text: Governance. Management, provided by Ashford Inc., is ultimately responsible for assessing and managing the Company's cybersecurity risk. The information security program is overseen by the Chief Financial Officer of Ashford Inc. and the Chief Technology Officer for Remington Hospitality. A Cyber Incident Response Team comprised of Ashford Inc. and Remington Hospitality employees meets bi-weekly to review incidents that have occurred and/or impacted the Company's electronic assets. The Chief Technology Officer of Remington Hospitality reviews weekly reports that contain an overview of the activity in the department, any United States Computer Emergency Readiness Team alerts processed and all findings from the preventative maintenance tools. The Chief Technology Officer provides such report to the Chief Financial Officer on a quarterly basis. The Audit Committee of the board of directors is then briefed each quarter on the occurrence of any cybersecurity incidents. The board of directors will also be provided an overview of the information security program on an annual basis, including updates on Remington Hospitality's IT team, IT training, implementation, IT controls, cybersecurity testing, the incident response process and the cybersecurity assets of the Company.


text: Risk Management and Strategy We have implemented ongoing processes that are designed to continually identify, assess, manage and mitigate the dynamic and evolving material risks to us from cybersecurity threats. Our cybersecurity threat risks are identified, assessed, managed, and monitored by our Adviser's and Administrator's resource management and compliance departments, on our behalf, and work in conjunction with an independent third-party information technology service provider ("ISP") engaged by our Adviser to manage our information technology strategy. The ISP regularly performs cyber assessments and assists in maintaining our cyber and information security programs. The ISP proposes recommendations to our Adviser's resource management and compliance departments, which then are considered by other officers and employees of our Adviser and Administrator, working on our behalf, before improvements are implemented to our information technology strategy, cybersecurity, and incident response policies, processes and procedures.

companyName: GLADSTONE COMMERCIAL CORP

ticker: GOOD

secItem: Item 1C


text: In addition, regular ongoing cybersecurity threat risk assessments are performed throughout the year and reported to our officers and Board of Directors by our Chief Compliance Officer ("CCO") no less than quarterly. Cybersecurity risks are assessed in general as part of the overall enterprise risk management for us, but also specifically between the ISP and our Adviser and Administrator in monitoring and determining not only the risks but also in assessing corresponding processes and procedures to mitigate those risks appropriately. Additionally, third party business applications are also incorporated in these risk assessments.


text: As an international service provider, our ISP constantly monitors information technology risk and cybersecurity threats globally. When risks are detected, we, through our Adviser and Administrator, consults with the ISP to assess if the risk is a cybersecurity threat to our information technology systems or data. If a risk to our information systems or data is identified, we then, through our Adviser and Administrator, work in conjunction with the ISP to implement recommended processes, improvements, or safeguards to our systems or processes to address the risks as needed. Relevant examples of such efforts include but are not limited to: • implementation of industry leading Cloud solutions and business applications which possess integrated cybersecurity safeguards; • anti-malware, antivirus and threat detection software; • ransomware containment and isolation software; • enhanced password requirements and multifactor authentication requirements; • endpoint encryption; • intrusion detection and response system conduct file integrity monitoring; • email archiving, firewalls, and quarantine capabilities; • mobile device management of business applications; • frequent systems backups with recovery capabilities; and • regular vulnerability scans and penetration testing.


text: Contractually, we require the ISP to annually provide a third-party report on its systems and on the suitability of the design and operating effectiveness of its controls relevant to information and cyber security. In addition to the ongoing dialogue and technology interaction between our Adviser and Administrator, on our behalf, and our ISP, any significant findings in these reports are shared with us, including our Board of Directors and other officers, to enhance ongoing monitoring and assessment of our information technology and cybersecurity risk management.


text: While our ISP works to create a hardened information technology systems environment, our Adviser and Administrator also regularly trains employees working on our behalf on the evolving threats and educates them on cybersecurity risks. Whether it is communicating information about the latest cybersecurity threats, assessing employees' awareness through mock fraud exercises, social engineering and phishing campaigns, or providing access to a library of educational material about past and newly evolving cybersecurity attacks, our Adviser and Administrator work in concert with the ISP, on our behalf, to keep employees servicing us informed so as to provide an additional protection barrier through end-user knowledge.


text: Notwithstanding our risk management and strategy described above, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See "Risk Factors - Cybersecurity threats and cyber incidents may adversely affect our business by causing a disruption to our operations, or the operations of businesses in which we invest, a compromise or corruption of our confidential information and/or damage to our business relationships, all of which could negatively impact our business, financial condition and operating results." for a discussion of risks related to cybersecurity and cyber incidents.


text: Our Board of Directors is actively engaged in overseeing our cybersecurity and information security program. Our Board of Directors receives regular reports during board meetings from our CCO on our and our Adviser's and Administrator's efforts concerning information security and addressing information technology and cybersecurity risks, no less than quarterly. The reports are distributed to our Board of Directors, and our CCO engages in detailed discussions with the independent board members during the independent members' session. The reports cover all potentially material cybersecurity threats facing us, as well as key risks and mitigation efforts undertaken by us and our Adviser and Administrator. As significant threats or events are identified by management or the ISP between regular reporting periods, our CCO will inform our Board of Directors immediately and keep it informed as to the developments of assessing the risks, mitigating efforts, and potential disclosure. Appropriate members of management and third party providers will be involved as deemed necessary based on the potential impact.


text: Our management personnel most involved with assessing and managing the cybersecurity risks and program with our ISP include our Head of Resources Management, who is also a member of our Board of Directors, and our CCO. Our Head of Resources Management has more than 30 years of overall experience and more than 20 years directly assessing and managing our cyber information technology and human resources systems, and the associated security concerns. Our CCO has more than 30 years of overall experience as a CPA, with more than 15 years managing information technology systems and databases, and 15-plus years supporting our Adviser's and Administrator's resource management department. This includes identifying, assessing, mitigating, and monitoring cyber information security risks. These managers, as well as other management personnel, attend various professional continuing education programs, which include cybersecurity matters. Certain members of our Board of Directors have, or previously held, positions with other companies, including other public companies, that involved managing risks associated with their cyber and information technology systems. Our Board of Directors regularly receives updates from third parties on various business risks, which include cybersecurity matters.


text: Risk Management and Strategy We have implemented ongoing processes that are designed to continually identify, assess, manage and mitigate the dynamic and evolving material risks to us from cybersecurity threats. Our cybersecurity threat risks are identified, assessed, managed, and monitored by our Adviser's and Administrator's resource management, information technology ("IT"), and compliance departments, on our behalf, and work in conjunction with an independent third-party information technology service provider ("ISP") engaged by our Adviser to manage our information technology strategy. The ISP regularly performs cyber assessments and assists in maintaining our cyber and information security programs. The ISP proposes recommendations to our Adviser's Head of Resource Management, Director of IT, and Chief Compliance Office ("CCO"), which then are considered by other officers and employees of our Adviser and Administrator, working on our behalf, before improvements are implemented to our information technology strategy, cybersecurity, and incident response policies, processes and procedures.


text: In addition, regular ongoing cybersecurity threat risk assessments are performed throughout the year and reported to our officers and Board of Directors by our CCO no less than quarterly. Cybersecurity risks are assessed in general as part of the overall enterprise risk management for us, but also specifically between the ISP and our Adviser and Administrator in monitoring and determining not only the risks but also in assessing corresponding processes and procedures to mitigate those risks appropriately. Additionally, third party business applications are also incorporated in these risk assessments.


text: As an international service provider, our ISP constantly monitors information technology risk and cybersecurity threats globally. When risks are detected, our Head of Resource Management, Director of IT, and CCO consult with the ISP to assess if the risk is a cybersecurity threat to our information technology systems or data. If a risk to our information systems or data is identified, we then, through our Adviser and Administrator, work in conjunction with the ISP to implement recommended processes, improvements, or safeguards to our systems or processes to address the risks as needed. Relevant examples of such efforts include but are not limited to: • implementation of industry leading Cloud solutions and business applications which possess integrated cybersecurity safeguards; • restrict access to known devices only; • anti-malware, antivirus and threat detection software; • ransomware containment and isolation software; • enhanced password requirements and multifactor authentication requirements; • endpoint encryption; • intrusion detection and response system conduct file integrity monitoring; • email archiving, firewalls, and quarantine capabilities; • mobile device management of business applications; • frequent systems backups with recovery capabilities; and • regular vulnerability scans and penetration testing.


text: Contractually, we require the ISP to annually provide a third-party report on its systems and on the suitability of the design and operating effectiveness of its controls relevant to information and cyber security. In addition to the ongoing dialogue and technology interaction between our Director of IT and our ISP, any significant findings in these reports are shared with us, including our Board of Directors and other officers, to enhance ongoing monitoring and assessment of our information technology and cybersecurity risk management.


text: Our management personnel most involved with assessing and managing the cybersecurity risks and program with our ISP include our Head of Resources Management, who is also a member of our Board of Directors, Director of IT, and CCO. Our Head of Resources Management has more than 30 years of overall experience and more than 20 years directly assessing and managing our cyber information technology and human resources systems, and the associated security concerns. Our Director of IT has over 20 years of experience in IT, with a focus in the implementation of information security projects to enhance organizations' resilience against emerging threats, and has collaborated closely with security vendors/partners to contain and address cybersecurity incidents. Our CCO has more than 30 years of overall experience as a CPA, with more than 15 years managing information technology systems and databases, and 15-plus years supporting our Adviser's and Administrator's resource management department. This includes identifying, assessing, mitigating, and monitoring cyber information security risks. These managers, as well as other management personnel, attend various professional continuing education programs, which include cybersecurity matters. Certain members of our Board of Directors have, or previously held, positions with other companies, including other public companies, that involved managing risks associated with their cyber and information technology systems. Our Board of Directors regularly receives updates from third parties on various business risks, which include cybersecurity matters.


text: Risk Management and Strategy We are committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, have implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats.

companyName: QVC INC

ticker: QVCD


text: Cybersecurity risks are assessed as part of our enterprise risk assessment and risk management program and our cybersecurity risk management program is designed and assessed based on recognized frameworks, including the National Institute of Standards and Technology Cybersecurity Framework.


text: We rely on a multidisciplinary team, including our information security function, legal department, management, and third-party consultants, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, using manual and automated tools such as vulnerability scanning software, monitoring existing and emerging cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and assessments, and conducting threat and vulnerability assessments.


text: To manage and mitigate material risks from cybersecurity threats to our information systems and data, we implement and maintain various technical, physical and organizational measures, processes and policies. These measures include risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our information technology ("IT"), security and other departments, encryption of data, network security controls, access controls, physical security, asset management, system monitoring, vendor risk management program, employee cybersecurity awareness and training, phishing tests, and penetration testing. Cybersecurity awareness training is also made available annually to our board of directors.


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place at QVC. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary.


text: To operate our business, we utilize certain third-party service providers to perform a variety of operational functions. We have implemented a third-party risk management program to evaluate the cybersecurity practices of higher risk vendors and vendors that encounter our systems or data. We additionally engage and retain third-party consultants, legal advisors and assessors to keep us appraised of emerging third-party risk, defense and mitigation strategies, and governance best practices.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: For additional information on our cybersecurity risks, see "Our business is subject to cyber security risks, including cyber security threats and cybersecurity incidents, such as security breaches and identity theft" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Role of the Qurate Retail Board of Directors The Qurate Retail board of directors has overall responsibility for risk oversight and has delegated to its Audit Committee primary enterprise risk oversight responsibility, including privacy and cybersecurity risk exposures, policies and practices, the steps management takes to detect, monitor and mitigate such risks and the potential impact of those exposures on our business, financial results, operations and reputation. The Audit Committee receives quarterly updates on the enterprise risk management program, including cybersecurity risks and the initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates, employee education initiatives, and internal audit observations, if applicable. In addition to the efforts undertaken by the Audit Committee, Qurate Retail's board of directors regularly reviews matters relating to cybersecurity risk and cybersecurity risk management. Any material cybersecurity events are brought to the attention of Qurate Retail's board of directors once the event is deemed material. We additionally use our incident response framework as part of the process we employ to keep our management and board of directors informed and to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Role of Management Through a services agreement between Qurate Retail and Liberty Media Corporation ("LMC"), Qurate Retail has established a cross functional Information Security Steering Committee ("ISSC") with executives from the Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at Qurate Retail and at QVC.


text: At QVC, the VP Information Security is responsible for day-to-day management and oversight of cybersecurity, including assessing, monitoring and mitigating cybersecurity risk. The VP Information Security provides regular reporting to the ISSC and QVC executive management, including quarterly updates on security hot topics, threat intelligence, incidents (if any) and the status of the cybersecurity program to the Chief Executive Officer and the broader executive leadership team. In addition to real time notification to the ISSC of privacy and security incidents, the ISSC and QVC have a bi-monthly meeting to discuss incidents, incident trends, developments in laws and regulations, and other privacy and cybersecurity hot topics, as applicable.


text: The experience of the combined QVC and Qurate Retail management teams includes a diverse background in telecom, retail and other industries, with decades of experience in various aspects of technology and cybersecurity. LMC's Head of Cybersecurity, who sits on the ISSC, has more than 25 years of cybersecurity and IT experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications. QVC's VP Information Security has more than 30 years of IT experience and holds multiple certifications, including Certified Information Security System Professional and Certified Information Security Manager. Together this management team has worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, business applications, customer facing applications and customer payment systems.


text: Role of the QVC Group Board of Directors The QVC Group board of directors has overall responsibility for risk oversight and has delegated to its Audit Committee primary enterprise risk oversight responsibility, including privacy and cybersecurity risk exposures, policies and practices, the steps management takes to detect, monitor and mitigate such risks and the potential impact of those exposures on our business, financial results, operations and reputation. QVC Group's audit committee receives quarterly updates on the enterprise risk management program, including cybersecurity risks and the initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates, employee education initiatives, and internal audit observations, if applicable. In addition to the efforts undertaken by the audit committee, QVC Group's board of directors regularly reviews matters relating to cybersecurity risk and cybersecurity risk management. Any material cybersecurity events are brought to the attention of QVC Group's board of directors once the event is deemed material. We additionally use our incident response framework as part of the process we employ to keep our management and board of directors informed and to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Role of Management Through a services agreement between QVC Group and Liberty Media Corporation ("LMC"), QVC Group has established a cross functional Information Security Steering Committee ("ISSC") with executives from the Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at QVC Group and at QVC.


text: At QVC, the VP of Cybersecurity is responsible for day-to-day management and oversight of cybersecurity, including assessing, monitoring and mitigating cybersecurity risk. The VP of Cybersecurity provides regular reporting to the ISSC and QVC executive management, including quarterly updates on security hot topics, threat intelligence, incidents (if any) and the status of the cybersecurity program to the Chief Executive Officer and the broader executive leadership team. In addition to real time notification to the ISSC of privacy and security incidents, the ISSC and QVC have a bi-monthly meeting to discuss incidents, incident trends, developments in laws and regulations, and other privacy and cybersecurity hot topics, as applicable.


text: The experience of the combined QVC and QVC Group management teams includes a diverse background in telecom, retail and other industries, with decades of experience in various aspects of technology and cybersecurity. LMC's Head of Cybersecurity, who sits on the ISSC, has more than 25 years of cybersecurity and IT experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications. QVC's VP of Cybersecurity has more than 30 years of IT experience and holds multiple certifications, including Certified Information Security System Professional and Certified Information Security Manager. Together this management team has worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, business applications, customer facing applications and customer payment systems.


text: The Company's enterprise-wide cybersecurity program is embedded within and integrated with the enterprise risk management function. The Chief Security Officer is part of our senior leadership team and reports to the Chief Risk Officer. Our Chief Security Officer has over thirty years of cybersecurity, technology, and leadership experience both as a career active-duty military cyber operations officer and in the private sector. The cybersecurity team is organized into three departments: Protective Operations, Posture Management, and Governance, Risk, and Compliance. Each of the three departments identifies, assesses, and manages material cybersecurity threats through specific approaches as further described below.

companyName: NELNET INC

ticker: NNI


text: Protective Operations includes the Security Operations Center, cyber threat intelligence, offensive security, and application security teams. New cybersecurity threats surface daily, and existing cybersecurity threats evolve constantly. Our 24x7x365 in-house Security Operations Center is organized to not only monitor for signs of intrusion but also to provide contextual threat intelligence to system and platform owners across the enterprise, empowering them to take an active role in defending the enterprise. The Security Operations Center conducts daily briefings, identifies emerging cyber threats affecting the financial and education sectors, and reviews new tactics, techniques, and procedures utilized by cyber criminals and nation-state cyber actors. The Security Operations Center is also our incident response team, and ensures that the Company is prepared to detect, analyze, contain, eradicate, and recover from cyber incidents. While we have experienced cybersecurity incidents in the past, to date none have materially affected us, including our business strategy, results of operations, or financial condition. Our offensive security team conducts continuous threat-based and risk-based red team activities, and our application security team utilizes a combination of training, tools, code reviews, and awareness to ensure that our applications are developed with security at the forefront. We also engage with professional cybersecurity firms to conduct penetration tests on specific systems and applications annually. For more information about the cybersecurity risks we face, see the factors set forth under the caption "Risk Factors" in Part I, Item 1A of this report.


text: Posture Management includes the vulnerability management, log operations, and architecture and engineering teams. Our vulnerability management team conducts regular scans of our enterprise to look for potential weaknesses and configuration-related issues. Based on the results of these scans, this team routinely patches or works with system and platform owners to resolve identified vulnerabilities. Our log operations team works closely as a bridge between the system owners and our Security Operations Center by ensuring that activities on our systems and applications are logged and monitored. Our architecture and engineering team manages security appliances and provides security architecture advice and consulting to our information technology and delivery teams throughout the enterprise. When it comes to posture management, our goal is not just to reactively resolve potential vulnerabilities discovered through the vulnerability management process; we also look for ways to ensure that vulnerabilities don't materialize through minimizing system ports, protocols, and services to only that which is necessary.


text: Governance, Risk, and Compliance includes the risk management and compliance management teams. This team manages the security awareness program, compliance with cyber and privacy regulations, security policies, and prioritizes potential cyber risks that require ongoing monitoring or remediation. Identified risks are brought to the Cyber Risk Steering Committee for treatment. The Chief Security Officer chairs the committee, which consists of the Deputy Chief Security Officer, cybersecurity managers, various subject matter experts, and (as needed) members of management from operational areas of the business.


text: The Company's business segments and support teams also work closely with cybersecurity and enterprise risk management to monitor and manage third-party risks. Managing third-party risks includes maintaining a close and effective working relationship with the information technology procurement, accounting, and legal teams. In addition to identifying risks as part of the third-party selection process, we continuously monitor our third parties using products and services that provide us insight into their attack surface, threats that can impact us through them, and real-world security posture.


text: Audits are an important part of our layers of defense; they can help us to identify areas in which we have incomplete coverage or ineffective placement of controls. The Company has an independent internal audit team that conducts audits based on their own methodology and assessment and we utilize external cybersecurity auditors, where applicable. In addition, certain lines of business utilize other third-party cybersecurity auditors for PCI DSS assessments and PCI ASV scans; and we are routinely audited by our customers.


text: The Company's Board of Directors and Board Risk and Finance Committee oversee our integrated enterprise risk management and cybersecurity programs. The Board Risk and Finance Committee receive regular reports from the Chief Risk Officer and Chief Security Officer on key company risks and emerging threats. These reports also include cybersecurity monitoring and threat response metrics, industry trends and educational materials, risk mitigation strategies, regulatory requirements, corporate policies, third-party risk metrics, cybersecurity tools and resources, incident response plans, and other areas of importance.


text: Protective Operations includes the Security Operations Center, cyber threat intelligence, offensive security, and application security teams. New cybersecurity threats surface daily, and existing cybersecurity threats evolve constantly. Our 24x7x365 in-house Security Operations Center is organized to not only monitor for signs of intrusion but also to provide contextual threat intelligence to system and platform owners across the enterprise, empowering them to take an active role in defending the enterprise. The Security Operations Center conducts daily briefings, identifies emerging cyber threats affecting the financial and education sectors, and reviews new tactics, techniques, and procedures utilized by cyber criminals and nation-state cyber actors. The Security Operations Center is also our incident response team, focused on detecting, analyzing, containing, eradicating, and recovering from cyber incidents. While we have experienced cybersecurity incidents in the past, to date none have materially affected us, including our business strategy, results of operations, or financial condition. Our offensive security team conducts continuous threat-based and risk-based red team activities, and our application security team utilizes a combination of training, tools, code reviews, and awareness designed to ensure that our applications are developed with security at the forefront. We also engage with professional cybersecurity firms to conduct penetration tests on specific systems and applications annually. For more information about the cybersecurity risks we face, see the factors set forth under the caption "Risk Factors" in Part I, Item 1A of this report.


text: Posture Management includes the vulnerability management, log operations, and architecture and engineering teams. Our vulnerability management team conducts regular scans of our enterprise to look for potential weaknesses and configuration-related issues. Based on the results of these scans, this team routinely patches or works with system and platform owners to resolve identified vulnerabilities. Our log operations team works closely as a bridge between the system owners and our Security Operations Center by logging and monitoring activities on our systems and applications. Our architecture and engineering team manages security appliances and provides security architecture advice and consulting to our information technology and delivery teams throughout the enterprise. When it comes to posture management, our goal is not just to reactively resolve potential vulnerabilities discovered through the vulnerability management process; we also look for ways to prevent vulnerabilities through minimizing system ports, protocols, and services to only that which is necessary.


text: The Company's Board of Directors and Board Risk and Finance Committee oversee our integrated enterprise risk management and cybersecurity programs. The Board Risk and Finance Committee receives regular reports from the Chief Risk Officer and Chief Security Officer on key company risks and emerging threats. These reports also include cybersecurity monitoring and threat response metrics, industry trends and educational materials, risk mitigation strategies, regulatory requirements, corporate policies, third-party risk metrics, cybersecurity tools and resources, incident response plans, and other areas of importance.


text: We have established a risk-based cybersecurity and information security program ("program") designed to assess, identify, and manage material risks from cybersecurity threats. Our cybersecurity risk management process includes policies that specify the requirements for technical security controls, monitoring systems, tools and services from third-party providers, and employee training and awareness. Our cybersecurity risk management process also includes regular independent audits across our operating units. Management oversees our cybersecurity risk management process in order to assess and manage material risks from cybersecurity threats identified by both internal and external threat intelligence. Our program monitors and evaluates risks from cybersecurity threats, and we aim to adapt our program and related processes accordingly. As adopted by our businesses, which has been overseen by our corporate executive team, we have a cybersecurity incident response plan that outlines our policies and procedures for managing a cybersecurity incident. Our businesses are required to conduct regular exercises of their incident response plan as part of our program.

companyName: TransDigm Group INC

ticker: TDG


text: The multi-layered framework on which our cybersecurity and information security program is built incorporates cybersecurity standards and certain requirements of the National Institute of Standards and Technology ("NIST") Special Publication 800-171—Protecting Controlled Unclassified Information in Non-Federal Systems and Organizations—along with other legal and regulatory requirements. However, this does not mean that we meet any particular technical standards, specifications, or requirements, but rather that we use NIST and other cybersecurity standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity and information security program is led by the Company's Vice President of Cybersecurity ("VPoC") who reports to our Chief Financial Officer. Our VPoC has served as a technology leader of cybersecurity, information security, infrastructure, and operational functions for over 35 years. The VPoC is supported by the Incident Response Team ("IRT"), a management committee made up of the Co-Chief Operating Officers, Chief Financial Officer, and executives in legal, finance, IT, and audit. The IRT supports the VPoC in assessing and managing risks from cybersecurity threats and in the event of a cybersecurity incident, provides oversight and leadership with respect to incident response.


text: We have in place an incident response plan to identify, respond to, and recover from cybersecurity threats and cybersecurity incidents. In the event of a potentially material cybersecurity incident, as determined by the VPoC with support from legal, as needed, the IRT is notified through an established escalation protocol. The Chair of the Audit Committee is also notified and briefed, and meetings of the Audit Committee and/or full Board of Directors would be held as appropriate. We maintain a relationship with a third-party forensic vendor available for incident response and investigation. Additionally, we maintain cybersecurity insurance.


text: The Company's Board of Directors oversees our enterprise risk management ("ERM") program and has delegated the primary responsibility for its oversight, which includes oversight of cybersecurity risk, to the Audit Committee. The Audit Committee is informed of about material risks from cybersecurity threats through regular discussion with management regarding cybersecurity risk mitigation and cybersecurity incident management. Executive management, including our VPoC, regularly presents to the Audit Committee regarding cybersecurity matters, including program updates, key metrics, and developments.


text: The ERM program inventories and classifies key risk areas. We employ a methodology for scoring the risks based on the probability and impact of individual risks and discuss and implement countermeasures to address the risks.


text: Based on the information we have as of the date of this Annual Report on Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For further information about risks related to cybersecurity threats, refer to Item 1A. "Risk Factors."


text: We have established a risk-based cybersecurity and information security program ("program") designed to assess, identify, and manage material risks from cybersecurity threats. Our cybersecurity risk management process includes policies that specify the requirements for technical security controls, monitoring systems, tools and services from third-party providers, and employee training and awareness. Our cybersecurity risk management process also includes regular independent audits across our operating units. Management oversees our cybersecurity risk management process in order to assess and manage material risks from cybersecurity threats identified by both internal and external threat intelligence. Our program monitors and evaluates risks from cybersecurity threats, and we aim to adapt our program and related processes accordingly.


text: As adopted by our businesses, which has been overseen by our corporate executive team, we have a cybersecurity incident response plan that outlines our policies and procedures to identify, respond to, and recover from cybersecurity threats and cybersecurity incidents. Our businesses are required to conduct regular exercises of their incident response plan as part of our program.


text: In the event of a potentially material cybersecurity incident, as determined by the VPoC with support from legal, as needed, the IRT is notified through an established escalation protocol. The Chair of the Audit Committee is also notified and briefed, and meetings of the Audit Committee and/or full Board of Directors would be held as appropriate. We maintain a relationship with third-party forensic vendor(s) available for incident response and investigation. Additionally, we maintain cybersecurity insurance.


text: The Company's Board of Directors oversees our enterprise risk management ("ERM") program and has delegated the primary responsibility for its oversight, which includes oversight of cybersecurity risk, to the Audit Committee. The Audit Committee is informed of material risks from cybersecurity threats through regular discussion with management regarding cybersecurity risk mitigation and cybersecurity incident management. Executive management, including our VPoC, regularly presents to the Audit Committee regarding cybersecurity matters, including program updates, key metrics, and developments.


text: Our cybersecurity risk management program is guided by industry standards developed by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO"), and other relevant organizations.

companyName: DOCUSIGN, INC.

ticker: DOCU


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and utilizes common reporting channels and governance processes that apply across other risk areas. While everyone at our company plays a part in managing cybersecurity risks, as discussed in more detail under "Cybersecurity Governance" below, our board of directors, both directly and through delegation to our Audit Committee (the "Audit Committee"), and our senior management team are actively involved in the oversight of our cybersecurity risk management program. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Our cybersecurity risk management and strategy includes: • Our dedicated Security team, which performs periodic risk assessments to identify and assess cybersecurity threats, vulnerabilities, their severities, and potential mitigations. The team leverages both top-down and bottom-up risk processes and technologies to identify, manage and monitor cyber threats and vulnerabilities. The team also manages our response to cybersecurity incidents. • Incident Response Playbooks and Standard Operating Procedures ("SOP") outlining procedures for detecting, responding to, and mitigating cybersecurity incidents. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the board of directors. • The use of external service providers, where appropriate, to assess, test or otherwise assist with certain aspects of our security controls and processes, as well as maturity assessments of our cybersecurity program. • Implementation of new hire and annual data privacy and cybersecurity training of all employees, including senior management; annual role-based training of employees with specific access to systems, devices, or locations, and targeted cybersecurity simulation training held on a recurring basis. • A third-party risk management process that identifies and mitigates cybersecurity threats associated with our use of third-party service providers. Such service providers are subject to risk tiering, security risk assessments, continuous monitoring including investigation of security incidents that have impacted our third party service providers, as applicable.


text: We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. While we have experienced cybersecurity incidents in the past, we believe our current processes, systems and oversight with respect to the management of risks associated with cybersecurity threats are effective. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding the risks we face from cybersecurity threats see "Risk Factors."


text: Cybersecurity Governance Securing the information of our customers, employees, contractors, and third party service providers is important to us. We have adopted physical, technological, and administrative controls on data security, and have defined procedures for data incident detection, containment, response, and remediation. While everyone at our company plays a part in managing these risks, oversight responsibility is shared by our board of directors, our Audit Committee, and management. Accordingly, our management team provides regular cybersecurity updates to our board of directors and regular updates on cyber risk management to the Audit Committee. We also maintain information security risk insurance coverage.


text: We have recently also established a Security Governance Council ("Council") that provides strategic guidance for the protection of our information, technology, and physical assets, including the definition of security risks and the prioritization of the implementation of associated controls. The Council membership is led by the Chief Information Security Officer ("CISO") and includes relevant senior executives and has begun to meet at least quarterly, and will reconvene on an emergency basis when necessary to respond to potentially material cybersecurity incidents. The CISO reports to the Chief Information Officer ("CIO") and is responsible for management of cybersecurity risks and the protection and defense of our networks, systems and data. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Our CISO has over 20 years of experience in IT and Information Security across security architecture, incident response, and threat intelligence programs. Our CISO also holds a bachelor's degree in computer science and maintains Certified Information Systems Security Professional ("CISSP") certification.


text: Members of executive leadership are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described herein, including the operation of our incident response plan. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to members of executive leadership, and the Audit Committee. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: Our cybersecurity risk management program is guided by industry standards developed by the NIST, the International Organization for Standardization ("ISO"), and other relevant organizations.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and utilizes common reporting channels and governance processes that apply across other risk areas. While everyone at our company plays a part in managing cybersecurity risks, as discussed in more detail under "Cybersecurity Governance" below, our board of directors, both directly and through delegation to our Audit Committee (the "Audit Committee"), and our senior management team are actively involved in the oversight of our cybersecurity risk management program. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach by engaging teams across the business. We expect these teams to operate pursuant to our Standard Operating Procedures. Our approach is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur through shared processes.


text: Our cybersecurity risk management and strategy includes: • Our dedicated Security team, which performs periodic risk assessments to identify and assess cybersecurity threats, vulnerabilities, their severities, and potential mitigations. The team leverages both top-down and bottom-up risk processes and technologies to identify, manage and monitor cyber threats and vulnerabilities. The team also manages our response to cybersecurity incidents. • Incident Response Playbooks and Standard Operating Procedures ("SOP") outlining procedures for detecting, responding to, and mitigating cybersecurity incidents. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the board of directors. • The use of external service providers, where appropriate, to assess, test or otherwise assist with certain aspects of our security controls and processes, as well as maturity assessments of our cybersecurity program. • Implementation of new hire and annual data privacy and cybersecurity training of all employees, including senior management; annual role-based training of employees with specific access to systems, devices, or locations, and targeted cybersecurity simulation training held on a recurring basis. • A third-party risk management process that identifies and mitigates cybersecurity threats associated with our use of third-party service providers. Such service providers are subject to risk tiering, security risk assessments, continuous monitoring including investigation of security incidents that have impacted our third-party service providers, as applicable.


text: We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. While we have experienced cybersecurity incidents in the past, we believe our current processes, systems and oversight with respect to the management of risks associated with cybersecurity threats are effective. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding the risks we face from cybersecurity threats see "Risk Factors. "


text: Cybersecurity Governance Securing the information of our customers, employees, contractors, and third-party service providers is important to us. We have adopted physical, technological, and administrative controls on data security, and have defined procedures for data incident detection, containment, response, and remediation. While everyone at our company plays a part in managing these risks, oversight responsibility is shared by our board of directors, our Audit Committee, and management. To facilitate coordinated supervision of cybersecurity matters, our management team provides regular cybersecurity updates to our board of directors and regular updates on cyber risk management, which include development regarding our cybersecurity program, broader cybersecurity trends, evolving industry standards, the threat environment and other topics, to the Audit Committee. Together with management, our Audit Committee and board of directors consider this information in their review of our cybersecurity risks and response to data breaches. We also maintain information security risk insurance coverage.


text: We have recently also established a Security Governance Council ("Council") that provides strategic guidance for the protection of our information, technology, and physical assets, including the definition of security risks and the prioritization of the implementation of associated controls. The Council membership is led by the Chief Information Security Officer ("CISO") and includes relevant senior executives and has begun to meet at least quarterly, and will reconvene on an emergency basis when necessary to respond to potentially material cybersecurity incidents. The CISO reports to the Chief Information Officer ("CIO") and is responsible for management of cybersecurity risks and the protection and defense of our networks, systems and data. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Our CISO has over 20 years of experience in IT and Information Security across security architecture, incident response, and threat intelligence programs. Our CISO also holds a bachelor's degree in computer science and maintains Certified Information Systems Security Professional certification.


text: Our board of directors recognizes the importance of maintaining the trust and confidence of our customers, clients, business partners and employees. Our board of directors, through the Audit Committee, oversees our cybersecurity program as part of our enterprise-wide approach to risk management. Our cybersecurity policies, standards, processes and practices are fully integrated into our risk management approach and are based on recognized frameworks established by the National Institute of Standards and Technology. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: UNIVERSAL TECHNICAL INSTITUTE INC

ticker: UTI


text: Governance: As discussed in more detail under the heading "Governance" below, our cybersecurity program is overseen by our Chief Information Officer (CIO), who reports to our Chief Executive Officer (CEO), and is responsible for publishing cybersecurity policies and standards, conducting annual risk assessments and maintaining our compliance. Our CIO regularly reports to our Audit Committee on the status of the cybersecurity program.


text: Collaboration: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our board of directors and Audit Committee by CIO, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our board of directors, through the Audit Committee, oversees our enterprise-wide approach to risk management, including the risks arising from cybersecurity threats. Our Audit Committee regularly receives presentations and reports on cybersecurity risks, which address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to our third party partners. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, our Audit Committee discusses our approach to cybersecurity risk management with management.


text: Our Audit Committee, in connection with management led by CIO, works collaboratively across our Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our Information Security Team monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management when appropriate.


text: Our CIO holds an undergraduate degree in Business Administration and has served in various roles in Information Technology for over 15 years and has been overseeing the cybersecurity program for 5 years. Our VP information Security hold an undergraduate degree in Information Systems Security and has served in various roles in cybersecurity for over 15 years. Our Chief Executive Officer, interim Chief Financial Officer, and Chief Legal Officer each hold undergraduate and/or graduate degrees in their respective fields, and each has experience managing risks at our Company and at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity Threats To date, we are not aware of any cybersecurity threats, including as a result of previous cybersecurity incidents, that are reasonably likely to have a material effect on us, our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us.


text: Governance: As discussed in more detail under the heading "Governance" below, our cybersecurity program is overseen by our Chief Information Officer ("CIO"), who reports to our Chief Executive Officer ("CEO"), and is responsible for publishing cybersecurity policies and standards, conducting annual risk assessments and maintaining our compliance. Our CIO regularly reports to our Audit Committee on the status of the cybersecurity program.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our board of directors and Audit Committee by our CIO, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our Audit Committee, in connection with management led by our CIO, works collaboratively across our Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our Information Security Team monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management when appropriate.


text: Our CIO holds a graduate degree in Business Administration and has more than 23 years of experience across technology roles, including the past three years overseeing cybersecurity programs. Our Vice President of Information Security holds a bachelor's degree in Information Systems Security and brings over 15 years of experience in cybersecurity leadership roles. Our CEO, Chief Financial Officer, and Chief Legal Officer each hold undergraduate and/or graduate degrees in their respective fields, and each has experience managing risks at our Company and at similar companies, including risks arising from cybersecurity threats.


text: Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, end users, business partners, stockholders and employees. Our board of directors is actively involved in oversight of our risk management program, and information and product security represent an important component of our overall approach to enterprise risk management ("ERM"). Our risks from cybersecurity threats are considered in conjunction with other risks in our ERM program. In addition, we leverage a cybersecurity-specific risk assessment process and strategy based on the NIST Cybersecurity Framework to manage risks to organizational operations and assets, individuals and other organizations associated with the operation and use of systems. Risk assessments are periodically conducted to identify threats and vulnerabilities, and then used to determine the likelihood and impact for each risk using a qualitative risk assessment methodology. In general, we seek to address cybersecurity risks through a broad, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Fortinet, Inc.

ticker: FTNT


text: The Audit Committee of our board of directors (the "Audit Committee") is responsible for reviewing with management our cybersecurity and other information technology risks, controls and processes, including the processes used to prevent or mitigate cybersecurity risks and respond to cybersecurity events. Our executives with responsibility over cybersecurity provide quarterly reports to the Audit Committee as well as to the Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program and the emerging threat landscape. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Audit Committee. We also actively engage with key vendors, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. The Audit Committee also receives prompt and timely information regarding any cybersecurity threat or incident that meets established reporting thresholds, as well as ongoing updates regarding any such threat or incident until it has been mitigated, resolved or otherwise addressed.


text: We believe our systems and processes with respect to the management of risks associated with cybersecurity threats are adequate. We have experienced, and may in the future experience, adverse impacts to our operations as a result of cybersecurity incidents. However, to date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business strategy, operating results, and/or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see our risk factors, including our risk factor titled "If our internal enterprise IT networks, on which we conduct internal business and interface externally, our operational networks, through which we connect to customers, vendors and partners systems and provide services, or our research and development networks, our back-end labs and cloud stacks hosted in our data centers, colocation vendors or public cloud providers, through which we research, develop and host products and services, are compromised, public perception of our products and services may be harmed, our customers may be breached and harmed, we may become subject to liability, and our business, operating results and stock price may be adversely impacted."


text: Governance: As discussed in more detail above under the heading, "Governance," our board of directors' oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with executives with responsibility for cybersecurity, our Chief Executive Officer, Chief Technology Officer and President, Chief Financial Officer, Chief Operating Officer/General Counsel and other members of management. Management is promptly updated regarding any significant security events and the Audit Committee regularly reviews updates from our information security and product security leaders about cyber threat response preparedness, security controls and procedures, security program maturity milestones, risk and approaches to risk mitigation and the current and emerging threat landscape. In addition, all members of our board of directors receive management's cybersecurity updates to the Audit Committee as part of their regular attendance at meetings of our board of directors.


text: Collaborative Approach: We have implemented a broad, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. In addition, we manage a cross-functional program across our engineering, manufacturing and technical services teams, together with our suppliers and channel partners, designed to ensure the proper security of our products from design through manufacture and shipment.


text: Information Security: We implement organizational, administrative and technical measures based on commercially reasonable procedures using: (i) industry standard information security measures prescribed for use by NIST; (ii) security measures aligned with the ISO/IEC 27000 series of standards, (iii) Sarbanes-Oxley and SSAE 18/ISAE 3402; (iv) privacy regulations such as the GDPR and the CCPA; (v) business continuity management measures aligned with the ISO/IEC 22301 standard; and (vi) other generally recognized industry standards, in each case, designed to safeguard the confidentiality, integrity, and availability of our infrastructure and data and the resiliency of our operations.


text: Incident Response and Recovery Planning: We have established and maintains broad incident response and recovery plans that help enable its effective and orderly management of, and response to, any identified security incidents, including escalation and internal and external-notification steps, allowing the incident response team to respond in a timely manner and enlist appropriate personnel and third-party experts. We maintain a process to promptly assess and assign severity levels to any identified security incidents in order to prioritize their importance and promptly direct resources to those issues of potentially greater impact. The notification plan establishes steps to alert external stakeholders as appropriate, including law enforcement, regulatory bodies, investors, customers and other business partners.


text: Third-Party Risk Management: We maintain a broad, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In addition, our Trusted Supplier Program is designed to ensure manufacturing partners undergo a selection and qualification process that adheres to NIST 800-161.


text: Education and Awareness: We provide regular, mandatory training for personnel and contractors regarding cybersecurity threats as a means to equip Fortinet personnel with effective tools to address cybersecurity threats and to communicate Fortinet's evolving information security policies, standards, processes and practices.


text: Risk and Readiness Assessments: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to identify vulnerabilities and weaknesses, address cybersecurity threats and test its readiness to respond to cyber security incidents. These efforts include a wide range of activities, including threat modeling, a variety of vulnerability and configuration scans, penetration testing, audits, tabletop exercises and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness and penetration tests. The results of such assessments, audits and reviews are reported to the Audit Committee and our board of directors and to our management, and we adjust its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. Insurance: We maintain information security risk insurance coverage.


text: Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, end users, business partners, governmental entities, stockholders and employees. Our board of directors is actively involved in oversight of our risk management program, and information and product security represent an important component of our overall approach to enterprise risk management ("ERM"). Our risks from cybersecurity threats are considered in conjunction with other risks in our ERM program. In addition, we leverage a cybersecurity-specific risk assessment process and strategy based on the NIST Cybersecurity Framework to manage risks to organizational operations and assets, individuals and other organizations associated with the operation and use of systems. Risk assessments are periodically conducted to identify threats and vulnerabilities, and then used to determine the likelihood and impact for each risk using a qualitative risk assessment methodology. In general, we seek to address cybersecurity risks through a broad, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: As a global cybersecurity provider, cybersecurity risk management is integral to our company. Historically, the Audit Committee of our board of directors (the "Audit Committee") was responsible for reviewing with management our cybersecurity and other information technology risks, controls and processes, including the processes used to prevent or mitigate cybersecurity risks and respond to cybersecurity events. However, due to the importance of cybersecurity to our company, in July 2024, our board of directors formed Cybersecurity Committee of our board of directors (the " Cybersecurity Committee "), which is solely dedicated to cybersecurity risk management. Our executives with responsibility over cybersecurity, including our Chief Information Security Officer, provide quarterly reports to the Cybersecurity Committee as well as to the Chief Executive Officer and other members of our senior management as appropriate. Each member of our board of directors is invited to attend all meetings of the committees of our board of directors, including the Cybersecurity Committee, and thus all of the members of our board of directors are apprised of cybersecurity developments. The quarterly reports to the Cybersecurity Committee include updates on cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program and the emerging threat landscape. Our cybersecurity program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Cybersecurity Committee. We also actively engage with key vendors and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. The Cybersecurity Committee also receives prompt and timely information regarding any cybersecurity threat or incident that meets established reporting thresholds, as well as ongoing updates regarding any such threat or incident until it has been mitigated, resolved or otherwise addressed.


text: We believe our systems and processes with respect to the management of risks associated with cybersecurity threats are adequate. We have experienced, and may in the future experience, adverse impacts to our operations as a result of cybersecurity incidents. However, to date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business strategy, operating results, and/or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see our risk factors, including our risk factor titled "If our internal enterprise IT networks, on which we conduct internal business and interface externally, our operational networks, through which we connect to customers, vendors and partners systems and provide services, or our research and development networks, our back-end labs and cloud stacks hosted in our data centers or PoPs, colocation vendors or public cloud providers, through which we research, develop and host products and services, are compromised, public perception of our products and services may be harmed, our customers may be breached and harmed, we may become subject to liability, and our business, operating results and stock price may be adversely impacted."


text: Governance: As discussed in more detail above under the heading, "Governance," our board of directors' oversight of cybersecurity risk management is supported by the Cybersecurity Committee, which regularly interacts with executives with responsibility for cybersecurity, our Chief Executive Officer, Chief Technology Officer and President, Chief Financial Officer, Chief Operating Officer/General Counsel, our CISO, and other members of management. Our CISO is primarily responsible for our cybersecurity risk management program and partners with our legal team on data privacy matters at the management level. Our CISO, Dr. Carl Windsor, has over 25 years of experience in various technology and cybersecurity leadership positions, including over 18 years at our company driving product security and strategy and reports to the board Cybersecurity Committee. The CISO's leadership team members are all seasoned information security professionals, covering a wide range of security disciplines, who have worked at some of the largest well-known brand names and are experts in their fields. Our CISO monitors, and participates in, our various cybersecurity policies and procedures, and our cybersecurity team regularly updates our CISO on the current status.


text: Management is promptly updated regarding any significant security events and the Cybersecurity Committee regularly reviews updates from our CISO, information security and product security leaders about cyber threat response preparedness, security controls and procedures, security program maturity milestones, risk and approaches to risk mitigation and the current and emerging threat landscape. In addition, all members of our board of directors receive management's cybersecurity updates to the Cybersecurity Committee as part of their regular attendance at meetings of our board of directors.


text: Incident Response and Recovery Planning: We have established and maintain broad incident response and recovery plans that help enable its effective and orderly management of, and response to, any identified security incidents, including escalation and internal and external-notification steps, allowing the incident response team to respond in a timely manner and enlist appropriate personnel and third-party experts. We maintain a process to promptly assess and assign severity levels to any identified security incidents in order to prioritize their importance and promptly direct resources to those issues of potentially greater impact. The notification plan establishes steps to alert external stakeholders as appropriate, including law enforcement, regulatory bodies, investors, customers and other business partners.


text: Education and Awareness: We provide regular, mandatory training for personnel and contractors regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats and to communicate our evolving information security policies, standards, processes and practices.


text: Risk and Readiness Assessments: We engage in the periodic assessment and testing of our policies, standards, process es and practices that are designed to identify vulnerabilities and weaknesses, address cybersecurity threats and test its readiness to respond to cyber security incidents. These efforts include a wide range of activities, including threat modeling, a variety of vulnerability and configuration scans, penetration testing, audits, tabletop exercises and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness and penetration tests. The results of such assessments, audits and reviews are reported to the Cybersecurity Committee and our board of directors and to our management, and we adjust its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. Insurance: We maintain information security risk insurance coverage.


text: We describe whether and how risks from cybersecurity threats are reasonably likely to materially affect us, including our results of operations and financial condition, under the heading " The Company's failure to protect personal information adequately and breaches in cyber security and data protection could have an adverse effect on its business. " in Item 1A, " Description of Risk Factors" of Part I of this report.

companyName: Two Hands Corp

ticker: TWOH


text: We believe we maintain an information technology and cybersecurity program appropriate for a company our size, taking into account our operations and risks. We are committed to cybersecurity and vigilantly protecting all our resources and information from unauthorized access. Our cybersecurity approach incorporates external resources to manage and monitor the evolving threat landscape, effective board oversight of cybersecurity risks and knowledgeable teams responsible for preventing and detecting cybersecurity risks.


text: The Company maintains a comprehensive approach to cybersecurity and data protection, based on a risk-based, defense-in-depth strategy. We regularly assess industry best practices and standards and endeavor to implement them in our efforts to manage cybersecurity risk. We follow industry standard cybersecurity frameworks, including the National Institute of Standards and Technology's Cybersecurity Framework, to design, assess and update our cybersecurity strategy, controls and processes. Our focus is on protecting our highest-value information assets, which include manufacturing systems, financial systems, and confidential, personal, and private information.

companyName: WESTLAKE CORP

ticker: WLK


text: To safeguard our networks and systems, we have a dedicated cybersecurity organization overseen by our Chief Information Security Officer, which operates within our information technology department overseen by our Chief Information Officer. Our cybersecurity organization employs multiple security controls, such as firewalls, spam protection, web filtering, endpoint detection and response software, controlled access, vulnerability management, redundancies, patching, and regular onsite and offsite backups. Our cybersecurity organization also uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and risk-based performance monitoring.


text: Both our Chief Information Officer and our Chief Information Security Officer have extensive experience in assessing and managing cybersecurity risks, including decades of collective experience in information technology and cybersecurity roles of increasing responsibility both at the Company and in prior positions. We prioritize cybersecurity awareness among our employees and contractors through various training exercises, including formal programs and simulated phishing events. We maintain incident response plans, playbooks, and engage third-party cybersecurity firms for simulated cyberattacks and penetration testing to identify potential risks. We also have a third-party cybersecurity firm on retainer for incident assistance and response. Periodic internal self-assessments are conducted by our cybersecurity organization using the National Institute of Standards and Technology Cybersecurity Framework.


text: From time to time, we experience cybersecurity threats and attempted breaches and other incidents. We classify and track these events based on significance and implement remediation actions that we consider appropriate to address the risks relating to such incidents. Although we have not experienced material impacts to our business strategy, results of operations or financial condition from any such incidents in the past three years, we cannot guarantee that a material incident will not occur in the future. Refer to "Failure to adequately protect critical data and technology systems could materially affect our operations" under "Item 1A. Risk Factors—Legal, Government and Regulatory Risks" of this Form 10-K.


text: Our Board has charged the Corporate Risk and Sustainability Committee with assisting the Board with its oversight of cybersecurity risks, which is a component of our overall enterprise risk management program. The Corporate Risk and Sustainability Committee includes directors with cybersecurity experience and expertise, primarily through supervision of information technology departments as executive officers. The Corporate Risk and Sustainability Committee receives regular updates from senior management and our Chief Information Officer on cybersecurity risks, incidents and trends, and ongoing and planned projects. Regular status reports are also provided by the cybersecurity organization to our Chief Information Officer and other members of our senior management and incident updates are reported to senior management as the Chief Information Officer and cybersecurity organization considers appropriate depending on the severity of the incident.


text: As part of our incident response planning, we also maintain cross-functional response teams involving personnel outside of our cybersecurity organization, both globally and regionally, in order to be prepared to respond to an incident.


text: We have policies, procedures, and processes for assessing, identifying, and managing cybersecurity risks, which are defined and managed by Cimpress' central security and privacy team and are designed to help protect our information assets and operations from internal and external cyber threats and secure our networks and systems. Our cybersecurity processes include procedural and technical safeguards, response plans, regular vulnerability and penetration tests on our systems, incident simulations, and routine reviews of our policies and procedures to identify risks and improve our practices. Our cybersecurity incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to assess the severity of, escalate, contain, investigate, and remediate incidents as well as to comply with applicable legal obligations. We have security policies that apply to all employees worldwide, and we conduct annual employee trainings on data protection, cybersecurity, and incident prevention, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use, and mobile security. In addition to our internal penetration testing and vulnerability management program, we engage an external party to simulate attacks on our systems to test our defenses and response. We also use a third-party vendor risk assessment platform to score vendors' cybersecurity vulnerabilities and provide suggested mitigations.

companyName: CIMPRESS plc

ticker: CMPR


text: The Audit Committee of our Board of Directors oversees cybersecurity risk and receives regular updates from our Vice President and Chief Security and Privacy Officer on these risks, risk management activities, incident response plans, best practices, the effectiveness of our security measures, and other related matters. Our Vice President and Chief Security and Privacy Officer, who reports to our Chief Technology Officer, leads our central security and privacy team, which works in partnership with each of our businesses and the corporate center to measure security maturity and risk and provides managed security services in a way that allows each business to address their unique challenges and become more efficient in using their resources. We have processes and policies for the escalation of cybersecurity incidents to the central security team, evaluation of the materiality of the incidents, and coordination of our response as needed across businesses and operations. Our Chief Security and Privacy Officer has more than 20 years of privacy and data security experience, including a series of roles in Cimpress over the last 15 years, the last two and a half years of which have been spent leading the central security and privacy team.


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. See Part I, Item 1A, Risk Factors, in this Annual Report for a discussion of cybersecurity risks.


text: The Company currently does not have operations in which the internet is utilized. Once operations commence we will contract with a data center that is current on their cyber security policies and practices.

companyName: Real Brands, Inc.


text: The Company's board of directors oversees, among other things, the adequacy and effectiveness of the Company's ability to assess, identify, and manage material risks from cybersecurity threats. Management has been informed as to the need to be constantly aware of the possibility of cybersecurity breaches and to inform the board of directors immediately upon receipt of any information with respect to an actual or even a potential breach. In such event, evaluation of the degree of the breach will be made and third-party experts consulted and/or retained, as necessary, to address any such situation. As a technology-based company, management believes that the security it currently has in place to protect its proprietary information, and that the personal information of its employees and customers, is sufficient and appropriate for its current level of business activities.

companyName: WORLDS INC

ticker: WDDD


text: This is a fluid situation and management and the board of directors intends to meet periodically to assess the adequacy of the then-current status and determine if any additional steps are indicated.


text: As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition.


text: We face a multitude of cybersecurity threats from a range of adversaries. Our vendors, clients, distributors and other third parties with whom we work face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business, operations, financial condition and results of operations.

companyName: ASSURANT, INC.

ticker: AIZ


text: The Board has ultimate oversight of cybersecurity risk. The Board reviews management's assessment of our key enterprise risks and its strategy with respect to each risk, including cybersecurity risks, and receives a corresponding risk management update annually. The Information Technology Committee reviews the effectiveness of our cybersecurity controls and procedures, including procedures to identify and assess internal and external risks from cybersecurity threats; controls to prevent and protect from cyberattacks, unauthorized access or other malicious acts and risks; procedures to detect, respond to, mitigate negative effects from and remediate cybersecurity attacks; and controls and procedures for fulfilling applicable regulatory reporting and disclosure obligations of the risks and costs of cybersecurity incidents. Our Chief Information Security Officer ("CISO") briefs or provides a report to the Information Technology Committee on our cybersecurity and information security posture and program at least quarterly, including penetration test results and related remediation and significant cybersecurity incidents, and also provides an annual cybersecurity update to the full Board.


text: Cybersecurity risk is integrated into our Global Risk Management process. Cybersecurity risk continues to be identified as one of our key enterprise risks. Risk owners from the Management Committee, senior leadership and the Global Risk Management function have been assigned to develop risk mitigation plans, which are tracked and reported at least quarterly to the Finance and Risk Committee of the Board and annually to the Board. See "Item 1 – Business – Global Risk Management" for more information on the Global Risk Management function.


text: Our CISO, who reports to our Global Technology Officer on the Management Committee, has over 20 years of information technology and security program management experience, holds a Certified Information Security Manager certification and has led our information security team, including information technology compliance and risk management, since 2009. Our Global Technology Officer joined the Company in 2016 and has over 30 years of information technology experience, including leading global digital, security, infrastructure, cloud services and application teams. Prior to joining the Company in 2016, our Global Technology Officer was chief information officer at a large, publicly-traded energy company.


text: Our CISO has implemented a management-level governance structure and process to assess, identify, manage and report cybersecurity risks, and manage our overall information security program. The Information Security Board, led by our CISO and comprised of leaders from all of our lines of business and key functional areas such as Global Risk Management, Privacy and Compliance, as well as members of our information security team, meets quarterly, and is responsible for overseeing our information security program, including our information security strategy and related policies and standards. The information security team manages cybersecurity risks and controls, and continually enhances a global security control framework with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously minimizing the business impact should an incident occur.


text: We have implemented cybersecurity policies and standards based on leading industry frameworks, including the ISO 27001 standard and the National Institute of Standards and Technology Cybersecurity Framework, and regularly assess our policies and practices, including tabletop exercises, aimed at mitigating cybersecurity risks. In the event of a cybersecurity incident, we follow our Enterprise Information Security Incident Response Plan (the "IRP"), which outlines steps from incident detection to assessment, response, mitigation, recovery and notification, including to key functional areas such as Global Risk Management, Corporate Law, Privacy and Compliance, senior leadership and the Board, as appropriate. The IRP includes quantitative and qualitative incident assessment guidance and promotes engagement with multidisciplinary teams across the enterprise to facilitate real-time information sharing during a cybersecurity incident.


text: Employees outside of our information security team as well as third-party cybersecurity experts have an important role in our cybersecurity defenses. We require employees to participate in annual cybersecurity training and provide them with additional optional training and awareness materials, and regularly engage our employees in phishing exercises, reporting results to the Information Technology Committee. In addition, we regularly engage assessors, consultants, auditors and other third parties in our management of cybersecurity risk. For example, third parties are engaged to conduct evaluations of the maturity and effectiveness of our security program, including testing the design and operational effectiveness of security controls, penetration testing, engaging in independent audits, reviewing our policies and standards, and consulting on best practices to address new challenges. We also receive threat intelligence from government agencies, information sharing and analysis centers, and cybersecurity associations.


text: We rely on our vendors and other third parties, including the continued availability of their products and services, to conduct business and provide services to our clients. A cybersecurity incident at a vendor or other third party could materially adversely impact us. We assess third-party cybersecurity controls through a cybersecurity questionnaire and a review of independent cybersecurity rating assessments. Our contracts with third parties generally include security and privacy addendums where applicable and require counterparties to meet a specific standard of data security and report cybersecurity incidents to us.


text: While we have not experienced a cybersecurity incident that resulted in a material adverse effect on our business, operations, financial condition or results of operations, there can be no guarantee that we will not experience such an incident in the future. Although we maintain cybersecurity insurance, the costs and expenses related to cybersecurity incidents may not be fully insured. See "Item 1A – Risk Factors – Technology, Cybersecurity and Privacy Risks – The failure to effectively maintain and modernize our technology systems and infrastructure and integrate those of acquired businesses could adversely affect our business", " – Technology, Cybersecurity and Privacy Risks – We could incur significant liability if our technology systems or those of third parties are breached or we or third parties otherwise fail to protect the security of data residing on our respective systems, which could adversely affect our business and results of operations" and " – Business Strategic and Operational Risks – Our inability to successfully recover should we experience a business continuity event could have a material adverse effect on our business, financial condition and results of operations" for more information.