text: Our cybersecurity risk management processes are fully integrated into our overall risk management system and corporate governance framework. This integration ensures that cybersecurity considerations are embedded within our strategic decision-making processes and are aligned with our broader business objectives. By integrating cybersecurity into our overall risk management system, we promote a comprehensive approach to risk mitigation and resilience-building across the organization.


text: 1.External Expertise: We recognize the value of external expertise in assessing and enhancing our cybersecurity posture. To complement the internal capabilities of our Chief Information Security Officer ("CISO"), Chief Technology Officer ("CTO") and their team of professionals, we engage assessors, consultants, auditors, and other third-party experts with specialized knowledge in cybersecurity. These external stakeholders conduct independent assessments, penetration testing, vulnerability scans, and audits to evaluate the effectiveness of our cybersecurity controls and identify areas for improvement.

companyName: NewtekOne, Inc.

ticker: NEWT

secItem: Item 1C


text: 2.Continuous Improvement: The insights and recommendations provided by external assessors and consultants inform our ongoing efforts to strengthen our cybersecurity defenses. We prioritize the implementation of their recommendations, ensuring that our cybersecurity measures remain robust and adaptive to evolving threats.


text: 1.Vendor Risk Management: We recognize that third-party service providers may introduce additional cybersecurity risks to our organization. As such, we have established a vendor risk management program to assess and monitor the cybersecurity posture of our third-party vendors and partners.


text: 2.Due Diligence: Prior to engaging with third-party service providers, we conduct due diligence assessments to evaluate their cybersecurity controls, practices, and compliance with industry standards and regulations. This due diligence process includes assessing the vendor's security policies, procedures, incident response capabilities, and contractual obligations related to cybersecurity.


text: 3.Ongoing Monitoring: We continuously monitor the cybersecurity performance of our third-party vendors throughout the duration of our engagement. This includes regular assessments, audits, and compliance reviews to ensure that vendors adhere to agreed-upon cybersecurity standards and contractual obligations.


text: 4.Remediation and Escalation: In the event that cybersecurity risks or deficiencies are identified within our third-party vendor ecosystem, we work collaboratively with the vendor to address and remediate these issues in a timely manner. Depending on the severity of the risk, we may escalate concerns to senior management or terminate the vendor relationship if necessary.


text: Our Board oversees material risks facing the Company. For some categories of risk, the Board has empowered a committee to provide more focused oversight. In the case of cybersecurity and technology risk, the Board's Risk Committee has that responsibility.


text: The Risk Committee is informed of risks from cybersecurity threats through regular reports from the Company's management, including our CISO and CTO. Our CISO and CTO, who are employees of our subsidiary NTS, oversee our cybersecurity risk management program. The CISO is chiefly responsible for developing, maintaining, and enforcing cybersecurity and cyber risk-related policies; ensuring the Company and its subsidiaries satisfy requirements of relevant regulations, industry standards, and third-party risk assessment requirements; keeping abreast of developing security threats, and helping both the Board and the Risk Committee understand potential security problems that might arise from the changing threat landscape; and overseeing and implementing regular security awareness training of all employees on cybersecurity, and supporting effective communication with users to limit security vulnerabilities. The CISO regularly reports to the Risk Committee, as well as the risk committee of the board of directors of Newtek Bank, on the state of our cybersecurity risk management program and provides updates on cybersecurity matters.


text: The Risk Committee also receives regular reports on how management identifies, assesses, and manages cybersecurity and broader technology risks. The Risk Committee reviews these reports and discusses them with management. The Risk Committee reports to the full Board on key aspects of management's presentations on cybersecurity and broader technology risks. All members of the Board have access to written cybersecurity reports that are provided to the Risk Committee.


text: While our Board and Risk Committee oversee risk, our senior leadership is responsible for identifying, assessing, and managing our exposure to risks from cybersecurity threats. Accountability of our cybersecurity program is housed within our subsidiary NTS, which is led by our CTO. Reporting to our CTO is the CISO, the individual who provides day-to-day oversight of our cybersecurity program. Our CISO is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity threats. Our CISO oversees a team that regularly communicates with respect to the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The CISO's team consists of individuals that have knowledge, skills and expertise to respond to a cybersecurity incident. Our CISO coordinates with the Company's and our subsidiaries' executive officers relating to potentially material cybersecurity incidents and regularly discusses with the Risk Committee the effectiveness of the Company's technology security, capabilities for disaster recovery, data protection, cyber threat detection and cyber incident response and management of technology-related compliance risks.


text: Our CISO is a Certified Information System Security Professional (CISSP) with decades of experience with technology in security, architecture, infrastructure and support in the financial, education, healthcare and verticals. He is a results driven leader who has managed multimillion dollar projects and solutions to successful completion. Our CTO has over 25 years of experience in enterprise technology services with expertise in managed services, private cloud, service operations, and security. He is committed to driving reliability of services while prioritizing robust security measures.


text: Risk Management and Strategy NewtekOne maintains a Risk Management framework to identify, measure, mitigate, monitor and report material risks to the Risk Committee of our Board. Our Risk Management process includes participation by our senior management and employees across NewtekOne and its consolidated subsidiaries and is overseen by our Chief Risk Officer who reports to the Risk Committee and our CEO. The Risk Committee sets the risk appetite across NewtekOne while the executive leadership team and our associates identify and monitor current and emerging risks and manage those risks within our risk appetite. Cybersecurity has been identified among the material risks in our business and the following approach has been developed to address cybersecurity.


text: We and NTS, and NTS's successor, IPM, which manages our IT infrastructure and cybersecurity under the direction of our CTO, have developed an enterprise-wide cybersecurity risk management system and strategy to safeguard our assets and operations, including the protection of the confidentiality of nonpublic, sensitive personal and business information and the integrity and security of our information systems, as follows: Assessment, Identification, and Management of Material Risks:


text: 1.Internal Expertise: Our CTO is responsible for overseeing the Company's IT infrastructure and cybersecurity and reports to our executive management team and the Technology Steering Committee of our Board.


text: 2.External Expertise: We recognize the value of external expertise in assessing and enhancing our cybersecurity posture. Historically, the Company's subsidiary NTS and its team of professionals, including NTS' Chief Information Security Officer ("CISO"), who currently serves as our CISO, and CTO, and their team of professionals, have managed the Company's IT infrastructure, including our dedicated server hosting, managed cybersecurity, backup and disaster recovery, and other related services. As of the January 2, 2025, close of our divestiture of NTS to IPM, we and IPM entered into a Master Services Agreement pursuant to which IPM provides us with the same services NTS provided to the Company prior to the divestiture. Our CTO is responsible for overseeing IPM's provision of the managed technology services, including cybersecurity, to NewtekOne. In addition, we engage assessors, consultants, auditors, and other third-party experts with specialized knowledge in cybersecurity. These external stakeholders conduct independent assessments, penetration testing, vulnerability scans, and audits to evaluate the effectiveness of our cybersecurity controls and identify areas for improvement.


text: 3.Continuous Improvement: The insights and recommendations provided by external assessors and consultants inform our ongoing efforts to strengthen our cybersecurity defenses. We prioritize the implementation of their recommendations, ensuring that our cybersecurity measures remain robust and adaptive to evolving threats.


text: Our management is actively engaged in overseeing our third-party service providers. Our Enterprise Third Party Risk Management (TPRM) Policy establishes requirements and practices used to oversee and manage the activities of third parties with whom we have a relationship, under which we identify, measure, monitor, and manage third-party risk (including information cybersecurity risks) in alignment with our strategic objectives and in compliance with applicable law. Any identified threats, vulnerabilities, or cybersecurity incidents are addressed as appropriate through our CTO, CISO and IPM.


text: Our Board oversees material risks facing the Company. For some categories of risk, the Board has empowered committees to provide more focused oversight. In the case of cybersecurity and technology risk, in 2024 the Board formed the Technology Steering Committee which has that responsibility.


text: The Technology Steering Committee is informed of risks from cybersecurity threats through regular reports from the Company's management, including our CTO. Our CTO and the CISO, who is employed by IPM, oversee our cybersecurity risk management program. The CISO is chiefly responsible for developing, maintaining, and enforcing cybersecurity and cyber risk-related policies; ensuring the Company and its subsidiaries satisfy requirements of relevant regulations, industry standards, and third-party risk assessment requirements; keeping abreast of developing security threats, and helping both the Board and the Technology Steering Committee understand potential security problems that might arise from the changing threat landscape; and overseeing and implementing regular security awareness training of all employees on cybersecurity, and supporting effective communication with users to limit security vulnerabilities. The CISO regularly reports to our CTO who reports to the Technology Steering Committee on a quarterly and more frequently as needed, on the state of our cybersecurity risk management program and provides updates on cybersecurity matters.


text: The Technology Steering Committee also receives regular reports on how management identifies, assesses, and manages cybersecurity and broader technology risks. The Technology Steering Committee reviews these reports and discusses them with management. The Technology Steering Committee reports to the full Board on key aspects of management's presentations on cybersecurity and broader technology risks. All members of the Board have access to written cybersecurity reports that are provided to the Technology Steering Committee.


text: While our Board and Technology Steering Committee oversee cybersecurity and technology risk, our senior leadership is responsible for identifying, assessing, and managing our exposure to risks from cybersecurity threats. Accountability of our cybersecurity program is housed within IPM, with oversight by our CTO. Reporting to our CTO is the CISO, the individual who provides day-to-day oversight of our cybersecurity program. Our CISO is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity threats. Our CISO oversees a team that regularly communicates with respect to the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The CISO's team consists of individuals that have knowledge, skills and expertise to respond to a cybersecurity incident. Our CISO coordinates with the CTO, who coordinates with the Company's and our subsidiaries' executive officers relating to potentially material cybersecurity incidents and regularly discusses with the Technology Steering Committee the effectiveness of the Company's technology security, capabilities for disaster recovery, data protection, cyber threat detection and cyber incident response and management of technology-related compliance risks.


text: Our CISO is a Certified Information System Security Professional (CISSP) with decades of experience with technology in security, architecture, infrastructure and support in the financial, education, healthcare and verticals. He is a results driven leader who has managed multimillion dollar projects and solutions to successful completion. Our CTO has over 25 years of experience in enterprise technology solutions, with expertise in managed services, private cloud, service operations, and security. He is committed to driving reliability of services while prioritizing robust security measures.


text: Risk Management and Strategy The Company's cybersecurity is overseen by the Chief Executive Officer, who receives reports directly from other officers and individuals who perform services for the Company, including, but not limited to, the Manager's Information Security Steering Committee ("ISSC"), employing a risk-based methodology designed to safeguard the security, confidentiality, integrity, and availability of its information. The ISSC is tasked with developing an effective cyber strategy, establishing policies, and managing cyber risks within the organization. The Manager's Chief Financial Officer and General Counsel, along with the Chief Operating Officer, Chief Human Resources Officer, Chief Compliance Officer, Chief Technology Officer, Chief Information Security Officer and Chief of Intelligence collaborate with the Company's Chief Financial Officer to formulate, implement, and enforce these policies. They help ensure that the ISSC considers best practices in its decision-making, and convenes quarterly or as needed to assess cybersecurity issues and supervise matters related to information security, fraud, vendors, data protection, and privacy risks.

companyName: FTAI Aviation Ltd.

ticker: FTAI


text: To help identify and assess risks, we and our Manager engage third-party advisors, leveraging standards such as the National Institute of Standards and Technology security framework ("NIST"). The results of these assessments inform the development of cybersecurity controls and risk mitigation strategies, which are then implemented throughout the Company.


text: We have taken proactive measures intended to minimize the likelihood of successful cyberattacks, including the establishment of incident response procedures designed to address potential cyber threats that may arise. These response procedures are structured with the aim to identify, analyze, contain, and remediate any cyber incidents that occur. We also have risk management processes to oversee and help identify risks from cybersecurity threats associated with our use of third-party providers.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "A cyberattack that bypasses our information technology ("IT"), security systems or the IT security systems of our third-party providers, causing an IT security breach, may lead to a disruption of our IT systems and the loss of business information which may hinder our ability to conduct our business effectively and may result in lost revenues and additional costs." in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: Material risks are identified and prioritized by management, and material risks are discussed periodically or as needed with the Board of Directors. The Board of Directors regularly reviews information regarding the Company's credit, liquidity and operations, including risks and contingencies associated with each area, including cybersecurity. In addition to the formal compliance program, the Board of Directors encourages management to promote a corporate culture that incorporates risk management into the Company's corporate strategy and day-to-day business operations.


text: Risk Management and Strategy The Company's cybersecurity is overseen by the Chief Executive Officer, who receives reports directly from other officers and individuals who perform services for the Company, including, but not limited to, the Former Manager's Information Security Steering Committee ("ISSC"), employing a risk-based methodology designed to safeguard the security, confidentiality, integrity, and availability of its information. The ISSC is tasked with developing an effective cyber strategy, establishing policies, and managing cyber risks within the organization. The Former Manager's Chief Financial Officer and General Counsel, along with the Chief Operating Officer, Chief Human Resources Officer, Chief Compliance Officer, Chief Technology Officer, Chief Information Security Officer and Chief of Intelligence collaborate with officers and individuals at the Company to formulate, implement, and enforce these policies. They help ensure that the ISSC considers best practices in its decision-making, and convenes quarterly or as needed to assess cybersecurity issues and supervise matters related to information security, fraud, vendors, data protection, and privacy risks. The Former Manager's Chief Technology Officer and Chief Information Security Officer have extensive knowledge and skills, and collectively bring decades of experience in the cybersecurity industry.


text: To help identify and assess risks, we and our Former Manager engage third-party advisors, leveraging standards such as the National Institute of Standards and Technology security framework ("NIST"). The results of these assessments inform the development of cybersecurity controls and risk mitigation strategies, which are then implemented throughout the Company.


text: Risk Management and Strategy We recognize the importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data. Our processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes. Cybersecurity events are collected, evaluated and, when appropriate, escalated to the Chief Information Security Officer (CISO) for impact analysis utilizing the cybersecurity risk management policy.

companyName: Civeo Corp

ticker: CVEO


text: Cybersecurity risks are monitored and evaluated by management through an internal compliance program with oversight by internal audit. We engage a variety of cybersecurity partners to perform penetration testing and quarterly audits on our cybersecurity profile. These partnerships enable us to leverage specialized knowledge and insights, and are meant to help our cybersecurity strategies and processes in remaining risk appropriate. In order to promote a company-wide culture of cybersecurity risk management, management has also implemented a variety of required programs to both test and train our employees on cybersecurity fundamentals, including both annual and ongoing information security awareness training.


text: Our cybersecurity policies and procedures encompass data privacy, incident response, information security and risks from our use of third-party vendors. In order to help develop these policies and procedures, we monitor the privacy and cybersecurity laws, regulations and guidance applicable to us in the regions where we do business, as well as proposed privacy and cybersecurity laws, regulations, guidance and emerging risks.


text: We also have conducted a cyber breach simulation exercise with the assistance of a third party cybersecurity consultant. The exercise focused on incident management and communication processes. Company business functions, executive management and members of the Board participated. The goal was to identify opportunities for greater efficiency, coordination, and alignment.


text: We face risks from various security threats, including cybersecurity threats to gain unauthorized access to sensitive information or to render data or systems unusable or hold them for ransom. Cybersecurity attacks in particular develop and evolve rapidly, including from emerging technologies, such as advanced forms of artificial intelligence. Such attacks include, but are not limited to, malicious software, attempts to gain unauthorized access to data, ransomware attacks and other electronic security breaches that could lead to disruptions in critical systems, unauthorized release of or denial of access to confidential or otherwise protected information and corruption of data. We have experienced, and expect to continue to confront, efforts by hackers and other third parties to gain unauthorized access or deny access to, or otherwise disrupt, our information systems and networks. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an affect. See Part I, Item 1A, "Risk Factors," under the heading "Risks Related to Our Operations - Our business could be negatively impacted by security threats, including cybersecurity threats and other disruptions" for more information regarding the risks we face.


text: As discussed in Part I, Item 1A, "Risk Factors," under the heading "Financial/Accounting Risks – We may not have adequate insurance for potential liabilities and insurance may not cover certain liabilities," we maintain cyber risk insurance to mitigate our exposure to these threats.


text: Risk oversight is a responsibility of the Board. The Board has delegated responsibility for monitoring technology and cybersecurity risks to the Audit Committee. The Board reviews the Company's cybersecurity risk posture, strategy and execution on at least an annual basis while the Audit Committee receives cybersecurity updates quarterly.


text: The CISO and executive management play a pivotal role in informing the Audit Committee on cybersecurity risks. Executive management, including the CISO, regularly meets with the Audit Committee to discuss cybersecurity risks, review quarterly cyber metrics and oversee progress against our annual action plans. These briefings may encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee and executive management maintain an ongoing dialogue regarding emerging or potential cybersecurity risks.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO. Our CISO has cybersecurity expertise from over 18 years of experience in the field of cybersecurity. His background includes extensive experience as CISO at Civeo and previously for a Fortune 500 company. He also oversees our cybersecurity governance programs, assists with testing our compliance with applicable standards, leads our efforts to remediate known risks and leads our employee training program.


text: The CISO is informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CISO implements and oversees processes for the monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. The Company deploys a Security Operations Center team who monitor and escalate cybersecurity events. In the event of a cybersecurity incident, the CISO is equipped with an incident response plan, which is intended to mitigate the impact of the incident and includes long-term strategies for remediation and prevention of future incidents.


text: The CISO regularly updates executive management on cybersecurity risks and incidents. Significant cybersecurity matters and certain strategic risk management decisions are escalated to the Audit Committee and the Board.


text: Risk Management and Strategy We recognize the importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data. Civeo leverages controls modeled in the Center for Internet Security (CIS) and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) to evaluate our cybersecurity capabilities and to inform the implementation and configuration of certain systems, processes, and technologies. Our processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes. Cybersecurity events are collected, evaluated and, when appropriate, escalated to the Chief Information Security Officer (CISO) for impact analysis utilizing our cybersecurity risk management policy.


text: Our cybersecurity policies and procedures encompass data privacy, incident response, information security and risks from our use of third-party vendors. In order to help develop these policies and procedures, we monitor applicable privacy and cybersecurity laws, regulations and guidance in the regions where we do business, as well as proposed privacy and cybersecurity laws, regulations, guidance and emerging risks.


text: Cybersecurity risks are monitored and evaluated by management through an internal compliance program with oversight by internal audit. We engage various third-party cybersecurity partners, such as auditors, assessors and consultants to perform penetration testing and audits on our cybersecurity profile. With the assistance of a third-party cybersecurity consultant, we also conducted three cyber breach simulation exercises in the last five quarters, focused on incident management and communication processes. These third-party partnerships enable us to leverage specialized knowledge and insights, and are meant to ensure our cybersecurity strategies and processes remain appropriately tailored to the company's risk profile. In order to promote a company-wide culture of cybersecurity risk management, management has also implemented programs to both test and train our employees on cybersecurity fundamentals, including both annual and ongoing information security awareness training.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an affect. See Part I, Item 1A, "Risk Factors," under the heading "Risks Related to Our Operations - Our business could be negatively impacted by security threats, including cybersecurity threats and other disruptions" for more information regarding the risks we face.


text: While the Board maintains responsibility for risk oversight it has delegated responsibility for evaluating technology and cybersecurity risks to the Audit Committee. The Board reviews the Company's cybersecurity risk posture, strategy and execution on at least an annual basis while the Audit Committee receives cybersecurity updates quarterly.


text: The CISO and executive management play a pivotal role in informing the Audit Committee on cybersecurity risks. Executive management, including the CISO, meets regularly with the Audit Committee to discuss cybersecurity risks, review quarterly cyber metrics and oversee progress against our annual action plans. These briefings may encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee and executive management maintain an ongoing dialogue regarding emerging or potential cybersecurity risks, and the CISO regularly updates executive management on cybersecurity risks and incidents.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO who has over 18 years of experience in the field of cybersecurity, including at Civeo and previously for a Fortune 500 company. The CISO implements and oversees processes for the monitoring of our information systems, which includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. The CISO also oversees our cybersecurity governance programs, assists with testing our compliance with applicable standards, leads our efforts to remediate known risks and leads our employee training program.


text: The Company deploys a Security Operations Center team who monitor and escalate cybersecurity events to the CISO. In the event of a cybersecurity incident, the Company maintains an incident response plan, which is intended to facilitate response, escalation, and mitigate the impact of the incident and includes long-term strategies for remediation and prevention of future incidents. Significant cybersecurity matters and certain strategic risk management decisions are escalated to the Audit Committee and the Board.


text: Cybersecurity is a part of our risk management framework, and we have established policies and processes designed to manage cybersecurity defenses, controls and programs, including ISO 27001 compliant security procedures. Our processes are evaluated by expert cybersecurity firms through various security assessments and audits, which help us identify and mitigate cyber-related risks to our businesses. We also engage with providers of information systems as part of our continuing efforts to enhance the effectiveness of our security measures. Our vendor risk management (VRM) program, through which we screen external providers, helps us identify and evaluate known risks associated with these third parties.

companyName: Element Solutions Inc

ticker: ESI


text: Our information security program is led by our Chief Information Security Officer (CISO) who manages a global information security team responsible for assessing and mitigating cyber-related threats. The cybersecurity expertise of our CISO and his team includes information security management roles, hands-on cyber incident response experience, forensic and network intrusion investigations and security risk assessments.


text: Our CISO regularly reports to senior management on cybersecurity risks and incidents, including the nature of threats, the state of our defense and detection capabilities, incident response plans and employee training activities, as applicable. In addition, as part of the Board's oversight of the Company's risk management program, our CISO provides periodic updates to the Board on the state of our cybersecurity management program in addition to, when needed, ad hoc information about any significant cybersecurity matters and/or strategic risk management decisions.


text: Our information security program is led by our Chief Information Security Officer (CISO) who manages a global information security team responsible for assessing and mitigating cyber-related threats. The cybersecurity expertise of our CISO and his team includes information security management as well as governance, risk and compliance (GRC) roles, hands-on cyber incident response experience, forensic and network intrusion investigations and security risk assessments.


text: In the ordinary course of our business, we collect, use, store, and transmit digitally confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by our information technology team, which is led by our Vice President, Digital Operations & Facilities, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we conduct cybersecurity audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, CROs, and other contractors and suppliers. We also conduct periodic employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: Viridian Therapeutics, Inc.\DE

ticker: VRDN


text: Our Vice President, Digital Operations & Facilities, who reports directly to the Chief Operating Officer and has over 12 years of experience managing information technology and cybersecurity matters, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework that is overseen by our Audit Committee of our board of directors and our board of directors. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. See "Risk Factors" for additional information on cybersecurity risks we face.


text: Our board of directors, as a whole and at the Audit Committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. Our Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives biannual updates on cybersecurity and information technology matters and related risk exposures from our Chief Operating Officer as well as other members of the senior leadership team. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: We have developed and implemented a cybersecurity risk management program that is designed to assess, identify, and manage material risks from cybersecurity threats and to protect the security, confidentiality, integrity and availability of our critical systems and information. These processes are managed and monitored by our information technology team, which is led by our Vice President, Information Technology & Facilities, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting our data and information technology environment. For example, we conduct cybersecurity audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, CROs, and other contractors and suppliers. We also conduct periodic employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.


text: Our Vice President, Information Technology & Facilities, who reports directly to the Chief Operating Officer and has over 15 years of experience managing information technology and cybersecurity matters, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework that is overseen by our Audit Committee of our board of directors and our board of directors. In the last fiscal year, we have not experienced any cybersecurity incidents that resulted in a material effect on our business strategy, results of operations, or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents See "Risk Factors" for additional information on cybersecurity risks we face.


text: Our Audit Committee has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives biannual updates on cybersecurity and information technology matters and related risk exposures from members of the senior leadership team. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Risk management and strategy We maintain a cybersecurity team responsible for the development and implementation of a program intended to protect the confidentiality, integrity and availability of our critical systems and information. A component of our program is a cybersecurity Incident Response Plan ("IRP") which has been built by the team utilizing current and historical industry knowledge and experience.

companyName: Caesars Entertainment, Inc.

ticker: CZR


text: Key elements of our risk management procedures and processes include: • risk assessments to help mitigate material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a team comprised of IT security, IT infrastructure, and IT compliance personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • formal information security training program for all team members as well as supplemental training on specific matters such as phishing and email security best practices; • a cybersecurity incident response plan and Security Operations Center (SOC) to respond to cybersecurity incidents; • attack and response simulations at the technical level and execute tabletop response exercises at the management level; • a third-party risk management process for service providers; and • cybersecurity insurance to cover certain expenses in the event of a cybersecurity incident.


text: The cybersecurity team reports to the Chief Information Officer and in January 2024, we hired a Chief Information Security Officer ("CISO") with significant experience in leading cybersecurity teams to assume the leadership of management's responsibilities and governance discussed below.


text: We evaluate our cybersecurity risk management processes and continue to integrate our procedures into our overall enterprise risk management program, which shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Incidents are investigated by the cybersecurity team as they are identified and may be resolved or escalated based upon the specific details and severity of each incident. Incidents are evaluated throughout the investigation and remediation processes and incidents determined to be insignificant may be resolved by the cybersecurity team without further escalation at that time. Incidents determined to be more severe, such as those that may have compromised the confidentiality, integrity and availability of our critical systems and information, are escalated by the cybersecurity team to notify legal counsel, our Cybersecurity & Privacy Executive Steering Committee, our Board of Directors, or various regulators, as required.


text: Our cybersecurity team evaluates the risk profile of new third party service providers and maintains communication channels with key third party service providers to evaluate and respond to possible effects of incidents within a service provider's organization. We rely on, and in certain cases require, our third parties to communicate such incidents timely.


text: As previously disclosed, on September 14, 2023, we announced that an unauthorized actor had gained access to our information technology network as a result of a social engineering attack on an outsourced IT support vendor used by the Company, and acquired a copy of, among other data, our loyalty program database ("Data Incident"). After detecting suspicious activity in our information technology network, we activated our IRP, which included containment measures, and commenced an investigation of the incident. We also notified law enforcement and state gaming regulators, engaged legal counsel and other third-party incident response and cybersecurity professionals, as well as forensic professionals.


text: We have received, and continue to pursue, reimbursements from insurance carriers for costs incurred as a result of the Data Incident. Based on our assessment, the incident has not had a material impact, and we do not believe the incident has materially affected or will materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: As a result of the Data Incident, numerous putative class action lawsuits have been filed against us purporting to represent various classes of persons whose personal information was affected by the Data Incident. These class actions assert a variety of common law and statutory claims based on allegations that we failed to use reasonable security procedures and practices to safeguard customers' personal information, and seek monetary and statutory damages, injunctive relief and other related relief. In addition to those putative class action lawsuits, individual claims have been filed or threatened against us as well.


text: We have also received inquiries from numerous state regulators related to the Data Incident. We are responding to these inquiries and cooperating fully with regulators. See Note 11 for further discussion.


text: We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as critical to the enterprise and is responsible for reviewing our cybersecurity risk profile, including management's design, implementation and enforcement of our cybersecurity risk management program. The Board of Directors receives periodic updates from our Chief Information Officer ("CIO") on cybersecurity risks and threats. Board members also receive periodic presentations on cybersecurity topics from our CIO, supported by our internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.


text: The Board has determined that retaining responsibility for risks related to cybersecurity oversight is appropriate, given the complexity of the risks associated with cybersecurity and the attention required to appropriately review and monitor such risks. The full Board lends its collective experience and attention to discussing and overseeing potential risks identified by management and stays up to date on management's risk-mitigation processes related to cybersecurity.


text: Our CIO is responsible for assessing and managing our material risks from cybersecurity threats. Our CIO has the primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CIO has significant global experience in managing and leading IT and cybersecurity teams. Members of the cybersecurity team hold various credentials and certificates with respect to information systems and they participate in continuing education.


text: Key elements of our risk management procedures and processes include: • risk assessments to help mitigate material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a team composed of IT security, IT infrastructure, and IT compliance personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • formal information security training program for all team members as well as supplemental training on specific matters such as phishing and email security best practices; • a cybersecurity incident response plan and Security Operations Center (SOC) to respond to cybersecurity incidents; • attack and response simulations at the technical level and execute tabletop response exercises at the management level; • a third-party risk management process for service providers; and • cybersecurity insurance to cover certain expenses in the event of a cybersecurity incident.


text: The cybersecurity team reports to the Chief Information Officer ("CIO") and in January 2024, we hired a Chief Information Security Officer ("CISO") with significant experience in leading cybersecurity teams to assume the leadership of management's responsibilities and governance discussed below.


text: Our cybersecurity team evaluates the risk profile of new third-party service providers and maintains communication channels with key third-party service providers to evaluate and respond to possible effects of incidents within a service provider's organization. We rely on, and in certain cases require, our third parties to communicate such incidents timely.


text: As previously disclosed, on September 14, 2023, we announced that an unauthorized actor had gained access to our information technology network as a result of a social engineering attack on an outsourced IT support vendor used by the Company, and acquired a copy of, among other data, our loyalty program database, which includes driver's license numbers and/or social security numbers for a significant number of members in the database ("Data Incident"). After detecting suspicious activity in our information technology network, we activated our IRP, which included containment measures, and commenced an investigation of the incident. We also notified law enforcement and state gaming regulators, engaged legal counsel and other third-party incident response and cybersecurity professionals, as well as forensic professionals.


text: We have also received inquiries from numerous state regulators related to the Data Incident. We are responding to these inquiries and cooperating fully with regulators. See Note 8 for further discussion.


text: Our Board considers cybersecurity risk as critical to the enterprise and is responsible for reviewing our cybersecurity risk profile, including management's design, implementation and enforcement of our cybersecurity risk management program. The Board of Directors receive periodic updates and presentations on cybersecurity topics from our CISO, supported by internal security staff and/or external experts, as part of the Board's continuing education on topics that impact public companies.


text: Our CISO is responsible for assessing and managing our material risks from cybersecurity threats and has the primary responsibility for leading our overall cybersecurity risk management program, supervising both our internal cybersecurity personnel and external cybersecurity service providers. Our CISO has over 20 years global large-scale cybersecurity experience in managing and leading IT and cybersecurity teams. Members of the cybersecurity team hold various credentials and certificates with respect to information systems and they participate in continuing education.


text: Our CISO also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our products ("Information Systems and Data").

companyName: MALIBU BOATS, INC.

ticker: MBUU


text: Our information technology function is overseen by our Chief Information Officer ("CIO"), with support from our Cybersecurity Steering Committee, and helps identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's risk register. This group works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example: manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, evaluating our and our industry's risk profile, evaluating threats reported to us, internal and external audits, and conducting vulnerability assessments to identify vulnerabilities.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: documented incident response process, vulnerability management policy, disaster recovery and business continuity processes, risk assessments, network security controls, access controls, physical security, asset management, tracking and disposal for certain assets, systems monitoring, employee cyber security training, penetrating testing, cybersecurity insurance, dedicated cybersecurity staff, and a security operations center.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk assessment and identified in the Company's risk register.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, threat intelligence service providers, professional services firms, including legal counsel, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract manufacturing organizations, and supply chain resources. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management processes may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Risks Related to Our Business and Operations – If our information technology systems or those of third parties with whom we work of our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CIO, who is a Certified Information Systems Security Professional ("CISSP") with more than 20 years of experience leading IT and cybersecurity projects in a variety of industries.


text: Our CIO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CIO is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CIO. Our CIO works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from our CIO concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them.


text: Our information technology function is overseen by our Chief Information Officer ("CIO"), with support from our Cybersecurity Steering Committee, and helps to identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's risk register. This group works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example: manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, evaluating our and our industry's risk profile, evaluating threats reported to us, internal and external audits, and conducting vulnerability assessments to identify vulnerabilities.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: documented incident response process, vulnerability management, disaster recovery and business continuity processes, risk assessments, network security controls, access controls, physical security, asset management, tracking and disposal for certain assets, systems monitoring, employee cyber security training, penetration testing, cybersecurity insurance, dedicated cybersecurity staff, and a security operations center.


text: Risk Management and Strategy Our cybersecurity risk management program, which is part of our overall risk management function, comprises processes for assessing, identifying and managing material risks from cybersecurity threats, including the following:

companyName: Paylocity Holding Corp

ticker: PCTY


text: Information Security Policies We maintain information security policies that are formally reviewed and approved by senior management and are periodically updated for new developments. These policies map to standard industry frameworks such as the National Institute of Standards and Technology (NIST), Committee of Sponsoring Organizations (COSO), and International Organization for Standardization (ISO) 27001 to establish structured governance, policies, standards, and controls.


text: Information Security Certifications and Audits We maintain certification for compliance with ISO 27001:2022 as assessed by an independent third-party auditor. We also engage an independent accounting firm to perform assessments of our procedures and controls as part of our annual Systems and Organization Controls (SOC) 1 and SOC 2 audits.


text: Security Awareness and Training Through our onboarding process, each new employee is required to complete security training upon employment. Our employees also are required to complete annual security and privacy training to maintain our focus on protecting our information and that of our clients and their employees. This mandatory training educates our employees on safe handling of sensitive information, appropriate responses to a suspected data security breach, and awareness of security responsibilities. We strive to promote a healthy security awareness culture throughout the organization through supplemental education, training courses, videos, internal and external publications, and supporting activities. We also invest in our Information Security professionals with continued information security training and certifications.


text: Data and Web Security Safeguards We have implemented the following information security solutions and practices: • deployment of intrusion prevention systems designed to detect and block malicious traffic, • web application firewalls designed to protect our application from attacks, • network firewalls, • security information and event management, • user and entity behavior analytics, • endpoint detection and response designed to protect our workstation and server population, • data loss prevention software at multiple layers of our IT environment, • regular penetration testing conducted by both our internal teams and external providers, and • a multi-layered vulnerability management program designed to identify technical bugs within our product and infrastructure.


text: We encrypt sensitive client information both during transmission and at rest using industry standard protocols. We also have a mature application security program that promotes security champions within the developer community to instill strong, secure coding practices for reducing vulnerabilities and delivering a secure web application.


text: Incident Response Plan We maintain an incident response plan designed to provide a high-level framework that can be implemented in any cyber incident. The plan addresses identification of the incident, notifications to appropriate individuals, organization of response activities by role, and escalation procedures based on the severity of the incident. We also have action plans to support business remediation and recovery efforts in the event of an incident.


text: Business Resilience We apply controls from best practices such as, but not limited to, The Business Continuity Institute (BCI), Disaster Recovery Institute International (DRII), and International Organization for Standardization (ISO) 22301 for developing and maintaining threat-agnostic plans with strategies to continue client services and critical business operations in the event of a disruption to critical dependencies. The business resilience planning process includes business impact analyses, risk assessments, and continuity strategies. Our business resilience team conducts regular exercises to validate and continuously improve the plans and strategies, including conducting tabletop exercises with teams from across the organization.


text: Third-Party Risk Management We monitor and reassess our third-party relationships on an ongoing basis depending on risk level or in the event of a change of products and services provided to us. We also require third-party vendors, suppliers and service providers to undergo a cybersecurity risk assessment prior to entering into a contract with us. The third-party risk assessments, conducted by our information security and enterprise risk management teams with input from key business stakeholders, involve understanding the products and services we obtain from the third party, what sensitive company and client data it will be able to access and an evaluation of the vendor's security program and documentation. We also require that certain information security-related contract terms be incorporated into agreements with third parties that will have access to sensitive information before entering into such agreements.


text: Although we have experienced cybersecurity incidents in the past, none of these incidents to date have materially affected our business strategy, results of operations or financial condition. Despite our efforts, there can be no assurance that our risk management program will be effective in preventing cybersecurity incidents that could adversely affect our business strategy, results of operations or financial condition. For more information regarding risks from cybersecurity threats, please refer to the Risk Factors entitled "If our security measures are breached or unauthorized access to client data or funds is otherwise obtained, our solutions may be perceived as not being secure, clients may reduce the use of or stop using our solutions and we may incur significant liabilities." and "Any failure to protect our intellectual property rights could impair our ability to protect our proprietary technology and our brand." in Part I, Item 1A, Risk Factors.


text: Our board of directors has delegated oversight of risk assessment and risk management activities, including oversight over cybersecurity risks, to the audit committee. The audit committee meets at least quarterly with our Vice President and Chief Information Security Officer ("CISO"), who oversees our overall information security risk management program. The CISO's updates to the audit committee include recent developments related to the threat landscape, security controls, results of vulnerability assessments, third-party reviews, technological trends and information security considerations arising with respect to peers and third parties.


text: Our CISO reports to our Chief Financial Officer and leads our cybersecurity risk management efforts and our dedicated information security team. Our CISO has 20 years of information security experience, including over four years as a director in the information security management practice of a big four accounting firm. He holds multiple information security certifications and has a B.S. in Network Security. Our CISO leads our Information Security Steering Committee ("ISSC"), comprised of key executives and operating personnel from across the company, that oversees ongoing day-to-day management of our risks to information systems. The ISSC tracks risks and security initiatives, reviews the results of annual cybersecurity risk assessments, reviews the results of internal and third-party information security audits and assessments, identifies significant risks that threaten the achievement of security commitments and identifies controls to mitigate such risks. The CISO, along with other members of the ISSC and information security teams, remains apprised of developing cybersecurity trends through communications with the intelligence and law enforcement communities, vendors and industry engagement so that our cybersecurity risk management and governance controls and processes address new and evolving cybersecurity threats.


text: Third-Party Risk Management We monitor and reassess our third-party relationships on an ongoing basis depending on risk level or in the event of a change of products and services provided to us. We also require third-party vendors, suppliers and service providers to undergo a cybersecurity risk assessment to be able to enter into a contract with us. The third-party risk assessments, conducted by our information security and enterprise risk management teams with input from key business stakeholders, involve understanding the products and services we obtain from the third party, what sensitive company and client data it will be able to access and an evaluation of the vendor's security program and documentation. We also require that certain information security-related contract terms be incorporated into agreements with third parties that will have access to sensitive information before entering into such agreements.


text: Our board of directors has delegated oversight of risk assessment and risk management activities, including oversight over cybersecurity risks, to the audit committee. The audit committee meets at least quarterly with our Vice President and Chief Information Security Officer ("CISO"), who oversees our overall information security risk management program. The CISO's updates to the audit committee include recent developments related to the threat landscape, current IT-related risks, and corresponding controls or projects designed to mitigate those risks.


text: Our CISO reports to our Chief Financial Officer and leads our cybersecurity risk management efforts and our dedicated information security team. Our CISO has over 20 years of information security experience, including over four years as a director in the information security management practice of a big four accounting firm. He holds multiple information security certifications and has a B.S. in Network Security. Our CISO leads our Information Security Steering Committee ("ISSC"), comprised of key executives and operating personnel from across the company, that oversees ongoing day-to-day management of our risks to information systems. The ISSC tracks risks and security initiatives, reviews the results of annual cybersecurity risk assessments, reviews the results of internal and third-party information security audits and assessments, identifies significant risks that threaten the achievement of security commitments and identifies controls to mitigate such risks. The CISO, along with other members of the ISSC and information security teams, remains apprised of developing cybersecurity trends through communications with the intelligence and law enforcement communities, vendors and industry engagement so that our cybersecurity risk management and governance controls and processes address new and evolving cybersecurity threats.


text: We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process and have been embedded in our operating procedures, internal controls and information systems. We have engaged a third-party vendor to provide a variety of cybersecurity services ranging from ongoing security advisory services to cybersecurity monitoring and response management.

companyName: Sphere 3D Corp.

ticker: ANY


text: We use a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. For third parties that we rely upon for certain IT systems, we seek to use only reputable providers, to use the most recently reliable versions of such systems, and monitor and address alerts for potential vulnerabilities to any such systems. We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us, including our business strategy, results of operations or financial condition.


text: Our Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our Chief Executive Officer is responsible for assessing and managing cybersecurity risks, responding to any cybersecurity incidents and reporting any such incidents to our Board of Directors, and periodically briefs our Board of Directors on our cybersecurity and information security posture and on any cybersecurity incidents deemed to have a moderate or higher business impact. In the event of a material cybersecurity incident, our cybersecurity consultant has extensive information technology and program management experience. We believe that we have implemented a governance structure and processes that are equipped to assess, identify, manage and report cybersecurity risks. Refer to "Item 1A. Risk Factors" for a discussion of certain of the cybersecurity risks that our business is subject to. As a smaller reporting company, with respect to compliance with Form 8-K incident disclosure requirements, we are required to comply with the reporting requirements beginning June 15, 2024.


text: We maintain a robust cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and is designed to addresses the corporate information technology environment in which we operate. The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF").

companyName: EnLink Midstream, LLC


text: We utilize a third-party cybersecurity operations center to provide 24/7 monitoring of our cybersecurity environment and to coordinate the investigation and remediation of alerts. A program for assisting with incident response is in place to prepare support teams in the event of a significant incident. We also have an annual assessment, performed by a third-party, of our cyber risk management program against the NIST CSF. Cyber partners are a key part of EnLink's cybersecurity infrastructure. We partner with leading cybersecurity companies and organizations, leveraging third party technology and expertise. EnLink engages with these partners to monitor and maintain the performance and effectiveness of EnLink's technology environment.


text: EnLink's Director of Information Systems reports to EnLink's Chief Information Officer and is the head of the Company's cybersecurity team. The Chief Information Officer is responsible for assessing and managing EnLink's cyber risk management program, informing senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts, including overseeing and identifying risks from cybersecurity threats associated with the use of third party cyber security partners. The Chief Information Officer also has a regular quarterly meeting with EnLink's executive team to review cybersecurity matters and the status of EnLink's cyber risk management program in detail. The cybersecurity team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by EnLink.


text: Our Audit Committee oversees EnLink's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity team briefs the Audit Committee on the status and the effectiveness of EnLink's cyber risk management program on a quarterly basis and the Board is also updated on cybersecurity issues on a regular basis.


text: EnLink faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. We have not been subject to cybersecurity incidents that have materially impaired our operations or had a material adverse effect on EnLink's business, financial condition or results of operations. For additional discussion of our cybersecurity risks, see "Risk Factors–Business and Industry Risks–A failure in our computer systems or a terrorist or cyberattack on us, or third parties with whom we have a relationship, may adversely affect our ability to operate our business."


text: Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks We may collect and store certain sensitive Company information, including proprietary and confidential business information, trade secrets, intellectual property, sensitive third-party information, and employee information. Our ability to manage our business functions efficiently and effectively depends significantly on the availability and security of this information. We seek to assess, identify, and manage cybersecurity risks through the processes described below: Risk Assessment

companyName: Enviva, LLC


text: A multi-layered approach and methodology designed to protect and monitor data and manage cybersecurity risk has been implemented. Regular assessments of our cybersecurity safeguards are conducted by independent cybersecurity vendors who specialize in application and network penetration testing, threat emulation, social engineering, and best practice gap assessments. Our IT Risk and Cyber Security department conducts regular audits and assessments to identify, evaluate, and manage cybersecurity risks. As a result of these assessments and audits, we endeavor to update IT infrastructure, technical controls, procedures, policies, and education programs to improve resilience to cybersecurity threats.


text: Additionally, we assess third-party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addenda to our contracts where applicable.


text: Incident Identification and Response A cyber incident detection system has been implemented to help promptly identify cybersecurity incidents. In the event of any cybersecurity incident, we have a cross-functional incident response plan that is designed to provide for escalating actions to identify the cause, contain the incident, mitigate the impact, and efficiently restore normal operations. The incident response plan is reviewed annually, and a tabletop exercise testing the incident response plan is periodically conducted.


text: Cybersecurity Training and Awareness We require all employees with access to our systems to complete an annual information and cyber security training and conduct simulated phishing campaigns to measure the effectiveness of the training program.


text: Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. A multi-factor authentication requirement has been implemented for employees and third parties accessing sensitive company information.


text: Encryption and Data Protection Encryption methods are used to protect sensitive data in transit and at rest. This includes the encryption of customer data, financial information, and other confidential data.


text: We engage third-party vendors, such as independent service auditors, consultants, regulatory auditors, law firms, forensic specialists, and other third-party service providers in connection with the above processes. We recognize that third-party service providers introduce cybersecurity risks. Additionally, we endeavor to include cybersecurity requirements in our contracts with service and solution providers and to require them to adhere to security standards and protocols. Further, we request that third-party service providers with access to personally identifiable information enter into data processing services agreements and adhere to our policies and standards.


text: The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management processes. Cybersecurity risks are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management processes.


text: Impact of Risks from Cybersecurity Threats We have experienced attempted cybersecurity attacks, but have not suffered any material adverse impacts to our business and operations as a result of such unsuccessful attempts. However, we acknowledge that cybersecurity attacks are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See Item 1A – "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: Board of Directors' Oversight and Management's Role Our Vice President, Information Technology oversees the Company's cybersecurity initiatives. The head of the IT Risk & Cyber Security delivers quarterly updates to senior leaders, discussing the effectiveness of our cybersecurity strategy and to communicate our program, health, performance, metrics, and roadmap. In addition, our Vice President, Information Technology is responsible for upward reporting of emerging cybersecurity incidents.


text: Recognizing the importance of cybersecurity to the success and resilience of our business, the Board considers cybersecurity to be a vital aspect of corporate governance. To facilitate effective oversight, our Cyber Security team holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks.


text: Our Cyber Security team is made up of highly experienced professionals with an extensive background in information security and risk management, including disciplines such as security architecture, system security, identity and access management, communication and network security, security operations and software development security. This background includes experience across a variety of industries and various relevant degrees and certifications. The Cyber Security team is supported by managed service providers who bring diverse expertise in areas such as network security, data protection, and threat intelligence.


text: Virtu has established a Global Security team that, together with the Company's Chief Information Security Officer ("CISO"), is responsible for the strategic planning, execution, and enforcement of security initiatives and policies for the Company's business units (the "Security Program"). The CISO reports directly to the Chief Executive Officer, and together with the Global Security team, possesses significant experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. As part of its Security Program, the Company has developed policies and procedures governing cybersecurity (the "Cybersecurity Program").

companyName: Virtu Financial, Inc.

ticker: VIRT


text: Virtu's Cybersecurity Program is driven by a threat analysis, laying out standards and requirements pertaining to, but not limited to, penetration testing, endpoint protection, incident management, access controls, mobile security, data classification, third-party access, encryption, system hardening and patching, vulnerability management, passwords, data destruction, physical security, and vendor risk assessment. We also conduct training and awareness exercises to mitigate employee-related cyber risks. In addition to these elements of the Cybersecurity Program aimed at mitigating risk, the Company has developed an Incident Management procedure that addresses escalation and reporting of security incidents in the event that they do occur and has conducted various cross-functional table top exercises to develop and refine a coordinated response plan. The Company also maintains insurance coverage that, subject to its terms and conditions, is intended to address costs associated with certain aspects of cyber-related incidents. These processes are intended to identify and remediate cybersecurity incidents, and also provide the framework for our proactive identification, assessment, and management of potentially material risks from a wide range of cybersecurity threats. Risks identified through these processes are identified to and evaluated by our CISO, who periodically reports to our Board and Risk Committee as described below on any such risks determined by the Global Security team to be potentially material.


text: Our Cybersecurity Program is periodically evaluated by internal and external experts through penetration and vulnerability testing and other exercises which help us identify and assess material risks, evaluate the effectiveness of our Security Program in mitigating and managing these risks, and improve our security measures and planning, including by comparison to other companies and to industry standards. The results of these assessments are reviewed by our CISO and other members of management and are shared with the Risk Committee of our Board of Directors (the "Risk Committee").


text: Our Risk Committee assists our Board of Directors (the "Board") in its oversight of cybersecurity risk in accordance with its charter. The Risk Committee receives at least annually, and the Board receives periodically reports from our CISO and other members of senior management, which include updates on the Company's cyber risks and threats, its Cybersecurity Program, the status of projects to augment our information security systems, assessments of the Security Program, and the emerging threat landscape.


text: We face a number of cybersecurity risks in connection with our business. Although we maintain and enforce our Cybersecurity Program, we may not detect or prevent all attempts to compromise our systems or otherwise cause breaches or disruptions, which could result in material impacts to our operations or financial condition. As of the date of the filing of this Annual Report on Form 10-K, we are not aware of any material impact to our results of operations or financial conditions resulting from cyberattacks or other information security breaches. For more information about the cybersecurity risks we face, see the risk factor entitled "We could be the target of a significant cyber-attack, threat or incident that impairs internal systems, results in adverse consequences to information our system process, store or transmit or causes reputation or monetary damages as a consequence" in Item 1A- Risk Factors.


text: Our Risk Committee assists our Board of Directors (the "Board") in its oversight of cybersecurity risk in accordance with its charter. The Risk Committee receives at least annually, and the Board receives periodically, reports from our CISO and other members of senior management, which include updates on the Company's cyber risks and threats, its Cybersecurity Program, the status of projects to augment our information security systems, assessments of the Security Program, and the emerging threat landscape.


text: We face a number of cybersecurity risks in connection with our business. Although we maintain and enforce our Cybersecurity Program, we may not detect or prevent all attempts to compromise our systems or otherwise cause breaches or disruptions, which could result in material impacts to our operations or financial condition. As of the date of the filing of this Annual Report on Form 10-K, we are not aware of any material impact to our results of operations or financial conditions resulting from cyberattacks or other information security breaches. For more information about the cybersecurity risks we face, see the risk factor entitled "We could be the target of a significant cyber-attack, threat or incident that impairs internal systems, results in adverse consequences to information our system process, store or transmit or causes reputation or monetary damages as a consequence" in Item 1A - Risk Factors.


text: The Company has procedures and safeguards designed to detect and/or prevent unauthorized access to confidential information and defend against cyber-attacks, both internally and with the assistance and partnership of cybersecurity experts, with a view toward addressing the ever-evolving threat landscape and changing cybersecurity regulations. As part of its role in risk oversight, the Audit & Finance Committee of the Company's Board (Audit & Finance Committee) reviews the Company's program for managing information security risks, including data privacy and data protection. Our cybersecurity framework, which is based on the National Institute of Standards and Technology Cybersecurity Framework, includes risks and controls embedded into our processes and technology, and measured and monitored by cybersecurity subject matter specialists. All employees and contractors with access to our Company's systems must also complete mandatory comprehensive cybersecurity trainings periodically and participate in simulations which are deployed to educate and prepare users for cyber-attacks and similar risks.

companyName: Endo International plc


text: Under the direction of the Chief Information Officer (CIO), who reports to the Company's Chief Executive Officer, and Chief Information Security Officer (CISO), who reports to the CIO, as well as certain other cybersecurity focused team members (the IT Security team), the IT Security team is responsible for addressing the dynamic threats against our electronic systems and assisting the workforce with handling system incidents, including by centralizing the reporting, detection and response to incidents to one functional team. The CIO and CISO have multiple decades of relevant IT experience. Incident management and response processes establish the recommended organization, actions and procedures needed to recognize and respond to an incident; assess the situation quickly and effectively; notify the appropriate individuals and organizations about the incident; organize the Company's response activities, including activating a command center; escalate the Company's response efforts based on the severity of the incident; and support the business recovery efforts being made in the aftermath of the incident. Additionally, third-party security experts are regularly engaged to monitor, assess, review and analyze the information technology landscape. The Company's incident response framework also defines the roles with respect to cybersecurity risk oversight and assigns responsibility to the IT Security Team. The IT Security team members have: (i) completed extensive cybersecurity training; (ii) have experience assessing cybersecurity incidents; (iii) actively participate in industry and government forums; and iv) collaborate with our peers to understand and improve cybersecurity intelligence, vulnerability management and defense strategies.


text: Our internal audit team performs audits of our information systems and network security. The audit scope, timing and frequency of our cybersecurity control framework is integrated into the Company's overall risk management process and the planning for, and results of, those audits are reviewed with the Audit and Finance Committee.


text: We regularly assess and monitor our cybersecurity risks and incidents and report them to our senior management and Audit and Finance Committee. Our Audit and Finance Committee oversees our cybersecurity strategy and governance and reviews our cybersecurity policies and practices on a periodic basis. Additionally, and as further discussed above, the Audit and Finance Committee is briefed multiple times a year or as needed by the CISO and/or CIO and, if applicable as determined by the Company's senior leadership, external advisors on the current and emerging cybersecurity threats and trends and the effectiveness of our cybersecurity controls and response capabilities.


text: We conduct due diligence security assessments of certain third-party providers before engagement, have contractual rights to and gather data on the effectiveness of vendor systems and protocols and monitor compliance with our cybersecurity standards. The monitoring includes periodic assessments and ongoing monitoring by the IT Security team. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties.


text: To date, cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected the Company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents, of which we are aware, are reasonably likely to materially affect the Company. Refer to "Our operations could be disrupted if our information systems fail or are not upgraded or are subject to cyber-attacks" in Part I, Item 1A of this report for additional information on risks from cybersecurity threats.


text: Cybersecurity is a critical aspect of our business. As the world's largest independent omni-channel sell-side advertising platform, we face a multitude of cybersecurity threats, and our customers rely on us to safeguard their data. These challenges make it imperative that we take information security seriously, and we expend considerable resources on cybersecurity. We have implemented a comprehensive cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: MAGNITE, INC.

ticker: MGNI


text: Cybersecurity matters are overseen by our board of directors, which meets quarterly to review the measures implemented by the Company to identify and mitigate cybersecurity risks. Our chief information security officer ("CISO") reports to the board quarterly on cybersecurity matters. These reports and presentations are prepared with input from members of our senior management team responsible for overseeing the company's cybersecurity risk management, including the Chief Technology Officer, Chief Financial Officer, Chief Legal Officer and Chief People Officer. In addition, cybersecurity risks and associated mitigation efforts are assessed by senior management as part of the enterprise risk assessment process that includes reporting to and discussion with the audit committee and our board of directors. In addition, cybersecurity controls have been integrated into our disclosure controls and procedures.


text: Our CISO, who has extensive cybersecurity knowledge and skills gained from extensive information technology and engineering experience, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business. The CISO receives reports on cybersecurity threats from other internal information security personnel on an ongoing basis and in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate cybersecurity risks. The CISO also attends meetings of the board of directors to report on any material developments. We have protocols by which certain cybersecurity incidents are reported promptly to management and the legal team.


text: The Company maintains a general security policy, which outlines the relationship between employees and information technologies and systems within the Company, and sets guidelines on how such technologies and systems should and should not be used. This policy is revised regularly by the CISO and reviewed and acknowledged by all Company employees in conjunction with annual cybersecurity training. The Company also has a Systems Security Policy in place, which outlines the requirements for system configuration and administration of systems within the Company, and includes steps for reporting cybersecurity incidents and keeping senior management and other key stakeholders informed and involved as appropriate.


text: With respect to incident response, we have adopted an Incident Response Playbook that applies in the event of a cybersecurity threat or incident (an "IRP") to provide a standardized framework for responding to security incidents, including malware, hacking, data breach (including third-party data breach), and other types of vulnerabilities. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, and provides triage workflows for individuals to follow. Our incident response process is generally based on the NIST framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services requiring access to secure Company information, and to all devices and network services that are owned or managed by the Company. Our incident response team includes our CISO and the information security team, along with various business units, as applicable, and undergoes periodic training which includes exercises on monitoring and detection tools.


text: Security incidents are reviewed by the CISO and the information security team as soon as they are discovered or reported. The initial review of a security incident is conducted immediately, in order to appropriately determine the severity and urgency of the event. Key stakeholders and any technical owners of the impacted systems or processes are included in the incident review process and are brought in immediately in the case of potentially critical incidents. All phases of the review process are led by the CISO or another member of the security team, as appropriate.


text: We perform regular vulnerability scanning of our systems in order to ensure appropriate security controls are in place and function in accordance with established policies. We also have ongoing engagements with security consultants and other third parties as required to assist with assessing, identifying, and managing cybersecurity risks. These vendors help us with annual penetration testing and other items as needed. We have a robust internal controls framework and process and issue annual SOC 1 Type 2 reports covering our DV+, Streaming, and SpringServe platforms. In addition to our internal audit team, we have a dedicated compliance manager within the engineering department who helps ensure compliance with our control framework.


text: As detailed elsewhere in this Annual Report on Form 10-K, we also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, proprietary and other types of information. We use state of the art systems with respect to the type of information processed, and employ processes designed to oversee, identify, and reduce the potential impact of a security incident with a third-party vendor or customer or otherwise implicating the third-party technology and systems we use. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber-attacks, we may not be able to protect all information systems. Any incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences.