection, use, disclosure, protection, and maintenance of the individually identifiable information that we collect from consumers. We regularly assess our compliance with privacy and security requirements and conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats.


text: Early on, we identified information security as a salient risk as described in Part I, Item 1A, Risk Factors, of this Annual Report on Form 10-K. We maintain data privacy and security through a robust program of safeguards, including responsible management, appropriate use, and protection that is designed to address applicable legal and regulatory requirements. Furthermore, all employees are required to complete annual privacy and security training.


text: Our security policies and procedures are reviewed and updated regularly to address regulatory, industry, and contractual requirements and recommendations and address new and emerging security threats. We also conduct regular scans of our technical infrastructure and regular penetration audits to check for vulnerabilities and meet our governance and compliance requirements. Training our employees and contractors is crucial to eHealth's governance and compliance requirements. All employees and contractors with access to an eHealth IT system are required to complete security awareness training during onboarding and annually thereafter. Due to the increased inherent risk associated with these roles, developers and privileged users are subject to additional security training requirements.


text: Every person with access to eHealth IT systems is required to undergo periodic phishing simulations and receives personalized tools to improve their security behavior. Performance is measured both individually and by functional groups to manage the maturity and improvement of eHealth's overall security posture. Employees must also acknowledge receipt and understanding of their responsibility to comply with eHealth's Code of Business Conduct, including the eHealth Information Security and Acceptable Use Policies, during onboarding and annually thereafter.


text: Despite our rigorous efforts, incidents may occur, and we are prepared to deal with them through our formal Incident Response Plan. Events such as human errors, computer viruses or other malicious code, unauthorized access, cyber-attacks, or phishing attempts concern all organizations. Our Incident Response Team is trained to contain incidents, mitigate impacts, resolve or remediate issues, and notify affected parties as appropriate. The team is made up of key security, privacy, and legal professionals who work with eHealth Technology and Business Teams and our managed security services.


text: Additionally, eHealth has engaged a guided cyber crisis response platform and conducted a mock cyber-attack exercise to build crisis management experience for our senior leadership and cybersecurity teams. We believe this voluntary skill building exercise put our teams in a better position to manage a potential cybersecurity crisis.


text: Our comprehensive data security strategy includes: • Regular critical security assessments such as advanced attack simulations and vulnerability scans. • A System Development Life Cycle (SDLC) framework to assess applications and related infrastructure before implementation to ensure our security standards are met. • Use of a Role Based Access Control (RBAC) methodology, which defines the access a user receives to eHealth's information systems based on job function. • Requirements that third-party vendors that host, transmit, or have access to eHealth data comply with our policies and undergo reviews. • Monitoring of security event data and the security industry to flag anomalies and be aware of potential threats. • Dedicated domestic and international liaisons who help ensure that business and functional area employees have easy access to experts for guidance and assistance mitigating privacy and information protection risks. • Encryption of customer data both in transit and at rest. • A broad spectrum of technical controls, including data loss prevention, role-based access, application/desktop logging, and data encryption as well as multi-factor authentication and enhanced web application firewall controls.


text: We, like any technology company, have experienced cybersecurity incidents in the past. However, as of the date of this Annual Report on Form 10-K, we have not experienced any cybersecurity incidents which have been determined to be material. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business, operating results and financial condition, please refer to Part I, Item 1A, Risk Factors, in this Annual Report on Form 10-K.


text: eHealth's Board of Directors oversees our enterprise risk management process, including cybersecurity, information security, governance, risk management, and compliance programs and strategies. The Board is responsible for monitoring and assessing strategic risk exposure, and our senior leadership team are responsible for the day-to-day management of the risks that we face. The Board administers its cybersecurity risk oversight both directly and through its Audit Committee. The Audit Committee is regularly briefed on eHealth's risk profile issues. These briefings are designed to provide visibility about identifying, assessing, and managing critical risks, audit findings, and management's risk mitigation strategies. Management briefs the Audit Committee periodically about eHealth's protection programs, focusing on current trends in the environment, incident preparedness, business continuity management, program governance, and program components, including updates on security processes, external testing, and employee training and awareness initiatives.


text: eHealth maintains an Office of the Chief Information Security Officer ("CISO"), who reports to our Chief Digital Officer ("CDO"). Our CISO focuses on information and systems technology, corporate governance, and behaviors to drive security best practices and safeguard information from unauthorized or inappropriate access, use, or disclosure. eHealth also has a Privacy Officer who advises the company on privacy-related laws and regulations, provides guidance on privacy compliance, drives privacy policy, creates, and oversees the privacy program.


text: Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in our information security team and through the use of technological tools and software and results from third party audits. Our CISO and CDO have extensive experience assessing and managing cybersecurity programs and risks. Our CISO has served in that position since 2019 and, before eHealth, was the Chief Information Security Officer and Vice President IT at Castlight Health where he led the company's overall security program. Before that, our CISO was the Chief Information Security Officer and Director Global Infrastructure Operations at Ooyala with similar responsibilities during rapid growth. His security experience also includes a 21-year career in the U.S. Navy where he served as a Cryptologic Officer. Our CDO joined eHealth in 2023 and was previously Chief Product Officer at M1 Finance, responsible for defining the company's product vision, strategy and roadmap to drive growth and profitability, Prior to M1 Finance, our CDO was the Chief Product Officer at Roofstock, Head of Product at LifeLock (acquired by Symantec) and Sr. Director and Head of Product, D3 Incubation Unit at Capital One. Our CISO reports directly to the Audit Committee of the Board of Directors on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues at least once annually or more frequently as determined to be necessary or advisable. In addition, we have an escalation process in place to inform senior management and the Board of Directors when it is appropriate under the circumstances.


text: Risk Management and Strategy At eHealth, information security is everyone's responsibility, and we value the trust consumers and business partners place in us to protect their sensitive information. We have established policies and processes for assessing, identifying, and managing risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes.


text: Our comprehensive data security strategy includes: • Regular critical security assessments such as advanced attack simulations and vulnerability scans. • A Software Development Life Cycle (SDLC) framework to assess applications and related infrastructure before implementation to ensure our security standards are met. • Use of a Role Based Access Control (RBAC) methodology, which defines the access a user receives to eHealth's information systems based on job function. • Requirements that third-party vendors that host, transmit, or have access to eHealth data comply with our policies and undergo reviews. • Monitoring of security event data and the security industry to flag anomalies and be aware of potential threats. • Dedicated domestic and international liaisons who help ensure that business and functional area employees have easy access to experts for guidance and assistance in mitigating privacy and information protection risks. • Encryption of consumer data both in transit and at rest. • A broad spectrum of technical controls, including data loss prevention, role-based access, application/desktop logging, and data encryption as well as multi-factor authentication and enhanced web application firewall controls.


text: We, like any technology company, have experienced cybersecurity incidents in the past. However, as of the date of this Annual Report on Form 10-K, we have not experienced any cybersecurity incidents that have been determined to be material. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business, operating results and financial condition, please refer to Part I, Item 1A, Risk Factors, of this Annual Report on Form 10-K.


text: eHealth's Board of Directors oversees our enterprise risk management process, including cybersecurity, information security, governance, risk management, and compliance programs and strategies. The Board is responsible for monitoring and assessing strategic risk exposure, and our senior leadership team is responsible for the day-to-day management of the risks that we face. The Board administers its cybersecurity risk oversight both directly and through its Audit Committee. The Audit Committee is regularly briefed on eHealth's risk profile issues. These briefings are designed to provide visibility about identifying, assessing, and managing critical risks, audit findings, and management's risk mitigation strategies. Management briefs the Audit Committee periodically about eHealth's protection programs, focusing on current trends in the environment, incident preparedness, business continuity management, program governance, and program components, including updates on security processes, external testing, and employee training and awareness initiatives.


text: eHealth's Head of Information Security reports to our Chief Digital Officer ("CDO") and, with respect to cybersecurity risks, to the Audit Committee of the Board of Directors. Our Head of Information Security focuses on information and systems technology, corporate governance, and behaviors to drive security best practices and safeguard information from unauthorized or inappropriate access, use, or disclosure. eHealth also has a Privacy Officer who advises the company on privacy-related laws and regulations, provides guidance on privacy compliance, drives privacy policy, and creates and oversees the privacy program.


text: Our Head of Information Security is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in our information security team and through the use of technological tools and software and results from third-party audits. Our Head of Information Security and CDO have extensive experience assessing and managing cybersecurity programs and risks. Our Head of Information Security has served in that position since 2024 and, before eHealth, was the interim Chief Information Security Officer at Castlight Health where he led the company's overall security program. Before that, our Head of Information Security was Senior Manager of Cyber Security at Secureworks. His security experience also includes a 12-year career at Banc of America Securities and subsequently at Merrill Lynch on their information security teams as Senior Consultant, Systems Engineering & Architecture. Our CDO joined eHealth in 2023 and was previously Chief Product Officer at M1 Finance, responsible for defining the company's product vision, strategy and roadmap to drive growth and profitability, Prior to M1 Finance, our CDO was the Chief Product Officer at Roofstock, Head of Product at LifeLock (acquired by Symantec) and Sr. Director and Head of Product, D3 Incubation Unit at Capital One. Our Head of Information Security reports directly to the Audit Committee of the Board of Directors on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues at least once annually or more frequently as determined to be necessary or advisable. In addition, we have an escalation process in place to inform senior management and the Board of Directors when it is appropriate to do so under the circumstances.


text: We maintain a Cybersecurity Incident Response Plan that is an important component of our Cybersecurity Risk Management Program, which then integrates into our Enterprise Risk Management ("ERM") Program. Our Cybersecurity Incident Response Plan is designed to facilitate a timely, consistent, and compliant response to actual or attempted cybersecurity incidents impacting the Company. The Cybersecurity Incident Response Plan is built on a framework that is aligned with publication 800-61 of the National Institute of Standards and Technology and is tailored to our people, processes, and technology. Cybersecurity Incident Response Plan phases include (1) preparation, (2) detection and analysis, which includes processes to assess the materiality of cybersecurity incidents and make timely reports, (3) containment, eradication, and recovery, and (4) post-incident activity. The Cybersecurity Incident Response Plan also defines the objectives, roles and responsibilities, and scope of our incident response program.

companyName: Crocs, Inc.

ticker: CROX


text: We maintain a formal information security training program for all employees that includes training on matters such as security awareness, phishing, and email security best practices. Employees are also required to complete compulsory training on compliance and data privacy.


text: We engage with third party assessors, consultants, and auditors to test our cybersecurity maturity and to drive continuous monitoring and improvements. The engagement includes having independent third parties perform compliance, technical, and maturity assessments, such as (1) attack surface assessment, (2) penetration testing assessment, and (3) cybersecurity maturity assessments. We also annually engage third parties and our internal audit department to assess our information security programs, whose findings are reported to the Audit Committee of the Board.


text: We rely on our information technology ("IT") systems and networks in connection with our business activities. Some of these networks and systems are managed by third-party service providers and are not under our direct control. We have implemented processes to manage the cybersecurity risks associated with our use of third-party service providers through our vendor risk management program and an application governance policy.


text: Despite the security measures we have implemented, certain cyber incidents could materially disrupt operational systems. If our IT resources are compromised by an intentional attack and results in loss of trade secrets or other proprietary or competitively sensitive information; compromise personally identifiable information regarding customers or employees; delay our ability to deliver products to customers; jeopardize the security of our facilities; or cause other damage. Although the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition, such incidents could have a material adverse effect in the future as cyberattacks continue to increase in frequency and sophistication. We continuously seek to maintain a robust program of information security and controls, but the impact of a material cybersecurity incident could have an adverse effect on our competitive position, reputation, results of operations, financial condition, and cash flows. Additionally, while we have a cybersecurity program designed to protect and preserve the confidentiality, integrity, and availability of our information systems, we also maintain cybersecurity insurance to manage potential liabilities resulting from specific cyber-attacks. Although we maintain cybersecurity insurance, there can be no guarantee that our insurer(s) will cover specific claims, pay the full costs of an incident, or provide payment in a timely manner. For more information, please see "Item 1A – Risk Factors – Risks Specific to Our Company and Strategy-Our business relies significantly on the use of information technology. A significant disruption to our operational technology or those of our business partners, a privacy law violation, or a data security breach could harm our reputation and/or our ability to effectively operate our business, and our financial results."


text: The Audit Committee of the Board is responsible for monitoring and overseeing risk management from cybersecurity threats. In accordance with the Audit Committee's charter, the Audit Committee is responsible for oversight of our ERM program, which includes cyber risk management. It is the Audit Committee's responsibility to review and discuss with management the adequacy and effectiveness of our cybersecurity policies and the internal controls regarding cybersecurity and privacy related areas. To satisfy this responsibility, the Audit Committee receives periodic updates from management regarding our cybersecurity program. The updates may include information on, among other things, actual events or incidents, results of vulnerability assessments and penetration testing, results of security incident and event management monitoring, updates to the cybersecurity strategy and program, new or modified security policy recommendations, and cybersecurity risk in general. On at least an annual basis, management presents to the Audit Committee on cybersecurity strategy and framework, roadmaps for continued program maturity, key risk areas and related actions, and any significant incidents that have occurred or are reasonably likely to occur. The entire Board is invited to attend this annual cybersecurity meeting of the Audit Committee.


text: Our Executive Leadership Team is responsible for managing enterprise risk, which is inclusive of cybersecurity. The Chief Information Officer ("CIO"), a member of the Executive Leadership Team, and the Chief Information Security Officer ("CISO"), who reports to the CIO, are responsible for assessing and managing cybersecurity risk, including the prevention, detection, mitigation, and remediation of cybersecurity incidents. The CIO has over 30 years of experience in Information Technology and Operations including executive-level experience within the consumer goods industry. The CISO possesses relevant expertise in cybersecurity, including 25 years in both IT and cybersecurity.


text: The cybersecurity team reports to the CISO and has responsibility to prevent, mitigate, detect, and remediate cybersecurity incidents through various processes. These processes include regular vulnerability assessments and penetration testing, security incident and event management, continuous monitoring, and threat intelligence gathering. Additionally, we employ several third parties with expertise in specific cybersecurity risk areas. These third parties report to the CISO, who actively engages with these third parties to monitor their activities and compliance with service level agreements. Through these activities and monitoring, both internally and externally, any events or incidents identified will be escalated to the Board in accordance with our formal Cybersecurity Incident Response Plan.


text: We engage with third-party assessors, consultants, and auditors to test our cybersecurity maturity and to drive continuous monitoring and improvements. The engagement includes having independent third parties perform compliance, technical, and maturity assessments, such as (1) attack surface assessment, (2) penetration testing assessment, and (3) cybersecurity maturity assessments. We also annually engage third parties and/or our internal audit department to assess our information security programs, whose findings are reported to the Audit Committee of the Board.


text: Risk Management and Strategy The Company maintains a robust cybersecurity program that promotes confidentiality, integrity and availability of our corporate and customer resources throughout the life cycle of our out-of-home service offerings. Under the oversight of the Audit Committee of our Board of Directors, as more fully explained below, and with the support of the Company's compliance function and the Company's internal and external audit functions, the Company operates an enterprise-wide risk management governance framework that sets standards and provides guidance for the identification, assessment, monitoring and control of the most significant risks facing the Company, including cybersecurity. Our enterprise risk management process is guided by the COSO Enterprise Risk Management Framework three lines of defense model, and we further utilize our global Compliance department, legal teams, cybersecurity teams and privacy teams as part of our overall cybersecurity program.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO


text: Our cybersecurity program includes comprehensive technology and risk oversight programs designed to ensure that our technology systems and cybersecurity education programs are effective and that we are prepared to report and manage information security risks. Developed using collaboration and transparency principles, we maintain a suite of information and cybersecurity policies, standards and guides based on commonly adopted cybersecurity standards, frameworks and regulatory requirements, including ISO 27001 and publications from the National Institute of Standards and Technology and the Center for Information Security. Furthermore, we perform periodic evaluations of our security programs, information technology infrastructure and information security management systems through internal self-assessments and external independent consultations. In addition, we conduct regular security monitoring for internal and external threats to the confidentiality and integrity of our information assets, and our cybersecurity programs undergo periodic testing with the purpose of achieving swift and orderly restoration of business operations in the event of a cybersecurity incident. Cyber hygiene is integrated into our culture from employee onboarding and lasts throughout the employee life cycle, using various tools, such as frequent information security awareness messages and annual cybersecurity awareness training. As part of testing our programs, we regularly conduct internal simulated phishing campaigns. The Company also maintains comprehensive cyber insurance. However, such insurance may not be sufficient to cover all of our potential losses and may not continue to be available to us on acceptable terms, or at all.


text: Communication of our cybersecurity values and expectations is extended to our third-party solutions through specific programs, which include monitoring and rating services and open-source intelligence risk assessments. In addition to conducting posture and intelligence reviews of our vendors, our cybersecurity teams conduct evaluations of critical vendors to assess security requirements, and we assess our service level agreements so that cyber controls and practices to the levels set out in our cybersecurity standards are embedded within.


text: We have experienced, and may in the future experience, whether directly or through our supply chain partners, cybersecurity incidents. While prior cybersecurity incidents have not had a material impact on the Company, future cybersecurity incidents, including breaches, could have a material impact on our business, operations and reputation. For additional information about the Company's cybersecurity risks, please refer to "Technology Risks" in Item 1A, Risk Factors.


text: Our Board of Directors has delegated oversight of risks related to cybersecurity to the Audit Committee. The Audit Committee is, therefore, charged with reviewing our cybersecurity processes for assessing key strategic, operational and compliance risks. Our Corporate Compliance Officer briefs the Audit Committee on cybersecurity risks at each of its meetings, which occur at least four times each year. These briefings include an assessment of cyber risks, an overview of the cyberthreat landscape, updates on cybersecurity incidents and reports on our investments in cybersecurity risk mitigation strategies and technologies and related corporate governance. In addition, our domestic and European chief technology officers brief the Audit Committee on cybersecurity risks at least annually. The Audit Committee then provides updates on significant cybersecurity matters to the Board periodically.


text: Regional heads of cybersecurity and chief technology officers oversee their respective cybersecurity programs, including regional Cybersecurity Steering Committees (each, a "CSSC"), which are comprised of senior executives and extended leadership, and which provide oversight of cybersecurity investments by monitoring, evaluating, approving and supporting actions related to cybersecurity risk, incident management, investment and prioritization of projects and services.


text: Each CSSC meets quarterly and reports to the Company's senior management team, including the Corporate Compliance Officer, on progress towards specific cybersecurity objectives. A strong partnership exists between our information technology, enterprise security, internal audit and legal and compliance functions so that identified issues are addressed in a timely manner and incidents are reported to the appropriate regulatory bodies as required.


text: Our Corporate Compliance Officer is Karis McLarty. Ms. McLarty is an international privacy, economic crime and corporate human rights lawyer. Ms. McLarty has 20 years of experience specializing in U.S. and cross-border protection of large companies. Her areas of responsibility cover privacy, cyber risk and data protection; COSO, COBIT and ISO governance; forensic investigations, including regarding privacy and cyber issues; and regulator reporting, economic crime, antitrust and sustainability. Ms. McLarty holds the CIPP/E certification in European Data Protection and two Master's degrees in Jurisprudence and Forensic Psychology (MA Oxon, MSc).


text: Our domestic Chief Technology Officer, Christian Aaselund, oversees the integration and security of the Company's digital products, infrastructure and all user-facing technology. Mr. Aaselund has over two decades of experience in technology leadership. His career reflects a broad spectrum of expertise, from spearheading tech solutions in startups to executing strategic initiatives in large enterprises.


text: Our domestic cybersecurity program is overseen by our Head of Cybersecurity, Louie Garcia. Mr. Garcia has over 18 years of cybersecurity experience, spanning threat perspectives, cyber exercise development and training, enterprise vulnerability assessments, defensive and offensive network solutions and operational evaluation of cyber products.


text: Our European Chief Technology/Information Officer and our European Head of Information Security each have approximately 25 years' experience in the technology industry, with our Head of Information Security having focused for the last 10 years solely on the Information Security and Cybersecurity domains.


text: Our Head of Information Technology for Latin America, who oversees Cybersecurity, has 25 years of experience in strategic IT leadership and global project management.


text: Risk Management and Strategy The Company maintains a robust cybersecurity program that promotes confidentiality, integrity and availability of our corporate and customer resources throughout the life cycle of our out-of-home service offerings. Under the oversight of the Audit Committee of our Board of Directors, as more fully explained below, and with the support of the Company's compliance function and the Company's internal and external audit functions, the Company operates an enterprise-wide risk management governance framework that sets standards and provides guidance for the identification, assessment, monitoring and control of the most significant risks facing the Company, including cybersecurity. Our enterprise risk management process is guided by the COSO Enterprise Risk Management Framework, which incorporates the three lines of defense model. In addition, we leverage our global Compliance department, legal teams, cybersecurity teams and privacy teams as key components of our overall cybersecurity program.


text: Our cybersecurity program includes comprehensive technology and risk oversight programs designed to ensure that our technology systems and cybersecurity education programs are effective and that we are prepared to report and manage information security risks. Developed using collaboration and transparency principles, we maintain a suite of information and cybersecurity policies, standards and guides based on commonly adopted cybersecurity standards, frameworks and regulatory requirements, including publications from the National Institute of Standards and Technology and the Center for Information Security. Furthermore, we perform periodic evaluations of our security programs, information technology infrastructure and information security management systems through internal self-assessments and external independent consultations. In addition, we conduct regular security monitoring for internal and external threats to the confidentiality and integrity of our information assets, and our cybersecurity programs undergo periodic testing with the purpose of achieving swift and orderly restoration of business operations in the event of a cybersecurity incident. Cyber hygiene is integrated into our culture from employee onboarding and lasts throughout the employee life cycle, using various tools, such as frequent information security awareness messages and annual cybersecurity awareness training. As part of testing our programs, we regularly conduct internal simulated phishing campaigns. The Company also maintains comprehensive cyber insurance. However, such insurance may not be sufficient to cover all of our potential losses and may not continue to be available to us on acceptable terms, or at all.


text: Communication of our cybersecurity values and expectations is extended to our third-party solutions through specific programs, which include monitoring and rating services and open-source intelligence risk assessments. In addition to conducting posture and intelligence reviews of our vendors, our cybersecurity teams conduct evaluations of critical vendors to assess security requirements, and we assess our service level agreements to monitor whether cyber controls and practices are integrated to the levels specified in our cybersecurity standards.


text: We have experienced, and may in the future experience, whether directly or through our supply chain partners, cybersecurity incidents. While prior cybersecurity incidents have not had a material impact on the Company, future cybersecurity incidents, including breaches, could have a material impact on our business, operations and reputation. For additional information about the Company's cybersecurity risks, please refer to "Technology Risks" in Item 1A of this Annual Report on Form 10-K.


text: Our Board of Directors has delegated oversight of risks related to cybersecurity to the Audit Committee. The Audit Committee is, therefore, charged with reviewing our cybersecurity processes for assessing key strategic, operational and compliance risks. Our Corporate Compliance Officer briefs the Audit Committee on cybersecurity risks at each of its meetings, which occur at least four times each year. These briefings include an assessment of cyber risks, an overview of the cyberthreat landscape, updates on cybersecurity incidents, and reports on our investments in cybersecurity risk mitigation strategies and technologies and related corporate governance. In addition, our domestic and European chief technology officers brief the Audit Committee on cybersecurity risks at least annually. The Audit Committee then provides updates on significant cybersecurity matters to the Board periodically.