text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our business strategy, results of operations or financial condition. From time to time, we experience cybersecurity events that require investigation. For additional information regarding whether any risks from cybersecurity threats, including as a result of any cybersecurity incidents are reasonably likely to materially affect our company, including our business strategy, results of operations or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factor entitled "We are subject to cybersecurity risks to our operational systems, security systems, infrastructure, and data processed by us or third-party vendors."


text: Members of our management team, most notably our Chief Financial Officer, who has responsibility for managing our Information Technology and Security functions, are responsible for leading our cybersecurity program. Our management team meets regularly with our information technology leadership personnel, including our Vice President, Head of Global Information Technology, who reports to our Chief Financial Officer, to receive updates and data on cybersecurity management activities, including assessments on emerging technologies and evaluations of recommended practices related to cybersecurity measures. Our Vice President, Head of Global Information Technology, who has decades of information technology leadership experience, and our Chief Financial Officer maintain their expertise through participating in events such as continuing education and training, and information-sharing collaborations. We also retain a third-party Information Security consulting firm to advise on and assess our cybersecurity processes on an ongoing basis.

companyName: UNIVERSAL DISPLAY CORP \PA\

ticker: OLED

secItem: Item 1C


text: The Audit Committee of our Board of Directors has oversight responsibility for our cybersecurity program. Our Chief Financial Officer and Information Technology leadership provide periodic updates regarding our cybersecurity risk management strategy and related activities to the Audit Committee, and provide other information as needed or requested to facilitate the committee's oversight of our cybersecurity risk. The chair of our Audit Committee, who previously founded and for 19 years led an information technology consulting company that specialized in providing software and systems integration, business process and technical consulting to multinational companies, holds a certification in Systemic Cyber Risk Governance for Corporate Directors. Other members of our full Board of Directors, which also receives periodic briefings on cybersecurity matters, also have received professional education and training related to cybersecurity.


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides regular updates to our Board of Directors regarding such oversight. The Audit Committee regularly meets with members of management responsible for data privacy, technology, and information security risks to discuss these risks, risk management activities, incident response plans, best practices, the effectiveness of our security measures, and other related matters.

companyName: CarGurus, Inc.

ticker: CARG


text: Our corporate information security team, led by our CISO, is responsible for our overall information security strategy, policy, security engineering, security operations (as a second line of defense) and cyber threat detection and response. The current CISO has more than ten years' experience in cybersecurity and 35 years as an information technology professional. Given that our CISO has more than 25 years at the Company in multiple positions, he helped incubate and grow our corporate information security team into what it is today. During 2024 Altair chose to grow its security team further, recognizing the ever-increasing threats; a Director for IT Security was brought on board and a number of global staff were added to the Security Operations team. Our information security management philosophy is one of cyber risk prevention and we have the ultimate goal of preventing cyber incidents. Simultaneously, our information security team focuses on increasing our system resilience to minimize data breach (or other compromise) business impact should an incident occur. Cybersecurity is not the sole responsibility of our information security team. During 2024 and into 2025 we have increased the Security team involvement with business leaders. Our Security team works closely with internal departments to keep security at the forefront. Our employees and vendors also play a role in our company's cybersecurity efforts. Through our cybersecurity awareness training and other team training we are fostering a culture that all employees and vendors have a role in our cybersecurity defenses.

companyName: Altair Engineering Inc.


text: The corporate information security team has implemented a governance structure and processes to assess, identify, manage and report cybersecurity risks. We also have threat intelligence and insider threat programs to identify external and internal threats, and to mitigate those threats in a timely manner to the best of our ability. In addition, we have further developed security corporate practices, controls, and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks.


text: We employ a data privacy counsel to specifically improve our responses to growing international privacy laws. We believe that this enhances our data control and thus may reduce risk.


text: Third parties also play a role in our cybersecurity and supplement our program. We engage third-party services in some vital areas of our business to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. Additionally, we leverage a Security Operations Center ("SOC")-as-a-Service provider to ensure continuous monitoring and rapid response to potential threats, enhancing our ability to maintain a robust security posture at all times.


text: We are committed to protecting Company information and the confidential information of our employees, customers, partners, and suppliers. To that end, we have in place various policies, procedures, and processes to identify, assess, manage, and prevent potential cybersecurity risks, and to timely detect the occurrence, and mitigate the effects of cyberattacks and data breaches. Our Chief Information Officer ("CIO"), who has more than 25 years of information security and cybersecurity experience, manages cybersecurity, and oversees a team of dedicated cybersecurity personnel with various experience and certifications in information security and cybersecurity. Our personnel, along with external parties engaged to assess the sufficiency of our risk management processes (e.g., through penetration testing), continuously work to maintain and improve our cybersecurity program and the security and integrity of our information systems and infrastructure through our ongoing risk management program, including (i) by conducting cybersecurity assessments and audits to address threats and to stay in step with emerging malicious trends, and (ii) by performing due diligence on partners and suppliers to ensure similar values and appropriate security standards and safeguards are maintained by such partners and suppliers with respect to our information security assets and to third-party systems on which we rely. In addition, our Incident Response Team is trained to identify, quarantine, and remediate cybersecurity threats, and all of our employees are regularly trained to increase awareness of threats and to identify how to spot and avoid them.

companyName: Ryerson Holding Corp

ticker: RYZ


text: Cybersecurity is a formal component of our overall risk management program, and our management, including our Chief Information Officer, regularly update the Audit Committee of the Board of Directors on the status of our cybersecurity program. In the event that management identifies significant cybersecurity risk exposures, it will present such exposures to the Audit Committee, which oversees the actions, security, and risk mitigation efforts taken across our cybersecurity framework. With this input from management, the Audit Committee evaluates our cybersecurity risks and the responses implemented to prevent and/or mitigate any such risks.


text: We maintain comprehensive programs and technologies to ensure that our information systems are effective and prepared for data privacy and cybersecurity risks, including regular oversight of our security programs for monitoring internal and external threats to ensure the confidentiality and privacy of our data. As the volume and complexity of cyberattacks continue to evolve, we continue to enhance our security capabilities by continued investment in cyber technologies, further developing our internal cybersecurity personnel and educating our workforce regarding cybersecurity, and leveraging emerging technologies.

companyName: MERCER INTERNATIONAL INC.

ticker: MERC


text: When reviewing key third-party information technology service providers, our engagement process customarily includes, among other things, a review of such providers' cybersecurity measures. Additionally, we use third-party data, such as Security Scorecard, to review and monitor such providers and as an indicator in respect of our cybersecurity environments.


text: We periodically undertake cybersecurity audits or other independent assessments, the results of which are reported to our Audit Committee. We have also implemented security monitoring programs designed to alert us of any suspicious activity, and have developed an incident response program in the event of a security breach. We have also engaged a third-party vendor to, among other things, provide continuous monitoring and respond to cybersecurity events.


text: Additionally, we have engaged third-party providers to supplement our response capabilities for both informational and operational technology incidents, as needed.


text: As of the date of this filing, we have not identified any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, there can be no assurance that we, or our third-party partners or service providers, will not experience a cybersecurity threat or incident in the future that could materially adversely affect our business strategy, results of operations, or financial condition.


text: For further discussion of the risks related to cybersecurity, see also Item 1A. "Risk Factors – Risks Related to our Business - Failures or security breaches of our information technology systems could disrupt our operations and negatively impact our business".


text: Our Audit Committee and management meet with the Board on a quarterly basis to provide updates on cybersecurity risks, material cyberattacks and security incidents as they occur, as well as to promote company-wide cyber risk and security awareness. Additionally, our Chief Information Officer and Director of Cybersecurity meet periodically with the Board or the Audit Committee to brief them on technology and information security matters.


text: Our Director of Cybersecurity is informed of cybersecurity incidents by applicable personnel, and oversees remediation efforts in accordance with our policies and processes. Our Chief Information Officer reports to our Audit Committee on significant incidents periodically. Our Chief Information Officer has over 30 years of technology leadership experience and is, among other things, a Certified Information Systems Security Professional and a Certified Secure Infrastructure Specialist. Our Director of Cybersecurity has over 20 years of experience as a cybersecurity and information technology professional. He has held various leadership positions where he developed, managed and implemented security programs and controls. He also holds, among other information technology certifications, the Certified Information Systems Security Professional designation.


text: Our various cybersecurity risk management processes apply to various functions, including but not limited to, third-party suppliers and vulnerability management. We employ processes and technologies to bring visibility to, and protect against, cybersecurity risk, to include real time monitoring of network traffic and email. The Company also has a comprehensive body of policies and standards for assessing, identifying, and managing material risks from cybersecurity threats, including an incident response plan, business continuity plan, crisis management plan, as well as disaster recovery mechanisms, which are tested and updated. Additionally, the Company employs staff that are specifically dedicated to raising cybersecurity awareness and training within the organization.

companyName: Alcoa Corp

ticker: AA


text: The Company engages third-party assessors, consultants, and auditors to assist in assessing, identifying, and managing risk from cybersecurity threats. Third parties assist the Company by (i) providing regular penetration testing and vulnerability assessments; (ii) assessing and maintaining our formal incident response policies, including the use of tabletop testing; and (iii) providing multiple sources of threat intelligence information that are fed directly into our technical security platforms and our awareness campaigns, including ongoing network monitoring. The Company also has a comprehensive third-party information security audit program in place.


text: Alcoa has implemented processes designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to a security risk assessment prior to engagement to determine if they meet defined levels of security capabilities. Our master services agreements with third-party service providers generally carry a number of security requirements, including audit rights for the Company. After engagement, third-party service providers are subject to audits in which contract owners within Information Technology Automation Solutions (ITAS) validate that any certifications a vendor had upon engagement are maintained throughout the life of the agreement.


text: The Alcoa Board of Directors (Board), in coordination with the Audit Committee, is responsible for the oversight of our cybersecurity risk management program, and specifically, reviews and oversees the Company's risk management and strategy relating to cybersecurity, including cybersecurity developments and threats and the Company's process for assessing, managing, and mitigating material cybersecurity risks and threats. The Audit Committee and the Board receive regular updates regarding the state of the Company's cybersecurity program, cybersecurity developments, and emerging threats. The Chief Information Security Officer (CISO) and the Chief Information Officer (CIO) regularly update the Audit Committee and the Board regarding the Company's strategy to mitigate cybersecurity risks, which includes regular vulnerability assessments and employee training on cybersecurity matters. Alcoa's CISO is responsible for maintaining identified material cybersecurity risks within the Company's ERM platform. On a quarterly basis, the CISO reviews and updates risks, as well as the control procedures in place. These risks are regularly reported to the Audit Committee and Board.


text: Alcoa's CISO has thirty years of experience in information technology, including over fifteen years in cybersecurity, and prior to joining Alcoa, was the CISO of the U.S. business of a large global insurance and asset company and was responsible for the security of data, systems, and processes supporting customer assets. Alcoa's CISO maintains professional certifications in information security, participates in intelligence sharing organizations, and has extensive cybersecurity risk management experience in manufacturing organizations and reports to the CIO. Alcoa's CIO has almost thirty years of information technology experience, including a diverse knowledge in manufacturing and process control solutions, corporate applications, infrastructure, and service delivery operations. The CISO closely collaborates with the CIO and Chief Financial Officer (CFO) in managing material risks from cybersecurity threats. Alcoa also maintains an information security steering committee (ISSC), which oversees current and emerging cybersecurity risks and investments in the cybersecurity risk protections for the Company. The steering committee is comprised of a cross-functional team of leaders from across Alcoa's business groups, including the CISO (the ISSC Chair) and CIO.


text: We incorporate reputable third-party vendors and solutions into our cyber risk management strategies to fortify our cyber defense mechanisms. We have processes to oversee and identify material risks from cybersecurity threats associated with or use of third-party vendors. We collaborate with internal stakeholders across the Company to integrate cybersecurity principles into our operations, including deployment of multiple layers of cybersecurity defenses, restricted access based on business need, and integrity of our business information. We also train our employees during onboarding and annually thereafter on matters including cybersecurity awareness, confidential information protection, and phishing attacks.

companyName: TPI COMPOSITES, INC

ticker: TPICQ


text: Risk Management and Strategy — The Company maintains a cybersecurity risk management program, led by a Chief Information Security Officer (CISO), who is responsible for the Company's overall cybersecurity strategy, policy, architecture and cyber threat detection and response. The CISO, who reports to the Company's Chief Information Officer (CIO), has a Bachelor's degree in Information Systems and Master of Business Administration degree and is a Certified Information Systems Security Professional with over a decade of professional cybersecurity experience. The Company's program is aligned to industry frameworks and controls from the National Institute of Standards and Technology that allow the Company to identify the fundamental security capabilities and controls necessary to maintain and enhance the program. The Company utilizes a wide range of capabilities to maintain cybersecurity, including threat intelligence, multi-factor authentication, endpoint detection and response and security automation.

companyName: OSHKOSH CORP

ticker: OSK


text: As part of the cybersecurity risk management program, the Company has a set of Company-wide cybersecurity policies and procedures, including an Acceptable Use Policy as well as other policies covering subjects such as Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Media Protection, System and Communications Protection and Incident Response. These policies and procedures go through an internal review process and are approved by appropriate members of management. The Company requires all personnel, including contingent workers and business partners handling information on the Company's behalf to follow its cybersecurity policies and procedures. Regular training modules educate the Company's team members on relevant cyber threats and trends and help prepare them for real-life phishing threats.


text: The Company implements processes to assess and manage risks associated with using third-party information system service providers. This risk assessment process assesses both the service provider's security posture as well as the security controls available from the third-party information system. The service provider's security posture assessment includes reviewing any third-party attestations as well as third-party controls in the following areas: assets, data flows, authentication, access, monitoring, response and recovery. Depending on the type of system or data, additional controls may be assessed.


text: The Company maintains an Incident Response Plan that includes processes for detecting, containing, and responding to incidents including processes for reporting incidents to management and the Board of Directors. The Company periodically performs simulations and tabletop exercises at a management level and incorporates external advisors as needed. The Company engages third-party service providers to conduct evaluations of its security controls, whether through penetration testing, independent audits or consulting on best practices to address cybersecurity risks.


text: Assessing, identifying and managing cybersecurity-related risks is integrated into the Company's overall Organization Risk Management (ORM) program. Cybersecurity related risks are included in the risk universe that the ORM program evaluates to assess top risks to the enterprise on an annual basis. To the extent the ORM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion.


text: Governance — The Board of Directors is responsible for general oversight of the Company's risk management program, including cybersecurity risks. The Board of Directors receives an annual report from senior management through the ORM program and material risk assessments and mitigation strategies, including with respect to cybersecurity risks.


text: The Audit Committee of the Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align the Company's risk exposure with its strategic objectives. The CIO provides periodic updates to the Audit Committee on the status of the Company's cybersecurity risk management program; the Company's information systems, cybersecurity, data privacy and other risks; and the steps management has taken to identify, monitor and mitigate such risks. The Audit Committee is also briefed on cyber crisis contingency planning, incident recovery capabilities and matters related to any material cybersecurity incident the company may experience.


text: The review of cybersecurity risks and threats is integrated into our enterprise risk management ("ERM"). Our ERM program includes an annual risk prioritization process to identify key enterprise risks. Each key risk is assigned risk owners to establish action plans and implement risk mitigation strategies. The cybersecurity threat risk action plan is managed at the enterprise level by our Chief Information Officer ("CIO"), who reports to our Executive Vice President and Chief Financial Officer. Management employs in-depth defense mechanisms throughout the enterprise. We regularly engage and consult with independent third-party consultants as part of our overall ERM, including penetration testing and periodic tabletop exercises to better prepare us for potential cyber threats. We also conduct annual information security training to educate employees and make them aware of information security risks and to enable them to take steps to mitigate those risks. As part of this program, we take reasonable steps to provide our executive management and employees who may come into possession of confidential financial information with appropriate information security awareness training. In addition, we employ multi-factor authentication and vulnerability management to mitigate and/or prevent cybersecurity incidents.

companyName: KAISER ALUMINUM CORP

ticker: KALU


text: Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents involving us or third-parties, that have materially affected or are reasonably likely to materially affect the Company in 2024, including its business, strategy, results of operations, or financial condition. See "Item 1A. Risk Factors - Risks Related to Cybersecurity and Privacy" for additional information. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third-party providers. In the event an attack or other intrusion were to be successful, we have a response team of internal and external resources engaged and prepared to respond. We also have a cyber risk insurance policy to help us mitigate risk exposure by offsetting costs involved with recovery and remediation in the event of a successful attack or other intrusion.


text: The Audit Committee is responsible for the review of risks relating to our information technology system, including cybersecurity, emerging cybersecurity developments and threats and our strategy for mitigating cybersecurity risks. Our entire Board of Directors is responsible for overseeing management's risk assessment and risk management processes designed to monitor and mitigate information security risks. The CIO and Director of Cybersecurity reports on cybersecurity matters semi-annually to the Board, primarily through the Audit Committee. Management provides benchmarking information and updates on key operational and compliance metrics to the Audit Committee. In addition, cybersecurity training is provided to the Audit Committee, to educate directors on the current cybersecurity threat environment and measures companies can take to mitigate the risk and impact of cyberattacks. As described above, management is actively involved in assessing and managing the Company's material cybersecurity risks. The CIO and the Director of Cybersecurity primarily lead these efforts. The CIO, reporting to the Company's Executive Vice President and Chief Financial Officer, manages the global information technology and cybersecurity programs. The CIO holds bachelor's and master's degrees in business administration, specializing in information systems and quantitative methods from Loyola Marymount University. The CIO has over 25 years of information technology expertise with extensive experience in enterprise risk management, including analysis, development, evaluation, and testing of control objectives and procedures to mitigate risks. The Director of Cybersecurity oversees and helps to ensure appropriate capabilities and controls are implemented in the areas of network security, endpoint protection, data protection, incident response, identity, and access management. Additionally, in this role, the Director of Cybersecurity works closely with third-party security partners surrounding monitoring and incident response services.


text: While neither the Sponsor no r the Trust has experienced a material cybersecurity incident, cybersecurity threat risks may materially affect either the Sponsor or the Trust, including the Trust's business strategy, results of operations or financial condition. For further discussion of the risks the Trust faces from cybersecurity threats, see "Item 1A. Risk Factors—Risks Related to Trust Investment—Investing in the Trust may result in the total loss of investment due to passive management strategies, cybersecurity vulnerabilities, and inadequate recovery options for lost assets."

companyName: Bitwise 10 Crypto Index ETF

ticker: BITW


text: The Trust does not have any directors, officers or employees. Under the Trust Agreement, all management functions of the Trust have been delegated to and are conducted by the Sponsor, its agents and its affiliates. As a result, Katherine Dowling, the General Counsel and Vice President of the Sponsor, is responsible for assessing and overseeing the Sponsor's and the Trust's cybersecurity risks and providing direction and oversight for risk mitigation action, in conjunction with Hong Kim, the Chief Technology Officer of Bitwise. Ms. Dowling has served as a Chief Compliance Officer at various companies since 2015 and has more than ten years of experience as an Assistant U.S. Attorney, most recently in the Economic Crimes Unit of the U.S. Attorney's Office for the Northern District of California. Ms. Dowling receives periodic reports from the Experts, outside legal representatives and members of the Sponsor's Legal and Compliance team who take part in cybersecurity review, implementation and testing. Mr. Kim graduated from the University of Pennsylvania with a Bachelor of Science in Computer Science, and, prior to Bitwise, worked on Google's backend infrastructure for Google Drive and worked in software security for the South Korean military.


text: Our process of assessing, identifying and managing material risks from cybersecurity threats is integrated into our overall enterprise risk management ("ERM") process. The audit committee of the board of directors (the "Audit Committee") oversees our ERM framework, including cybersecurity and other information technology risks. This involves collaboration with key personnel, including the Chief Financial Officer ("CFO"), the Chief Information Security Officer ("CISO"), IT operational management and Internal Audit. We also have a cross-functional team led by the CISO, which meets weekly with a fixed agenda to discuss mitigation and action-items related to ERM cyber risk updates, cyber statistics dashboards and threat vectors. Our CISO has a comprehensive background in various enterprise-wide information technology and cybersecurity leadership roles within the global energy and oil and gas sectors and strategy consulting. The Audit Committee receives a report from our Director of Internal Audit on the ERM risk register at least three times a year.

companyName: Great Lakes Dredge & Dock CORP

ticker: GLDD


text: The CISO and Chief Legal Officer ("CLO") are key members of management responsible for strategic cybersecurity leadership. They lead tactical threat assessment, keep an updated risk register and develop and maintain governance and procedures. The CISO reports to the CFO and presents at least annually to the Audit Committee and the full board of directors on cybersecurity processes. The CLO reports to the CEO, and to the Audit Committee and the full board of directors with regard to significant cybersecurity incidents, as further described below. Our CLO has specific training in cybersecurity awareness and holds a certificate of Cybersecurity Governance for the Board of Directors from the Massachusetts Institute of Technology Sloan School of Management.


text: The Company's Board of Directors has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee of the Board. The Audit Committee receives quarterly reports from our Chief Information Security Officer ("CISO") regarding cybersecurity matters. The CISO also briefs the full Board of Directors on cybersecurity matters semi-annually.

companyName: First American Financial Corp

ticker: FAF


text: The Company maintains an extensive and structured enterprise risk management ("ERM") program encompassing senior executive leaders from all facets of its business, including operations, human resources, finance, accounting, treasury, information security, information technology, legal/regulatory, internal audit, compliance, underwriting, and real estate. As part of our ERM program, the Company maintains an Information Security Oversight Committee ("ISO Committee") that oversees the Company's cybersecurity program from a management perspective.


text: The ISO Committee meets quarterly and is comprised of the Company's Chief Executive Officer, Chief Financial Officer and Chief Legal Officer, whose relevant expertise and experience can be found in the Company's Proxy Statement on Schedule 14A filed on April 1, 2024.


text: The ISO Committee also includes the Co-Presidents of First American Title Insurance Company, the Vice-Chairman of our data and analytics business and the President of our international division, who bring deep operational experience specific to our businesses; the Chief Intellectual Property and Privacy Officer, who is responsible for protecting and advising on innovation, data privacy and intellectual property; and is chaired by the Company's Chief Risk Officer, who has over 25 years of experience in risk management. The Company's CISO and Chief Technology Officer ("CTO") are participants on the ISO Committee.


text: The Company's CISO is primarily responsible for assessing and managing cybersecurity risks and threats and is responsible for developing and implementing our information security program, working closely with the ISO Committee. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity governance, cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Our CISO has been with the Company for 14 years in various information security leadership roles and has over 20 years of experience in the cybersecurity field. The CISO provides regular reports to the ISO Committee that are shared with the Company's Board of Directors.


text: The Company's CTO is responsible for overseeing the Company's overall technology strategy, including integrating security considerations into all aspects of our technology development. Our CTO has over 20 years of experience in technology management roles.


text: As part of our risk management process, the Company maintains an overall risk management program that encompasses cybersecurity, conducts security audits, annual System and Organization Controls ("SOC 2") testing, and ongoing risk assessments using a company-wide risk framework. We also require employees with access to information systems to undertake data protection and cybersecurity training. The Company has processes in place for assessing, identifying, and managing material risks from potential cybersecurity incidents, including vulnerability identification, intrusion prevention, encryption, endpoint protection, behavior analysis, mitigation and the processes and protocols set forth in the Company's incident response plans. Certain of our subsidiaries manage their own cybersecurity functions and coordinate with the Company's CISO. The Company also employs systems and processes designed to oversee and identify cybersecurity threats associated with third-party vendors, including a risk assessment and rigorous evaluation of each vendor that may access, process or store highly sensitive or proprietary data or that is systematically integrated with the Company's systems or network. In addition to our in-house cybersecurity capabilities, we engage assessors, consultants, auditors, and other third parties to assist with assessing, identifying, mitigating and managing cybersecurity risks, including the maintenance of a Security Operations Center that is co-managed between the Company and a managed security service provider ("MSSP"), which continuously reviews the Company's network using threat intelligence from a variety of sources and reports potential incidents from users.


text: While the Company has experienced cybersecurity threats to its data and systems, such threats have not materially affected the Company, including our business strategy, results of operations or financial condition, with the exception of an incident in the fourth quarter of 2023, as disclosed in a Current Report filed by the Company on Form 8-K on December 22, 2023, as amended on December 29, 2023 and January 12, 2024 and followed by a Current Report on Form 8-K on May 28, 2024. On June 21, 2024, the Company received a complaint, on a class action basis, relating to the incident in the fourth quarter of 2023. For additional information on cybersecurity risks we face, see Item 1A. Risk Factors of this Annual Report, which should be read in conjunction with the foregoing information.


text: Cybersecurity Risk Management and Strategy As a component of our overall risk management system and processes, we have a risk-based cybersecurity program, dedicated to protecting our data as well as data belonging to consumers (including UWC Members), employees and suppliers. We devote significant resources and utilize a defensive in-depth strategy, with multiple layers of security controls to protect the security of our computer systems, software, networks, and other technology assets. Our security efforts are designed to preserve the confidentiality, integrity, and continued availability of all information we own, or is in our care, and protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt or degrade service, sabotage systems, or cause other damage. These processes include technical, administrative and physical controls and processes, as well as contractual mechanisms to mitigate risk. We also have policies and procedures to oversee and identify the cybersecurity risks associated with our use of third-party service providers, including the regular review of System & Organization Controls ("SOC") reports, relevant cyber attestations, and other independent cyber ratings.

companyName: Mister Car Wash, Inc.

ticker: MCW


text: These processes are overseen by our Chief Technology Officer, who has over 30 years of experience consulting and leading technology teams at several global multi-unit brands, including Blockbuster, FedEx, and Yum! Brands.


text: Board Oversight and Governance Our Board recognizes the important role of information security and mitigating cybersecurity and other data security threats. While the full Board has overall responsibility for risk oversight, it is supported in this function primarily by its committees. The Audit Committee is responsible for reviewing and discussing our policies with respect to risk assessment and risk management, including risks related to cybersecurity and other technology issues. The Board periodically evaluates our cybersecurity strategy to help ensure its effectiveness. Management provides periodic reports to the Audit Committee regarding cybersecurity and other information technology risks, as well as our plans to mitigate cybersecurity risks and to respond to any breaches, and to the Nominating and Corporate Governance Committee regarding governance matters related to cybersecurity and other information technology risks.


text: TEC's Information Security group of the Information Technology department has the direct responsibility for developing, monitoring, and enforcing information security standards and procedures; reviewing and approving all network interconnections for compliance to security standards; and assisting, consulting, and training individuals throughout TEC in the use of appropriate information security practices. This group is responsible for ensuring that all IT and OT cyber systems, assets, and networks are aligned with Emera and affiliate cybersecurity framework. TEC engages independent third-party consultants from time to time to assess the adequacy of its cybersecurity measures and assist in implementing any appropriate actions to address any vulnerabilities identified. In addition, TEC participates in an Electric Power Research Institute (EPRI) research project to develop cybersecurity performance metrics. EPRI offers a web-based platform, which supports automated cybersecurity data collection, security metrics calculation, visualization, and analysis. The Vice President of Information Technology and Chief Information Officer (CIO), who reports to the President and Chief Executive Officer, oversees this group and is responsible for managing the program, in collaboration with TEC's businesses and functions. TEC's CIO has advanced degrees in computer science and extensive experience in cybersecurity and information technology, including many years of experience at large organizations leading cybersecurity, IT processes and controls, strategy, architecture, delivery and support of IT applications, and overseeing large groups of employees and contractors responsible for carrying out these responsibilities.

companyName: TAMPA ELECTRIC CO


text: TEC's Vendor Risk Management process includes conducting risk assessments to identify and monitor cybersecurity risks associated with third-party service providers, including threat detection and security event notifications. TEC also has requirements for third-party service providers which include regulatory compliance and meeting policies and standards based on the National Institute of Standards and Technology Cybersecurity Frameworks. TEC's processes also provide for mitigating cybersecurity risk from third parties through seeking to include in its agreements with third-party service providers, as applicable, cybersecurity provisions designed to appropriately address such risks.


text: Cybersecurity risks are integrated into TEC's overall risk management process through the collaboration of the cybersecurity professionals and TEC's and Emera's risk management functions to assess threat levels on an affiliate and corporate basis and identify steps and resources appropriate to manage such risks. The Board of Directors oversees the management of risks from cybersecurity threats through receiving regular reports from the CIO, which include updates on TEC's performance with preparing, preventing, detecting, responding to, mitigating, and recovering from cybersecurity incidents. Should a cybersecurity threat or incident pose a significant risk to TEC, TEC's processes provide that the CIO, through the CEO, as appropriate, would promptly inform the Board regarding any such threat or inciden t. The CIO also provides regular updates on the key elements of its cybersecurity program to the Emera Board's Risk and Sustainability Committee, which has oversight over Emera's enterprise risk management framework, including oversight over cybersecurity risk.


text: Our cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") cybersecurity framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Kimco Realty OP, LLC


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for critical service providers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We have in the past experienced adverse events that have not resulted, and are not expected to result, in a material impact on the Company's business operations or financial results. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We have experienced cybersecurity attacks and could in the future be subject to significant disruption, data loss or other security incidents or breaches".


text: Cybersecurity Governance and Oversight Our Board of Directors ("Board") considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program. Our Audit Committee receives quarterly briefings from our Chief Information Security Officer regarding the emerging cybersecurity threat and risk landscape as well as our cybersecurity risk management program and related readiness, resiliency, and response efforts. In addition, management will update the Audit Committee, as necessary, regarding significant cybersecurity incidents. Our Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: We have a Cyber Risk Committee ("Cyber Committee") which reviews and reports on cybersecurity risks and related issues. The Cyber Committee is comprised of senior management from various business units within the Company and meets at least quarterly to review the status of the Company's overall cybersecurity risk management program, as well as controls and procedures and to stay up to date regarding relevant legislative, regulatory, and technical developments. The Cyber Committee is responsible for assessing and managing our material risks from cybersecurity threats. The Cyber Committee has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants, and in this capacity, the Committee works closely with the Chief Information Security Officer.


text: The Cyber Committee is informed about and monitors the prevention, detection, mitigation, and remediation of key cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants.


text: We utilize a variety of administrative, technical and physical safeguards that take into account the nature of our IT environment, information assets and cybersecurity risks posed by both internal and external threats. We have incorporated cybersecurity coverage in our insurance policies, and our goal is to keep our data and systems, as well as our employees, safe from cybersecurity threats.


text: The Company conducts employee security awareness training and internal phishing exercises. When security issues arise, the Company conducts a prompt investigation and initiates response protocols and other measures to protect the Company and its valued employees and key stakeholders.


text: Cybersecurity Risk Management and Strategy We recognize the importance of developing, implementing and maintaining the integrity of our information technology systems and safeguarding the personal data and confidential information we receive, process or transmit, and store in any format. We have a cybersecurity risk management program, which we refer to as our information security risk management program, in place designed to assess, identify, and manage material risks from cybersecurity threats to our information, data, or information technology systems utilizing a defense-in-depth security strategy that integrates our staff, technology, and operations to establish various security barriers across multiple layers of our operations. Our information security risk management program is designed to employ industry standard practices across our operations and business functions, including access controls, monitoring and analysis of the threat environment, vulnerability assessments, and third-party cybersecurity risks; resilience through detecting and responding to cybersecurity events, incidents, and data disclosures or breaches, business continuity, and disaster recovery capabilities; and investments in cybersecurity infrastructure and technology needs. Key aspects of our information security risk management program include, but are not limited to, the following: • Surveillance controls and technical protective capabilities, including a centralized security incident event management system, or SIEM, continuous threat detection and response monitoring, and full incident response; • Routine cybersecurity training for all employees, including social engineering techniques, simulated phishing campaigns, physical access such as tailgating, privacy or handling of sensitive data, and other related topics; • Established policies and procedures that govern information security and cybersecurity which apply to all employees and information systems we control; • Business continuity, incident response, and disaster recovery procedures, including routine tabletop incident response exercises, disaster recovery tests, unannounced penetration tests, and security control assessments; • Network, infrastructure, and application security such as database activity monitoring, encryption, secure file transfer protocols, and application firewalls; and • Maintaining cybersecurity insurance covering certain security and privacy damages and claim expenses resulting from cybersecurity incidents (we periodically meet with our insurer to discuss trends in cybersecurity).

companyName: CoreCivic, Inc.

ticker: CXW


text: We engage third parties in connection with assessing, identifying and managing our cybersecurity risks, including, but not limited to, the following: • Incident response expertise to provide intelligence-based cybersecurity solutions and services to assist us with preparing for, investigating, and responding to cybersecurity incidents, including attacks that target on premise, cloud, and critical infrastructure environments; • Annual security program assessment of the controls, maturity and performance of our information security risk management program and the information security risks associated with our technology and business systems; • External and internal penetration and intrusion testing using industry standard tools and techniques; • Compliance assessments with certain information security standards required under some of our federal contracts; • Established cadence of reviews, reporting and coordination with government agencies to review cybersecurity metrics, findings and any applicable remediation efforts in accordance with the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF; and • Review processes and procedures designed to control access to information systems as part of our Sarbanes-Oxley Act, or SOX, testing. In addition to the third parties described above, we regularly engage consultants, advisors, service providers and other third parties to help develop and manage our information security risk management program. Further, our internal audit team conducts annual assessments of our information security risk management program and controls.


text: To help identify and manage cybersecurity and information security risks associated with our use of third-party service providers, we have implemented processes to assess third-party systems which could be compromised in a manner that adversely impacts us and our technology systems. We conduct diligence of significant third-party service providers who will have access to our data or information technology systems and incorporate certain cybersecurity protections in our engagement contracts with such providers. In addition, we require such third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations.


text: Our information security risk management program is designed to, among other things, assess, identify and manage material risks from cybersecurity threats. Cybersecurity risks we face include cyberattacks, computer viruses, malicious or destructive code (such as ransomware), social engineering (including phishing, vishing and smishing), denial of service to information or security breach tactics as well as attacks to our website, financial applications, operational technology, telecommunications and human resources data. Our information security risk management program includes technology and processes designed to maintain active awareness of risks to the security of our information or systems. We do not believe that any risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we cannot ensure that future cybersecurity incidents will not materially affect our business strategy, results of operations or financial condition. For more information on the Company's risks associated with cybersecurity threats and incidents, information and security breaches and technology failures, see Part I, Item 1A. Risk Factors - Interruption, delay or failure of the provision of our technology services or information systems, or the compromise of the security thereof, could adversely affect our business, financial condition or results of operations.


text: Our information security risk management program is integrated into our overall risk management program. Our BOD has a formalized enterprise risk management program, or ERM Program, which the Risk Committee of the BOD, or Risk Committee, on behalf of the BOD and the Audit Committee of the BOD, oversees. Our ERM Program addresses the identification, prioritization and assessment of a broad range of risks (e.g., cybersecurity, financial, operational, business, reputational, governance and managerial), and the formulation of plans to develop and improve controls for managing these risks or mitigating their effects in an integrated effort involving our BOD, relevant committees of the BOD, management, and other personnel. Our ERM Program is led by our General Counsel and is a component of management's strategic planning process. Our BOD and Risk Committee have primary oversight responsibility regarding our information security risk management program. Our BOD and Risk Committee each receives regular and frequent updates on cybersecurity and information technology matters from management (including our Chief Information Officer, or CIO) and, periodically, from outside experts. For example, the CIO provides reports to our BOD, Technology Steering Committee and Risk Committee regarding information security risks, as well as plans and strategies to mitigate those risks, on a periodic basis.


text: In addition, our Enterprise Risk Council, or ERC, is a management-level team comprised of a select group of executive officers, vice presidents, and senior managers overseeing risk, which is responsible for managing enterprise risks and planning and organizing the activities of our organization to minimize the effects of risk on our business, operations and financial results. The ERC is led by our General Counsel and our Managing Director, Litigation & Risk Management. The ERC coordinates enterprise risk management reports to the Risk Committee and/or our BOD. Further, the Risk Committee reviews management's information security risk management program controls, including management's assessment of recent information security incidents meeting certain criteria.


text: We also have a Technology Steering Committee that assists with fulfilling oversight responsibilities of information technology risks, including cybersecurity risks. The Technology Steering Committee is comprised of our executive officers and relevant business leaders from the information security, information technology, legal, human resources, audit, finance, communication and risk functions, and identifies, defines, manages and measures information technology and cybersecurity risks applicable to us on an enterprise level. The Technology Steering Committee meets quarterly, and reviews all cybersecurity risks and incidents meeting certain criteria, and provides oversight with respect to cybersecurity matters at a management level. Further, the Technology Steering Committee reviews management's information security risk management program controls meeting certain criteria.


text: As mentioned above, our SIEM tool monitors threat detection and response continuously. Identified threats create alerts which are monitored and addressed by our information technology team in accordance with internal policies, industry standard practices, and regulatory requirements. Audit logs of external security threats are reviewed weekly as part of general event threat intelligence monitoring procedures. Other ongoing monitoring includes data from our information services team, which maintains an audit trail to detect risks in areas such as unauthorized local connections, network use and remote connections. Vulnerability scans are performed frequently and are supplemented on an ad-hoc basis for specific threats or to test patch status.


text: Our Sr. Director, Information Security and Privacy Compliance, prepares an incident summary and collaborates with the CIO to conduct an initial assessment of information and cybersecurity incidents. They perform an impact assessment with respect to information or cybersecurity incidents meeting certain criteria and elevate the review of any such information or cybersecurity incidents for review by our executive officers.


text: Cybersecurity incidents meeting certain criteria are escalated to our Disclosure Committee for SEC disclosure consideration. The materiality of any cybersecurity incident is ultimately evaluated and determined by our Disclosure Committee in collaboration with our CIO. Our Disclosure Committee is comprised of our executive officers, our CIO, our Chief Ethics and Compliance Officer, and relevant business leaders from our finance and legal departments. The Disclosure Committee is presented with a detailed overview of the cybersecurity incident by the CIO. The Disclosure Committee then evaluates the cybersecurity incident and its potential materiality based on SEC guidance and by considering relevant quantitative and qualitative factors.


text: At a management level, our information security risk management program is led by our CIO, along with our Sr. Director, Information Security and Privacy Compliance. As of the date of this Annual Report, our Technology Department, led by our CIO, along with our Sr. Director, Information Security and Privacy Compliance, is comprised of nearly 100 technology professionals, with currently 11 of such technology professionals exclusively dedicated to cybersecurity. These security professionals have an average information security/cybersecurity tenure of 6 years and over 30 active certifications from ISC2, ISACA, CompTIA and other industry certification leaders including certifications such as CISSP, CISM, Security+, and CEH, among other advanced Cybersecurity and Technology degrees, tool and process specific certifications, and cybersecurity related work experience. Our Technology Department stays current on cybersecurity issues and trends through continuing education activities such as conferences and participating in webinars, maintaining continuous education requirements for certification bodies, as well as through the monitoring of security and vendor feeds on cybersecurity trends and threats.


text: Our Cybersecurity and Information Services (IS) department executes and measures the delivery of the cybersecurity program and incorporates the program into the governance and internal controls framework for our Company. We engage third parties such as consultants, auditors and specialists to support, evaluate, and improve the program, and utilize cybersecurity technologies and services to prevent, identify, detect, respond, and recover from cybersecurity threats and incidents. We also maintain a third party continuous monitoring security program to identify, prioritize, assess, mitigate and remediate third party risks, which is part of our overall cybersecurity risk management framework.

companyName: EXPEDITORS INTERNATIONAL OF WASHINGTON INC

ticker: EXPD


text: Our Enterprise Risk Management Committee includes a cross-functional team including the Chief Executive Officer, CIO, Chief Financial Officer and the General Counsel as members who are well versed in risk management. In addition, the Enterprise Cybersecurity Committee includes the CIO, CISO, and Vice Presidents who have the relevant risk management and cybersecurity expertise. The Cybersecurity and Information Services department is led by the CISO and includes cyber professionals who have the relevant cybersecurity expertise. The CISO reports to the CIO and has over 20 years of experience, a graduate degree and several certifications in the field of cybersecurity. Material risks are managed and monitored by persons or committees with relevant expertise and experience. The Company maintains a Cybersecurity incident response team and a Business Continuity Plan and has a well-established incident reporting protocol to inform management, the Board of Directors or third parties.


text: We face various cybersecurity threats that could adversely affect our business, financial condition, and results of operations. We have implemented processes and procedures and engaged third-party service providers to assess, identify, and manage these risks, as well as to respond to and mitigate the impact of any potential or actual cybersecurity incidents to our information systems and the information residing therein.

companyName: COMSTOCK RESOURCES INC

ticker: CRK


text: Risk Management and Strategy Our cybersecurity risk management processes have been integrated into our enterprise risk framework, which identifies, aggregates, and evaluates risks across the enterprise. We identify our enterprise risks through each member of our management team, along with counsel from our internal auditors and attorneys and we present an assessment of our enterprise risks to our board of directors on an annual basis. Our information technology management plays an integral part in the identification and communication of cybersecurity risks to our management team.


text: Our processes for assessing and identifying cybersecurity risks include, but are not limited to, the following elements: • regular network security assessments and vulnerability scans performed by third parties; • third-party audits of our information systems, • third-party systems for monitoring and analysis of network activity and threat intelligence; • systems for protecting our information technology, such as firewalls and anti-virus software; • cybersecurity awareness training for our employees and contractors, including senior management; • and processes to oversee and identify cybersecurity risks associated with our use of third-party service providers, such as conducting due diligence, reviewing contracts, and verifying compliance with security standards and best practices.


text: Despite our efforts, there is the ever-present risk that our systems and/or data will suffer a successful cyber incident such as unauthorized access, use, disclosure, modification, or destruction by hackers, cybercriminals, state-sponsored actors, insiders, or other malicious actors. We have experienced attempts to compromise our systems and/or data. These attempts included phishing attacks, malware infections, and unauthorized access attempts. We do not believe that these attempts, if successful, would have resulted in a material adverse effect on our business, financial condition, or results of operations. We continue to be diligent in preventing, detecting, and responding to cyber incidents. However, we cannot guarantee that we will not suffer cybersecurity incidents in the future. See Item 1A. Risk Factors "Our business could be negatively impacted by security threats, including cybersecurity threats and other disruptions."


text: We have adopted as the governance framework for our cybersecurity program the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). We use this framework as a guide to help us identify, assess, respond to, and manage cybersecurity risks relevant to our business. Our cybersecurity risk management program includes: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise information technology (IT) environment; • skilled internal information security (IS) and data privacy personnel, who support our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • external service providers, where appropriate, to monitor, assess, test, or otherwise assist with aspects of our security controls, and to support risk mitigation efforts; • training for our employees on cybersecurity awareness and the importance of protecting information assets, including "phishing" tests; • periodic reviews of key cybersecurity policies, and updating as needed; • information governance policy and a cybersecurity incident response plan that includes procedures for monitoring data use and responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: STAAR SURGICAL CO

ticker: STAA


text: Based on the information available to us as of the date of this Annual Report, we believe that risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition, and as of the date of this Annual Report, we are not aware of any material risks from cybersecurity threats that are reasonably likely to do so. However, we cannot eliminate all risks from cybersecurity threats or provide assurances that the Company will not be materially affected by such risks in the future. Additional information on cybersecurity risks we face can be found in Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.


text: The Audit Committee receives reports from management on the Company's cybersecurity risks and the Company's cybersecurity program. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents. The Audit Committee regularly updates the Board on such matters,and the Board also periodically receives presentations from management directly on our cybersecurity risk management.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats and reporting on such risks to the Audit Committee. Our management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat briefings from internal personnel and external service providers, as well as alerts and reports produced by security tools deployed in the information technology environment.


text: STAAR utilizes internal personnel and external service providers to support the Company's cybersecurity efforts. Our Chief Information Officer (CIO) leads a team of IS professionals who have primary responsibility for our overall cybersecurity risk management program and supervises both our internal personnel and our retained external cybersecurity consultants. Our CIO has over two decades of experience, including experience building IT and IS functions and teams, as well as cybersecurity programs. Our CIO holds an M.B.A. in management, has an audit and accounting background, and serves on the SoCalCIO Board, a Southern California organization developing and supporting local CIOs. The CIO and IS team collaborate closely with STAAR's legal, privacy, and internal audit functions to address cybersecurity and data privacy risks. The Company's internal IS and data privacy specialists have certifications from various organizations, including ISC2 (Certified Information Security Systems Professional or CISSP), Global Information Assurance (GIAC), the Computing Technology Industry Association (CompTIA) and International Association of Privacy Professionals (IAPP).


text: Information Technology and Cybersecurity Pursuant to the Shared Services Agreement, the Company depends on the proper functioning, availability and security of SITE Centers' information systems, including financial, data processing, communications, and operating systems, as well as proprietary software programs that are important to the efficient operation of the business. The Company also utilizes software applications provided by third parties. SITE Centers grants limited access to its systems to third parties providing specific outsourced functions or other services and increasingly stores and transmits data using connected information technology or "cloud" systems. Any significant failures or disruptions of the critical information systems on which the Company relies, including ransomware attacks or other cyber incidents, that impact the availability or other proper functioning of these systems or that result in the compromise of sensitive or confidential information, including information of tenants, employees and others, could result in liability for the Company and have a significant impact on the Company's operations and reputation.

companyName: Curbline Properties Corp.

ticker: CURB


text: The Company's internal audit team annually assesses and reviews the risks posed to the security of the networks used by the Company, including a review of system and process assurance for information technology and application controls, and takes into account certain frameworks and policies. The Company's internal audit team also reviews the Company's fraud assessment and confirms IT management's oversight of its cybersecurity policies. The Company's management team reviews the findings, if any, of these assessments, assesses the identified risks and takes action based on the Company's risk profile. In order to assess the risks posed to the information systems by third-party service providers and vendors, the SITE Centers' information technology department, coordinating with the Company's internal audit services team, evaluates and implements, as appropriate, new software and network application vendors' contracts, internal policies, certifications and System and Organization Controls ("SOC") reports during the procurement of solutions and services.


text: To mitigate the risk and impact of any cybersecurity incidents on the security and availability of the networks on which the Company relies, the information technology systems are protected through physical and software safeguards and backup procedures the Company considers appropriate. SITE Centers contracts with independent cybersecurity providers for security event incident management, end-point detection and incident response monitoring, and security incident response services. Additionally, SITE Centers has deployed a layered approach to network intrusion detection and protection using technology provided by industry-leading companies. The SITE Centers' information technology department also performs timely system and security updates to maintain current software versions and apply appropriate security updates aimed at reducing risk.


text: SITE Centers has also implemented various safeguards designed to ensure the confidentiality, availability and the integrity of its network and data, including redundant telecommunication facilities, replicating critical data and backups to multiple off-site locations, a fire suppression system to protect SITE Centers' on-site data center, and electrical power protection and generation facilities. SITE Centers also has a catastrophic disaster recovery plan and alternate processing capability available for its critical data processes in case of a catastrophe that renders the primary data center unusable.


text: The Company and SITE Centers conduct annual cybersecurity awareness training for all employees, new-hire cybersecurity training, monthly simulated phishing tests, and additional training for specific departmental requirements as part of their respective risk mitigation efforts. SITE Centers also maintains cybersecurity insurance (of which the Company is an additional insured); however, there is no assurance that the insurance SITE Centers maintains will cover all cybersecurity breaches or that policy limits will be sufficient to cover all related losses.


text: Under the leadership of the Company's Chief Technology Officer, the SITE Centers' information technology department is primarily responsible for assessing and managing material risks to SITE Centers' information systems, including from cybersecurity threats. The Company's Chief Technology Officer has over 30 years' experience working in information technology and managing information technology systems and holds several specialized security certifications, including the Certified Information Security Manager certification from the Information Systems Audit and Control Association. In addition, certain members of the SITE Centers information technology department have obtained specialized security certifications, including accreditation as Certified Information Systems Security Professionals, and have prior work experience in various roles involving technology and security. The Company has established an internal Security and Privacy Governance Committee, comprised of the Chief Technology Officer and other senior members of management that generally meets quarterly. This committee receives updates from the SITE Centers' information technology department with respect to the implementation of various systems and security measures, the Company's cybersecurity training and awareness program, enhancements or modifications to the security program, and the impacts of such changes to the Company's information security risk environment. The Company has adopted a Cybersecurity Incident Response Plan, which requires communication of cybersecurity incidents to varying levels and personnel within the organization depending on the severity of the threat impact and encompasses tactics related to cybersecurity, systems and facilities availability, and information privacy.


text: The Board of Directors has specifically delegated oversight of the Company's cybersecurity risks and related practices to the Audit Committee of the Board of Directors (the "Audit Committee") through the committee's charter. At least annually, senior members of the Company's information technology team (including the Chief Technology Officer) and internal audit services team brief the Audit Committee on information and cyber security matters, including results from risk assessments, the Company's policies and its internal control function. The Audit Committee reviews such information alongside other company risks as part of our overall risk assessment.


text: The Company has experienced risks from cybersecurity threats, including issues related to malware, email phishing, and other events intended to disrupt information systems, wrongfully obtain valuable information, or cause other malicious events. To the best of the Company's knowledge, these threats have not materially affected the Company, nor have they materially obstructed the availability of the information systems and data on which it relies. Although no assurances can be given, the Company does not believe that such threats are reasonably likely to materially affect the Company in the future. See Item 1A. Risk Factors under the caption "Risks Related to the Company's Business, Properties and Strategies— A disruption, failure or breach of the networks or systems on which the Company relies, including as a result of cyber-attacks, could harm its business."


text: The Company's risk management program includes procedures, systems, and processes for assessing, identifying, and managing material risks from cybersecurity threats. Overall, we address cybersecurity risks through the Board of Directors (the "Board") and management oversight and a system of controls and procedures designed to protect the confidentiality, integrity, and availability of the Company's information assets. The Company employs a comprehensive system of monitoring, detection, internal reporting, and prompt escalation of certain cybersecurity incidents, plans for incident response and recovery, technical safeguards, third-party risk management, and mandatory training and awareness campaigns.

companyName: MANITOWOC CO INC

ticker: MTW


text: The Global Information Services team has relevant educational and industry experience. The Director of Cybersecurity has served in various roles in information technology and security at Manitowoc for over 30 years, including the last six years overseeing cybersecurity. The Senior Vice President Global Information Systems has been with Manitowoc for over 24 years, leading the Global IS team since 2022.


text: We depend on information systems and technology in substantially all aspects of our business, including communications among our employees and with suppliers and customers. Such uses of information systems and technology give rise to cybersecurity risks, including system disruption, security breach, ransomware, theft, espionage, and inadvertent release of information. Our business involves the storage and transmission of numerous classes of sensitive and/or confidential information and intellectual property, including customers' and suppliers' information, private information about employees, and financial and strategic information about the company and its business partners. Further, as we pursue new initiatives that improve our operations and cost structure, we are also expanding and improving our information technologies, resulting in a larger technological presence and increased exposure to cybersecurity risk. If we fail to properly assess and identify cybersecurity risks, we may become increasingly vulnerable to such risks.

companyName: TTM TECHNOLOGIES INC

ticker: TTMI


text: Cybersecurity risk management and strategy We assess and identify security risk to the organization by: • conducting assessments of risk including likelihood and magnitude from unauthorized access, use, disclosure, disruption, modification, or destruction of information systems and the related information processes, stored, or transmitted; • performing risk assessments and producing security assessment reports that document the results of the assessment for use and review by IT senior leadership, including the Company's Senior Vice President of Information Technology (SVP-IT); • ensuring security controls are assessed for effectiveness, are implemented correctly, operating as intended, and producing the desired outcome; and • periodically scanning for vulnerabilities and remedying all vulnerabilities in accordance with the associated risk.


text: Other processes in place to further manage any additional security risk to the organization include: • identifying, reporting, and correcting information system flaws, security alerts, and advisories; • monitoring inbound and outbound communications for unusual or unauthorized activity; • designing and implementing application systems to include sound backup and recoverability principles, such as periodic data backups in the case of a disaster; • mechanisms designed for the physical protection of IT resources; and • use of all third-party and cloud computing services are reviewed and evaluated for material risks of cybersecurity threats by the IT security department before being formally authorized for use. Use of services must comply with all laws and regulations governing the handling of personally identifiable information, corporate financial data, controlled unclassified information, or any other data owned or collected by the company.


text: Our cybersecurity incident management plan includes the following, among other things: • The SVP-IT leads the team in the development, documentation, review and testing of security procedures, and incident response procedures. Beyond initial creation, procedures are continually re-assessed, augmented, updated, and tested on an ongoing basis; • The SVP-IT works with the Executive Team on the identification, assessment, verification, and classification of incidents to determine affected stakeholders and appropriate parties for contact; • The SVP-IT is responsible for launching the Cybersecurity Incident Response Team (CIRT) if necessary, and for notification to the Chief Executive Officer, who in turn will contact the Board of Directors and Government Security Committee in order to validate the response is being addressed appropriately. • The CIRT team, in consultation with outside experts if needed, is responsible for the following: o Initial containment; o Analysis to establish root cause of incidents, identification and evidence collection;


text: While we have experienced cybersecurity incidents in the past, to date none have materially affected us or our business strategy, results of operations, financial condition and/or cash flows. Moreover, we have not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, financial condition and/or cash flows. See Item 1A, Risk Factors above for more information. While we continually work to safeguard the information systems we use, and the proprietary, confidential, and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks, and data or those of our third-party providers.


text: We rely on our technology network infrastructure and information systems to operate our business, rent our equipment, interact with vendors and customers, support and grow our customer base and bill, collect and make payments, among other functions. Our internally developed infrastructure and systems, as well as those systems and processes provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information. Such attacks have become more sophisticated over time, especially as threat actors have become increasingly well-funded by, or themselves include, governmental actors with significant means. We expect the sophistication of cyber-threats will continue to evolve as threat actors increase their use of AI and machine-learning technologies.

companyName: H&E Equipment Services, Inc.


text: The Company has robust processes for assessing, identifying and managing material risks from cybersecurity threats that are integrated into our overall risk management process. The Company utilizes the National Institute of Standards and Technology (NIST) framework as the basis for our cybersecurity management approach. Under the supervision of the Chief Information Officer ("CIO"), we review our cybersecurity insurance policy and regularly identify all computing assets including hardware, software, and network infrastructure for a comprehensive risk assessment. We consider threats that may originate from both internal and external sources and build in technical security controls based on a defense-in-depth strategy. To identify risks, we complete vulnerability assessments on a recurring basis to proactively identify potential weaknesses. We additionally employ third party external and internal penetration testing on an annual basis to assist in identifying additional vulnerabilities in our environment. We also perform disaster recovery exercises throughout the organization annually by our in-house team. In connection with our threat management and overall risk management process, we receive recurring threat intelligence from our partners that help us recognize the updated tactics, techniques, and procedures being utilized by threat actors and apply the MITRE ATT&CK framework to review defensive coverage against cybersecurity attacks. Employees at H&E receive mandatory recurring cybersecurity training and phishing exercises to reduce the likelihood of success by threat actors. Our managed detection and response partner provides 24/7 monitoring and detection of our cybersecurity environment, which allows us to timely respond to cybersecurity events with the goal of reducing its potential impact. The Company performs an IT security assessment of critical third-party vendors prior to establishing a formal relationship and has additional processes in place to continue to oversee and identify risks associated with the use of our third-party service providers once a formal relationship is established. A cybersecurity incident is defined as any successful unauthorized access, disclosure, or misuse of computing systems, data or networks, including hacking and theft, of any scope that may or may not have an impact to the organization. We have a comprehensive incident response plan that outlines the appropriate procedures, communication flow and response for potential cybersecurity incidents as well as categorizations of scope, incident and impact of such incidents. As of December 31, 2024, risks from cybersecurity threats have not materially affected the Company's financial condition or operations.


text: The Company's information security and cybersecurity program is managed by our CIO whose team includes a VP of Infrastructure and Director of IT Security (collectively, "the IT Security Team"), whom all have the necessary expertise, certifications and experience to lead our enterprise-wide cybersecurity strategy, policy, architecture and processes. The CIO has over 26 years of experience and has been a member and leader of our Company's information systems and technological advancements for the past 22 years. The Director of IT Security, reporting to our VP of Infrastructure, is responsible for our overall network security and assessing and managing cybersecurity risks and threats. The Director of IT Security has over 16 years of experience working in IT security and holds CISSP and GIAC certifications. The VP of Infrastructure reports to our CIO, and has principal responsibility for our network infrastructure and the operation of our cybersecurity program, network and system administration. The VP of Infrastructure has over 30 years of experience in system administration and has specialized in ERP systems and network infrastructure. Collectively, the IT Security Team prepares updates and presentations for the Board of Directors, Audit Committee and executive management.


text: The IT Security team reports the detection, mitigation and remediation of cybersecurity incidents to executive management and the Audit Committee of the Board of Directors. If we were to experience a cybersecurity incident, our Director of IT Security will inform the rest of the IT Security Team, which will then evaluate and assess the materiality of the incident to the Company, its information technology infrastructure and data integrity, and in accordance with our incident response plan, notify executive management and the necessary finance, operations and legal team functions. The CIO additionally reports all cybersecurity incidents to the Audit Committee of the Board. Once a cybersecurity incident is reported to the Audit Committee of the Board, and potentially the overall Board of Directors, the Audit Committee, with the input of the IT Security Team and executive management, will discuss impact, determine how to address it and whether or not the incident would require external reporting, if applicable.


text: Our Board includes members with skills and experience in cybersecurity, technology, and innovation. The Board ultimately oversees cybersecurity risks and evaluates such risks as part of our ERM program. As part of our ERM processes, we utilize a formal corporate risk and governance structure that sets out the roles, responsibilities, and expectations of the various parties involved throughout our company in risk mitigation and management. The Risk Committee of the Board is responsible for approving and periodically reviewing and assessing the effectiveness of our ERM policies and procedures. The Risk Committee also assists the Board in its oversight of risks related to cybersecurity by regularly engaging with management and/or third-party consultants to assess the cyber threat landscape; evaluate our information security program; review the results of penetration testing; and analyze the design, effectiveness, and ongoing enhancement of our capabilities to monitor, prevent, and respond to cyber threats and events. The Risk Committee generally meets with management and/or third-party consultants regarding cybersecurity matters on a quarterly basis. Any material developments are reported by the Risk Committee to the Board. Further, any cybersecurity incidents deemed to have a high impact on our business are also generally reported to the Board, regardless of materiality.

companyName: Regional Management Corp.

ticker: RM


text: Our SDIS, who holds a graduate degree in cybersecurity and several industry leading cybersecurity certifications, is the management position responsible for our overall information security program including strategy, security engineering, cyber threat detection, and response. The information security team managed by our SDIS contains certified cybersecurity professionals with broad experience and expertise in cybersecurity threat assessment and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats, and regulatory compliance, among other areas. The information security team continually evaluates our cybersecurity posture, which aligns with the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) industry standard, and makes on-going investments in our networks, in addition to performing regular testing of our environment.


text: Third-party risk is assessed as part of our information security program and includes risk-tiered criteria for due diligence. Contractually, data handling third parties are required to uphold all applicable rules, laws, and regulations in addition to, when applicable, notifying us of cybersecurity events that may negatively impact us or our data.


text: Cybersecurity Roadmap and Risk Assessment We have a cybersecurity roadmap that provides a framework for prioritizing and managing our ongoing cybersecurity program. We conduct periodic risk assessments based on the National Institute of Standards and Technology ("NIST") cybersecurity framework to identify and assess our cybersecurity risks, vulnerabilities and information security maturity assessments to evaluate the maturity stage of the overall cybersecurity program. The results of these assessments are reported to the Audit Committee of the Board, and we adjust our cybersecurity roadmap, policies, processes and practices as necessary based on the information provided by these assessments as well as the monitoring, testing and auditing noted below.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: Third-Party Risk Management We use a risk-based approach to identify and oversee cybersecurity risks presented by third parties, including vendors and service providers, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We also obtain assurances from outsourced service providers regarding the sufficiency of their security procedures and, where appropriate, assess the protections employed by these third parties.


text: Monitoring, Testing and Auditing We monitor the evolving cybersecurity landscape that could result in new or increased cybersecurity threats. We also engage in the periodic assessment and testing of our policies, standards, processes and practices. These efforts include audits, vulnerability and penetration testing, tabletop exercises, social engineering campaigns and other internal and external assessments. We evaluate the effectiveness of our information technology-related internal controls annually.


text: Education and Awareness The Company regularly conducts mandatory cybersecurity training for its employees, and all new hires are required to take cybersecurity training when they receive their Company computer. Failure to complete the training in a timely fashion results in their system access being suspended until completion. Management also regularly conducts "phishing" exercises to test the effectiveness of our training programs. The results of these exercises are reported to the Audit Committee. Employees also receive monthly newsletters highlighting cybersecurity developments as well as targeted email messages, as appropriate.


text: Our Senior Vice President and Chief Information Officer and our Vice President, Global Cybersecurity, update the Audit Committee regularly regarding the status of ongoing cybersecurity initiatives and strategies and incident reports. They also present information to the Audit Committee regarding management's cybersecurity risk and maturity assessments, including changes to our cybersecurity roadmap as a result of these assessments. This briefing is also posted to the full Board, which also receives quarterly updates through the Audit Committee. In accordance with the Company's policies and incident response plans, based on the severity of the incident, the Audit Committee is notified and briefed. The Board and executive management participate in cybersecurity training and conduct tabletop exercises on a periodic basis.


text: Management Oversight At a management level, our cybersecurity program is led by our Vice President, Global Cybersecurity who oversees a team with extensive knowledge and expertise. He is a Certified Information Security Professional and has over 20 years of cybersecurity experience and reports to our Chief Information Officer, who reports to our Chief Executive Officer. Our Vice President, Global Cybersecurity also chairs our Cybersecurity Management Committee which consists of senior business and functional leaders, including our Chief Information Officer and General Counsel. The Cybersecurity Management Committee is intended to provide cross-functional support for cybersecurity risk management.


text: Cyber Risks, Threats and Incidents As a global company servicing customers in over 100 countries, we experience a variety of cybersecurity events and incidents. However, as of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incident that has materially affected or is reasonably likely to materially affect our business, strategy, results of operations or financial condition; though there can be no assurance that a cybersecurity incident that could have a material impact on us will not occur in the future. For further details regarding the cybersecurity risks and uncertainties we face see "Part I, Item 1A. Risk Factors -Technology and Cybersecurity Risks" of this report.


text: Risk Management and Strategy Our business operations and strategy are highly dependent on our ability, and the ability of certain third parties, to access internal and external systems and data to perform necessary business functions. We are heavily reliant on data and information, including non-public information, as well as technology systems that process and store such data and information, the integrity and functionality of which are critical to our ability to grow our business, operate efficiently, and generate earnings. As discussed in further detail in "Risk Factors" in Part I – Item 1A, and like others in the financial services industry, we have from time to time experienced, and are likely to continue to experience, security events and data incidents, and while none of these events to date have had a material adverse effect on our business, no assurances can be made that such attacks or security events will not have a material adverse impact on our business, results of operations or financial condition in the future, due to impairments in our ability to conduct our business or harm to our relationships with our business partners and customers.

companyName: HANOVER INSURANCE GROUP, INC.

ticker: THG


text: We have an enterprise-wide cybersecurity program that provides governance, direction and executive support for assessing, identifying and managing cybersecurity risks. Our cybersecurity program aligns with leading industry frameworks including the National Institute of Standards and Technology Cyber Security Framework and Control Objectives for Information and Related Technologies. Our cybersecurity program is designed to identify relevant assets and associated risks, protect against, detect, respond to and recover from cybersecurity events, and employs a "defense in depth" strategy that uses multiple security measures to protect the confidentiality, integrity, and availability of our systems and information assets. We continually assess our cybersecurity and threat detection capabilities, including our proficiency in identifying emerging tactics, techniques, and procedures of threat actors, to enhance our ability to focus resources appropriately.