text: Management Expertise Adient's global information operations security leader has over 30 years of experience in IT with a focus on cybersecurity for the past 25 years, reporting into Adient's Chief Information Officer, who has over 25 years of IT related experience and who further reports into Adient's Executive Vice President of Global IT & Business Services and Sustainability as well as the senior executive team and the Audit Committee and the Board, as necessary.


text: For the year ended September 30, 2025, Adient did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect Adient's business strategy, results of operations, or financial condition. For further information about the risks associated with cybersecurity incidents, refer to the cybersecurity risk factor in Item 1A, "Risk Factors" in this Form 10-K.

companyName: Adient plc

ticker: ADNT

secItem: Item 1C


text: Management Expertise Adient's global information operations security leader has over 30 years of experience in IT with a focus on cybersecurity for the past 26 years, reporting into Adient's Chief Information Officer, who has over 25 years of IT related experience and who further reports into Adient's Executive Vice President of Global IT & Business Services and Sustainability as well as the senior executive team and the Audit Committee and the Board, as necessary.


text: Risk Management and Strategy We operate a risk-based cybersecurity program dedicated to protecting the confidentiality, integrity and availability of our information systems and the information residing therein.

companyName: YETI Holdings, Inc.

ticker: YETI


text: YETI's cybersecurity program has been integrated into our enterprise risk framework, which identifies, aggregates, and evaluates risks across the enterprise. The enterprise risk framework is integrated with our annual planning, internal audit scoping, and management process. Our internal audit team annually facilitates an enterprise risk assessment with senior management and, through this process, we identify and assess material risks impacting our company and our operations and strategic objectives, which includes information technology and security risks. Management and the Board rank YETI's risks based on their potential impact to YETI's ability to meet our strategic priorities. Management determines appropriate risk responses for each identified enterprise risk. Outside of this annual process, management is responsible for our day-to-day risk management activities.


text: Our Information Technology team (which includes our Director of Cybersecurity) and our Technology Compliance team (which includes our Director of Technology Compliance) have primary responsibility for the implementation of our cybersecurity program and the management of our responses to information technology and security risks, including risks related to cybersecurity threats. Our cybersecurity program has been developed based on industry standards, including those published by the International Organization for Standardization and the National Institute of Standards Technology.


text: We utilize a layered approach in managing and protecting against cybersecurity threats and in detecting and responding to cybersecurity incidents. Although we have numerous practices and processes to protect against common cybersecurity incidents, some attacks or other breaches may still be effective. Such practices and processes are designed to detect, triage and contain these cybersecurity incidents. These controls include: • Identification: In addition to technology-based detection capabilities, there are numerous ways employees can report suspected or actual events, including through our internal information technology ticketing system, by emailing the cybersecurity or privacy team emails, or by submitting a report through the compliance hotline. External parties can also report a vulnerability through the link in the footer of our website. • Technical Safeguards: We leverage outside partnerships to gain intelligence on threats and continue to adjust our protection mechanisms (including firewalls, anti-malware functionality and access controls) to be effective. We have systems in place that are designed to securely receive and store information and to detect, contain, and respond to data security incidents. • Incident Response: We maintain a comprehensive incident response plan to guide our response to a cybersecurity incident. Events are analyzed and categorized into one of four severity tiers and an incident response team is formed (whose membership depends on the nature of the incident). In addition to taking actions to respond to and remediate the incident, the incident response team also considers external notification and disclosure obligations. The incident response plan provides for prompt escalation of certain cybersecurity incidents to a multi-disciplinary committee so that decisions regarding the public disclosure of such incidents can be made in a timely manner. • Testing: We engage in periodic assessment and testing of our policies, processes, and practices that are designed to address cybersecurity threats and incidents. For example, we hire a third party to perform an annual penetration test on our website, internal network, and cloud environments. Our other efforts vary from year to year, but have in the past included an information security maturity assessment, risk assessment, tabletop exercises, and threat modeling. The results of such efforts are reported to the Audit Committee of the Board (the "Audit Committee") and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessment, exercise or review. • Education and Awareness: We have a cybersecurity and information security training and compliance program in place to support our employees and directors. As part of this program YETI employees are subject to reoccurring phishing exercises. The results of these exercises are used to inform the subject matter and frequency of additional training modules that employees are required to complete. In addition, employees annually receive training on data privacy and information security, including cybersecurity. YETI also maintains a number of policies that apply to employees and contractors, including a Global Internal Data Protection and Privacy Policy, an Acceptable Use Policy, and a Password Policy.


text: • Insurance: YETI also maintains a cybersecurity and information security risk insurance policy. • Third Parties: YETI has processes in place to oversee and identify risks from cybersecurity threats associated with third-party vendors. Such processes vary based on factors such as the type of vendor, whether the relationship will implicate our technology, and the type of data involved, if any.


text: To date, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that we are aware of, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected all cybersecurity incidents or cybersecurity threats. Please refer to the risk factor titled "We rely significantly on information technology, and any compromise or interruption of that technology resulting from cybersecurity incidents, data security breaches, design defects or system failures could have a material negative impact on our business" in Part I, Item 1A of this Report for additional information about the risks associated with cybersecurity threats.


text: As part of its oversight function, the Board plays an active role, both as a whole and at the committee level, in overseeing management of YETI's cybersecurity risks. The Audit Committee has primary oversight responsibility for our overall enterprise risk assessment and risk management policies and systems, which includes risks related to our information technology and security systems, processes, and procedures, including risks related to cybersecurity threats. The Audit Committee receives quarterly presentations regarding our enterprise risk management program, including reports from our Director of Cybersecurity, on information security matters (such as cybersecurity risk and developments), as well as the steps management takes to monitor and control such exposures. These presentations address, among other things, the results of the most recent assessment or testing of our security information systems and our cybersecurity measures; the current threat environment; and cybersecurity trends and best practices. As applicable, these quarterly presentations also include reports of cybersecurity incidents affecting our information systems along with updates on the status of prior cybersecurity incidents and applicable remediation efforts. Such quarterly presentations given to the Audit Committee are summarized and shared with the Board at its next meeting by the Audit Committee Chair. Outside of such quarterly presentations, senior leadership would be expected to update the Audit Committee and the Board in real time of incidents deemed material and requiring disclosure in a Securities and Exchange Commission filing or of other "critical" or "high" severity incidents (the highest severity tiers under our incident response plan) that in senior leadership's discretion require more immediate Audit Committee attention. In addition, the internal audit team provides quarterly cybersecurity updates to either the Audit Committee or the full Board regarding our risk analyses, assessments, risk mitigation strategies, and activities. As described above, management is responsible for our day-to-day risk management activities and identifies and manages areas of material risk, which includes information technology and security. Our Chief Financial Officer oversees our Information Technology team, which includes the Director, Cybersecurity. Our Chief Legal Officer oversees our Compliance team, which includes our Director, Technology Compliance. We believe that such cross-departmental involvement promotes a collaborative approach to protecting the Company's information systems from cybersecurity threats, detecting cybersecurity incidents and responding to cybersecurity incidents in accordance with our incident response plan. Through the practices and policies described above, including our incident response plan, our Director, Cybersecurity and Director, Technology Compliance are informed about cybersecurity threats and incidents affecting our information systems and lead the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time. Incidents deemed "critical" or "high" are immediately escalated to the Chief Financial Officer, Chief Legal Officer, other senior leadership, and the Audit Committee.


text: The Director, Cybersecurity has served in various roles in information technology and information security for over 24 years. Prior to joining YETI, he was a principal information security engineer for a global information technology consulting company. The Director, Cybersecurity holds an undergraduate degree in information technology, a master's degree in information systems and technology management and has attained the professional certifications of Certified Information Systems Security Professional and Certified Information Systems Auditor. The Director, Technology Compliance has served in various roles in information technology for 11 years, including as a compliance manager for a large software company and information technology consultant for a major consulting firm. The Director, Technology Compliance holds an undergraduate degree in accounting and a master's degree in management information systems and has attained the professional certifications of Certified Information Systems Auditor. Our Chief Legal Officer has over 13 years of experience managing risks, including risks arising from cybersecurity threats, in an officer capacity. Our Chief Financial Officer has 20 years of experience managing risks at large companies.


text: Our Chief Information Officer ("CIO"), Director, Cyber Security (who reports to the CIO) and our Director, Technology Compliance (who ultimately reports to the Chief Legal Officer) have primary responsibility for the implementation of our cybersecurity program and the management of our responses to information technology and security risks, including risks related to cybersecurity threats. Our cybersecurity program has been developed based on industry standards, including those published by the International Organization for Standardization and the National Institute of Standards Technology.


text: We utilize a layered approach in managing and protecting against cybersecurity threats and in detecting and responding to cybersecurity incidents. Although we have numerous practices and processes to protect against common cybersecurity incidents, some attacks or other breaches may still be effective. Such practices and processes are designed to detect, triage and contain these cybersecurity incidents. These controls include: • Identification: In addition to technology-based detection capabilities, there are numerous ways employees can report suspected or actual events, including through our internal information technology ticketing system, by emailing the cybersecurity or privacy team emails, or by submitting a report through the compliance hotline. External parties can also report a vulnerability through the link in the footer of our website. • Technical Safeguards: We leverage outside partnerships to gain intelligence on threats and continue to adjust our protection mechanisms (including firewalls, anti-malware functionality and access controls) to be effective. We have systems in place that are designed to securely receive and store information and to detect, contain, and respond to data security incidents. • Incident Response: We maintain a comprehensive incident response plan to guide our response to a cybersecurity incident. Events are analyzed and categorized into one of four severity tiers and an incident response team is formed (whose membership depends on the nature of the incident). In addition to taking actions to respond to and remediate the incident, the incident response team also considers external notification and disclosure obligations. The incident response plan provides for prompt escalation of certain cybersecurity incidents to a multi-disciplinary committee so that decisions regarding the public disclosure of such incidents can be made in a timely manner. • Testing: We engage in periodic assessment and testing of our policies, processes, and practices that are designed to address cybersecurity threats and incidents. For example, we hire a third party to perform an annual penetration test on our website, internal network, and cloud environments. Our other efforts vary from year to year, but have in the past included an information security maturity assessment, risk assessment, tabletop exercises, and threat modeling. The results of such efforts are reported to the Audit Committee of the Board (the "Audit Committee") and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessment, exercise or review. • Education and Awareness: We have a cybersecurity and information security training and compliance program in place to support our employees and directors. As part of this program YETI employees are subject to reoccurring phishing exercises. The results of these exercises are used to inform the subject matter and frequency of additional training modules that employees are required to complete. In addition, employees annually receive either reminders or training on data privacy and information security, including cybersecurity. YETI also maintains a number of policies that apply to employees and contractors, including a Global Internal Data Protection and Privacy Policy, an Acceptable Use Policy, and a Password Policy.


text: As part of its oversight function, the Board plays an active role, both as a whole and at the committee level, in overseeing management of YETI's cybersecurity risks. The Audit Committee has primary oversight responsibility for our overall enterprise risk assessment and risk management policies and systems, which includes risks related to our information technology and security systems, processes, and procedures, including risks related to cybersecurity threats. The Audit Committee receives quarterly presentations regarding our enterprise risk management program, including reports from our CIO and Director, Cyber Security, on information security matters (such as cybersecurity risk and developments), as well as the steps management takes to monitor and control such exposures. These presentations address, among other things, the results of the most recent assessment or testing of our security information systems and our cybersecurity measures; the current threat environment; and cybersecurity trends and best practices. As applicable, these quarterly presentations also include reports of cybersecurity incidents affecting our information systems along with updates on the status of prior cybersecurity incidents and applicable remediation efforts. Such quarterly presentations given to the Audit Committee are summarized and shared with the Board at its next meeting by the Audit Committee Chair. Outside of such quarterly presentations, senior leadership would be expected to update the Audit Committee and the Board in real time of incidents deemed material and requiring disclosure in a Securities and Exchange Commission filing or of other "critical" or "high" severity incidents (the highest severity tiers under our incident response plan) that in senior leadership's discretion require more immediate Audit Committee attention. In addition, the internal audit team provides quarterly cybersecurity updates to either the Audit Committee or the full Board regarding our risk analyses, assessments, risk mitigation strategies, and activities. As described above, management is responsible for our day-to-day risk management activities and identifies and manages areas of material risk, which includes information technology and security. Our CIO, who reports to our Chief Financial Officer, oversees our Information Technology and Cybersecurity teams, including the Director, Cyber Security. Our Chief Legal Officer oversees our Compliance team, which includes our Director, Technology Compliance. We believe that such cross-departmental involvement promotes a collaborative approach to protecting the Company's information systems from cybersecurity threats, detecting cybersecurity incidents and responding to cybersecurity incidents in accordance with our incident response plan. Through the practices and policies described above, including our incident response plan, our CIO, Director, Cyber Security and Director, Technology Compliance are informed about cybersecurity threats and incidents affecting our information systems and lead the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time. Incidents deemed "critical" or "high" are immediately escalated to the Chief Financial Officer, Chief Legal Officer, other senior leadership, and the Audit Committee.


text: Our CIO has served in various executive leadership roles for over 10 years and has over 30 years of experience in technology. Prior to joining YETI, he was the Senior Vice President of Consumer Technologies at a large publicly traded cosmetics company. The CIO holds a Masters of Business Administration. Our Director, Cyber Security has served in various roles in information technology and information security for over 25 years. Prior to joining YETI, he was a principal information security engineer for a global information technology consulting company. Our Director, Cyber Security holds an undergraduate degree in information technology, a master's degree in information systems and technology management and has attained the professional certifications of Certified Information Systems Security Professional and Certified Information Systems Auditor. Our Director, Technology Compliance has served in various roles in information technology for 12 years, including as a compliance manager for a large software company and information technology consultant for a major consulting firm. Our Director, Technology Compliance holds an undergraduate degree in accounting and a master's degree in management information systems and has attained the professional certifications of Certified Information Systems Auditor. Our Chief Legal Officer has over 14 years of experience managing risks, including risks arising from cybersecurity threats, in an officer capacity. Our Chief Financial Officer has 20 years of experience managing risks at large companies.


text: Risk Management and Strategy Risk is an inherent component of the Company's strategic activities and operating environment. The ability to effectively identify, assess, measure, respond, monitor, and report on risks is critical to the achievement of the Company's mission and strategic objectives. Cybersecurity risk, including the risk of managing cybersecurity threats, is a key risk integrated into our enterprise risk management ("ERM") program and processes. In addition to cybersecurity risk being included in our annual enterprise risk assessment process, other cybersecurity-related risk assessments, such as threat and vulnerability assessments, are performed regularly. Cybersecurity risk is also considered in the Company's annual fraud risk assessment.

companyName: NeueHealth, Inc.

ticker: NEUE


text: Annually, the Company completes a National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") maturity assessment to identify and evaluate the areas of strength and opportunities for improvement. These maturity assessments, which are performed leveraging independent third-party advisors or through self-assessments, evaluate the organization's cyber maturity based on predefined standards and criteria (e.g., NIST Special Publication (SP) 800-66). Results of these assessments commonly set the roadmap for future cybersecurity improvement initiatives.


text: Additionally, for third party vendors providing services to the Company, a security risk assessment is completed during vendor due diligence, before execution of agreements. The assessment evaluates, among other areas, the vendors' data security, access identity, endpoint protection and incident management and response capabilities. Vendors are required to either complete a security questionnaire based on the HIPAA Security Rule requirements or provide evidence of a current Service Organization Control report completed by a third-party, Health Information Trust Alliance certification, or similar security and compliance attestation. These risk assessments are refreshed regularly during the duration of an agreement with the vendor, and the results can be used to influence the vendor to make improvements where weaknesses in their security and compliance measures are identified.


text: Board of Directors The Board of Directors has direct responsibility for the risk profile of the Company, as defined by the requirements of the shareholders. Inherently included in the Company's risk profile is the risk of cybersecurity threats. The Audit Committee of the Board of Directors has been delegated the responsibility to oversee the management of risks for the Company, including those pertaining to cybersecurity. The Audit Committee is responsible for: • Providing oversight of risks, including but not limited to finance, operations, information technology and information security, privacy, legal and regulatory. • Meeting periodically with management to review the Company's significant risks and the steps management has taken to monitor, control or mitigate such risks. • Reviewing required disclosures pertaining to risks.


text: Cybersecurity risk is a standing agenda topic at quarterly Audit Committee meetings. Common topics discussed include, but are not limited to, cybersecurity risks, threats and vulnerabilities, and the related monitoring activities, as well as progress made with the Company's information security roadmap. The Audit Committee is apprised of the results of cybersecurity risk assessment and prevention/detection activities (e.g., vulnerability scanning, penetration testing, security awareness training) as well as any changes to cybersecurity laws and regulations, current leading practices, and the changing threat landscape.


text: Annually, the results of the Company's enterprise risk assessment are presented to the Audit Committee. These results include a discussion on the top enterprise risks (including, when appropriate, cybersecurity risk) identified through the enterprise risk assessment process, controls in place to address the risks, as well as the mitigation plans management will take to address any uncontrolled risks.


text: Following most Audit Committee meetings, the Chair of the Audit Committee provides an update to the full Board of Directors at the Board's next regularly scheduled meeting. It is through this update where the Board of Directors would be apprised of any material risks or threats, including those pertaining to cybersecurity matters.


text: Management of risks, including risks of cybersecurity threats, is delegated to the Company's Head of Information Security, who reports administratively to the Chief Information Officer and has informal reporting relationships with the General Counsel and Chief Audit Executive. The Head of Information Security has over 30 years of information technology and security experience with assessing and managing cybersecurity threats and is responsible for the day-to-day information security program objectives. The Head of Information Security is also responsible for attending quarterly Audit Committee meetings and reporting results of the cybersecurity program to the Audit Committee, including results of preventative activities (e.g. endpoint protection, security training), ongoing monitoring activities (e.g., vulnerability testing), and remediation activities (e.g., issues identified through audits and assessment activities).


text: The Head of Information Security utilizes various tools and resources to manage and monitor cybersecurity threats, vulnerabilities, and incidents, most of which are delivered through third-party solutions. Examples include, but are not limited to: • Endpoint and network device vulnerability identification and scanning • Internal and external penetration testing services with an emphasis on on-premise and cloud security • Security training and awareness, with an emphasis on phishing threats • Third-party security risk assessments • NIST CSF assessment tools • Security information and event management for monitoring infrastructure events.


text: The Company's enterprise threat and vulnerability identification and detection capabilities operate on an ongoing basis, with results reported to Information Security daily. The capabilities utilize endpoint sensors and network scanning to meet and maintain leading bad actor tactics and techniques, including machine learning and artificial intelligence, to protect against potential malicious threats or other potentially unwanted programs or identity abuse, including privilege escalation or abuse of least privilege access enforced by the Company. The information gathered by the Head of Information Security through these activities, through assessment results provided by cybersecurity consultants or advisors, as well as through gathering cyber-risk landscape insights from various other third-party sources, informs the Company's assessment of the risk of cybersecurity threats.


text: Finally, the Company's Disclosure Committee is responsible for assisting the CEO, CFO and Audit Committee to prepare SEC-required disclosures, confirming the Company's disclosure controls and procedures are properly implemented and asserting the accurate, complete, timely and fair presentation of public disclosures. The Disclosure Committee is comprised of the Company's CFO, Chief Accounting Officer, General Counsel, Chief Audit Executive, Head of Information Security, and senior members of our external reporting, financial planning and analysis, and tax departments. The Disclosure Committee meets quarterly prior to the issuance of required quarterly SEC filings, and in these meetings relevant cybersecurity risks would be discussed.


text: Based on the Company's most recent assessments of cybersecurity risk, as of the date of this Form 10-K, we are not aware of any risk from cybersecurity threats that has caused or is reasonably likely to cause a material effect on the Company's business strategy, results of operations, or financial condition. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor under the caption "Risks Related to our Intellectual Property, Information Technology, and Data Privacy" included in Part I, Item 1A. - Risk Factors" in this Form 10-K.


text: Management of risks, including risks of cybersecurity threats, is delegated to the Company's Associate Vice President (AVP) of IT Infrastructure and Security. This leader reports administratively to the Vice President of Technology and has informal reporting relationships with the General Counsel and Chief Audit Executive. The AVP of IT Infrastructure and Security has over 25 years of information technology and security experience and are responsible for the day-to-day information security program objectives. They are also responsible for attending quarterly Audit Committee meetings and reporting results of the cybersecurity program to the Audit Committee, including results of preventative activities (e.g. endpoint protection, security training), ongoing monitoring activities (e.g., vulnerability testing), and remediation activities (e.g., issues identified through audits and assessment activities).


text: The Information Security team utilizes various tools and resources to manage and monitor cybersecurity threats, vulnerabilities, and incidents, most of which are delivered through third-party managed services and/or solutions. Examples include, but are not limited to: • Endpoint and network device vulnerability identification and scanning • Internal and external penetration testing services with an emphasis on on-premise and cloud security • Security training and awareness, with an emphasis on phishing threats • Third-party security risk assessments • NIST CSF assessment tools • Security information and event management for monitoring infrastructure events.


text: The Company's enterprise threat and vulnerability identification and detection capabilities operate on an ongoing basis, with results reported weekly. The capabilities utilize endpoint sensors and network scanning to meet and maintain leading bad actor tactics and techniques, including machine learning and artificial intelligence, to protect against potential malicious threats or other potentially unwanted programs or identity abuse, including privilege escalation or abuse of least privilege access enforced by the Company.


text: Finally, the Company's Disclosure Committee is responsible for assisting the CEO, CFO and Audit Committee to prepare SEC-required disclosures, confirming the Company's disclosure controls and procedures are properly implemented and asserting the complete, accurate, timely and fair presentation of public disclosures. The Disclosure Committee is comprised of the Company's CFO, Chief Accounting Officer, General Counsel, Chief Audit Executive, AVP of IT Infrastructure and Security, and senior members of our external reporting, financial planning and analysis, and tax departments. The Disclosure Committee meets quarterly prior to the issuance of required quarterly SEC filings, and in these meetings relevant cybersecurity risks would be discussed.


text: Our information security function, which is led by our Chief Information Officer ("CIO"), helps identify, assess and manage our cybersecurity threats and risks, including through the use of our risk register. The information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, manual tools and automated tools, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating certain threats reported to us, internal and external audits, leveraging third party threat assessments, and conducting vulnerabilities assessments.

companyName: Immunocore Holdings plc

ticker: IMCR


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk register.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants, cybersecurity service providers, and penetration testing services.


text: We also use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations, contract manufacturing organizations, and other distributors, including those who process clinical trial data on our behalf. Depending on the nature of the services provided, the sensitivity of the critical systems, information and assets at issue, and the identity of the provider, our third-party risk management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including, for example, a review of security assessments and imposition of contractual obligations related to cybersecurity on the provider.


text: Risk Management and Strategy Management has implemented a program to protect the confidentiality, integrity and availability of our information systems and to identify, assess, manage and report on material risks from cybersecurity threats. The program is managed by an in-house cybersecurity team, and the program includes risk management and mitigation processes, such as malware protection, access management, technical vulnerability management and security incident response among other processes and technical safeguards; communication with third-party providers of services regarding their information security practices and disclosed cybersecurity incidents; the use of third-party service providers, as appropriate, for monitoring and mitigating cybersecurity threats and conducting penetration tests; education and training across the organization to mitigate cybersecurity threats to employees and our company; the maintenance of cybersecurity breach insurance; and disaster recovery and business continuity arrangements to minimize the potential impact to our operations in the event of a cybersecurity incident.

companyName: Trade Desk, Inc.

ticker: TTD


text: The cybersecurity program is aligned with our enterprise risk framework. Members of our cybersecurity, enterprise risk management, finance and legal teams collaboratively assess the degree of risk to our business and operations from cybersecurity threats and incidents to develop incident response plans and risk mitigation practices. Risk is assessed across the potential technological, operational, financial, legal, regulatory and reputational impacts to our company, including the materiality of cybersecurity incidents pursuant to SEC disclosure rules.


text: Although we follow guidance from various standards related to cybersecurity and engage third-party attestation services to test controls relevant to our business, this does not imply that we meet any particular technical standards, specifications or requirements.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, financial condition or results of operations. However, we remain subject to unknown or future cybersecurity threats that could materially affect us, including our business strategy, financial condition or results of operations. See "Item 1A. Risk Factors" for a discussion of various risks related to cybersecurity.


text: Our board of directors has delegated oversight of all risk assessment and risk management activities to the audit committee. The audit committee provides strategic oversight of management's risk management practices, including cybersecurity. Regular and ad hoc reporting from management, such as the executive risk committee (as described below), to the audit committee may include information about the prevention, detection, mitigation and remediation of material cybersecurity incidents, if any.


text: Our executive risk committee, which is comprised of our Chief Financial Officer, Chief Legal Officer and Senior Vice President, Technology, oversees the cybersecurity risk assessment and mitigation activities and receives regular reports from our cybersecurity team regarding the nature, timing and extent of incidents that occur across the Company's internal environments and those disclosed by third-party service providers, if applicable. Our cybersecurity team is comprised of technically skilled professionals with computer science, cybersecurity assurance or other cybersecurity degrees and professional experience in monitoring, detecting, mitigating and preventing cybersecurity incidents and testing cybersecurity processes. The executive risk committee has expertise in the pertinent financial, legal, regulatory, operational and technical areas to assess the impact of cybersecurity risks and incidents across the business and oversee our response to and disclosure of such incidents. In particular, our Senior Vice President, Technology brings decades of technical experience to our executive risk committee along with technical education in computer engineering.


text: The cybersecurity program is aligned with our enterprise risk framework. Members of our cybersecurity, enterprise risk management, engineering, finance and legal teams collaboratively assess the degree of risk to our business and operations from cybersecurity threats and incidents to develop incident response plans and risk mitigation practices. Risk is assessed across the potential technological, operational, financial, legal, regulatory and reputational impacts to our company, including the materiality of cybersecurity incidents pursuant to SEC disclosure rules.


text: We have not identified risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, financial condition or results of operations. However, we remain subject to unknown or future cybersecurity threats that could materially affect us, including our business strategy, financial condition or results of operations. See "Item 1A. Risk Factors" for a discussion of various risks related to cybersecurity.


text: Our executive risk committee, which is comprised of our Chief Financial Officer, Chief Legal Officer and Senior Vice President, Engineering Operations, oversees the cybersecurity risk assessment and mitigation activities and receives regular reports from our cybersecurity team regarding the nature, timing and extent of incidents that occur across the Company's internal environments and those disclosed by third-party service providers, if applicable. Our cybersecurity team is comprised of technically skilled professionals with computer science, cybersecurity assurance or other cybersecurity degrees and professional experience in monitoring, detecting, mitigating and preventing cybersecurity incidents and testing cybersecurity processes. The executive risk committee has expertise in the pertinent financial, legal, regulatory, operational and technical areas to assess the impact of cybersecurity risks and incidents across the business and oversee our response to and disclosure of such incidents. In particular, our Senior Vice President, Engineering Operations brings decades of technical experience to our executive risk committee along with technical education in computer engineering.


text: To more effectively prevent, detect and respond to cyber and information security threats, we maintain a global cyber security risk management program designed to identify, assess, and manage material risks from cybersecurity threats. Our risk management program is supervised by a dedicated Senior Director of Cyber & Information Security (the "SDCIS"), who has more than 30 years of experience in cybersecurity and information technology in both private industry and the United States Air Force. The SDCIS is responsible for leading an enterprise-wide cyber security strategy, policy, standards, architecture and processes. The SDCIS reports directly to our Executive Vice President and Chief Technology and Digital Officer (the "CTDO"). For information regarding the relevant expertise and qualifications of our CTDO, see "Information About Our Executive Officers" included in Part I of this report. The cyber risk management program is based on a leading cyber risk controls framework and includes periodic maturity and risk assessments.

companyName: Acushnet Holdings Corp.

ticker: GOLF


text: Our Board of Directors has established oversight mechanisms to manage risks from cybersecurity threats. The Audit Committee has responsibility for overseeing our cyber and information security program, which institutes and maintains controls for our systems, applications, and databases and for our third-party providers. The Audit Committee receives quarterly updates on the status of the cyber risk management program from the CTDO which include, among other things, a review of a dynamic and emerging cyber threat landscape, security events of note, updates on cyber risks and threats and the status of projects to strengthen and mature our cyber and information security program. Additionally, the SDCIS chairs the Cybersecurity Risk Committee, which seeks to drive awareness, ownership and alignment across broad governance and risk stakeholder groups for enhanced effectiveness of cybersecurity risk management and reporting. Members of senior management also discuss cybersecurity developments with the CTDO and SDCIS between meetings. Top identified cyber risks, metrics and measures of the effectiveness of the cyber risk management program are reviewed quarterly at the Cybersecurity Risk Committee and Company Risk Management Committee. Our Board also receives periodic updates from the CTDO and the SDCIS relating to cyber and information security risks.


text: We annually engage third parties (as well as our own internal audit department) to audit our cyber and information security programs, processes and controls, and the findings of these parties are reported to the Audit Committee and the full Board. These audits also include annual penetration testing and web application assessments by third parties to test control effectiveness against threat actor attack techniques.


text: Our processes also address cybersecurity risks associated with our use of third-party service providers. We oversee third-party service providers by conducting vendor diligence upon onboarding and ongoing monitoring. Vendors are assessed for risk based on the nature of their service, access to data and systems and supply chain risk and, based on that assessment, we conduct diligence that may include completing security questionnaires, onsite evaluation, penetration test and policy reviews, and scans or other technical evaluations. We also partner and actively engage with key vendors and industry participants to share intelligence, best practices and benchmarking data with other member organizations of the Retail and Hospitality Information Sharing and Analysis Center, which aims to help its members improve their security posture and resilience against cyber-attacks.


text: We maintain a Cyber and Data Security Incident Response Plan to more effectively respond to cyber and information security events. Periodically, we conduct a cybersecurity incident response tabletop exercise to test response actions of the Security Incident Response Team, to facilitate group discussions regarding the effectiveness of our cybersecurity incident response strategies and tactics and to update the plan with any lessons learned from the exercise.


text: Our Security Awareness Program includes training that reinforces cybersecurity risk management policies, standards and practices, as well as the expectation that employees comply with these policies. The Security Awareness Program also trains personnel on how to identify potential cybersecurity risks and protect our resources and information. This training is mandatory for all relevant employees globally on a periodic basis, and it is supplemented by firmwide testing initiatives, including quarterly phishing tests. We provide specialized security training for certain employees such as application developers, human resources and finance teams. Finally, our Global Privacy Program requires all relevant employees to take periodic awareness training on data privacy. This privacy-focused training includes information about the relevant laws, confidentiality and security, as well as how to effectively report and respond to unauthorized access to or use of personal information.


text: As of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations or financial condition. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. For more information about the cybersecurity risks we face, see the risk factor in Item 1A entitled "We rely on complex information systems for management of our manufacturing, distribution, sales and other functions. If our information systems fail to perform these functions adequately or if we experience an interruption in our operations, including a breach in cybersecurity, our business, financial condition and results of operations could be materially adversely affected."


text: To more effectively prevent, detect and respond to cyber and information security threats, we maintain a global cyber security risk management program designed to identify, assess, and manage material risks from cybersecurity threats and to protect the security, confidentiality, integrity and availability of our critical information technology systems and information. Our cybersecurity risk management program is supervised by a dedicated Senior Director of Cyber & Information Security (the "SDCIS"), who has more than 30 years of experience in cybersecurity and information technology in both private industry and the United States Air Force. The SDCIS is responsible for leading an enterprise-wide cyber security strategy, policy, standards, architecture and processes. The SDCIS reports directly to our Executive Vice President and Chief Technology and Digital Officer (the "CTDO"). For information regarding the relevant expertise and qualifications of our CTDO, see "Information About Our Executive Officers" included in Part I of this report. The cyber risk management program is based on a leading cyber risk controls framework and includes periodic maturity and risk assessments.


text: Our b oard of directors has established oversight mechanisms to manage risks from cybersecurity threats. The Audit Committee has responsibility for overseeing our cyber and information security program, which institutes and maintains controls for our systems, applications, and databases and for our third-party providers. The Audit Committee receives quarterly updates on the status of the cyber risk management program from the CTDO which include, among other things, a review of a dynamic and emerging cyber threat landscape, security events of note, updates on cyber risks and threats and the status of projects to strengthen and mature our cyber and information security program. Additionally, the SDCIS chairs the Cybersecurity Risk Committee, which seeks to drive awareness, ownership and alignment across broad governance and risk stakeholder groups for enhanced effectiveness of cybersecurity risk management and reporting. Members of senior management also discuss cybersecurity developments with the CTDO and SDCIS between meetings. Top identified cyber risks, metrics and measures of the effectiveness of the cyber risk management program are reviewed quarterly at the Cybersecurity Risk Committee and Company Risk Management Committee. Our Board also receives periodic updates from the CTDO and the SDCIS relating to cyber and information security risks.


text: As of the date of this report, we have not experienced any current or past cybersecurity incidents that resulted in a material effect on our business strategy, results of operations or financial condition. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. For more information about the cybersecurity risks we face, see the risk factor in Item 1A entitled "We rely on complex information systems to manage our manufacturing, distribution, sales and other functions. If our information systems fail to perform these functions adequately or if we experience an interruption in our operations, including a breach in cybersecurity, our business, financial condition and results of operations could be materially adversely affected."


text: Risk Management and Strategy We maintain a comprehensive process for assessing, identifying and managing material risks from cybersecurity threats as part of our overall risk management system and processes. Our cybersecurity risk management processes include the following: a. We leverage the National Institute of Standards and Technology ("NIST") framework to help ensure the Company's risk posture remains in alignment with the Company's overall risk appetite.

companyName: JELD-WEN Holding, Inc.

ticker: JELD


text: b. The Company utilizes policies, software, training programs, hardware solutions and managed services to protect and monitor our environment, including multifactor authentication on all critical systems, firewalls, intrusion detection and prevention systems, vulnerability and penetration testing, identity and access management systems and 24x7 security operations center.


text: c. The Company's approach to managing cybersecurity and digital risk is led by our CIO and CISO. Our CIO is supported by the Company at the highest levels and regularly engages with cross-functional teams at the Company, including Legal, Audit, Finance, Human Resources and Enterprise Risk Management.


text: d. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident. Such insurance may be insufficient to cover all losses or all types of claims that may arise.


text: e. Our cybersecurity team conducts semi-annual cyber awareness training for professional associates using an independent third-party security training provider to educate best practices, policies and responsibilities pertaining to cybersecurity. We also conduct quarterly simulated phishing tests to generate awareness and run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our practices, procedures and technologies.


text: f. Our cybersecurity incident response plan coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, communicate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: g. Our cybersecurity team regularly conduct tests of our information security environment and controls through vulnerability scanning, penetration testing and attack simulation testing.


text: Additionally, our cybersecurity risk management processes include review and assessment by external, independent third parties, who assess the maturity of our cybersecurity program and identify areas for continued focus and improvement. Furthermore, our Legal Department advises the Board about best practices for cybersecurity oversight by the Board, and the evolution of that oversight over time.


text: Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers. Our cybersecurity team conducts third-party software security reviews for new software products being implemented into our production environments. The Company also has a third-party risk management process that regularly assesses and monitors risks, including cybersecurity, from vendors and suppliers.


text: See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for information on cybersecurity risks that may materially affect our business strategy, results of operations and financial condition.


text: The cybersecurity risk management processes described above are led by our CIO and CISO, each having more than 25 years of information security experience. Our Board, Audit Committee, senior management and the Enterprise Risk Management Committee (a management committee of senior representatives from corporate functions and business lines) devote resources to cybersecurity and risk management processes. The Audit Committee is primarily responsible for the oversight of enterprise risk management and cybersecurity risks, including cybersecurity threats. To fulfill this responsibility, the Audit Committee receives periodic reports from the CIO. These reports include information regarding updates on cybersecurity initiatives, cybersecurity metrics, such as phishing results and attack volume metrics, results of any assessments performed by internal stakeholders or external third-party advisors and updates on cybersecurity trends and insights. The CIO provides a cybersecurity update to the full Board at least annually.


text: Risk Management and Strategy We maintain a comprehensive process for assessing, identifying and managing material risks from cybersecurity threats as part of our overall risk management system and processes. To that end, we regularly monitor the need and implementation of enhancements to security infrastructure, legacy system replacement, emerging technology risk assessment and security integration.


text: Our cybersecurity risk management processes include the following: a. We leverage the NIST framework to help ensure the Company's risk posture remains in alignment with the Company's overall risk appetite.


text: b. The Company utilizes policies, software, training programs, hardware solutions and managed services to protect and monitor our environment, including multifactor authentication on all critical systems, firewalls, intrusion detection and prevention systems, vulnerability and penetration testing, identity and access management systems, cloud security controls and monitoring, data backup and recovery systems and 24x7 security operations center.


text: e. Our cybersecurity team conducts routine cyber awareness training for professional associates using an independent third-party security training provider to educate best practices, policies and responsibilities pertaining to cybersecurity. We also conduct periodic simulated phishing tests to generate awareness and run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our practices, procedures and technologies.


text: g. Our cybersecurity team regularly conducts tests of our information security environment and controls through vulnerability scanning, penetration testing and attack simulation testing.


text: Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers. Our cybersecurity team conducts third-party software security reviews for new software products being implemented into our production environments. We also have a third-party risk management process that regularly assesses and monitors risks, including cybersecurity, from vendors and suppliers.


text: As of the date of this Form 10-K, we do not believe any risk from any cybersecurity threats or incidents have had, or are reasonably likely to have, a material impact on us; however, there is no guarantee that a future cybersecurity threat or incident will be detected and remediated to not have a material adverse impact on our business, results of operations and financial condition. Refer to Item 1A - Risk Factors of this Form 10-K for information on cybersecurity risks that may materially affect our business, results of operations and financial condition.


text: The cybersecurity risk management processes described above are led by our CIO and CISO, each having more than 25 years of information security experience. Our CIO reports to the CEO, and the CISO reports to the CIO. Our Board, Audit Committee, senior management and the Enterprise Risk Management Committee (a management committee of senior representatives from corporate functions and business lines) devote resources to cybersecurity and risk management processes. Cybersecurity and data governance risks are aligned with our overall Enterprise Risk Management process to help ensure potential cyber threats are identified, assessed and mitigated. Our top risks, such as cybersecurity, identified sub-risks and current and proposed mitigation strategies are reviewed regularly by the Enterprise Risk Management Committee. The Audit Committee is primarily responsible for the oversight of enterprise risk management and cybersecurity risks, including cybersecurity threats. To fulfill this responsibility, the Audit Committee receives periodic reports from the CIO and CISO. These reports include information regarding updates on cybersecurity initiatives, cybersecurity metrics, such as phishing results and attack volume metrics, results of any assessments performed by internal stakeholders or external third-party advisors and updates on cybersecurity trends and insights. The CIO and CISO provide a cybersecurity update to the full Board at least annually.


text: As a critical component of our overall risk management process, we have adopted a framework that shares existing reporting channels and governance processes to identify, assess, manage and report cybersecurity threats on an ongoing basis. This risk management process is led by our Manager's Chief Compliance Officer and Cyber Security Committee ("CSC").

companyName: Terra Property Trust, Inc.

ticker: TPTA


text: Our management, including our Manager's Chief Compliance Officer and CSC, is authorized to take the appropriate steps deemed necessary to identify, assess, contain, mitigate, and resolve cybersecurity threats including by (a) maintaining (i) an Incident Response Plan in the event of an Incident and (ii) a Cybersecurity Policy which governs information technology security policies, (b) regularly monitoring our systems and user accounts for any suspected Incidents, (c) performing annual audits on certain of our systems, and (d) providing general cybersecurity awareness and data protection training. In addition, depending on the circumstances of an Incident, we may engage third parties such as insurance carriers, outside legal counsel, forensic investigators, crisis communications or public relations firms, investor relations firms and response vendors and we may coordinate with regulators or law enforcement. We also assess third party risks when determining the selection and oversight of applicable third-party service providers.


text: As a critical component of our overall risk management process, we have adopted a framework that shares existing reporting channels and governance processes to identify, assess, manage and report cybersecurity threats on an ongoing basis. This risk management process is led by our Manager's Chief Compliance Officer and Cyber Security Committee ("CSC"). Our Manager's Chief Compliance Officer has 17 years of experience in regulatory compliance, risk management, and cybersecurity governance, with expertise in implementing and overseeing security policies in financial and REIT sectors. [The CSC is composed of professionals with backgrounds in information security, IT risk management, and data protection, ensuring a well-rounded approach to cybersecurity oversight.


text: Our management, including our Manager's Chief Compliance Officer and CSC, is authorized to take the appropriate steps deemed necessary to identify, assess, contain, mitigate, and resolve cybersecurity threats including by (a) maintaining (i) an Incident Response Plan in the event of an Incident and (ii) a Cybersecurity Policy which governs information technology security policies, (b) regularly monitoring our systems and user accounts for any suspected Incidents, (c) performing annual audits on certain of our systems, and (d) providing general cybersecurity awareness and data protection training. In addition, depending on the circumstances of an Incident, we may engage third parties such as insurance carriers, outside legal counsel, forensic investigators, crisis communications or public relations firms, investor relations firms and response vendors and we may coordinate with regulators or law enforcement. We perform due diligence in order to identify and evaluate cyber risks of third party service providers. Third party service providers processing sensitive data are contractually required to meet applicable legal and regulatory obligations to protect sensitive data against cybersecurity threats and unauthorized access to the sensitive data. Third party service providers deemed critical undergo ongoing monitoring to ensure they continue to meet their security obligations and other potential cybersecurity threats.


text: Valvoline is committed to protecting information that is valuable to customers and critical to business operations from unauthorized access and disclosure by devoting significant resources to protecting information systems and data through investing in people, technology, and processes to protect data and systems against evolving cybersecurity threats. A cybersecurity program has been designed and implemented that is believed to reasonably manage risks from cybersecurity threats and enable the Company to prevent, monitor, identify, detect, investigate, respond to, mitigate, and report on threats and incidents.

companyName: VALVOLINE INC

ticker: VVV


text: Cybersecurity governance Valvoline has adopted a cross-functional and multi-management level approach to assessing and managing risks arising from cybersecurity threats. The Audit Committee of the Board (the "Audit Committee") oversees the Company's enterprise risk management program. As part of this oversight, the Audit Committee has primary responsibility for overseeing risks related to cybersecurity, although the Board retains ultimate oversight over these risks. The Audit Committee reviews and discusses cybersecurity risks along with the Company's cybersecurity programs and strategy with management. The Audit Committee receives reports and presentations from the Senior Vice President and Chief Technology Officer ("CTO") and Senior Director of Information Security during bi-annual meetings, and as needed, on a range of topics including, but not limited to, the cybersecurity program and processes, information systems, business risk identification and mitigation strategies, strategic updates, operational matters, the evolving cybersecurity threat landscape, regulatory developments, and notable incidents or threats affecting the Company.


text: The CTO, who serves as the Chief Information Security Officer ("CISO") for the Company, is the primary executive responsible for leading the Company's cybersecurity risk management program and has over 25 years of experience in various technology-related roles, including responsibilities related to managing information security, developing cybersecurity strategy, and implementing cybersecurity programs. The Company's Computer Security Incident Response Team ("CSIRT") has primary responsibility for monitoring and enacting the incident response program and is led by the Senior Director of Information Security who reports to the CTO.


text: The CSIRT receives direction and guidance from various departments including operations, information technology, communications, legal, and human resources while being responsible for maintaining and operating incident response capabilities at Valvoline by collecting, aggregating, and analyzing detected alerts and events from computer systems across the enterprise. Valvoline's CSIRT meets at least quarterly, and more frequently as appropriate, to review and discuss the Company's cybersecurity program. The CSIRT has the authority and system entitlements to confiscate, isolate, or disconnect equipment; investigate suspicious activity; monitor usage; and disable system access in the proper execution of their duties. The CSIRT is responsible for declaring an incident and initiating escalation to the Incident Response Team ("IRT"). The IRT is responsible for coordinating incident response activities across functions and is comprised of cross-functional and multi-management level personnel including, but not limited to, the Senior Director of Information Security, CSIRT Manager, Chief Legal Officer, Chief Audit Executive, Privacy & Compliance Counsel, Chief Technology Officer, Head of Global Insurance, Director of Corporate Communications, Chief Financial Officer, Chief Operating Officer, Chief Human Resource Officer, and Head of Physical Security.


text: The IRT is also responsible for reporting incidents, following Valvoline's Information Security Incident Response Plan ("IRP"), in accordance with legal requirements, coordinating external communications, and setting information sharing restrictions. Other departments or individuals may be engaged according to the specific nature of the incident and will operate at the direction of the IRT. Valvoline's Senior Director of Information Security is responsible for the implementation of, and amendments to, the IRP and supporting procedures.


text: Risk management and strategy Valvoline has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of critical systems and information in addition to a cybersecurity incident response plan based on the National Institute of Standards ("NIST") Cybersecurity Framework ("CSF"). The program applies, where appropriate, to the Company's internal and external information systems, applications, networks, and operations which includes scanning, testing, and assessments designed to identify risks from cybersecurity threats. Management across various functional teams administer the enterprise risk management program, which is designed to identify, assess, and manage top enterprise risks, including risks arising from cybersecurity threats. Valvoline continually evaluates and makes updates to the Company's cybersecurity programs to align with regulatory requirements and industry best practices in order to keep company-wide training initiatives related to cybersecurity risks robust and up to date.


text: The IRP was designed to comprehensively leverage capabilities throughout the Company and to provide a standardized framework for responding to cybersecurity incidents by coordinating an approach to investigate, contain, mitigate, fix vulnerabilities, determine legally required responses or notifications, and document cybersecurity incidents including reporting and escalating findings as appropriate. The CSIRT, being responsible for incident response, assembles the IRT and assigns responsibilities based on the circumstances of the information security incident.


text: Valvoline employs a risk-based approach to secure access to networks, systems, and applications for business partners and vendors receiving access to the environments and data. Business partners and vendors with whom information is shared to conduct business are required to safeguard it by appropriate means, including elevated contractual commitments when appropriate. The Company provides cybersecurity training to team members during onboarding and regularly thereafter and deploy technologies to automate and enhance operational security capabilities. In addition, Valvoline also uses third-party managed security services to augment the cybersecurity team's capabilities.


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including the business strategy, results of operations or financial condition, and management does not believe that such risks are reasonably likely to have such an effect over the long term.


text: However, due to evolving cybersecurity threats, and despite security measures taken, it may not be possible to anticipate, prevent, and stop future cybersecurity incidents, including attacks on information systems and data or those of relevant business partners. Additional information on cybersecurity risks identified is discussed in Item 1A of Part I, "Risk Factors", which should be read in conjunction with this Item 1C. Cybersecurity.


text: Cybersecurity governance Valvoline has adopted a cross-functional and multi-management level approach to assessing and managing risks arising from cybersecurity threats. The Audit Committee of the Board (the "Audit Committee") oversees the Company's enterprise risk management program. As part of this oversight, the Audit Committee has primary responsibility for overseeing risks related to cybersecurity, although the Board retains ultimate oversight over these risks. The Board of Directors reviews and discusses cybersecurity risks along with the Company's cybersecurity programs and strategy with management. The Board of Directors receives reports and presentations from the Senior Vice President and Chief Technology and Cybersecurity Officer ("CTO") Vice President of IT Operations & Platforms, and Senior Director of Information Security during bi-annual meetings, and as needed, on a range of topics including, but not limited to, the cybersecurity program and processes, information systems, business risk identification and mitigation strategies, strategic updates, operational matters, the evolving cybersecurity threat landscape, regulatory developments, and notable incidents or threats affecting the Company.


text: The CTO, who serves as the Chief Information Security Officer ("CISO") for the Company, is the primary executive responsible for leading the Company's cybersecurity risk management program and has over 30 years of experience in various technology-related roles, including responsibilities related to managing information security, developing cybersecurity strategy, and implementing cybersecurity programs. The Company's Computer Security Incident Response Team ("CSIRT") has primary responsibility for monitoring and enacting the incident response program and is led by the Senior Director of Information Security who reports to the CTO.


text: Risk management and strategy Valvoline has developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of its critical systems and information. This program, which is based on the National Institute of Standards and Technology ("NIST") Cybersecurity and Privacy Frameworks, is an integrated part of the company's overall enterprise risk management process. The program applies, where appropriate, to Valvoline's internal and external information systems, applications, networks, and operations. It includes ongoing activities such as scanning, testing, and assessments intended to identify and manage risks arising from cybersecurity threats.


text: Management, including various functional teams, is responsible for assessing, identifying, and managing material risks from cybersecurity threats. Valvoline continually evaluates and updates its cybersecurity programs to align with regulatory requirements and industry best practices. This includes keeping company-wide training initiatives related to cybersecurity risks robust and up-to-date.


text: Valvoline's Executive Information Security and Privacy Committee provides crucial oversight for cybersecurity risk management. On a monthly basis, the committee reviews key metrics, evaluates risk tolerance, and approves strategic direction to ensure the program aligns with the company's business objectives.


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including the business strategy, results of operations or financial condition, and management does not believe that such risks are reasonably likely to have such an effect over the long term. However, due to evolving cybersecurity threats, and despite security measures taken, it may not be possible to anticipate, prevent, and stop future cybersecurity incidents, including attacks on information systems and data or those of relevant business partners. Additional information on cybersecurity risks identified is discussed in Item 1A of Part I, "Risk Factors", which should be read in conjunction with this Item 1C. Cybersecurity.


text: Information security, which includes cybersecurity, is a significant operational risk facing our business. Cybersecurity risks include intentional malicious attacks or unintentional acts that result in an impact to the confidentiality, integrity or availability of our or our clients' or third parties' operations, systems or data.

companyName: FVCBankcorp, Inc.

ticker: FVCB


text: Management assesses and manages material risks from cybersecurity threats through designated management positions and committees that are responsible for overseeing technology and information security. Our Information Security Officer is responsible for information security and cybersecurity risk management. He has over 40+ years of financial services related experience, including 10+ years of experience in cybersecurity program strategy, security architecture and security team leadership. Our Chief Technology Officer, who has over 25+ years of experience in financial services, including 15+ years in information technology, among other duties, is responsible for the security and integrity of systems, applications and databases and coordinates security implementations, monitoring and enforcement in conjunction with the Information Security Officer.


text: We maintain a comprehensive information security policy that is intended to maintain the security and confidentiality of client information, protect against threats to the security or integrity of such information, and protect against unauthorized access to or use of such information. We have a written information security program that is aligned to our information security policy and designed to assess, identify and manage risks that result from cybersecurity threats. Our information security program is centered on preparing for, preventing, detecting, mitigating, responding to and recovering from cyber threats and cyber incidents while ensuring our processes continue to operate effectively. On an annual basis, the Board of Directors reviews and approves our information security program and information security policy.


text: We use the Federal Financial Institutions Examination Council's Cybersecurity Assessment Tool to help us identify our cybersecurity risks and determine our cybersecurity preparedness. This assessment tool incorporates regulatory guidance as well as concepts from other industry standards, including the National Institute of Standards and Technology Cybersecurity Framework. The results of the assessment are used to determine risk management practices and controls in order to align our cybersecurity preparedness to address the identified risks within our risk appetite. We engage a third-party to provide an annual risk assessment of our compliance with interagency guidelines for safeguarding confidential customer information. This risk assessment focuses on our information security program and the controls in place to protect client information. The results of the risk assessment are analyzed and used to improve our information security program where needed. Internal audits, regulatory examinations and third-party assessments of our processes in information technology and information security also help us assess our cybersecurity preparedness and whether risk management practices and controls need adjustment. Risk issues are identified through assessments, audits, examinations and security testing. Findings are tracked and reported to the Bank's Technology Committee, and the Audit Committee of the Board of Directors.


text: We leverage multiple managed security service providers to monitor key system and network activity on a 24 hour basis to detect and alert the information technology team of cyber threats and potential cybersecurity events of concern. In addition to monitoring for security events, cyber threat intelligence sources are analyzed in order to understand potential cyber threats and techniques that may be used in cyberattacks against us and to monitor for such threats. Examples of cyber threat intelligence sources include the Financial Services Information Sharing and Analysis Center, trade organizations, the Cybersecurity and Infrastructure Security Agency, security service providers, vendor alerts, and open-source intelligence sources. The Bank utilizes two cybersecurity tools to detect and prevent successful phishing campaigns. All employees receive semi-annual training covering social engineering, phishing and current scam events, followed by periodic testing.


text: Our cybersecurity risk management processes are integrated into our overall risk management system through our risk management committee structure. These committees have processes to help facilitate appropriate and effective oversight of cybersecurity risk, including tracking and reporting of cybersecurity risks and remediation plans. The Bank maintains a chartered Technology Committee, which is responsible for the oversight of policies and practices relating to the identification, assessment, measurement, monitoring and management of our technology and information security risks. The Technology Committee is chaired by our Chief Technology Officer and members include two members from our Board of Directors, one independent Director and the President, the Information Security Officer, Chief Financial Officer, Chief Banking Officer, and officers of key business systems. The Information Security Officer reports the cyber security status of the Bank to our Board of Directors on a monthly basis. These reports include performance metrics, security events, penetration testing, training, audit results, new system and vulnerability assessments and the identification and remediation of cybersecurity risks. The Information Security Officer also provides information regarding the threat environment and our efforts to detect, prevent and respond to internal and external critical threats The Board of Directors, leveraging the efforts of the Technology Committee, oversees our continuing efforts to strengthen our information security infrastructure and staffing, adhere to regulatory guidelines and enhance our processes, technology controls and cybersecurity defenses. Our Information Security Officer regularly reports to the Board of Directors on security matters, our Risk Management Committee establishes and reviews key cyber risk indicators and performance metrics, and our Technology Committee assesses and disseminates periodic updates on information security risk, the maturity of our information security program, and related investments and results.


text: Management assesses and manages material risks from cybersecurity threats through designated management positions and committees that are responsible for overseeing technology and information security. Our Chief Technology & Information Security Officer is responsible for information security and cybersecurity risk management. He has over 25+ years of experience in financial services, including 15+ years in information technology, and among other duties, is responsible for the security and integrity of systems, applications and databases and coordinates security implementations, monitoring, and enforcement.


text: We currently use the Federal Financial Institutions Examination Council's Cybersecurity Assessment Tool ("FFIEC CAT") to help us identify our cybersecurity risks and determine our cybersecurity preparedness. This assessment tool incorporates regulatory guidance as well as concepts from other industry standards, including the National Institute of Standards and Technology Cybersecurity Framework. The results of the assessment are used to determine risk management practices and controls in order to align our cybersecurity preparedness to address the identified risks within our risk appetite. We engage a third-party to provide an annual risk assessment of our compliance with interagency guidelines for safeguarding confidential customer information. This risk assessment focuses on our information security program and the controls in place to protect client information. The results of the risk assessment are analyzed and used to improve our information security program where needed. Internal audits, regulatory examinations and third-party assessments of our processes in information technology and information security also help us assess our cybersecurity preparedness and whether risk management practices and controls need adjustment. Risk issues are identified through assessments, audits, examinations and security testing. Findings are tracked and reported to the Bank's Technology Committee, and the Audit Committee of the Board of Directors. The FFIEC CAT will sunset in Fall 2025. We are currently evaluating other assessment tools which will be implemented in 2026.


text: We leverage multiple managed security service providers to monitor key system and network activity on a 24 hour basis to detect and alert the information technology team of cyber threats and potential cybersecurity events of concern. In addition to monitoring for security events, cyber threat intelligence sources are analyzed in order to understand potential cyber threats and techniques that may be used in cyberattacks against us and to monitor for such threats. Examples of cyber threat intelligence sources include the Financial Services Information Sharing and Analysis Center, trade organizations, the Cybersecurity and Infrastructure Security Agency, security service providers, vendor alerts, and open-source intelligence sources. The Bank utilizes cybersecurity tools to detect and prevent successful phishing campaigns. All employees receive three training sessions annually covering social engineering, phishing and current scam events, followed by periodic testing.


text: Our cybersecurity risk management processes are integrated into our overall risk management system through our risk management committee structure. These committees have processes to help facilitate appropriate and effective oversight of cybersecurity risk, including tracking and reporting of cybersecurity risks and remediation plans. The Bank maintains a chartered Technology Committee, which is responsible for the oversight of policies and practices relating to the identification, assessment, measurement, monitoring and management of our technology and information security risks. The Technology Committee is chaired by our Chief Technology & Information Security Officer and members include two members from our Board of Directors, one independent Director and the President, Chief Financial Officer, Chief Banking Officer, IT Infrastructure & Security Manager, and officers of key business systems. The Chief Technology & Information Security Officer reports the cyber security status of the Bank to our Board of Directors on a monthly basis. These reports include performance metrics, security events, penetration testing, training, audit results, new system and vulnerability assessments and the identification and remediation of cybersecurity risks. The Information Security Officer also provides information regarding the threat environment and our efforts to detect, prevent and respond to internal and external critical threats The Board of Directors, leveraging the efforts of the Technology Committee, oversees our continuing efforts to strengthen our information security infrastructure and staffing, adhere to regulatory guidelines and enhance our processes, technology controls and cybersecurity defenses. Our Chief Technology & Information Security Officer regularly reports to the Board of Directors on security matters, our Risk Management Committee establishes and reviews key cyber risk indicators and performance metrics, and our Technology Committee assesses and disseminates periodic updates on information security risk, the maturity of our information security program, and related investments and results.


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. We have an enterprise-wide cybersecurity program designed to protect against, detect, respond to and remediate cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that are designed to prevent, identify, escalate, investigate and remediate identified cybersecurity threats and incidents, including threats and incidents associated with third-party service providers, in a timely manner. These tools include, among others, internal detection tools to support the identification, monitoring and reporting of threats, vulnerabilities and incidents, and a bug bounty program to allow security researchers to assist us in identifying vulnerabilities in our platform and products before they are exploited by malicious threat actors. We maintain a variety of incident response plans that are utilized when cybersecurity incidents are detected. We require employees with access to information systems, including specified corporate and engineering employees, to undertake data protection and cybersecurity training. Further, we use various processes to identify, monitor, assess and manage material risks from cybersecurity threats associated with the use of third-party service providers, including engaging in security reviews of third-party service providers who may have access to, or integrate with, our information systems; however, we rely on these third parties to implement cybersecurity programs commensurate with their risk profile and our expectations, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: Braze, Inc.

ticker: BRZE


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program, including tabletop exercises, penetration and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. In addition to our bug bounty program, we also engage third parties to provide independent penetration testing, to support internal security audits and to provide external security audits. We also regularly report on the results of our assessments and security testing to our audit committee.


text: Our management is responsible for identifying, assessing, and managing cybersecurity risks on an ongoing basis by establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors, including through the audit committee of our board directors.


text: Our chief technology officer is responsible for our information security team which oversees and implements our cybersecurity program. Our chief technology officer has over a decade of industry experience, and is supported by a team of information security professionals who have relevant educational and industry experience, including holding similar positions at large technology companies. Our chief technology officer and information security team provide regular reports to senior management, other relevant teams and the audit committee of our board of directors on our cybersecurity program, material cybersecurity risks and mitigation strategies, and other cybersecurity developments. In addition to such regular reports, and as part of our incident response processes, our chief technology officer will provide updates on material cybersecurity threats and incidents to our audit committee and, as necessary, to the full board of directors, based on management's assessment of risk.


text: Our board of directors has ultimate oversight responsibility for our strategic and business risk management and delegates cybersecurity risk management oversight to its audit committee. Our audit committee receives reports on, generally, a quarterly basis from our chief technology officer on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. Our audit committee is responsible for overseeing the adequacy and effectiveness of our privacy and information security policies and practices and the internal controls regarding privacy and information security. Our audit committee or chief technology officer, as appropriate, also reports material cybersecurity risks to our full board of directors.


text: While unauthorized persons have attempted to access our information systems in the past, and will likely continue to do so in the future, we have not, to date, identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information on these risks, see "Risk Factors—If we or our third-party service providers experience a security breach or unauthorized parties otherwise obtain access to our customers' data, our data or our platform, our solution may be perceived as not being secure, our reputation may be harmed, demand for our platform and products may be reduced and we may incur significant liabilities."


text: While unauthorized persons have attempted to access our information systems in the past, and will likely continue to do so in the future, we have not, to date, identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information on these risks, see "Risk Factors—If we or our third-party service providers or vendors experience a security breach or unauthorized parties otherwise obtain access to our customers' data, our data or our platform, our solution may be perceived as not being secure, our reputation may be harmed, demand for our platform and products may be reduced and we may incur significant liabilities."


text: As a leader in business process solutions, we leverage cloud computing, artificial intelligence, machine learning, automation and advanced analytics, our systems and information technology, and that of our third-party providers, and our interfaces with our customers are critical to our business, operating results, growth, prospects and reputation.

companyName: CONDUENT Inc

ticker: CNDT


text: We act as a trusted business partner in providing both front-office and back-office platforms. As part of our business process outsourcing solutions, we develop system software platforms necessary to support our customers' needs, with significant ongoing investment in developing and operating customer-appropriate operating systems, databases and system software solutions. We also receive, process, transmit and store substantial volumes of personal information relating to identifiable individuals. Additionally, we receive, process and implement financial transactions and disburse funds on behalf of both commercial and government customers.


text: We devote significant resources to cybersecurity and cybersecurity risk management processes to adapt to the changing cybersecurity landscape and to respond to emerging threats. We maintain a cybersecurity risk management program to assess, identify, manage, mitigate and respond to material risks from cybersecurity threats to both our corporate information technology environment and to customer-facing products. This program is integrated into our overall Enterprise Risk Management ("ERM") program, which is designed to strengthen our risk management capabilities by developing and implementing a governance structure, risk management framework, and processes that enable the identification, assessment, monitoring and management of risks.


text: The underlying controls of our cybersecurity risk management program are based upon industry standards for cybersecurity and information technology. Our corporate information technology environment aligns with Center for Internet Security Critical Security Controls ("CIS CSC"). Our systems that manage customer-facing products, where appropriate and contractually required, are certified/attested to applicable security standards, including, without limitation, National Institute of Standards and Technology's publication (NIST 800-53 rev 5 moderate baseline), Payment Card Industry Data Security Standard ("PCI-DSS"), Health Insurance Portability and Accountability Act ("HIPAA"), International Organization for Standardization ("ISO") and, the International Electrotechnical Commission ("IEC") Standard (ISO/IEC 27001:2013 & ISO 9001:2015). Our policies and procedures concerning cybersecurity matters include processes to safeguard our information systems, monitor these systems, protect the confidentiality and integrity of our data, train and raise awareness of cybersecurity threats among employees, detect intrusions into our systems and respond to cybersecurity incidents.


text: As part of our overall risk management strategy, we leverage a defense in depth philosophy, which includes, but is not limited to, additional end-user training, layered technology defenses, identifying and protecting critical assets, strengthening monitoring and warning systems and engaging industry and subject matter experts. We regularly test defenses by performing simulations and exercises at both a technical level and by reviewing our operational policies and procedures with third-party experts. At the management level, our cybersecurity team regularly monitors alerts and meets to discuss industry threats, trends and remediation tactics. The cybersecurity team also regularly prepares a cyber report that includes metrics and compliance performance, collects data on cybersecurity threats and risks and conducts an annual risk assessment, which it uses to assess and refine Conduent's overall security posture. Furthermore, we receive cybersecurity alerts and threat intelligence from our peers, government agencies, information sharing and analysis centers and cybersecurity associations, as well as conduct periodic external penetration tests and gap testing to assess our processes and procedures and the ever-changing threat landscape. We have created and continually update, as required, a detailed incident response plan, which outlines the steps to be followed from incident detection to eradication, recovery and notification and which we implement in the event of a cybersecurity incident.


text: We also engage third parties and cybersecurity consultants on a regular basis to assess, test, and assist with the implementation of our risk management strategies, policies and procedures to enhance our detection, response and management of cybersecurity risks and compliance frameworks, including but not limited to, consultants who assist with risk assessment, assist with our PCI-DSS compliance assessments, assess our systems' alignment with the NIST Cybersecurity Framework, ensuring adherence to ISO audits.


text: CNDT 2023 Annual Report We rely on a variety of security software, including cloud-based technology to scan and analyze for vulnerable software or misconfigurations, for our operations and our business processing solutions. These systems are either developed by us or licensed from or maintained by third-party providers. We assess key third-party cybersecurity controls through a cybersecurity questionnaire, require the implementation of certain security controls in our contracts where applicable, maintain continuous monitoring during the engagement of the third party, and maintain the ability to discontinue our engagement with a key vendor if its cybersecurity posture fails to meet pre-established standards.