text: These policies and standards include both preventive measures and reactive processes. Preventive measures include, but are not limited to, protective and detective cybersecurity systems, security monitoring, threat hunting and mandatory, enterprise-wide employee training. Our reactive processes are captured primarily by the IRP, which is comprised of an evolving set of procedures developed by cross-functional experts, and external consultants, who draw upon technical proficiency and learnings from past experiences. All these procedures and practices are tailored to our technology environment and are refined iteratively. Further, we have an information risk management program that includes a vendor risk assessment process, whereby we systematically oversee and identify risks from cybersecurity threats related to its use of third-party service providers.


text: While cybersecurity threats remain a risk to the Company's business operations, our risk mitigation strategies have been effective to date. Accordingly, no such threats have materially affected our business strategy, results of operations or our financial condition in the past three fiscal years. Despite our cybersecurity policies and practices, we may not be successful in preventing or mitigating a cybersecurity incident resulting in a material adverse effect. For more information regarding how cybersecurity threats could materially affect our business strategy, results of operations or financial condition, see the business and operational risk factor: We rely heavily on information technology systems that, if not properly functioning, could materially adversely affect our business in Item 1A, Risk Factors.

companyName: RICHARDSON ELECTRONICS, LTD.

ticker: RELL

secItem: Item 1C


text: Our Board of Directors has overall responsibility for enterprise risk management and has delegated the oversight of cybersecurity risks to the Audit Committee. The Company's Chief Financial Officer ("CFO") immediately updates the Audit Committee on any significant cybersecurity incident and/or threat that may require an 8-K filing. Furthermore, the CFO reports quarterly to the Audit Committee on any significant cybersecurity incidents, threats, mitigation strategies and controls at each Audit Committee meeting. The Audit Committee then updates the full board on significant matters raised and discussed during these sessions. These updates include the following: • Recent cyber risks and cybersecurity developments • Cyber risk governance • Assessments by third-party experts • Key cyber risk metrics • Projects and initiatives The Audit Committee delegates day-to-day management of cybersecurity risks to the Company's senior management, which includes our CFO, who reports directly to the Chief Executive Officer. Our CFO leads a team of dedicated professionals who are responsible for a wide range of risk assessment and management and leads specialized teams of internal and external experts focusing on distinct categories of threats.


text: The Audit Committee receives regular reports from our Chief Information Security Officer ("CISO") regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential. The Chief Information and Customer Officer ("CICO") and CISO periodically report to the full Board regarding cybersecurity risks and our cyber risk management program. Board members periodically receive presentations on cybersecurity topics from our CICO, our CISO, or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: EXTREME NETWORKS INC

ticker: EXTR


text: Our management team, including our CICO and our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CICO and CISO collectively have decades of IT and cybersecurity experience in technology companies, including significant experience in senior-level leadership roles. Additionally, our CISO holds Certified Information Security Manager and Certified in Risk and Information Systems Control certifications. Our CICO and CISO are assisted by a cross-functional Information Security Steering Committee.


text: The Company's information security function and management team is led by our Vice President of Information Technology and Cybersecurity, who has approximately 39 years of experience in the information technology area and holds the CISM certification, and our Senior Director of Information Technology Infrastructure and Cybersecurity, who has approximately 26 years of experience in the information technology area and holds CISSP, CCSP, CISM, and OSCP certifications.

companyName: SANFILIPPO JOHN B & SON INC

ticker: JBSS


text: The information security team is responsible for monitoring, managing and assessing cybersecurity risks and threats on a day-to-day basis. In particular, the information security team monitors, assesses and mitigates threats and is responsible for improving and strengthening the Company's cybersecurity environment. As discussed below, the information security team works with nationally recognized third parties and licenses various cybersecurity tools and products to assist with assessing and managing cybersecurity risks. The information security team regularly interacts and discusses cybersecurity matters with our Chief Executive Officer, Chief Financial Officer and Chief Operating Officer as part of our company-wide risk management system. The information security team has plans and processes in place to escalate certain cybersecurity issues to senior management and the Board or the Audit Committee, including for consideration of whether, when and how to publicly disclose any material cybersecurity event. In addition, we maintain insurance to help reduce our exposure from potential losses should a cybersecurity incident arise.


text: We have engaged in a tabletop exercise with a nationally recognized third party to test our readiness in respect to certain of the preceding events and risks. When risks or threats are identified to the Company by a third party, the information security team is responsible for assessing the risk or threat and determining a course of action to mitigate the risk or neutralize the threat.


text: The Company also has a Risk Assessment Committee composed of selected members of senior management. Member(s) of the information security team are members of this Risk Assessment Committee (which occur at least quarterly) to address cybersecurity risks and discuss cybersecurity threats to the Company. Member(s) of the information security team have the opportunity to present at the Risk Assessment Committee meetings and raise issues and concerns regarding cybersecurity. The minutes of Risk Assessment Committee meetings are provided to the Board and senior management discusses with the Board the matters addressed at the applicable Risk Assessment Committee meeting.


text: Risk Management and Strategy The Company’s cybersecurity program is part of its overall risk management framework. The cybersecurity risk program includes a risk-based approach to identifying, assessing, and addressing cybersecurity threats that could impact our data, our networks, or the information provided to us by consumers and counterparties.

companyName: QUINSTREET, INC

ticker: QNST


text: 1. Cybersecurity Risk Management Program – The Company’s cybersecurity risk management program includes the following activities: • Regular Security Committee meetings where the head of Information Security briefs the Security Committee on cybersecurity threats and responses, strategies and initiatives relating to cybersecurity, and roadmaps for improving the Company’s cybersecurity. • Training employees on cybersecurity upon hire, and at least annually, with more detailed training provided to those employees that have greater access to data and systems. • Over two dozen Information Security policies that focus on specific aspects of our cybersecurity risk management (e.g., Vendor Management).


text: The Company’s Information Security team is responsible for the Company’s cybersecurity risk management program. Their Information Security policies contain processes and templates which are intended to set standards, assign specific roles and responsibilities with respect to our information security environment, and categorize threats and map them to responses as required by law and contract.


text: 3. Training and Screening of Employees – The Company provides all Information Security policies to new hires. In addition, new hires are required to complete security awareness training which contains cybersecurity principles. Employees must also complete annual security awareness training, with additional and dedicated cybersecurity training for employees with access to more data and systems. As a part of hiring employees and contractors, background checks are performed that involve varying levels of depth depending on the employee’s or contractor’s level of data and system access.


text: 4. Third Party and Vendor Management – The Company’s Information Security team has established policies and processes to identify and oversee cybersecurity risks associated with using third party service providers and vendors. These include the following elements: • Access Control: The principle of least privilege is applied to manage user’s access of Company’s resources. User access is reviewed at least quarterly. • Vendor Management: One of the Company’s Information Security policies is its Vendor Management Policy. This policy includes conditions for vendor evaluation, how the Company performs its evaluation, and steps for monitoring thereafter. • Privacy Impact Assessments: The Company’s employees are trained to submit a Privacy Impact Assessment for review when there may be new access by a third-party to certain data or the Company may share information in a new way. The Privacy Impact Assessment is reviewed by the Information Security team to assess whether the proposed practices are manageable within the Company’s cybersecurity environment.


text: Impact of Cybersecurity Risks on Business Strategy, Results of Operations or Financial Condition Substantially all of the Company’s business is conducted online. Accordingly, there is a risk that a cybersecurity incident that impacts our ability to conduct business online (including any loss of confidence by consumers and counterparties in our information security practices or capabilities) could have a material adverse impact on our business strategy, results of operations or financial condition. The Company’s approach to the management and mitigation of cybersecurity risks reflects the online nature of our business. To date, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. As part of the Company’s overall risk mitigation strategy, we maintain cyber liability insurance coverage. Such coverage, however, may not be sufficient to cover us against related claims. For additional information, see “Risks Related to our Business and Industry,” in Item 1A, “Risk Factors” in this Annual Report.


text: Cybersecurity Governance Pursuant to the Audit Committee Charter, the Audit Committee reviews management's assessments of, and plans with respect to, the Company’s cybersecurity and other enterprise risks. The Audit Committee typically receives updates from a Security Committee member quarterly with respect to Information Security team activities.


text: The Company’s Information Security team is responsible for identifying, assessing, and mitigating cybersecurity risks. The Information Security team reports to the head of Information Technology, who reports to the Chief Technical Officer who reports to the Chief Executive Officer. The Information Security team also briefs the Security Committee (which consists of the Chief Technical Officer, CEO, CFO and Chief Legal Officer) regularly about the cyber threat landscape, their plans to mitigate cybersecurity risks and their responses to cybersecurity incidents.


text: The Board of Directors is responsible for the oversight of our cybersecurity risk management program. On a quarterly basis, our C hief Information Officer (CIO) provides a cybersecurity status report and update to the Board of Directors, which includes a scorecard of cybersecurity threats, updates on key initiatives, and any changes in trends that may impact the Company. The CIO reports directly to the President and Chief Executive Officer (CEO) and meets regularly with him, the Chief Financial Officer, and other members of the Executive Leadership Team. The CIO has over 25 years of experience in IT Operations and is supported by an internal Director of IT Security and a virtual Chief Information Security Officer (vCISO) service to ensure comprehensive focus on the program.

companyName: FLEXSTEEL INDUSTRIES INC

ticker: FLXS


text: The Company conducts regular assessments of cybersecurity risks both internally and with third party assistance Information Technology Director reports on the results of these assessments and corresponding recommendations to the full Board of Directors at least annually. We use the National Institute of Standards and Technology ("NIST") framework to regularly assess the threat landscape and support a cybersecurity strategy based on prevention, detection and mitigation. In general, the Company seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving confidentiality, managing data security and availability and effectively responding to cybersecurity incidents when they occur. Management's philosophy on cybersecurity is to be vigilant in protecting the Company through investments in tools and employee awareness to aid in the prevention, detection and mitigation of cyber threats, while recognizing that not all threats are preventable.

companyName: STRATTEC SECURITY CORP

ticker: STRT


text: The Company's Information Technology Director and Chief Financial Officer, along with cybersecurity personnel on their respective teams, are responsible for developing cybersecurity programs, as may be required by applicable law or regulation. Our cybersecurity personnel have the appropriate expertise in IT and cybersecurity, which generally has been gained from a combination of education, including relevant degrees and/or certifications, and prior work experience.


text: Risk Management and Strategy Among other best practices, we use multi-factor authentication wherever possible for external access to systems, assess and update current versions of security solutions, perform annual cybersecurity training and email phishing campaigns for employees, use third parties to perform external penetration testing, and maintain disaster recovery and incident response plans. We employ a combination of methods to monitor for new or developing cybersecurity risks. Incidents, if any, are escalated to management and the Board according to our incident response policy. Through these processes, we did not identify risks from current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past, and we could in the future experience similar attacks. For the years presented, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that had, or were reasonably likely to have, a material effect on the Company, including our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats we face, see "Operational Risks - Our business and operations could suffer in the event of cybersecurity breaches," in "Item 1A. Risk Factors" in this report.

companyName: UNIFI INC

ticker: UFI


text: The Audit Committee regularly reviews our cybersecurity and other technology risks, controls and procedures. The Audit Committee receives reports from the CIO quarterly regarding our cybersecurity framework, as well as our plans to mitigate cybersecurity risks and to respond to any data breaches. The Company's Information Technology Security Team and its cybersecurity infrastructure is overseen by the CIO who reports to the Chief Executive Officer. The CIO has served in various roles in information technology for over 30 years.


text: Our cybersecurity management team, lead by our CIO, supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and reports produced by security tools deployed in the IT environment. Our CIO reports to the Company's Chief Executive Officer, as well as to the Board and Audit Committee. The CIO has served as our CISO for four years and has more than 20 years of experience in various roles involving managing cybersecurity functions, developing strategies to protect privacy, customer safety and intellectual property, and developing key capabilities such as product security engineering, risk management and cybersecurity governance. The CIO holds a bachelor's degree in computer science and various certifications which include Certified Ethical Hacker and Certified Chief Information Security Officer, and has 25-plus years of previous software and hardware systems engineering experience.

companyName: MasterCraft Boat Holdings, Inc.

ticker: MCFT


text: Risk management and strategy We have developed processes for assessing, identifying and managing material risks from cybersecurity threats. Our enterprise risk management system incorporates risks from cybersecurity threats alongside other risks to the company. We employ a range of tools and services to inform our assessment, identification and management of material risks from cybersecurity threats, which include from time to time: • monitoring emerging data protection laws and implementing responsive changes to our processes; • undertaking periodic reviews of our policies with customers, partners, and suppliers and statements related to cybersecurity; • conducting cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • conducting phishing email simulations for employees and contractors with access to corporate email systems; • requiring employees, as well as third-parties who provide services on our behalf, to treat information and data with care; and • educating our teams on incident response, conducting tabletop exercises and using the findings to improve our processes and technologies.

companyName: Mativ Holdings, Inc.

ticker: MATV


text: We maintain a cybersecurity incident response plan designed to secure the enterprise, mitigate the impact of an incident, restore normal business operations, prevent similar future incidents and comply with applicable regulatory obligations arising from an incident. As part of the above process, we periodically engage with consultants and other third-parties, including annually having a third-party perform penetration testing and review our cybersecurity program to help identify areas for improvement and/or compliance. The Company's cybersecurity procedures have been developed based on the National Institute of Standards and Technology ("NIST") cybersecurity framework. We also engage with a third-party security operation center to assist in monitoring our cybersecurity risk environment. Our risk management processes also address cybersecurity threat risks associated with our use of third-party service providers.


text: For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, see "Part I, Item 1A. Risk Factors -- A failure of, or a security breach in a key information technology system or process or other unusual events could compromise our information and expose us to liability, which could adversely affect our business; IT project delays and overruns are possible" which is incorporated by reference into this Item 1C.


text: As previously disclosed, during the three-month period ending September 30, 2022, the Company became aware of a cyberattack that had been recently made against certain systems within the Company's network environment. The attack temporarily affected operations and caused delays in execution of sales transactions at some locations. In addition, the Company incurred financial costs to investigate and remediate the incident, some of which are expected to be mitigated by insurance. During the incident, the attackers accessed and exfiltrated Company data, including some personally identifying information of certain Company employees. The Company believes it has contained the incident, which only affected certain systems, and it has restored operations and notified affected individuals. The Company has put in place remediation measures designed to help prevent future similar attacks and has proactively undertaken to implement certain other enhancements to its security system.


text: Oversight of cybersecurity risk is a joint responsibility of the Board of Directors and the Audit Committee. The Company's Chief Information Officer (the "CIO") provides quarterly updates to the Audit Committee and the chair of the Audit Committee regularly updates the Board of Directors on cybersecurity matters potentially impacting the Company. Additionally, the CIO briefs the Board of Directors on information security matters at least annually. In addition to oversight by the Audit Committee and the Board of Directors, our CIO chairs a Working Council that includes our Chief Financial Officer, Chief Human Resources and Communications Officer and our Chief Legal and Administrative Officer. Our IT organization also includes a Chief Information Security Officer who is responsible for establishing processes as well as management of all cyber security risks and programs to mature our NIST posture. Our CIO has served in this role since 2023 and has more than 30 years of experience in the aggregate in various IT leadership roles. His educational background includes a master's in business administration in Information Systems from The State University of New York at Albany, and a bachelor's degree in electrical engineering from Harcourt Butler Technological Institute, Kanpur, India.


text: As previously disclosed, during the three-month period ending September 30, 2022, the Company became aware of a cyberattack that had been recently made against certain systems within the Company's network environment. The attack temporarily affected operations and caused delays in execution of sales transactions at some locations. In addition, the Company incurred financial costs to investigate and remediate the incident, some of which was mitigated by insurance. During the incident, the attackers accessed and exfiltrated Company data, including some personally identifying information of certain Company employees. The Company contained the incident, notified affected individuals, and restored operations. The Company put in place remediation measures designed to help prevent future similar attacks and implemented certain other enhancements to its security system.


text: Risk Management and Strategy The Company has adopted a cybersecurity risk management program that includes processes designed to identify, assess, manage, and monitor risks from cybersecurity threats. We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity awareness and risk management. Those processes include conducting an assessment of internal and external threats to the security, confidentiality, integrity and availability of Company data and systems along with other material risks to Company operations, at least annually or whenever there are material changes to the Company's systems or operations and responding to risks identified. The Company uses NIST cybersecurity and risk management frameworks to assess its cybersecurity controls, risks, and overall program effectiveness. As part of our risk management process, the Company also engages outside providers to conduct periodic internal and external penetration testing and security assessments. As part of our third-party risk management program, we conduct assessments of vendor cybersecurity risks, including risks associated with our cloud vendors and other third parties.

companyName: NOVAVAX INC

ticker: NVAX


text: As of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. For example, in 2020, several domestic and foreign security agencies announced that government actors or government-affiliated actors were specifically targeting organizations, like us, engaging in COVID-19 vaccine development and research. For more information, see Item 1A Risk Factors, "Security breaches and other disruptions to our information technology systems or those of the vendors on whom we rely could compromise our information and expose us to liability, reputational damage, or other costs."


text: The cybersecurity risk management program is led by the Company's Chief Information Officer ("CIO") who has over 20 years of experience in information systems, cybersecurity, and data protection. The CIO reports to the Company's Audit Committee at least annually, as well as to the Board of Directors, the Company's Chief Executive Officer, and other members of our senior management as appropriate. These reports may feature an overall assessment of the Company's compliance with the Company's cybersecurity policies and include topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures. Our program is evaluated by internal and external experts with the results of those reviews reported to senior management and the Board.


text: Risk Management and Strategy The Company has adopted a cybersecurity risk management program that includes processes designed to identify, assess, manage, and monitor risks from cybersecurity threats. We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity awareness and risk management. Those processes include conducting an assessment of internal and external threats to the security, confidentiality, integrity and availability of Company data and systems along with other material risks to Company operations, at least annually or whenever there are material changes to the Company's systems or operations and responding to risks identified. The Company's information security program is developed using industry standards as a guide, including the National Institute of Standards and Technology Cybersecurity Framework. As part of our risk management process, the Company also engages outside providers to conduct periodic internal and external penetration testing and security assessments. As part of our third-party risk management program, we conduct assessments of vendor cybersecurity risks, including risks associated with our cloud vendors and other third parties.


text: We recognize the critical importance of developing, implementing, and maintaining a robust cybersecurity risk management, strategy, and governance program in order to safeguard the confidentiality, integrity, and availability of our systems and information.

companyName: INSPERITY, INC.

ticker: NSP


text: Board Oversight of Cybersecurity Matters Our Board has established oversight mechanisms to help ensure effective governance in managing risks associated with cybersecurity threats. In addition to the updates that our Board receives on cybersecurity matters, the Board's Finance, Risk Management and Audit Committee (the "FRMA Committee") is tasked with overseeing enterprise risk management. The FRMA Committee reviews and discusses major risk exposures with management, including cybersecurity risks, and steps management has taken to monitor and control such exposures, including our guidelines and policies concerning risk assessment and management.


text: Management of and Reporting on Cybersecurity Matters Our management assumes responsibility for assessing, identifying, and managing cybersecurity risks, threats, and incidents.


text: In particular, our Senior Vice President of Innovative Technology Solutions ("SVP-ITS") is responsible for our overall technology strategy, including overseeing our information security function and plays a pivotal role in assessing and managing all cybersecurity risks, threats, and incidents. The SVP-ITS reports directly to our President and Chief Operating Officer ("President and COO") and maintains regular dialogue with our President and COO and other key members of our senior management to ensure these individuals are appropriately apprised of our latest cybersecurity posture and developments, such as new threats, incidents, risks, and risk management solutions. Our SVP-ITS prepares reports for each regular Board meeting regarding significant developments in these topics to support the Board in its efforts to have appropriate information to exercise oversight on critical cybersecurity issues. Our current SVP-ITS has decades of experience overseeing leading systems and software development efforts with critical cybersecurity components.


text: The SVP-ITS is supported by dedicated information technology and security personnel and resources, including team members that have numerous cybersecurity certifications. Collectively, these personnel and resources allow us to strategically integrate cybersecurity into our broader risk management framework and decision-making process.


text: We also have an Enterprise Risk Management Steering Committee (the "ERM Steering Committee"), which is responsible for formally identifying and evaluating risks that may affect our ability to execute our corporate strategy and fulfill our business objectives, including cybersecurity risks. The ERM Steering Committee is chaired by the Company's chief financial officer and includes the Company's SVP-ITS, general counsel, internal audit director, and other members of management. The ERM Steering Committee conducts an annual comprehensive risk review of our overall risk profile and analyzes any significant identified risks, including consideration of risks relating to cybersecurity matters, which the ERM Steering Committee then presents and discusses with the FRMA Committee and the entire Board. In addition to the formal annual review, members of the ERM Steering Committee review and provide periodic updates as appropriate regarding our overall risk profile and any significant identified risks to both the FRMA Committee and the entire Board.


text: We have processes in place that we believe are designed to allow our information security team and management to be informed of and monitor the prevention, detection, mitigation, and remediation of cybersecurity risks. These processes include establishing a formal incident response team, penetration testing, system vulnerability scanning, phishing simulations, tabletop exercises, employee security and compliance training, disaster recovery planning, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning.


text: Engagement of Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity consultants and systems auditors, in evaluating and testing our risk management systems. Our collaboration with these third parties includes regular audits, threat and vulnerability assessments, incident response plan design and testing, penetration testing, and consultation on improving our defense-in-depth security posture.


text: Overseeing Third-Party Risk We have processes in place designed to help us identify and oversee cybersecurity risks associated with our use of vendors, service providers, business partners, and other third parties that process our data on our behalf or have access to our systems. These processes include a vendor management policy designed to identify and consider potential risks from third parties as part of the vendor section process, which considers vendor cybersecurity standards and other factors based on the nature of the services that the vendor will provide.


text: Impact on the Company We have experienced, and may continue to experience, cyber incidents in the normal course of our business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. For further discussion, see Item 1A. "Risk Factors – Disruptions of our information technology systems could damage our reputation and materially disrupt our business operations " and Item 1A. "Risk Factors - We could be subject to reduced revenues, increased costs, liability claims, or harm to our competitive position as a result of data theft, cyberattacks or other security vulnerabilities."


text: Risk Management and Strategy Our enterprise risk management framework considers cybersecurity risk in conjunction with our other Company risks as part of the overall risk assessment process. Our enterprise risk management team collaborates with the information security function, led by the Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"), to gather their insights and risk mitigation strategies for managing cybersecurity threats. This integrated approach helps us assess, identify, and manage cybersecurity risks along with our other operational, financial and strategic risks, assisting in more effectively managing interdependencies among risks and enhancing risk mitigation strategies.

companyName: ESTEE LAUDER COMPANIES INC

ticker: EL


text: We have implemented a cybersecurity program including processes, technologies, and controls to assess, identify, and manage material risks from cybersecurity threats. This program includes implementing new technologies to proactively identify and monitor new vulnerabilities and reduce risk, conducting due diligence of third-party vendors' information security programs, maintaining security policies and standards and regularly updating and testing our response planning and protocols. We maintain a formal information security training program for employees that includes training on matters such as phishing and email security best practices. Employees are also required to complete mandatory training on data privacy. We also have a third-party cybersecurity risk review process, including requiring key third-party service providers to complete initial and periodic security assessments, which prioritizes, monitors and assesses the risks associated with our third-party service provider interactions. To evaluate and enhance our cybersecurity program, we periodically utilize third-party experts to undertake maturity assessments of the program.


text: We have also adopted a cybersecurity incident response plan that is designed to effectively identify, analyze, contain, remediate and eradicate, escalate, report, and appropriately document cybersecurity incidents. The plan also includes a materiality assessment framework that sets forth procedures and escalation protocols to support our assessment of whether a cybersecurity incident is material and subject to SEC reporting requirements. Such escalation protocols include the involvement of the CISO and other senior leaders across various functions, including finance, legal, privacy and global communications, as appropriate. We also maintain insurance coverage that, subject to its terms and conditions, is intended to address costs associated with certain aspects of cybersecurity incidents.


text: We have experienced cybersecurity incidents of varying degrees on our information technology; however, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operation or financial condition. However, we cannot eliminate all risks and the compromise or interruption of, or damage to, our information technology (including our operational technology and websites) by cybersecurity incidents could have a material negative impact on our business. For a more detailed discussion of the risks, see Risks related to Technology and Cybersecurity Matters within Item 1A. Risk Factors.


text: The Audit Committee of the Board of Directors oversees our information security program, which includes oversight of the cybersecurity program and management of cybersecurity risks. The Audit Committee receives at least semi-annual updates from the CISO, which typically address our cybersecurity strategy, initiatives, key security metrics, business response plans and the evolving cyber threat landscape and a detailed threat assessment relating to information technology risks.


text: At the management level, our cybersecurity program is led by the CISO, who is responsible for assessing and managing material risks from cybersecurity threats, including the prevention, mitigation, detection, and remediation of cybersecurity incidents. The CISO is informed about cybersecurity threats and incidents in accordance with the cybersecurity incident response plan as discussed above. The CISO, who reports to the CIO, regularly provides updates to the Chair of the Audit Committee and Chief Financial Officer. We also have protocols by which certain cybersecurity incidents are reported promptly to the Chair of the Audit Committee and Chief Financial Officer, as appropriate. The Company's CISO has served in various cybersecurity roles for over 20 years, leading a variety of cybersecurity and risk capabilities and also holds multiple cybersecurity certifications such as Certified Information Systems Security Professional, Certified Information Systems Auditor, and Certified in Risk and Information Systems Control.


text: Risk Management and Strategy Our enterprise risk management framework considers cybersecurity risk in conjunction with our other Company risks as part of the overall risk assessment process. Our enterprise risk management team collaborates with the cybersecurity function, led by the Chief Information Security Officer ("CISO"), to gather their insights and risk mitigation strategies for managing cybersecurity threats. This integrated approach helps us assess, identify, and manage cybersecurity risks along with our other operational, financial and strategic risks, assisting in more effectively managing interdependencies among risks and enhancing risk mitigation strategies.


text: At the management level, our cybersecurity program is led by the CISO, who is responsible for assessing and managing material risks from cybersecurity threats, including the prevention, mitigation, detection, and remediation of cybersecurity incidents. The CISO is informed about cybersecurity threats and incidents in accordance with the cybersecurity incident response plan as discussed above. The CISO, who reports to the Chief Technology, Data and Analytics Officer, regularly provides updates to the Chair of the Audit Committee and Chief Financial Officer. We also have protocols by which certain cybersecurity incidents are reported promptly to the Chair of the Audit Committee and Chief Financial Officer, as appropriate. The Company's CISO has served in various cybersecurity roles for over 20 years, leading a variety of cybersecurity and risk capabilities and also holds multiple cybersecurity certifications such as Certified Information Systems Security Professional, Certified Information Systems Auditor, and Certified in Risk and Information Systems Control.


text: Cybersecurity Risk Management and Strategy Riley Permian recognizes the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as is defined in Item 106 (a) of Regulation S-K. These risks include, among other things: operational risks, harm to our employees, suppliers or industry partners, intellectual property theft, fraud, extortion, and violation of data privacy or security laws. We use a risk management framework based on applicable laws and regulations, and informed by industry standards and industry-recognized practices for identifying and managing cybersecurity risks within our operations, infrastructure, and corporate resources.

companyName: Riley Exploration Permian, Inc.

ticker: REPX


text: Our cybersecurity program is built upon internationally recognized frameworks and maps to standards published by The National Institute of Standards and Technology ("NIST CSF"), which develops cybersecurity standards, guidelines, best practices and other resources to meet the needs of U.S. industry, federal agencies and the broader public. Utilizing monitoring technologies in conjunction with a well-established framework of policies, procedures and controls, our processes provide us with the structure to detect and respond to cyber threats, thereby mitigating the risk of potential cybersecurity issues. In addition, we conduct reoccurring security awareness training, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage material risks from cyber threats include the risks arising from threats associated with third party service providers, including cloud-based platforms.


text: We have developed a robust cyber incident response plan which provides a documented framework for handling high severity security incidents and facilitates coordination across a cross-disciplinary team of employees, legal counsel and third party service providers. Our information security team, which is part of our IT department, constantly monitors threat intelligence feeds, handles vulnerability management, responds to incidents and reports to the Information Security Coordinator. Upon detection of an event that meets certain assessment thresholds, the Information Security Coordinator reports such matters to the Incident Response Team, who then review the event and report to senior management, the cyber committee or our Board as appropriate. Cybersecurity events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.


text: Internally, we have developed a cybersecurity awareness program which includes training that reinforces our information technology and security policies, standards and practices, and we require that our employees comply with these policies. The cybersecurity awareness program offers training on how to identify potential cybersecurity risks and protect our resources and information. Finally, our privacy program requires all employees to take periodic awareness training on data privacy. This training includes information about confidentiality and security, as well as responding to unauthorized access to or use of information.


text: From time to time, we engage third-party service providers to enhance our risk mitigation efforts. For example, we have engaged a multifaceted cybersecurity advisory firm specializing in risk management and compliance, to perform annual cybersecurity risk assessments utilizing industry standard cybersecurity frameworks.


text: We also purchase insurance to protect us against the risk of cybersecurity breaches. Our Vice President of Finance and Treasurer is responsible for our insurance policies and reviews on a regular basis our cyber insurance policy with management to ensure we have appropriate coverage. We have business continuity, contingency and disaster recovery plans and procedures in place in the event of a cybersecurity incident. These plans are tested in conjunction with the Company's annual testing of its cybersecurity incident response readiness and reporting through tabletop exercises.


text: Role of our Board of Directors The Nominating and Corporate Governance Committee of the Board of Directors is primarily responsible for the oversight of our information security programs and cybersecurity incident response plans. We established a cyber subcommittee comprised of our senior management team that reports directly to the Board and its Committees regarding our cyber risks and threats, the status of initiatives strengthen our information security systems, assessments of our cybersecurity program and incident response plan, and our views of the emerging threat landscape. Our Executive Vice President – Business Intelligence and our head of Internal Audit report directly to the Nominating and Corporate Governance Committee as well as the Audit Committee regarding these matters and are responsible for reporting to the Committees on our company-wide enterprise risk assessment, and that assessment also includes an evaluation of cyber risks and threats. The Chair of the Nominating and Corporate Governance Committee regularly reports to the Board of Director on cybersecurity risks and other matters reviewed by the Nominating and Corporate Governance Committee in conjunction with the management team. All materials or presentations on cybersecurity provided to the Nominating and Corporate Governance Committee are provided to all Board members.


text: As a matter of process, the Nominating and Corporate Governance Committee annually reviews, and recommends to the Board of Directors its approval of, our information security policy and cybersecurity program and our incident response plans. Furthermore, on an annual basis, the Board of Directors and its Committees review and discuss our technology strategy with our Executive Vice President – Business Intelligence and approve our technology strategic plan.


text: Role of our Management Team Our Executive Vice President - Business Intelligence is responsible for the day-to-day management of our cybersecurity risks and for recommending the strategies and technologies used by the organization to collect, integrate and analyze business information to support the organization's strategic decisions. He is supported by a cross-disciplinary team from the Company's accounting, legal and risk oversight functions and its internal audit group. This incident response team meets quarterly and as needed to review the Company's cybersecurity risk management initiatives and progress and cybersecurity metrics. On an annual basis, the incident response team coordinates a cybersecurity risk assessment. In the event of a suspected cybersecurity incident, the team will coordinate the Company's evaluation, subsequent response and any updates to the cybersecurity risk management program with executive management and the cyber subcommittee.


text: We have a security incident response framework in place. We use this incident response framework as part of the process we employ to keep our management and Board of Directors informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The framework is a set of coordinated procedures and tasks that our incident response team, under the direction of the Information Security Officers, executes with the goal of ensuring timely and accurate resolution of cybersecurity incidents. Our cybersecurity framework includes regular compliance assessments with our policies and standards and applicable state and federal statutes and regulations. In addition, we validate compliance with our internal data security controls through the use of security monitoring utilities and internal and external audits.


text: Our Information Security Coordinator, members of our incident response team and our third party consultants each have extensive experience in the information technology area. The Executive Vice President of Business Intelligence has over 10 years of experience in the information technology area and holds a Master of Business Administration with a focus in Technology from Oklahoma Christian University. Additionally, our Vice President of Technology and Analytics has 10 years of professional experience in the information security area.


text: Additionally, our management team's internal cybersecurity risk management and strategy processes are supported with third party consultants with extensive work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Board of Directors, Nominating and Corporate Governance Committee and Audit Committee, as the case may be, on any appropriate items.


text: Cybersecurity Risk Management and Strategy Riley Permian recognizes the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as is defined in Item 106 (a) of Regulation S-K. These risks include, among other things: operational risks, harm to our employees, suppliers or industry partners, intellectual property theft, fraud, extortion, and violation of data privacy or security laws. We use a risk management framework based on applicable laws and regulations and informed by industry standards and industry-recognized practices for identifying and managing cybersecurity risks within our operations, infrastructure and corporate resources.


text: We also purchase insurance to protect us against the risk of cybersecurity breaches. Our Vice President of Finance and Treasurer is responsible for our insurance policies and reviews on a regular basis our cyber insurance policy with management to ensure we have appropriate coverage. We have business continuity, contingency and disaster recovery plans and procedures in place in the event of a cybersecurity incident. These plans are tested in conjunction with the Company's annual testing of our cybersecurity incident response readiness and reporting through tabletop exercises.


text: Cybersecurity Governance - Role of our Board of Directors The Nominating and Corporate Governance Committee of the Board of Directors is primarily responsible for the oversight of our information security programs and cybersecurity incident response plans. We established a cyber subcommittee comprised of our senior management team that reports directly to the Board and its Committees regarding our cyber risks and threats, the status of initiatives strengthens our information security systems, assessments of our cybersecurity program and incident response plan, and our views of the emerging threat landscape. Our Chief Information and Compliance Officer and our head of Internal Audit report directly to the Nominating and Corporate Governance Committee as well as the Audit Committee regarding these matters and are responsible for reporting to the Committees on our company-wide enterprise risk assessment, and that assessment also includes an evaluation of cyber risks and threats. The Chair of the Nominating and Corporate Governance Committee regularly reports to the Board of Director on cybersecurity risks and other matters reviewed by the Nominating and Corporate Governance Committee in conjunction with the management team. All materials or presentations on cybersecurity provided to the Nominating and Corporate Governance Committee are provided to all Board members.


text: As a matter of process, the Nominating and Corporate Governance Committee annually reviews, and recommends to the Board of Directors its approval of, our information security policy and cybersecurity program and our incident response plans. Furthermore, on an annual basis, the Board of Directors and its Committees review and discuss our technology strategy with our Chief Information and Compliance Officer and approve our technology strategic plan.


text: Cybersecurity Governance - Role of our Management Team Our Chief Information and Compliance Officer is responsible for the day-to-day management of our cybersecurity risks and for recommending the strategies and technologies used by the organization to collect, integrate and analyze business information to support the organization's strategic decisions. He is supported by a cross-disciplinary team from the Company's accounting, legal and risk oversight functions and our internal audit group. This incident response team meets quarterly and as needed to review the Company's cybersecurity risk management initiatives and progress and cybersecurity metrics. On an annual basis, the incident response team coordinates a cybersecurity risk assessment. In the event of a suspected cybersecurity incident, the team will coordinate the Company's evaluation, subsequent response and any updates to the cybersecurity risk management program with executive management and the cyber subcommittee.


text: Our Information Security Coordinator, members of our incident response team and our third party consultants each have extensive experience in the information technology area. The Chief Information and Compliance Officer has over 11 years of experience in the information technology area and holds a Master of Business Administration with a focus in Technology from Oklahoma Christian University. Additionally, our Vice President of Technology and Analytics has 11 years of professional experience in the information security area.


text: Risk Management and Strategy As a leader in Information Management and cybersecurity we recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. At OpenText, cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program aligns with industry best practices such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, and the International Organization for Standardization (ISO)/International Electro-technical Commission (IEC) ISO/IEC 27001 standard. This provides a framework for identifying, monitoring, evaluating, and responding to cybersecurity threats and incidents, including those associated with the use of our software, applications, services, and cloud and hybrid infrastructures developed or provided by third-party vendors and service providers. Our framework includes steps for identifying the source of a cybersecurity threat or incident, assessing the severity and risk of a cybersecurity threat or incident, implementing cybersecurity mitigation or remediation strategies, and informing our management and our Board of material cybersecurity threats and incidents.

companyName: OPEN TEXT CORP

ticker: OTEX


text: OpenText has a cross-functional incident response team, led by our cybersecurity team and comprised of representatives from our information technology, cybersecurity, finance, and legal teams. The cybersecurity team primarily is responsible for the monitoring and assessment of potential cybersecurity occurrences such as data breaches, intrusions, and other security incidents and implementing our detailed incident response plan. Our incident response plan includes processes and procedures for assessing potential internal and external threats, activation and notification, crisis management, and post-incident recovery designed to safeguard the confidentiality, availability, and integrity of the Company and our customers information assets.


text: Our cybersecurity team is responsible for assessing our cybersecurity risk management program and our incident response plan. We have devoted significant financial and personnel resources to implement security measures to meet regulatory requirements and customer expectations, and we intend to continue to make investments to maintain the security of the Company and its customers data and information management infrastructure. We have also implemented a review process to assess the security profile and data protection practices of third-party service providers that have exposure to our systems. We review and update our cybersecurity policies, standards and procedures annually, or more frequently as needed, to account for changes in the threat landscape, as well as in response to legal and regulatory developments. Our internal audit department has a team responsible for IT and information security (including cybersecurity) audits. We also engage third-party cybersecurity consultants to conduct additional audits of our cybersecurity processes, provide assessments of our risk management programs and identify potential cybersecurity vulnerabilities. Our cybersecurity efforts also include mandatory training for all employees and contractors on OpenText's security and privacy policies as well as other ancillary trainings on topics such as phishing emails and other social engineering tactics.


text: In Fiscal 2024, we did not identify any cybersecurity threats or incidents or risks of such incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see "Risk Factors—Risks Related to our Business and Industry" in this Annual Report on Form 10-K.


text: Our Board of Directors is responsible for monitoring and assessing the Company's cybersecurity risk management as part of its overall responsibility of risk oversight. The Board's Audit Committee is responsible for overseeing risks related to our accounting, financial statements and financial reporting process, including the Company's cybersecurity incident materiality assessment and relevant disclosures. For more information, see Part III, Item 11, "Board's Role in Risk Oversight."


text: Our Chief Information Security Officer (CISO) is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes in an effort to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Our CISO is responsible for providing a single consolidated view of the Company's enterprise cybersecurity risk in various industries. OpenText's CISO reports to the Chief Digital Officer (CDO) who is responsible for OpenText's broader IT program, which includes the Company's ability to remediate and recover from a cybersecurity incident while minimizing impacts to the business and operations. Management, including the CDO, updates the Audit Committee and the Board of Directors on the Company's cybersecurity programs, material cybersecurity risks, and mitigation or remediation strategies as needed or appropriate.


text: Risk Management and Strategy As a leader in Information Management and cybersecurity we recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. At OpenText, cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program aligns with industry best practices such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0, and the International Organization for Standardization (ISO)/International Electro-technical Commission (IEC) ISO/IEC 27001 standard. This provides a framework for identifying, monitoring, evaluating, and responding to cybersecurity threats and incidents, including those associated with the use of our software, applications, services, and cloud and hybrid infrastructures developed or provided by third-party vendors and service providers. Our framework includes steps for identifying the source of a cybersecurity threat or incident, assessing the severity and risk of a cybersecurity threat or incident, implementing cybersecurity mitigation or remediation strategies, and informing our management and our Board of material cybersecurity threats and incidents.


text: In Fiscal 2025, we did not identify any cybersecurity threats or incidents or risks of such incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see "Risk Factors—Risks Related to our Business and Industry" in this Annual Report on Form 10-K.


text: Our current Chief Information Security Officer (CISO) has over 20 years of experience architecting and directing global information security functions and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties. Our CISO is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes in an effort to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Our CISO receives ongoing communication from relevant teams related to cybersecurity and is responsible for providing a single consolidated view of the Company's enterprise cybersecurity risk in various industries. OpenText's CISO reports to the Chief Digital Officer (CDO) who is responsible for OpenText's broader IT program, which includes the Company's ability to remediate and recover from a cybersecurity incident while minimizing impacts to the business and operations. Management, including the CDO, updates the Audit Committee and the Board of Directors on the Company's cybersecurity programs, material cybersecurity risks, and mitigation or remediation strategies as needed or appropriate.


text: The Ameren Companies have identified cybersecurity as an enterprise risk, which is managed through Ameren's integrated enterprise risk management program. The program is designed to continuously assess risk and evaluate the likelihood and probability of impact in order to determine the appropriate risk tolerance and risk management strategies that inform our cybersecurity policies, investments, practices, controls, and countermeasures. The program is a comprehensive, consistently applied management framework that is designed to ensure all forms of material risk and opportunity are identified, reported and managed in an effective manner overseen by the risk management steering committee. The risk management steering committee, which is composed of senior-level Ameren officers, with Ameren board of directors' oversight, oversees Ameren's enterprise risk management processes, which include the identification, assessment, mitigation, and monitoring of risks including strategic, operational, and cybersecurity risks.

companyName: AMEREN CORP

ticker: AEE


text: Ameren's board of directors maintains a standing committee, the Cybersecurity and Digital Technology Committee, that is dedicated to the oversight of Ameren's cybersecurity and digital technology risks. The committee has primary responsibility for oversight of cybersecurity and digital technology risk management, including the programs, policies, practices, controls and safeguards for digital technology, information security, prevention and detection of cybersecurity incidents and information or data breaches, and cybersecurity and digital technology matters as they relate to crisis preparedness, incident response plans, and disaster recovery and business continuity capabilities. The committee receives regular updates from the Chief Customer and Technology Officer, the Chief Information Officer, the Chief Information Security Officer, and other members of senior management regarding Ameren's cybersecurity program and key initiatives. The Cybersecurity and Digital Technology Committee regularly reports on its activities to Ameren's board of directors, including reviewing and advising Ameren's board of directors of any developments it believes should be considered.


text: Ameren's cybersecurity program and team are led by the Chief Information Security Officer, who possesses 25 years of critical infrastructure experience both managing and protecting information systems in concert with extensive cybersecurity operations and leadership roles. The Chief Information Security Officer regularly engages with senior-level Ameren officers, reports to the risk management steering committee, and has recurring meetings with the Cybersecurity and Digital Technology Committee as part of ongoing risk management and oversight of the cybersecurity program. Ameren's board of directors is also regularly updated on its cybersecurity program. In addition, the board of directors participate in periodic cybersecurity drills to prepare for potential crisis scenarios.


text: To manage against existing conduct and new cybersecurity threats, we maintain enterprise-wide cybersecurity, crisis management, and information security policies and regular training and tests that reinforce the acceptable use of Ameren's information assets, protection of customer and employee data, and the role each employee plays in protecting Ameren against cybersecurity threats. Incident response plans and procedures are tested through recurring companywide cybersecurity exercises to promote readiness across the organization. The procedures are also designed to escalate incidents to appropriate members of management to guide the detection, response, and recovery from a material cybersecurity incident. To address cybersecurity threats, cybersecurity intelligence, as well as responding to cyber-related incidents, we work closely with law enforcement, cybersecurity consulting firms, and industry associations to enhance information sharing and guard against cybersecurity attacks.


text: We measure our cybersecurity effectiveness through formal cybersecurity scorecards and metrics reported to senior-level Ameren officers, the risk management steering committee, and the Cybersecurity and Digital Technology Committee. These metrics include but are not limited to measures around the effectiveness of our cybersecurity controls, our ability to manage cybersecurity events and incidents, cybersecurity incident response exercises, and results of our recurring internal assessments, external assessments, and audits that Ameren regularly undergoes. Ameren regularly engages external cybersecurity experts to assist with evaluating our cybersecurity program. These engagements provide insights into control performance, prioritized recommendations for enhancements to our cybersecurity strategy, and an overview of the cybersecurity threat landscape that collectively inform our investments and technical controls to protect Ameren's most critical assets. The results of these engagements are reviewed with senior-level Ameren officers and the Cybersecurity and Digital Technology Committee.


text: Ameren also deploys a third-party cybersecurity risk management program, which extends the governance elements described above to our third-party providers and suppliers. The supply chain and third-party risks introduced to Ameren are evaluated prior to the commencement of any new engagement or relationship, monitored closely throughout the lifecycle of the supplier and managed through privacy and cybersecurity provisions within the respective commercial contracts. Procedures have been established to address supplier incidents as well as supplier off-boarding at the expiration of the relationship.


text: We are not aware of any cybersecurity events that have materially affected or are reasonably likely to materially affect Ameren, including our business strategy, results of operations, financial position, or liquidity.


text: The Ameren Companies have identified cybersecurity as an enterprise risk, which is managed through Ameren's integrated enterprise risk management program. The program is designed to continuously assess risk and evaluate the likelihood and probability of impact to determine the appropriate risk tolerance and risk management strategies that inform our cybersecurity policies, investments, practices, controls, and countermeasures. The program is a comprehensive, consistently applied management framework that is designed to ensure all forms of material risk and opportunity are identified, reported, and managed in an effective manner overseen by the risk management steering committee. The risk management steering committee, which is composed of executive management and senior-level Ameren officers, with Ameren board of directors' oversight, oversees and governs Ameren's enterprise risk management processes, which include the identification, assessment, mitigation, and monitoring of risks including strategic, operational, and cybersecurity risks.


text: Ameren's board of directors maintains a standing committee, the Cybersecurity and Digital Technology Committee, which is focused on the oversight of Ameren's cybersecurity and digital technology risks. The committee has primary responsibility for oversight of cybersecurity and digital technology risk management, including the programs, policies, procedures, processes, controls and safeguards for digital technology, information security, prevention and detection of cybersecurity incidents or data breaches, and cybersecurity and digital technology matters as they relate to crisis preparedness, incident response plans, and disaster recovery and business continuity capabilities. The committee receives regular updates from the Chief Information Security Officer, the Chief Information Officer, executive management, and other members of senior management who collectively maintain the responsibility for both the execution and ongoing management of Ameren's cybersecurity program and respective initiatives. The Cybersecurity and Digital Technology Committee regularly reports on its activities to Ameren's board of directors, including reviewing and advising Ameren's board of directors of any developments it believes should be considered.


text: Ameren's cybersecurity program and team are led by the Chief Information Security Officer, who possesses over 25 years of critical infrastructure experience both managing and protecting information systems in concert with extensive cybersecurity operations and leadership roles. The Chief Information Security Officer regularly engages with senior-level Ameren officers, reports to the risk management steering committee, and has recurring meetings with the Cybersecurity and Digital Technology Committee as part of ongoing risk management and oversight of the cybersecurity program. In addition, Ameren's board of directors participate in periodic cybersecurity drills to prepare for potential crisis scenarios.


text: To manage against existing and emerging cybersecurity threats, we maintain enterprise-wide cybersecurity, crisis management, and information security policies and regular training and tests that reinforce the acceptable use of Ameren's information assets, protection of customer and employee data, and the role each employee plays in protecting Ameren against cybersecurity threats. Incident response plans and procedures are continuously tested through recurring companywide cybersecurity exercises to promote readiness across the organization. The plans and procedures are also designed to escalate incidents to appropriate members of management to guide the prevention, detection, response, recovery, and remediation from a material cybersecurity incident. These cybersecurity plans and procedures are positioned to promote the expedient identification, escalation, handling and reporting of a potentially material cybersecurity event or incident. To address cybersecurity threats, we work closely with law enforcement, cybersecurity consulting firms, and industry associations to enhance information sharing and guard against cybersecurity attacks.


text: Ameren employs a third-party cybersecurity risk management program, which extends the governance elements of Ameren's cybersecurity program, in addition to other diligence measures, to our critical third-party providers and suppliers. The supply chain and third-party risks introduced to Ameren are evaluated prior to the commencement of any new engagement or relationship, monitored closely throughout the lifecycle of the supplier and managed through privacy and cybersecurity provisions within the respective commercial contracts. Procedures have been established to address supplier incidents as well as supplier off-boarding at the expiration of the relationship.


text: We leverage common and widely accepted external cybersecurity risk management frameworks, such as the National Institute of Standards and Technology Cybersecurity framework, to assess, guide, and enhance our cybersecurity posture. Our program effectiveness is measured through formal cybersecurity scorecards and metrics reported to senior-level Ameren officers, the risk management steering committee, and the Cybersecurity and Digital Technology Committee. These metrics include but are not limited to measures on the effectiveness of our cybersecurity controls across core National Institute of Standards and Technology Cybersecurity framework functions (Govern, Identify, Protect, Detect, Respond, and Recover), our ability to manage first- and third-party cybersecurity events and incidents, cybersecurity incident response exercises, results of our recurring internal assessments, vulnerability assessments, penetration tests, external assessments, and audits that Ameren regularly undergoes. Ameren regularly engages external cybersecurity experts to assist with evaluating our cybersecurity program. These engagements provide insights into control design and implementation, prioritized recommendations for enhancements to our cybersecurity strategy, and an overview of the cybersecurity threat landscape that collectively inform our investments and technical controls to protect Ameren's most critical assets. The results of these engagements are reviewed with senior-level Ameren officers, the risk management steering committee, and the Cybersecurity and Digital Technology Committee.


text: We have established controls for identifying, assessing and managing material risks from cybersecurity threats that could adversely affect our information systems or the information residing on those systems. These include a combination of policies, procedures, technologies and safe-guards (based on frameworks such as Cybersecurity Maturity Model Certification ("CMMC") and Payment Card Industry ("PCI") that are designed to prevent, detect, and mitigate data loss, theft, misuse, unauthorized access, and other security incidents or vulnerabilities affecting our systems and data, and to assess and evaluate the risk of such incidents and vulnerabilities. Additionally, we have processes in place designed to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including our cloud computing platforms.

companyName: MSC INDUSTRIAL DIRECT CO INC

ticker: MSM


text: As part of our risk management process, we conduct application security assessments, security audits, third-party penetration testing, vulnerability assessments and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected. Associates of the Company complete an annual cybersecurity training program in which specific threats and scenarios are highlighted based on the cyber risk management team's analysis of current cyber risks to the Company or as required by regulatory frameworks. Simulated phishing tests are conducted with associates on a regular basis to provide training and awareness against scams and fraudulent communications. Associates also receive ongoing communications regarding the importance of guarding against phishing, social engineering and other cyberattack vectors. In addition to our in-house cybersecurity capabilities, at times, we also engage consultants, auditors or other third parties to assist with assessing, identifying and managing cybersecurity risks. We maintain cybersecurity insurance and regularly review our policy and levels of coverage based on current risks.


text: Our cyber management team, led by our Vice President of Information Security, is tasked with implementing and maintaining centralized cybersecurity and data protection practices in close coordination with MSC's leadership team and other teams across the Company. Our Vice President of Information Security has extensive cybersecurity knowledge and skills gained from over 25 years of work experience across multiple verticals. Reporting to our Vice President of Information Security are a number of experienced information security professionals responsible for various parts of our business, including Architecture and Engineering, Identity and Access Management, Security Operations, and Governance, Risk and Compliance programs, each of which is supported by a team of trained cybersecurity professionals.


text: The Audit Committee of our Board of Directors (the "Audit Committee") oversees our financial and risk management policies, including risk management policies and programs related to cybersecurity designed to monitor, mitigate and respond to cyber risks, threats, and reports. The Audit Committee receives regular reports from the Vice President of Information Security on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's cybersecurity program and the emerging cyber threat landscape. Additionally, the Audit Committee has engaged a consulting firm to serve in the role of a cybersecurity advisor to the Audit Committee. In fulfilling this role, the consultant will engage with the Vice President of Information Security and other associates of the Company to evaluate the Company's cybersecurity maturity and advise the Audit Committee on cybersecurity gaps, best practices and industry trends on an ongoing basis.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that we will not be materially affected in the future by such risks or future cybersecurity incidents. For more information on our cybersecurity related risks, see Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that we will not be materially affected in the future by such risks or future cybersecurity incidents. For more information on our cybersecurity related risks, see Part I, Item 1A. "Risk Factors" of this Report.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, processes, and practices. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: AFFILIATED MANAGERS GROUP, INC.

ticker: AMG


text: We recognize the importance of protecting information assets such as the personally identifiable information of our employees, and proprietary business information regarding our Affiliates and their clients, and have adopted policies, management oversight, accountability structures, and technology processes designed to safeguard this information. All of our employees are required to attest annually to our information security policies and participate in regular security awareness training to protect their information and the AMG data and systems to which they have access. These trainings also instruct employees on how to report any potential privacy or data security issues.


text: Our information security organization comprises internal and external resources designed to identify, protect, detect, mitigate, resolve, and recover from various threats and attacks by malicious actors. We leverage 24x7x365 monitoring tools and services to address the confidentiality, integrity, and availability of AMG assets and data. Regular internal and third-party reviews are performed on our processes and technologies to validate the effectiveness of our privacy and data security controls and safeguards. We monitor industry best practices and developments in data privacy and security, including increased scrutiny of third-party service providers with access to sensitive AMG data. We also have our own fully documented proprietary security incident response plan, with defined roles and responsibilities that address notification obligations and incident response procedures in the event of a data security breach. We are dedicated to business continuity and resiliency, and have documented strategies, policies, and procedures in place to protect employee, business, Affiliate, and Affiliate client data in the event of an emergency or natural disaster.


text: Although we provide our Affiliates with operational autonomy in managing their businesses and may have limited involvement in the design, oversight, and maintenance of their respective technology systems and networks, we offer ongoing cybersecurity support to Affiliates through our information security program, including with respect to conducting Affiliate program assessments and assisting, as appropriate and practicable, in their identification of, and response to, an actual or suspected cybersecurity incident. Additionally, prior to any investment in a new Affiliate, we conduct a diligence review of its information security program.


text: We work with third-party service providers to proactively assess our information security program and provide us with an industry view of the cyberthreat landscape, in addition to monitoring and supporting our control environment and breach notification and response processes.


text: As of the date of this Annual Report on Form 10-K, cybersecurity threats have not materially affected and we believe are not reasonably likely to materially affect AMG, including our business strategy, results of operations, or financial condition. Refer to the risk factor captioned "Failure to maintain and properly safeguard an adequate technology infrastructure may limit our or our Affiliates' growth, result in losses or disrupt our or our Affiliates' businesses" in Part I, Item 1A. "Risk Factors" for more information regarding cybersecurity risks and potential related impacts on AMG.


text: We have a formal information security program, designed to develop and maintain privacy and data security practices to protect AMG assets and sensitive third-party information, including personal and Affiliate information. This program is governed by a committee comprising members of senior management, including our Chief Information Officer ("CIO"), which meets regularly and reports to the Board of Directors at least annually (the "Information Security Governance Committee"). Members of the Information Security Governance Committee oversee communications with the Board of Directors regarding material cybersecurity incidents and provide the Board with a summary of risks from current cybersecurity threats on a regular basis, as well as updates on management's information security program oversight and maintenance activities, and any material changes to AMG's information security practices and procedures. The Board of Directors is also regularly provided with cybersecurity educational sessions, including perspectives from external advisors that are invited to present on current cybersecurity topics.


text: We take a risk-based approach to cybersecurity and have implemented policies throughout our operations that are designed to address cybersecurity threats and our response to actual or suspected incidents. In particular, the Information Security Governance Committee is responsible for the ongoing identification and assessment of reasonably foreseeable cybersecurity threats and based on these assessments, evaluating and overseeing the implementation of safeguards for limiting such risks, including employee training and compliance, and detection and prevention mechanisms. If a cybersecurity incident occurs, the Information Security Governance Committee will assemble an incident response team responsible for the identification, remediation, and post-incident review of such incident, engage outside advisors and notify third parties as appropriate, and assess the materiality of the nature, scope, and timing of a given incident and whether public disclosure is required.


text: The CIO, in coordination with the Information Security Governance Committee, is responsible for leading the assessment and management of cybersecurity risks. The current CIO has over 25 years of experience in information security. The CIO reports to the Board of Directors as part of the Information Security Governance Committee's updates discussed above and regularly communicates with the other members of the Information Security Governance Committee and senior management regarding cybersecurity risks.


text: Risk Management and Strategy Our cybersecurity risk management program is integrated into our overall risk management framework. We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, processes, and practices. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.


text: Our information security organization comprises internal and external resources designed to identify, protect, detect, mitigate, resolve, and recover from various threats and attacks by malicious actors. We leverage 24x7x365 monitoring tools and services to address the confidentiality, integrity, and availability of AMG assets and data. Regular internal and third-party reviews are performed on our processes and technologies to validate the effectiveness of our privacy and data security controls and safeguards. We monitor industry best practices and developments in data privacy and security and have increased scrutiny of third-party service providers with access to sensitive AMG data, including through security risk assessments at the time of initial contract, periodically as part of our third-party risk management process, and upon detection of an increase in the vendor's risk profile. In addition, we require key providers to meet appropriate security requirements and controls, and we investigate security incidents that have impacted our third-party providers, as appropriate. We also have our own fully documented proprietary security incident response plan, with defined roles and responsibilities that address notification obligations and incident response procedures in the event of a data security breach. We are dedicated to business continuity and resiliency, and have documented strategies, policies, and procedures in place designed to protect employee, business, Affiliate, and Affiliate client data in the event of an emergency or natural disaster.


text: Although we provide our Affiliates with operational autonomy in managing their businesses and may have limited involvement in the design, oversight, and maintenance of their respective technology systems and networks, we offer cybersecurity support to Affiliates through our information security program, including with respect to conducting Affiliate program assessments and assisting, as appropriate and practicable, in their identification of, and response to, an actual or suspected cybersecurity incident. Additionally, prior to any investment in a new Affiliate, we conduct a diligence review of its information security program.


text: As of the date of this Annual Report on Form 10-K, cybersecurity threats have not materially affected and we believe are not reasonably likely to materially affect AMG, including our business strategy, results of operations, or financial condition.


text: Refer to the risk factor captioned "Failure to maintain and properly safeguard an adequate technology infrastructure may limit our or our Affiliates' growth, result in losses or disrupt our or our Affiliates' businesses" in Part I, Item 1A. "Risk Factors" for more information regarding cybersecurity risks and potential related impacts on AMG.


text: We have a formal information security program, designed to develop and maintain privacy and data security practices to protect AMG assets and sensitive third-party information, including personal and Affiliate information. This program is governed by a committee comprising members of senior management, including our Chief Information Officer ("CIO"), which meets regularly and reports to the Board of Directors at least annually (the "Information Security Governance Committee").


text: Members of the Information Security Governance Committee oversee communications with the Board of Directors regarding material cybersecurity incidents and provide the Board with a summary of risks from current cybersecurity threats on a regular basis, as well as updates on management's information security program oversight and maintenance activities, and any material changes to AMG's information security practices and procedures. The Board of Directors is also regularly provided with cybersecurity educational sessions, including perspectives from external advisors that are invited to present on current cybersecurity topics.


text: The CIO, in coordination with the Information Security Governance Committee, is responsible for leading the assessment and management of cybersecurity risks. The current CIO has over 25 years of experience in information security, including serving as our CIO since 2016, and holds a B.A. in Business with a focus in Computer Science. The CIO reports to the Board of Directors as part of the Information Security Governance Committee's updates discussed above and regularly communicates with the other members of the Information Security Governance Committee and senior management regarding cybersecurity risks.


text: Cybersecurity Risk, Management and Strategy Cybersecurity is a significant and integrated component of the Company's risk management strategy, designed to protect the confidentiality, integrity, and availability of sensitive information contained within the Bank's information services. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident disrupting business operations, compromising sensitive data or both. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: OCEANFIRST FINANCIAL CORP

ticker: OCFC


text: To prepare and respond to incidents, the Company has implemented a multi-layered "defense-in-depth" cybersecurity strategy, integrating people, technology, and processes. This includes employee training, innovative technologies, and policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response.


text: Core activities supporting the Company's strategy include cybersecurity training, technology optimization, threat intelligence, vulnerability and patch management and the testing of incident response, business continuity and disaster recovery capabilities.


text: Employees play a significant role in the defense against cybersecurity threats. Every employee is responsible for protecting the Bank and client information. Accordingly, employees complete formal training and acknowledge security policies annually. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities.


text: Employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.


text: Like many other companies, the Company relies on third-party vendor solutions to support its operations; many of these vendors have access to sensitive and proprietary information. Third-party vendors continue to be a notable source of operational and informational risk. Accordingly, the Company has implemented a Third-Party Risk Management program, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive company data.


text: As indicated above, supporting the operations are incident response, business continuity, and disaster recovery programs. These programs identify and assess threats and evaluate risk. Further, these programs support a coordinated response when responding to incidents. Periodic exercises and tests verify these programs' effectiveness.


text: Validating solution and program effectiveness in relation to regulatory compliance and industry standards is important. Accordingly, the Company engages third-party consultants and independent auditors to conduct penetration tests, cybersecurity risk assessments, external audits, and program development and enhancement where applicable.


text: Management Committee Oversight The Company has established an Information Technology and Security Management Committee consisting of department leaders across multiple functional areas including Data Engineering, Enterprise Applications, Strategic Planning, Technology, and Cybersecurity. These functional areas are led by qualified financial service technology professionals, with extensive certifications and advanced degrees in cybersecurity. Cybersecurity knowledge is expanded across all areas of Information Technology and is foundational in the approach from planning to execution. The committee focuses on strategic and tactical delivery, policy oversight, and the assessment and management of material risks from cybersecurity threats. Policies are also shared with the management Risk Committee to provide a second line review in alignment with Enterprise Risk functions. All Information Security activity is led by the Chief Information Security Officer, which includes developing and implementing the information security program and reporting on cybersecurity matters to the Board. The Chief Information Security Officer has several years of experience leading cybersecurity operations in financial services, supported by a team with various security, technical, risk, audit and leadership certifications. Management provides cybersecurity statistics and details to the board monthly.


text: Board Committee Oversight The Company's Risk and IT Board Committees provide oversight of the cyber program. Each committee consists of Board members, chaired by an independent director. Committee members have extensive expertise in various disciplines, including risk management, communications, information technology, litigation, banking and transactional matters, regulatory compliance, and cybersecurity. Board Committees receive regular reports informing on the effectiveness of the overall cybersecurity program and the detection, response, and recovery from significant cyber incidents. Cybersecurity metrics are reported quarterly to both committees and Key Risk Indicators are reported to the Risk Committee.