text: Our cybersecurity program leverages both internal and external techniques and expertise across the cybersecurity spectrum. We maintain and utilize industry best practice capabilities, processes, and other security-related measures, based upon National Institute of Standards and Technology (NIST) and Control Objectives for Information Technologies (CoBIT) frameworks. Our capabilities, processes, and other security measures include, among others: • Threat detection through the use of security information and event management software; • Incident management processes for any security-related activity, requiring senior management signoff; • Corporate endpoint detection and response software, which monitors for malicious activities on external-facing endpoints; • Cloud monitoring tools, running on primary public and private cloud environments; • Data encryption at rest and during transit and immutable data backups; and • Business continuity, disaster recovery and incident response plans.

companyName: AMERICAS CARMART INC

ticker: CRMT


text: We also expect our suppliers and third party service providers to follow the same industry-standard security practices that we follow. Despite having thorough due diligence, onboarding, and cybersecurity assessment processes in place for our suppliers, the responsibility ultimately rests with our suppliers to establish and uphold their respective cybersecurity programs. The ability and availability of information to monitor the cybersecurity practices and controls of our suppliers and third party service providers is limited, and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in information systems, software, networks, and other assets owned or controlled by our suppliers and third party service providers. Although the Company attempts to manage its exposure to such events through the purchase of cyber liability insurance, such events are inherently unpredictable, and insurance may not be sufficient to protect the Company against all losses. There is no assurance that the Company's security systems or processes will prevent or mitigate future break-ins, tampering, security breaches or other cyber-related attacks.

secItem: Item 1C


text: Cybersecurity Governance Our Board of Directors oversees the management of risks inherent in the operation of our business, with a focus on the most significant risks that we face, including those related to cybersecurity. Our Board of Directors has delegated oversight of cybersecurity, including privacy and information security, as well as enterprise risk management to the Audit and Compliance Committee (the "Audit Committee"). In connection with that oversight responsibility, our Chief Technology Officer and Chief Legal Officer meet with the Audit Committee on a quarterly basis to provide information and updates on a range of cybersecurity topics which may include our cybersecurity program and governance processes; cyber risk monitoring and management; the status of projects to strengthen our cybersecurity and privacy capabilities; recent significant incidents or threats impacting our operations, industry, or third-party suppliers; and the emerging threat landscape.


text: Our information security team works closely with key stakeholders, including regulators, government agencies, peer institutions, industry groups, and develops and invests in talent and innovative technology to manage cybersecurity risk.


text: In the event that a cybersecurity threat or incident is identified, the Chief Technology Officer and the security team would work closely with cross functional committees, leveraging subject matter expertise across the organization, as part of our incident response plans and promptly provide information to senior management, with the goal of timely assessing such incidents, determining applicable disclosure requirements and communicating with the Chair of the Audit Committee regarding any significant cybersecurity incidents, including those experienced by third party service providers, which may pose significant risk to our business, customers, clients, associates and stakeholders, and continues to provide regular reports until such incidents are concluded. The above framework is designed to track and allow team members to monitor each incident throughout its lifecycle to ensure the Company is informed about and following cybersecurity incidents as they are mitigated and remediated. Post-incident reviews would also be performed to determine if there are any additional controls that may feasibly be implemented to prevent recurrence.


text: The Audit Committee of our Board of Directors oversees cybersecurity risk and receives regular updates from our Vice President and Chief Security and Privacy Officer on these risks, risk management activities, incident response plans, best practices, the effectiveness of our security measures, and other related matters. Our Vice President and Chief Security and Privacy Officer, who reports to our Chief Technology Officer, leads our central security and privacy team, which works in partnership with each of our businesses and the corporate center to measure security maturity and risk and provides managed security services in a way that allows each business to address their unique challenges and become more efficient in using their resources. We have processes and policies for the escalation of cybersecurity incidents to the central security team, evaluation of the materiality of the incidents, and coordination of our response as needed across businesses and operations. Our Chief Security and Privacy Officer has more than 20 years of privacy and data security experience, including a series of roles in Cimpress over the last 15 years, the last three and a half years of which have been spent leading the central security and privacy team.

companyName: CIMPRESS plc

ticker: CMPR


text: Risk Management and Strategy Cybersecurity risk management is an important part of and is integrated into our overall enterprise risk management framework, with cybersecurity risks being among the core enterprise risks identified for oversight by our Board of Directors (the "Board") through our annual enterprise risk assessment. We maintain an enterprise-wide cybersecurity risk assessment program and framework that is designed to identify, assess, and manage cybersecurity risk, vulnerabilities, and threats. The foundation of our cybersecurity program is based on the International Organization for Standardization ("ISO") and the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. In alignment with the concepts and principles articulated in these standards, we have implemented controls related to cybersecurity threats and incidents including monitoring, log collection and analysis, threat hunting and intelligence surveillance, and regular vulnerability scans/penetration tests. Additionally, in furtherance of assessing, identifying, and managing material cybersecurity risks, we: • Leverage technology solutions designed to provide protection for our assets and detect threats in our environment; • Regular vulnerability assessments and penetration testing in efforts to identify, assess, and remediate weaknesses; • Maintain an enterprise-wide disaster recovery governance program, which includes cybersecurity-related disaster recovery policies and procedures related thereto; • Regularly perform cybersecurity-related disaster recovery testing designed to ensure that the Company's mission-critical systems are recoverable, in support of our business continuity needs; and • Work with each of our business and corporate groups with our internal cybersecurity program to integrate cybersecurity requirements into operating environments as appropriate, which drives business strategies, budgeting, and similar processes. In addition, executive management, as well as our Board, regularly review our financial planning processes for these areas, inclusive of our cybersecurity programs.

companyName: Lumentum Holdings Inc.

ticker: LITE


text: Changes or additions to our cybersecurity risk assessment program and related practices and procedures described above in response to cybersecurity needs are reviewed by our Cybersecurity Steering Committee ("CSC"), an executive management-level cross-functional group.


text: We regularly engage independent third parties to assess our cybersecurity program and practices and to assist with risk mitigation. The effectiveness of our cybersecurity environment is regularly tested by internal personnel and these third parties. These assessments are performed in conformance with ISO standards and requirements. Enhancements to our cybersecurity program and practices are identified from assessment findings, and if deemed appropriate, implemented.


text: In addition, we evaluate critical systems and applications hosted by third parties for cybersecurity risks and we also assess the security posture and features of those services. This includes review and monitoring of the third party, and inclusion of cybersecurity requirements in contractual agreements to help ensure third party services meet our standards for such providers and that the cybersecurity risks associated with the use of these services are appropriate.


text: For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors - Any failure, disruption or security breach or incident of or impacting our information technology infrastructure or information management systems could have an adverse impact on our business and operations." We believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. However, we can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.


text: Our cybersecurity program is led by our CISO, who manages a team of cybersecurity professionals. Our CISO has over 20 years of experience in cybersecurity and technology, including as a CISO at another public company. Members of our cybersecurity team, combined, have over 80 years of cybersecurity experience and members of the team hold various professional certifications, including Certified Information Systems Security Professional ("CISSP").


text: As noted above, we also maintain a CSC, which consists of our Group Vice President, IT and CISO, Executive Vice President, Chief Financial Officer, Senior Vice President, Chief Human Resources Officer, Senior Vice President, General Counsel, Executive Vice President, Global Operations, Senior Vice President, Chief Accounting Officer, and Vice President, Internal Audit. The CSC has the primary day to day responsibility to monitor and manage cybersecurity risks. The CSC provides oversight of cybersecurity initiatives within Lumentum and is responsible for integrating cybersecurity risk management practices with critical business processes to help ensure that cybersecurity is appropriately addressed throughout Lumentum.


text: Risk Management and Strategy We recognize the importance of managing cybersecurity threats and risks related to our business, and we have adopted a multi-faceted and proactive strategy to identify, evaluate, address, respond and neutralize cybersecurity threats and attacks. We employ a combination of technical solutions, security policies and procedures, employee training programs, and regular security audits to enhance and fortify our defenses. We utilize advanced monitoring tools and anomaly detection systems to swiftly identify any suspicious activities or deviations from normal operation. Our security infrastructure includes firewalls, intrusion detection systems, encryption protocols, and access controls to protect our systems and data from unauthorized access or malicious attacks. In the event a cybersecurity incident is detected, we have established incident response procedures to contain the threat, minimize the impact, and restore normal operations as quickly as possible. We also conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect our information systems that are vulnerable to such cybersecurity threats. We believe that our cybersecurity risk management process has been and continues to be an integral part of our overall risk management process of the Company as our cybersecurity team collaborates closely with our information technology team, senior management, Audit Committee and Cybersecurity Subcommittee, and internal audit team to address any such threats and incidents.

companyName: ALPHA & OMEGA SEMICONDUCTOR Ltd

ticker: AOSL


text: We are not aware of any risks from cybersecurity threats that have materially affected our business strategy, results of operations or financial condition or are reasonably likely to have a material effect. However, cyber-attacks are increasing in frequency, sophistication and intensity, and despite our ongoing efforts we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. Please refer to "Risk Factors" in Part I, Item 1A of this Form 10-K for more information on the risks posed to us by cybersecurity threats.


text: Our senior management team, including our cybersecurity team, are responsible for day-to-day implementation, assessment, and management of our cybersecurity risk management processes. Our cybersecurity team includes Vice President of Information Technology and Information Security Officer with a team of eight full-time information technology professionals and several outside security vendors to manage our information security program. When a cybersecurity incident is identified, our computer incident response team will notify the Information Security Officer immediately, and upon assessment of the nature and severity of the incident, internal and external parties may be further notified to determine the appropriate response strategy, and written preliminary and final reports will be submitted to management. Our Vice President of Information Technology and Information Security Officer have served in various roles in information technology and information security, and together they have over 55 years of experience in this field. Our Information Security Officer is a certified information systems security professional (CISSP). The cybersecurity team has primary responsibility for our overall cybersecurity risk management program, including monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents, and works in partnership with senior management team, including our Chief Executive Officer and Chief Financial Officer, as well as our Board of Directors.


text: Our program is designed to guide our practices which are based on relevant industry frameworks and laws. This program consists of policies and procedures designed to manage material risks from cybersecurity threats, including training requirements, threat monitoring and detection and threat containment and risk assessments. Additionally, we leverage third-party firms to conduct routine external and internal penetration testing to emulate the common tactics and techniques of cyber threat actors and have processes to address identified vulnerabilities, although it may take time to mitigate or manage such vulnerabilities. The results of this testing are included in the Company's SOC report. Further, we also carry cyber security insurance, which is renewed annually and covers cyber events and business interruption. We closely monitor costs of breaches within the industry in an effort to ensure that our coverage is sufficient to address all reasonably foreseeable threats and levels of risk.

companyName: CANTALOUPE, INC.

ticker: CTLP


text: We have an Incident Management Policy ("IMP") and Incident Response Plan ("IRP") which helps enable us to quickly detect, respond to, and recover from third-party malicious attacks and potential security incidents. This plan includes formal steps to review incidents and implement improvements, including steps to involve the CISO and CTO as appropriate.


text: Our Information Security Program is overseen by our Chief Information Security Officer ("CISO"), who reports to our Chief Technology Officer ("CTO"). Our CISO oversees the third-party consultants who help assess our security controls and penetration testing previously described. The CTO provides oversight, leadership and direction for data risks, technology risks and information security risks. Our CISO leads the Cybersecurity organization and has the overall responsibility of implementing its strategy and objectives to build a strong cyber engineering function.


text: Our CISO has over 20 years of information technology experience with specialization in information security and risk management. Our CISO has industry recognized certifications including Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Payment Card Industry Professional (PCI ISA & PCIP). Our CISO has worked in various information security roles at other large publicly traded companies.


text: With the guidance of the Audit & Risk Management Committee (the "Committee"), our board of directors is responsible for our risk management framework, including our strategy, policies, procedures and systems with respect to cybersecurity and information technology risks associated with us and our supply chain, suppliers and service providers. Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Committee oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.

companyName: Tamboran Resources Corp

ticker: TBN


text: Our management team, including our Vice President of Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats, and takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment. Our management team has developed and implemented a risk management program that includes cybersecurity risks as a risk category and is intended to protect the confidentiality, integrity, and availability of our critical systems and information. Management has primary responsibility for our overall cybersecurity risk management program and supervising internal staff and external consultants assisting with cybersecurity matters, including those that assist management in staying informed about cybersecurity risks and incidents. Management updates the Committee periodically on our cyber risk management program, and the Committee reports to the full board of directors regarding its activities, including those related to cybersecurity.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas. Key elements of our risk management program relating to cybersecurity include: implementing risk assessments designed to help identify material risks, including risks arising from cybersecurity threats to our critical systems and information; engaging external cybersecurity consultants to assess and assist with aspects of our security processes; maintaining insurance coverage related to cybersecurity matters; and review of risks related to any new third-party IT providers based on our assessment of their criticality to our operations and respective risk profile.


text: Our Vice President of Information Technology has over 20 years of experience at public companies, including within the energy sector, enterprise technology vendors, and consulting firms. His expertise includes enterprise technology strategy, transformation, governance, vendor management, and operations and initiatives to strengthen cybersecurity, enhance information security posture, and mitigate technology risk. We continue to focus on cybersecurity measures as the company grows.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including controls, systems and processes that we have or will in the future implement, will be fully implemented, complied with or effective in protecting our systems and information. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See our risk factor titled "Our business could be negatively affected by security threats and disruptions, including electronic, cybersecurity or physical security threats, incidents and other disruptions."


text: RISK MANAGEMENT AND STRATEGY At Stitch Fix, we recognize the importance of robust cybersecurity measures to protect our systems, data, and the interests of our stakeholders. We have implemented a comprehensive cybersecurity risk management strategy and governance framework to identify, assess, manage, mitigate, and respond to cybersecurity risks and threats. Our risk management strategy and governance framework is designed to identify, assess and manage material risks from cybersecurity threats to our systems, networks, and data infrastructure, including intellectual property, customer data, and data that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Stitch Fix, Inc.

ticker: SFIX


text: We use third-party service providers to assist us from time to time to identify, assess, and manage risks from cybersecurity threats, which may include professional services firms (such as legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, penetration testing firms, dark web monitoring services, and forensic investigators.


text: Stitch Fix views its cybersecurity strategy through a multi-pronged lens encompassing prevention, detection, and response to ensure holistic coverage of our Information Systems and Data, along with the environments in which they operate.


text: Our cybersecurity program starts with prevention, which includes risk assessment and identification. We utilize that information to design a layer of controls as a baseline. We conduct assessments to identify and evaluate potential cybersecurity risks. This process involves analyzing our Information Systems and Data to identify vulnerabilities and potential threats. Our cybersecurity program also includes third-party risk management, in which we oversee the identification and mitigation of risk associated with outsourcing to third-party vendors and service providers, particularly focused on vendors who process sensitive information. In addition to our risk assessment processes, we prioritize cybersecurity awareness and training programs for our employees. These initiatives are designed to educate our workforce about potential threats, best practices for data protection, and the importance of maintaining security measures. We train our employees through annual security training, phishing simulations, and communications about cybersecurity topics and threats.


text: Our Chief Information Security Officer ("CISO") oversees the Company's cybersecurity program. Our CISO, who reports to our Chief Product and Technology Officer ("CPTO"), has over 20 years of experience in information technology, risk, and cybersecurity leadership, and has previously held both CISO and Chief Technology Officer roles. Our CISO chairs the Company's Cybersecurity Governance Committee, comprised of executive leaders across Legal, Finance, and Corporate Communications, that has oversight responsibilities regarding the Company's information security functions, including infrastructure, governance, privacy, and compliance.


text: Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Information Security Team conducts exercises to prepare for cybersecurity incidents, approves cybersecurity processes, and reviews security assessments and other security-related reports.


text: Our cybersecurity incident response processes include the escalation of information about certain cybersecurity incidents, depending on the circumstances, to our CISO, members of management, and the Audit Committee of the Board of Directors.


text: The Audit Committee provides oversight for our cybersecurity program and our enterprise risk management process. The Audit Committee also evaluates enterprise level risks and strategies, including our cybersecurity risk. The Audit Committee receives updates from management on the effectiveness of our cybersecurity program. The Audit Committee also reviews plans on how management will enhance the program, receives updates on special topics that help the Committee provide effective oversight of the program, and is notified in the event of certain cybersecurity incidents.


text: Although we have not experienced a material cybersecurity breach, we cannot guarantee that we will not experience a material cyber threat or incident in the future. For more information regarding the cybersecurity risks we face, see Item 1A. Risk Factors in this Annual Report.


text: Through strategic investments over several years, we have established and enhanced a comprehensive cybersecurity program consisting of security toolsets, people, policies, and contracted third-party service providers that provide technical, organizational, and administrative safeguards to protect against and timely respond to cybersecurity threats and incidents. Our cybersecurity strategy is based foremost on defense in depth, and secondarily on resilience. Defense in depth is a strategy of layered security, in which we employ a variety of overlapping controls, tools, and processes to defend against threat actors. Resilience is a strategy focused on business continuity and disaster recovery, with the goal of rapidly restoring, rebuilding, and recovering from any adverse cyber impacts to our business. These controls, tools and processes include technologies designed to detect and defend against unauthorized access to our systems and infrastructure, relevant corporate policies, periodic cybersecurity and privacy training programs, and incident response protocols for preventing, detecting, responding to and recovering from cybersecurity incidents. We use the National Institute for Standards in Technology security framework to evaluate our cybersecurity controls, which we work to continuously enhance.

companyName: COPART INC

ticker: CPRT


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, we have experienced threats to our data and systems in the past, including malware and viruses. For a description of the risks we face from cybersecurity threats that may affect us and how, see our risk factors under Part 1. Item 1A in this Annual Report on Form 10-K, including under the heading "Disruptions to our information technology systems, including failure to prevent outages, maintain security, and prevent unauthorized access to our information technology systems and other confidential information, could disrupt our business and materially and adversely affect our reputation, consolidated results of operations, and financial condition."


text: Risk Management and Strategy The Company recognizes the importance of cybersecurity and has implemented a comprehensive program to protect its information assets. Key components of our cybersecurity program include appointment of an Information Security Officer, who is also the Chief Operating officer with extensive knowledge of cybersecurity issues, information security policies and procedures, engagement of third-party security experts, regular penetration testing, managed backup and data protection, managed threat response, hardware and software protections, physical security measures, employee training, internal cybersecurity audits, and ongoing product cybersecurity assessments. The Company maintains cybersecurity insurance covering its internal operations and customer-facing products.

companyName: ESCALON MEDICAL CORP

ticker: ESMC


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other risk areas. We have also implemented a specific cybersecurity program which adopts a risk management approach to information security, requiring the identification, assessment, and appropriate mitigation of vulnerabilities and threats that can adversely impact our information assets. Our cybersecurity program is aligned with recognized industry standards and frameworks such as NIST SP 800-53, NIST SP 800-82, and the NIST Cybersecurity Framework 2.0. Our cybersecurity program includes: • An Information Security Charter and supporting policies outline governance, define responsibilities, and help enforce our cybersecurity program; • A risk assessment process designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • An information security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, incident response personnel, and senior management; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A third-party risk management process for customers, service providers, suppliers, and vendors.

companyName: Oil-Dri Corp of America

ticker: ODC


text: As of the date of this report, the Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents and potential impact to the Company, see the cybersecurity risk factors within "Item 1A. Risk Factors" in this Form 10-K.


text: Our cybersecurity risk management program is integrated into our global enterprise risk management framework, which is designed to help identify, monitor, and mitigate key strategic risks. Our enterprise risk assessment, which includes data protection and cybersecurity, is developed annually to provide insight into the risks with the greatest potential to impact Jabil's strategy and our financial goals. Key components of our cybersecurity risk management program include the following: • Cybersecurity policies. We leverage cybersecurity industry-standard frameworks and insights from internal assessments to develop policies to guide the use of our information assets (for example, business information and information resources such as mobile phones, computers, and workstations), access to specific intellectual property or technologies, deployment of AI within the Company, and protection of personal information. The Company has also established written policies and procedures to help ensure that cybersecurity incidents are quickly assessed and addressed. • Risk assessment. The Company uses risk assessment processes to identify and prioritize cybersecurity risks, employ operational controls to mitigate risks, report incidents, and analyze trends, and employ a corrective action process to address nonconformities. Key risk indicators are used across all business functions to monitor and measure our cybersecurity risk exposure. Through this cross-functional approach, management identifies potential operational and strategic risks which could impact our strategy and financial goals. • System safeguards. We implement industry-standard technical safeguards that are designed to protect our information systems, operations, and sensitive information from cybersecurity threats. By collaborating with internal stakeholders across the company, we integrate foundational cybersecurity principles throughout our organization, including multiple layers of cybersecurity defenses and restricted access based on business need. We frequently conduct vulnerability assessments to identify new risks and periodically test the efficacy of our safeguards through both internal and external penetration tests. • Security Awareness and Training. Cybersecurity education contributes to the safety of the Company, customer data, and employee sensitive data and assets. Our employees undergo regular training on information security, cybersecurity awareness, and the protection of confidential information. This training is designed to promote an understanding of the behaviors and technical requirements needed to safeguard Company data. Additionally, we provide ongoing education to help employees recognize and report suspicious activity. In addition, higher risk employees undergo routine anti-phishing testing and training. • Assessments. We periodically assess and test our cybersecurity policies, standards, processes, and practices that are designed to address threats. This includes monthly metrics review, threat modeling, vulnerability testing, and other exercises to evaluate our cybersecurity effectiveness. We regularly engage third parties to assist with our assessments and testing. Where appropriate, we adjust our cybersecurity policies, standards, processes, and practices accordingly based on internal and external assessment and testing results.

companyName: JABIL INC

ticker: JBL


text: • Engagement of third-party service providers. The Company utilizes third-party cybersecurity experts to assess the Company's cybersecurity risks and conduct penetration testing to measure our cybersecurity risk management program relative to industry-standard frameworks. The Company has established a standardized process for assessing and managing potential risks associated with the engagement of third-party service providers that request access to the Company's information systems. • Incident response. The Cybersecurity Incident Response Team ("CIRT"), deploys, maintains, and monitors various tools and processes designed to safeguard against and detect cybersecurity incidents that may occur. As part of our incident response program, members of management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. In accordance with established written policies and procedures, escalation protocols are used to provide information to, and engage with, executive management, the Cybersecurity Committee and the Board, throughout the incident response process. The CIRT reviews these controls regularly, and makes enhancements as needed to incorporate lessons learned, updated industry standards, and any new or revised legal requirements.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected us during fiscal year 2025 or are reasonably likely to materially affect us in the near term, including our business strategy, results of operations, or financial condition. Additional information about our cybersecurity risks is discussed in "Disruptions to our information systems, including security breaches, losses of data or outages, and other security issues, have and could in the future adversely affect our operations" in Item 1A. Risk Factors, which should be read in conjunction with the information above.


text: The CISO has over 39 years of experience working in cybersecurity, risk management, and infrastructure technology and network architecture. Our CISO holds industry-recognized cybersecurity certifications, including Certified Information Systems Security Professional (CISSP) certification. The CIO has over 33 years of experience focused on corporate strategy formulation and implementation, IT management including cybersecurity, and business and process transformation.


text: Effective September 1, 2025, the Company transitioned cybersecurity responsibilities to a new CISO. The new CISO has over 20 years of experience leading large-scale security programs protecting critical infrastructure and sensitive data, modernizing digital identity systems, and driving cultural transformation within security teams in the federal, healthcare, and global manufacturing sectors.


text: Cybersecurity Risk Management and Strategy We maintain an information security program with a dedicated internal team that is tasked with leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our information security team is responsible for identifying, assessing, managing, and responding to cybersecurity risks, threats and incidents relating to the protection of our information assets, systems and operations. The information security team also oversees the detection, prevention, mitigation and remediation of all cybersecurity incidents. Our information security team proactively monitors emerging cyber threat activity to proactively tune and upgrade our cyber capabilities to maintain a robust security posture.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: Our information security program is managed by a dedicated Chief Information Security Officer ("CISO") who reports to our Chief Technology Officer, a member of our Executive Leadership Team ("ELT"). Our CISO has a graduate degree in computer engineering and has worked in cybersecurity for over two decades, including at a major financial institution. The information security team is comprised of approximately 60 employees, with dedicated teams assigned to governance, risk and compliance, identity and access management, strategy and architecture, and analytics and automation. The team operates from FactSet locations around the world, including offices in the U.S., India, the Philippines and Europe.


text: FactSet's information security and governance framework is guided by International Organization for Standardization ("ISO") 27001 and System and Organization Control ("SOC") 2 Trust Service Criteria and the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.


text: Cybersecurity risk management is integrated into our broader Enterprise Risk Management ("ERM") framework. FactSet's ERM program is designed to identify, prioritize and assess the most significant risks that could impact our ability to achieve our strategic business objectives. Our information security leadership team, in concert with our ERM team, reviews our cybersecurity risks each quarter through our enterprise risk assessment process.


text: FactSet's information security program is grounded in a risk-based approach. Our information security team undertakes various activities to assess, identify and manage risks from cybersecurity threats, including managing security controls, conducting penetration testing, leading training and tabletop exercises (including an annual tabletop exercise with the ELT), and conducting internal and external vulnerability assessments. All FactSet's employees receive mandatory annual cybersecurity training; software engineers receive training on secure software development best practices; and other ad hoc training is provided to employees on the latest cyber threat landscape. In addition, we also perform quarterly "phishing simulations" to test the effectiveness of our security training program.


text: FactSet's information security team performs annual penetration testing with leading service providers, to mimic motivated threat actors, to assess the internal and external security posture of the Company. Findings from the penetration test and our internal and external vulnerability assessments are classified using a combination of scores and internal business metrics.


text: Our information security program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management, including the ELT and the FactSet Audit Committee, and, where appropriate, the Board of Directors (the "Board"). We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: The cybersecurity threat landscape is dynamic and volatile and requires significant investment. To date, risks from cybersecurity threats have not materially affected, and we do not believe are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. As discussed more fully under Item 1A, Risk Factors in this Annual Report on Form 10-K, although our processes are designed to help identify, detect, prevent, respond to, and mitigate cybersecurity risks, cybersecurity threats are rapidly evolving and we may not be able to anticipate, prevent, or detect all such attacks and there is no guarantee that a future cybersecurity incident could not materially affect our business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Cybersecurity is an important part of our Audit Committee, Board and ELT's risk management focus. The Board coordinates with the Audit Committee for active Board- and Committee-level oversight of the Company's technology and cyber risk profile, cyber strategies and information security initiatives.


text: The Audit Committee monitors management's responsibility in the area of risk oversight, including cybersecurity risks. At each regular meeting, the Audit Committee receives updates from the CISO, regarding trends, emergent risks to our technology infrastructure, major updates on security assessments and threat landscape, and the steps we are taking to respond to these matters. The CISO also provides an annual update to the Board, or as may otherwise be required.


text: Management has day-to-day responsibility for identifying risks facing FactSet, formulating risk management policies and procedures, managing our key risk exposures on a day-to-day basis and setting the right "tone at the top." As part of this, the ERM and technology teams, including the CISO, also deliver regular updates to the ELT on cybersecurity and related matters.


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. The Company has an ERM program to identify, evaluate, and manage risks, including cybersecurity risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program. The Company believes that integrating cybersecurity risks into its ERM program fosters a proactive and holistic approach to cybersecurity, which helps safeguard the Company's operations, financial condition, and reputation in an ever-evolving threat landscape. Atleos' ERM programs support the Company's strategic objectives and corporate governance responsibilities. The ERM programs include the following primary objectives: • Establish a standard risk framework and supporting policies and processes to identify, assess, respond to, and report on business risks and opportunities, including cybersecurity threats; • Establish clear roles and responsibilities in support of the Company's risk management activities, including cybersecurity; • Ensure appropriate independent oversight of business risks and opportunities and the impacts of related business decisions on the Company's risk profiles and tolerances; • Ensure appropriate communication and reporting of business risks and opportunities including related response strategies and controls to Atleos' executive leadership and Board of Directors; and • Provide relevant training to executives, managers and employees.

companyName: NCR Atleos Corp

ticker: NATL


text: We utilize various information technology and data protection services to help detect and prevent cyberattacks, including but not limited to firewalls, intrusion prevention systems, denial of service detection, anomaly based detection, anti-virus/anti-malware, endpoint encryption and detection and response software, Security Information and Event Management system, multiple threat intelligence services, threat hunting managed security service provider (MSSP), identity management technology, security analytics, multi-factor authentication and encryption. There can be no assurance that our protections will always be successful and any failure could result in loss, disclosure, theft, destruction or misappropriation of, or access to, our confidential information and cause disruption of our business, damage to our reputation, legal exposure and financial losses.


text: The Company has also established relationships with cybersecurity firms and internal cybersecurity experts, which it engages in connection with certain suspected incidents. The Company also regularly undergoes evaluation of its protections against incidents, including both self-assessments and expert third-party assessments, and it regularly enhances those protections, both in response to specific threats and as part of the Company's efforts to stay current with advances in cybersecurity defense.


text: To further our commitment to data privacy and cybersecurity: • Atleos maintains the ISO 27001 certification for certain locations throughout the United States, Europe, Australia, and India; • Third-party audits for PCI-DSS, PA-DSS and SSAE-18 SOC2 are conducted for certain service offerings; • Atleos engages third party experts to perform penetration tests to attempt to infiltrate our information systems, as such term is defined in Item 106(a) of Regulation S-K; • Atleos maintains a robust information security awareness and training program. Employees and contingent workers are required to complete training within 30 days of hire, as well as an annual refresher course; • Atleos performs regular testing to help ensure employees can identify email "phishing" attacks; and • Atleos' corporate insurance policies include certain information security risk policies that cover network security, privacy and cyber events.


text: As part of our overall ERM approach, our third-party risk management program is designed to ensure proper risk identification and oversight of Atleos' vendors and includes the following objectives: • Perform risk-based segmentation and prioritization of all existing and new Atleos vendors; • Perform sanctions screenings on all vendors and anti-bribery, anti-corruption screenings on applicable vendors; • Perform extended due diligence on identified high risk vendors to include responsible sourcing, business continuity, information security, data privacy, and other reviews as applicable; and • Perform a financial risk assessment on identified high risk vendors.


text: The Company also employs advanced screening and due diligence processes and tools, including data privacy and cybersecurity specific evaluations as applicable, as part of our standard third-party onboarding and continuous monitoring processes.


text: As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company has experienced cyberattacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place by the Company. For a detailed discussion of the Company's cybersecurity related risks, see "Item 1A. Risk Factors—Data protection, cybersecurity and data privacy issues could adversely impact our business."


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Audit Committee has oversight responsibility for the Company's ERM framework, including managing cybersecurity threat risks and cybersecurity incidents. Specifically, the Audit Committee oversees the design, implementation and maintenance of an effective ERM framework for the Company's overall operational, information security, strategic, reputational, technology, and other risks. To fulfill its oversight responsibility, the Audit Committee also regularly reviews, consults, and discusses with management on strategic direction, challenges, and risks faced by the Company. The Audit Committee also regularly receives management reports on information security and enhancements to cybersecurity protections, including benchmarking assessments, which it then shares with the Board.


text: Included among the members of both the Board and the Audit Committee are directors with substantial expertise in cybersecurity matters, and Board members actively engage in dialogue on the Company's information security plans, and in discussions of improvements to the Company's cybersecurity defenses. For example, a member of our audit committee has recently completed executive training at MIT in artificial intelligence and was a former chief executive officer and director of a publicly listed global software company that has an array of products including compliance and cybersecurity related software. He also served as the chair of the compliance and risk committee (including cyber security) at another public company. Additionally, another member of our audit committee recently completed an online course on boardroom governance in cybersecurity. When, in management's or the Board's judgment, a threatened cybersecurity incident has the potential for material impacts, management, the Board and applicable committees of the Board will engage to assess and manage the incident.


text: As discussed below, members of management report to the Audit Committee, which reports to the entire Board about cybersecurity threat risks, among other cybersecurity related matters, at least annually.


text: At the management level, Atleos also established the Office of Risk Management and appointed a Chief Risk Officer to assist the Company in fulfilling its objectives relating to ERM, ethics & compliance (E&C), data privacy, TPRM, BCP and sustainability. The Company's Chief Risk Officer is responsible for developing and managing formal programs designed to identify, assess and respond to material and emerging risks and opportunities that may impact the achievement of the Company's strategic objectives.


text: Under the direction of Atleos' CISO, the Global Information Security organization is responsible for implementing and maintaining an information security program with the goal to protect information technology resources and protect the confidentiality and integrity of data gathered on our people, partners, customers, and business assets. Also, we employ various information technology and protection methods designed to promote data security including firewalls, intrusion prevention systems, denial of service detection, anomaly-based detection, anti-virus/anti-malware, endpoint encryption and detection and response software, Security Information and Event Management system, identity management technology, security analytics, multi-factor authentication and encryption. In addition to the Chief Risk Officer, our Chief Compliance Officer has a direct channel to the Board. Further, our Chief Compliance Officer oversees investigations pertaining to fraud, conflicts of interest, violations of laws, and other similar matters, and reports on those activities to one or more Committees of the Board. All of these channels to the Board are designed to: prevent risks and initiatives from being siloed into one channel and provide a clear and accurate picture of the Company's evolving risk landscape.


text: Our Chief Risk Officer has over 20 years of experience developing and leading global risk organizations across multiple Fortune 500 companies. He holds an undergraduate degree in aerospace engineering from the Georgia Institute of Technology.


text: Our Chief Compliance Officer has over 40 years of experience leading global legal and compliance departments. He holds an undergraduate degree in economics from the Wharton School of Business and a Juris Doctor from Columbia University School of Law.


text: Our CISO has over 25 years of experience leading global teams across a variety of IT disciplines as well as executive leadership of global Information Security / Cybersecurity organizations in complex, regulated environments. He holds an undergraduate degree in business administration from Appalachian State University.


text: Our efforts are designed to maintain the confidentiality, integrity, and availability of our information and operational technology systems and the data stored on those systems. The program includes: • Conduct periodic risk assessments to identify material cybersecurity risks in our critical IT systems • Monitor for external threats and manage incident response • Engage third-party security providers for penetration testing and program reviews based on National Institute of Standards and Technology ("NIST") standards • Perform internal audit reviews of IT-related controls • Assess cybersecurity risks of third-party vendors • Train employees regularly, including phishing simulations The cyber security program is continually adapting to the evolving threat landscape and technology developments.

companyName: EDGEWELL PERSONAL CARE Co

ticker: EPC


text: Our Board of Directors is part of the Company's Cyber Response Task Force and table top simulations. Additionally, the Board of Directors have delegated to the Audit Committee oversight responsibility of our risk management program, including cybersecurity, business continuity, IT operational resilience, and data privacy. The Audit Committee has specific responsibility for reviewing the status of the security of the Company's electronic data processing information systems related to the Company's people, assets and information systems. The Audit Committee receives regular updates from the SVP, IT, about information security and systems security programs and plans, including emerging trends and progress on overall enterprise cybersecurity programs and priorities. These updates occur at least two times a year, with interim updates as needed. Additionally, we have protocols by which certain cybersecurity incidents are reported promptly to the Chief Executive Officer, or the Audit Committee, as appropriate. A Cyber dashboard is also provided to the Board of Directors quarterly.


text: The team is responsible for the following: • Implementing Enterprise-wide cybersecurity strategy • Developing and enforcing Cybersecurity Policy • Developing and enforcing Cybersecurity Standards • Approving and reviewing Cybersecurity Architecture • Developing and enforcing Cybersecurity Processes • Developing and testing Cybersecurity Incident response • Performing other Cybersecurity operational activities including but not limited to: Vulnerability management strategy


text: Network security configurations Risk Management and oversight of third parties Our cyber security and infrastructure team's experience includes a combined 102 years of experience. Further, our Director of Information Security, IT Governance Risk and Compensation Manager, Cybersecurity Team Lead, and Industrial Security and Network Senior Analyst all hold the Certified Information Systems Security Professional (CISSP) credential, widely recognized as the global standard for information security expertise. CISSP certification demonstrates advanced knowledge across eight security domains, a minimum of five years of industry experience, and adherence to strict ethical standards. This designation reflects our leaders' ability to align technical controls with business risk, ensuring robust governance, regulatory compliance, and resilience against evolving cyber threats. Our team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: In fiscal 2025, the Company developed a Cybersecurity Incident Materiality Policy (the "Policy") to guide the Company through the materiality decision making framework, SEC reporting and disclosures obligations, disclosure controls and procedures related to a cybersecurity incident, and a communication protocol to escalate material incidents to the Board and supplements the Company's Cybersecurity Incident Response Plan. In addition to the Policy, the Company also formed a Cyber Incident Disclosure Committee, which includes key stakeholders whose role will be to determine whether an incident is material and, therefore, requires public disclosure.


text: Risk Management and Strategy Under our Shared Services Agreement with D.R. Horton, D.R. Horton provides us with certain administrative and compliance services which includes information technology, i nternal audit and information technology risk services. Leveraging these services provided by D.R. Horton related to cybersecurity, we have processes in place for assessing, identifying, and managing risks from cybersecurity threats that may result in material adverse effects to the confidentiality, integrity and availability of our systems, operations and data. These processes are a part of our overall risk assessment process. Risks from cybersecurity threats include, among other things, unauthorized access, data theft, computer viruses, ransomware, malicious software and other disruptions. We have implemented systems and processes utilizing a multilayered, proactive approach to identify, evaluate, mitigate and prevent potential cybersecurity threats. Each of these layers contain multiple levels of protection and leverage industry standard framework including the National Institute of Standards and Technology (NIST) Cybersecurity Framework. At the management level, these systems and processes are overseen primarily by the D.R. Horton Chief Information Officer (CIO) and Cyber Security Risk Officer (CSRO).

companyName: Forestar Group Inc.

ticker: FOR


text: D.R. Horton's CIO has 36 years of experience working in information technology including roles in the commercial software development, healthcare, industrial and professional services sectors. While in those roles, the D.R. Horton CIO has led governance, risk, and compliance technology programs and information security programs. The D.R. Horton CIO currently reports to the D.R. Horton CFO.


text: D.R. Horton's CSRO has 24 years of experience working in information technology and cyber security roles including software development, identity and access management projects, privilege account management and multifactor authentication implementations. While in those roles, the D.R. Horton CSRO has led projects and implementations for a variety of organizations that assess and create solutions for security concerns. The D.R. Horton CSRO currently reports to the D.R. Horton CIO.


text: Our Company's Executive Management Team ("EMT") receives periodic briefings, and the Board of Directors and its Audit Committee receives annual and quarterly briefings, respectively, on cybersecurity matters. These briefings may include updates on critical information security and cybersecurity risks and the threat landscape; cybersecurity improvement initiatives and the internal control environment; and, if relevant, the status of actions taken with respect to any cybersecurity incidents.

companyName: Hillenbrand, Inc.

ticker: HI


text: The CISO has information technology and information security experience, including enterprise risk management leadership, and holds a Certified Information Security Manager certification from the Information Systems Audit and Control Association (ISACA). The CISO reports to the Chief Information Officer ("CIO"), who is a member of the EMT and reports directly to the CEO. The CIO has extensive experience overseeing and executing technology strategies and implementations in complex, global organizations.


text: As part of the Company's cybersecurity risk management program, we follow the National Institute of Standards and Technology Cybersecurity Framework to assess, identify and manage material risks that arise from cybersecurity threats. Griffon's cybersecurity risk management program is closely tied to and integrated with the Company's overall enterprise risk management processes.

companyName: GRIFFON CORP

ticker: GFF


text: We also maintain a cyber incident response plan with the objective of (1) providing a structured and systematic incident response process for cybersecurity threats that affect us, (2) timely and effectively identifying, resolving and communicating cybersecurity incidents, and (3) managing internal and external communications and reporting.


text: The Audit Committee assists the Board of Directors in its oversight of risks related to cybersecurity and directly oversees risk management relating to cybersecurity. The Audit Committee is also responsible for assessing the steps management has taken to monitor and control these risks and exposures, and evaluating guidelines and policies with respect to our cybersecurity risk assessment and risk management. The Audit Committee reviews our cybersecurity program with management and reports to the Board of Directors with respect to, and regarding its review of, the program. Cybersecurity reviews by the Audit Committee generally occur at least annually, or more frequently as determined to be necessary or advisable. From time to time, third-party subject matter experts present to the Audit Committee on contemporary cybersecurity topics of interest.


text: We maintain a cybersecurity program, designed to proactively identify, assess, manage, mitigate, and respond to cybersecurity threats. Our Cybersecurity Organization develops, implements, and maintains this program, which is governed by our global cybersecurity policy. The underlying controls of the cybersecurity program are based on recognized best practices and standards for cybersecurity and information technology and is aligned with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization for Standardization ("ISO") 27001 Information Security Management System Requirements. Cybersecurity is an important and integrated part of our enterprise risk management program that identifies, monitors and mitigates business, operational and legal risks. Our cybersecurity risk management process is integrated into our overall risk management process, and shares common methodologies, reporting channels and governance processes that apply across the risk management process to other legal, compliance, strategic, operational and financial risk areas.

companyName: JACOBS SOLUTIONS INC.

ticker: J


text: We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our cybersecurity program maintains assessment protocols for proactively evaluating potential cybersecurity impacts and risks, supported by incident response procedures. We employ systematic processes to manage cybersecurity risks, including through cybersecurity audits, network interconnectivity reviews, system access controls and monitoring, and data backup and recovery. Our cloud environments undergo continuous assessment, with firewall and backup systems designed to support operational resilience. We employ a Zero Trust Security framework that requires identity verification for network access, complemented by regular system assessments and monitoring. Our security controls include identity management programs, data loss prevention protocols, and threat detection capabilities. Our controls undergo regular review and updates based on threat intelligence, ensuring adaptability to emerging threats. Similarly, our incident response program is regularly tested and updated to address emerging threat landscapes. To ensure organization-wide security awareness, cybersecurity training is mandatory and provided to all employees annually. Cybersecurity awareness is also included across other training programs, including our annual "Living our Values" training modules and our privacy training programs.


text: Third-party risk management is a critical component of our cybersecurity strategy. We maintain oversight of service providers through proactive monitoring, leveraging a cybersecurity questionnaire and security and privacy addenda to our contracts where applicable. We evaluate third party providers to ensure they maintain effective security management programs, compliance with information handling and asset management protocols, and provide prompt notification of any known or suspected cybersecurity incidents.


text: To validate our security posture, we engage independent external firms to conduct regular penetration testing, security audits, and cybersecurity consulting. We maintain ISO/IEC 27001 certification for our global enterprise. We also maintain a Cybersecurity Maturity Model Certification (CMMC) L2 certification for our U.S. Federal operations, and Cyber Essentials (CE) Plus certification for our U.K. operations. Additionally, our IT General Controls (ITGCs) undergo annual testing through Sarbanes-Oxley (SOX) audits, which examine security controls relating to system changes, access management, system configurations, and data backup processes.


text: Our Board of Directors has ultimate oversight of cybersecurity and information security risk, which it manages as part of our enterprise risk management program. The Board is assisted by the Audit Committee,,as it pertains to cybersecurity threats to the integrity of the Company's financial systems and compliance with cybersecurity related disclosures, and the Sustainability and Risk Committee, as it pertains to cybersecurity as a part of the Company's enterprise risk, which oversee our cybersecurity risk exposures, review management's mitigation efforts, and report their findings to the Board. Throughout the year, our senior executives, including our Chief Information Security Officer ("CISO"), provide regular briefings to the full Board, the Audit Committee and the Sustainability and Risk Committee. These updates cover technology trends, regulatory developments, disclosure requirements, legal issues, policies and practices, threat environment assessments, and ongoing security measures to prevent, detect, and respond to critical threats. The Board and its committees regularly engage in discussions with senior executives regarding cybersecurity and information security risks. As part of our cybersecurity governance, we also maintain a Cybersecurity Steering Committee chaired by our CISO and comprised of executive management, operational leaders, and cross-functional teams. Generally, this committee meets quarterly, or more frequently as needed, to review, assess and direct decisions related to cybersecurity and information systems matters.


text: Our cybersecurity program is led by our CISO, who reports to our Chief Information Officer ("CIO"). Our CISO oversees prevention, detection, mitigation, and remediation efforts through regular communication and reporting from information security professionals, many of whom have decades of experience and hold certifications such as a Certified Information Systems Security Professional (CISSP) or Certified Information Security Manager (CISM). These efforts are supported by advanced technological tools, specialized software and engagement with external consultants. Our CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk and holds the following credentials: Certified Information Systems Security Professional (CISSP), a Certified Ethical Hacker (CEH), FINRA Licensed (with a Series 99), and an Oracle Cloud Certified Professional (OCP). Our CISO and CIO regularly provide reports to the Board, the Audit Committee and the Sustainability and Risk Committee on our cybersecurity posture, key initiatives and ongoing efforts to prevent, detect, mitigate, and remediate cyber incidents. In the event of a cybersecurity incident, we follow established incident response procedures, which includes protocols for timely notification to senior management as well as the Board of Directors, with ongoing updates provided until the issue is remediated, as appropriate.


text: Our operations are subject to cybersecurity risks, including unauthorized access, system failures, and breaches that could originate from both internal networks and through third-party suppliers and service providers. While we have not experienced a material impact on our business strategy, results of operations and/or financial condition from cybersecurity threats or prior incidents, such events have the potential to have a material adverse effect on such aspects of our business. Realization of these risks could damage or disrupt access to our information systems or networks, compromise confidential or protected information, destroy or corrupt data or otherwise interfere with our operations. We continuously monitor our networks for unauthorized access attempts and maintain a range of defensive measures. However, the evolving and sophisticated nature of cyber threats means we cannot guarantee prevention of all potential incidents that could materially impact our business operations, financial condition, or strategic objectives. In addition, even if we effectively defend our own systems, we rely on third-party providers of products, services and networks, with whom we share data and services, and who may themselves be unable to prevent or mitigate cyberattacks.


text: Cyber Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management program in accordance with our risk profile, which is informed by, and incorporates, elements of recognized industry standards. We leverage the support of third-party information technology and security providers, including for cybersecurity audits and risk assessments. We implement technical controls, such as multi-factor authentication and we deploy cybersecurity tools through a leading third-party cybersecurity firm to protect our systems from cybersecurity related risks. We have an enterprise risk management program and we maintain written information security policies, including an incident response plan, which is designed to establish our processes for identifying, responding to, and recovering from cybersecurity incidents. The incident response plan is exercised on an annual basis. Finally, we have implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, including through the use of vendor security questionnaires. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents that could affect our information or systems. For more information, please see Item 1A - Risk Factors.

companyName: Cerence Inc.

ticker: CRNC


text: Risk Management and Strategy As part of our enterprise risk management function, we have implemented processes to assess, identify and manage the material risks facing our company, including risks from cybersecurity threats. Our enterprise risk management function represents our overall risk management system. Our cybersecurity program is built upon recognized security frameworks. We believe that our processes provide us with a comprehensive assessment of potential cybersecurity threats. We conduct regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage the material risks from cybersecurity threats include the risks arising from threats associated with third-party service providers, including cloud-based platforms.

companyName: Construction Partners, Inc.

ticker: ROAD


text: We have developed a cybersecurity incident response plan that provides a documented framework for handling cybersecurity incidents and facilitates coordination across multiple parts of the Company. Dedicated members of our information security team, led by our Senior Vice President, Information Technology and our Director of Information Security, continuously monitor threat intelligence feeds, handle vulnerability management and respond to incidents. In addition, we periodically perform simulations and drills at a technical level.


text: Internally, we have a security awareness training platform that includes training to reinforce our information technology and security policies, standards and practices, and we require that our employees comply with these policies. The cybersecurity awareness training platform offers training on how to identify potential cybersecurity risks and protect our resources and information. This training is mandatory for all employees on a periodic basis, and it is supplemented by testing initiatives, including periodic phishing tests.


text: From time to time, we engage third-party service providers to enhance our risk mitigation efforts. For instance, we have engaged an independent cybersecurity advisor to evaluate our cybersecurity controls and a cybersecurity firm to conduct continuous threat detection, response and remediation.


text: To date, we have not experienced a cybersecurity incident that has had a material impact on our business strategy, results of operations or financial condition, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, as discussed more fully under "Item 1A. Risk Factors," cybersecurity attacks are continually evolving to become more sophisticated and, while we have invested in the protection of our data and information technology to reduce the risk of a cybersecurity incident, our efforts may not be effective in preventing breakdowns or breaches in our systems.


text: Role of the Board. Our board of directors exercises direct oversight of our strategic risks through its oversight of our enterprise risk management function. The Audit Committee of the board of directors in particular is responsible for overseeing our IT security controls and the adequacy of our IT security program, compliance and controls with management. As part of such oversight, the board of directors, including members of the Audit Committee, receive periodic reports from management and our third-party service providers to assess the primary cybersecurity risks we face.


text: Role of Management. Our Senior Vice President, Information Technology and our Director of Information Security are together responsible for the day-to-day management of our cybersecurity risks. These professionals have extensive experience in the information technology area, including cybersecurity. In particular, our Senior Vice President, Information Technology has more than 30 years of professional experience in the field of management information systems and information security, including with other companies in our industry. Further, our Director of Information Security has more than 20 years of experience in the information security area, with a career spanning roles with the U.S. Air Force, healthcare, academia and private consulting, and holds various certifications related to cybersecurity.


text: Security Incident Response Plan. We have a security incident response plan in place. The incident response plan is a set of coordinated procedures that our incident response team executes with the goal of ensuring timely and accurate resolution of cybersecurity incidents.


text: The Company's Board of Directors (the "Board") is responsible for overseeing the Company's risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Company's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards and are standalone from the Company's overall risk management system and processes. In general, the Company seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company's information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: Amentum Holdings, Inc.

ticker: AMTM


text: Cybersecurity Risk Management and Strategy The Company's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Company has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Company's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: The Company has implemented technical safeguards that are designed to defend the Company's information systems from cybersecurity threats. These safeguards include network security capabilities such as firewalls, intrusion prevention and detection systems; endpoint protection capabilities such as anti-malware functionality; and access controls, which are evaluated for accuracy on a quarterly basis. The Company has also implemented email protection to minimize phishing attacks and ensure integrity in digital communications. We baseline our assets according to the technical controls recommended in the National Institute of Standards and Technology Special Publication 800-171 ("NIST SP 800-171"). • Cyber Intelligence & Continuous Monitoring: The Company has established continuous monitoring of our environment through a third party and receives alerts on threats and policy violations to ensure we meet our 96 hour window to report material matters to the SEC. The Company is a member the Defense Industry Base ("DIB") and receives cyber intelligence based on current threat actors and tactics, techniques and procedures ("TTP's") from the DIB organization, the Federal Bureau of Investigation ("FBI") cyber division, Department of Homeland Security, and the National Security Agency Cybersecurity Collaboration Center ("NSA CCC"). • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Company's response to a cybersecurity incident. The Company conducts annual tabletop exercises that simulate a cyber-attack to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on the Company's cybersecurity systems. • Education and Awareness: The Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: The Company conducts periodic assessment and testing of the Company's policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The Company performs quarterly penetration tests against both externally facing assets and internal assets. The Company also performs monthly and ad-hoc vulnerability scanning. Lastly, we collaborate with the NSA CCC to scan our public facing assets for vulnerabilities against the latest advanced persistent threats. The results of such assessments, audits, and reviews are evaluated by management and reported to the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: The Board oversees the Company's risk management program, including the management of cybersecurity threats. The Board will receive regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by the Company's peers and third parties. The Board will receive prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. On an annual basis, the Board will discuss the Company's approach to overseeing cybersecurity threats with the Company's Chief Information Security Officer ("CISO") and other members of senior management.


text: The CISO, in coordination with senior management, works collaboratively across the Company to implement a program designed to defend the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Board when appropriate. To ensure prompt reporting and compliance with SEC requirements, the Board has adopted a "Cybersecurity Incident Materiality Assessment Policy."


text: The CISO is a retired Air Force veteran who has served in various roles in information technology, information security and the U.S. Government for over 30 years. The CISO most recently served as the Chief Information Security Officer of Optiv Security and previously served as the Executive Director, Classified Cybersecurity, at Lockheed Martin. The CISO holds an associates degree in criminal justice from the Community College of the Air Force, an undergraduate degree in information technology from the University of Phoenix, and a graduate degree in information systems security from Colorado Technical University. The CISO has attained the professional certifications of Certified Information Systems Security Professional with a concentration in Management, Certified Chief Information Security Officer, and Certified Ethical Hacker.


text: Material Effects of Cybersecurity Incidents Our operations are subject to cybersecurity risks, including unauthorized access, system failures, and breaches that could originate from both internal networks and through third-party suppliers and service providers. While we have not experienced a material impact on our business strategy, results of operations and/or financial condition resulting from cybersecurity threats or previous cybersecurity incidents, such events have the potential to have a material adverse effect on our business strategy, results of operations and financial condition, including by damaging or interrupting access to our information systems or networks, compromising confidential or otherwise protected information, destroying or corrupting data, or otherwise disrupting our operations. We continuously monitor our networks for unauthorized access attempts and maintain defensive measures; however, the dynamic nature of cyber threats means we cannot guarantee prevention of all potential future incidents that could materially impact our business operations, financial condition, or strategic objectives. Even if we successfully defend our own digital technologies and services, we also rely on providers of third-party products, services, and networks, with whom we may share data and services, and who may be unable to effectively defend their digital technologies and services against attack.


text: Cybersecurity Strategy and Risk Management Atkore's commitment to cybersecurity emphasizes maintaining secure technology and data environments and the cultivation of a security-minded culture and capability. We do this through education and training, and a layered approach to identifying, preventing, detecting, responding to and recovering from cybersecurity threats and incidents. Key elements of our program for assessing, identifying, and managing material risks from cybersecurity threats are anchored in widely used and industry recognized security frameworks and are described below.

companyName: Atkore Inc.

ticker: ATKR


text: We maintain cybersecurity policies that articulate Atkore's expectations and requirements with respect to topics such as acceptable use of technology and data, data privacy, risk management, education and awareness and event and incident management. We regularly conduct exercises, with the support of outside domain experts, to improve the effectiveness of our processes and we periodically assess our processes against recognized cybersecurity frameworks. Consistent with our position that cybersecurity is the responsibility of every Atkore employee, we regularly educate and share best practices with our employees to raise awareness of cybersecurity threats. Atkore employees participate in monthly training and testing. In addition to training, Atkore conducts table-top exercises as often as twice a year to simulate cybersecurity risk and response scenarios.


text: Our cybersecurity team implements measures designed to ensure that Atkore can quickly identify and mitigate cybersecurity risks. Our controls are designed to restrict access to locations that house significant physical information technology assets. Other controls include the use of multifactor authentication, various third-party tools, network security technologies, and a crisis playbook. Our notification policies and processes are escalated to the appropriate personnel on a timely basis to support effective review, response, and compliance with legal requirements. Data is also aggregated to support the identification of trends for forward looking oversight.


text: Key elements of Atkore's annual Enterprise Risk Management ("ERM") program include an inventory and classification of key risk areas and topics; a methodology for scoring risks based on the risk's probability, severity, and velocity of impact, and for trending key risks; and a framework for developing and implementing countermeasures for key risks. Cybersecurity is one of six topical areas required to be addressed as part of the annual ERM program. Cybersecurity risks are scored using the same methodology applied to all other risks. This helps evaluate the significance and prioritization of cyber-related risks relative to wider business risks. Members of Internal Audit present annually to the Atkore Board of Directors a report on the results of the ERM process. This includes cybersecurity risks. We periodically engage external consultants to assess our cybersecurity program.


text: Based on the information we have as of the date of this Annual Report, we do not believe any risks from cybersecurity threats have materially affected or are likely to materially affect Atkore, including our business strategy, results of operations or financial condition. For more information on risks relating to our cybersecurity threats, see Item 1A, "Risk Factors-Risks Related to Our Business-Interruptions in the proper functioning of our information technology ("IT") systems and the IT systems of those with whom we do business, including from cybersecurity threats, could disrupt operations and cause unanticipated increases in costs or decreases in revenues, or both."


text: Cybersecurity Governance and Oversight At the management level, Atkore's cybersecurity program is led by the Company's Vice President - Chief Information Officer ("CIO"), who is a member of the Executive Leadership Team. Atkore's CIO has over 30 years of experience in information technology roles with responsibilities including global cybersecurity strategy, global IT strategy, technology platforms and internal controls. The CIO has a Master of Business Administration from Kellogg School of Management at Northwestern University and a Bachelor of Science in Computer Information Systems from DeVry Institute of Technology. Reporting to the CIO is a Director of Cybersecurity. The current Director of Cybersecurity has over 20 years of experience in information technology roles with responsibilities including cybersecurity and security architecture and engineering. The CIO is supported by the Cybersecurity Steering Committee ("CSC"), a management committee comprising members of the Executive Leadership Team and the leaders of the information technology, legal, finance, human resources, commercial and communications functions that report to the Chief Executive Officer. The CSC supports the CIO in overseeing and managing information security risks and in the event of a cybersecurity incident provides oversight and leadership with respect to incident investigation, mitigation, and remediation.


text: At the Board level, Atkore's cybersecurity is overseen by a subset of the full Board of Directors, specifically the independent board members. This oversight includes a quarterly review of Atkore's cybersecurity program, including key program metrics, initiatives, and developments. In addition, in the event of a significant cybersecurity incident, Atkore's policy and process require engagement of, and consultation with, the Board of Directors.


text: Additional information about cybersecurity risks we face is discussed in "Item 1A. Risk Factors," which should be read in conjunction with the information above.


text: We also maintain an Executive Cyber Incident Escalation Team ("ECIET"), which consists of our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Senior Vice President - General Counsel, Chief Information Officer ("CIO") and the Chief Information Security Officer ("CISO"). The ECIET meets annually to practice and refine our processes through tabletop exercises simulating cyberattacks for incident response, management and escalation at both technical and executive levels in order to maintain readiness to respond and to identify any areas where improvements or updates to our cybersecurity infrastructure or procedures are required.

companyName: MOOG INC.

ticker: MOG-A


text: Risk Management and Strategy Cybersecurity risk management is a critical component of the Company's overall risk management. The Company proactively addresses cybersecurity risk through a comprehensive cybersecurity program to identify, protect, respond to, and manage any reasonably foreseeable cybersecurity risks, threats and incidents. The Company's cybersecurity risk management program is aligned with the International Standards Organization (ISO 27001:2022) and mapped to National Institute of Standards Special Publication 800-53 Revision 5 (NIST 800-53). The Company's cybersecurity program is integrated into the Company's overarching enterprise risk management program.

companyName: Vestis Corp

ticker: VSTS


text: The Company's Chief Information Security Officer (CISO) is responsible for developing and managing the Company's cybersecurity program and reporting on cybersecurity matters to management, the Audit Committee and the Company's Board of Directors. The CISO has over twenty years of cybersecurity and technology experience, originating with cryptography and security experience as a military officer and progressing through senior management roles at prominent global audit and technology consulting corporations. The CISO is supervised by the Company's Chief Information Officer.


text: The Company has established and maintains a cross-functional Cyber Governance Committee that is responsible for helping the CISO prioritize and manage evolving cyber risks and reports to the Company's Chief Information Officer. The Cyber Governance Committee, which oversees the Company's governance and oversight of information security, meets quarterly and interfaces with other functional areas within the Company, including, but not limited to, legal, internal audit, accounting, risk management, human resources, as well as external third-party partners. The CISO serves as the chair of the Cyber Governance Committee. The CISO also provides response and oversight during any significant cybersecurity incidents and informs the Cyber Governance Committee of all cybersecurity incidents that have been identified by the Company to date.


text: The Company engages third parties to assist with the monitoring components of the security infrastructure that we have deployed. As required, the Company engages consultants and third parties to assist with penetration testing, tabletop incident response exercises, or other activities necessary to comply with various standards and certifications that are necessary for the Company's business operations. The Company provides regular awareness training to its employees and consultants using its collaboration platforms to help identify, avoid, and mitigate cybersecurity threats, as well as targeted security training for key departments that routinely process, store or handle sensitive data types. Where service providers are materially utilized, the company obtains SOC1 or SOC2 reports and complies with complementary user entity controls to keep those attestations valid. Where needed, the Company requires appropriate certifications and contractually requires adherence to data privacy and security requirements from its vendors.


text: The Company operates technologies that are exposed to the internet, and although robust cybersecurity programs, technologies, and safeguards are deployed to help protect the Company's operations and assets, the Company, by nature, is exposed to material cybersecurity attacks that are either generally targeted at companies that operate on the internet, or the Company, by nature, remains exposed to attacks that are specifically directed at the Company's technology systems exposed to the internet.


text: The Company's Board of Directors recognizes the importance of cybersecurity and has ultimate oversight of the Company's cybersecurity risk management program. As reflected in the Audit Committee's charter, the Audit Committee of the Company's Board of Directors has been delegated certain cybersecurity oversight responsibility and, among other things, monitors the Company's cybersecurity risk profile, receives periodic updates from management on all matters related to cybersecurity and reports to the full Board of Directors. The CISO presents quarterly updates to the Audit Committee on the Company's cyber risks and threats, status of projects to strengthen the Company's information security systems, and emerging threats.


text: During the normal course of business, the Company has experienced and expects to continue to experience cyber-based attacks and other attempts to compromise its information systems. Based on the information that the Company had as of the end of the fiscal year covered by this Annual Report on Form 10-K, the Company does not believe that it has experienced any cybersecurity incidents that have materially affected the Company. However, the sophistication of cyber threats continues to increase, and the preventative actions the Company has taken and continues to take to reduce the risk of cyber incidents and protect its systems and information may not successfully protect against all cyber incidents. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors."