text: Our CISO is primarily responsible for assessing, monitoring and managing cybersecurity risks, including those presented by third-party service providers, as well as overseeing employee training programs. Our CISO has served in this role since July 2019, has a Master's Degree in Information Security from the University of London, has been working in technology risk management since the early 1990s, holds Certified Information Systems Security Professional status and is a member in good standing of the Institute of Electrical and Electronics Engineers ("IEEE") and the International Information System Security Certification Consortium ("ISC2"). The CISO reports at least annually to the Board of Directors on material cyber risks, including those identified in our business and rising threats, and the current state of L&W's information security and will continue to do so on a regular basis as needed.


text: The CISO and his team evaluate quantitative and qualitative factors to determine if a cybersecurity threat or incident needs to be escalated to other members of management and ultimately to the Board of Directors. The factors evaluated include but are not limited to: actual or potential monetary damages, number of impacted employees or customers, nature of the records compromised, potential impact on customer relationships, public knowledge and likely effect on L&W's reputation. Depending on the severity of the impact on these factors, management, including the CISO, Chief Compliance Officer and Chief Accounting Officer ("CAO"), meets as part of a management committee to determine if an incident is material. In the event the management committee determines that a cybersecurity incident or threat is material, the incident or threat is elevated and reviewed with our Board of Directors. The management committee reports all incidents requiring a materiality assessment to the Chief Legal Officer, regardless of whether such committee ultimately determines a cybersecurity incident to be material.

companyName: Light & Wonder, Inc.

ticker: LAWIL

secItem: Item 1C


text: For additional information regarding how cybersecurity threats could materially affect or are reasonably likely to materially affect our business strategy, results of operations or financial condition, see the risk factors captioned "Our success depends on the security and integrity of the systems and products we offer, and security breaches, including cybersecurity breaches, or other disruptions could compromise our information or the information of our customers and expose us to liability, which would cause our business and reputation to suffer," "We rely on information technology and other systems, and any failures in our systems or errors, defects or disruptions in our products and services could diminish our brand and reputation, subject us to liability and have disrupted and could disrupt our business and adversely impact our results," and "If we, our third-party vendors or service providers, our customers or a company we acquire sustains cyber-attacks or other privacy or data security incidents that result in security breaches, we could suffer a loss of sales and increased costs, exposure to significant liability, reputational harm, regulatory fines or punishment and other negative consequences" under the heading "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K for additional information.


text: Cybersecurity Risk Management and Strategy The Company has developed and implemented a comprehensive cybersecurity risk management program that is intended to protect the secure processing, transmission and storage of confidential information in its computer systems and networks. The Company's cybersecurity risk management program, a component of the Company's Enterprise Risk Management ("ERM") Program, is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance and other industry standards. The Company's process for identifying, assessing, managing and prioritizing cybersecurity risks throughout the Company includes: • A third party risk assessment program for the Company's third party vendors that access the Company's data (each, a "Vendor") to ensure that all Vendors meet the Company's cybersecurity requirements, including, periodic risk assessments of Vendors, monitoring Vendor compliance with the Company's cybersecurity requirements, and a requirement that all contracts with Vendors include provisions requiring the Vendor to notify the Company of any cyber incident, and/or to maintain minimum levels of cybersecurity insurance; • A security awareness program that includes training employees on best practices for securing the Company's data, as well as regular social engineering testing to keep employees informed of cybersecurity threats and to train them to look for malicious emails and other potential cybersecurity threats; • A dedicated information security team that monitors threats and vulnerabilities that arise, and regularly performs threat intelligence and vulnerability management; • The Company's engagement of a third party to conduct periodic independent testing of the Company's cybersecurity defenses to confirm that the defenses are effective; • A Managed Detection and Response ("MDR") service that continuously monitors the Company's systems and alerts the Company's information security team of any detected anomalies or suspicious activity and stops any event that is deemed dangerous to the Company's systems or networks; • An Incident Response Plan ("IRP") and Business Continuity Plan ("BCP") which outline steps to be taken during a cyber incident and to recover systems and continue business operations following a cyber incident; and • A Cybersecurity Incident Response Team ("CSIRT") that tracks cyber incidents, including those that affect third parties that are handling the Company's data.

companyName: CAMDEN NATIONAL CORP

ticker: CAC


text: Cybersecurity Threats During the fiscal year ended December 31, 2023, the Company did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or that are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition other than the risks described in Item 1A. "Risk Factors".


text: Cybersecurity Governance Board of Directors' Oversight. The Company's Board of Directors oversees the Company's cybersecurity program, including the oversight of risks related to cybersecurity through various committees that are responsible for monitoring and testing the Company's information security. The Board of Directors conducts an annual review of the Company's cybersecurity- related policies. Quarterly, the Company's Senior Vice President, Director of Information Security ("DIS") presents reports to the Audit Committee on vulnerability management and cybersecurity testing effectiveness, emerging threats and industry and regulatory changes that affect cybersecurity, and responds to inquiries from the Audit Committee. In addition, the Technology Committee receives and evaluates quarterly updates from the DIS on cybersecurity performance and on cybersecurity trends and strategies. The Board of Directors receives quarterly updates from the EVP, Chief Risk Officer ("CRO") on cybersecurity metrics and the cybersecurity risk management program's performance.


text: Management Oversight. While the Board of Directors and its Audit and Technology Committees oversee management's processes related to cybersecurity risks, management is responsible for identifying, monitoring and mitigating the material cybersecurity risks that face the Company. The Company's CRO is directly responsible for the overall cybersecurity risk management program which is a part of the Company's ERM Program. The CRO and the DIS oversee the information security department's implementation and maintenance of the cybersecurity security risk management program, including oversight of Vendors and regular reporting to the Board of Directors and its Audit and Technology Committees on the effectiveness of the cybersecurity risk management program. The DIS updates the CRO as appropriate, including as new developments or information related to cyber incidents arise.


text: The Company's CRO has over 27 years of experience in cybersecurity and information technology. The CRO joined the Company in 2011 and became CRO in July 2023. Prior to becoming CRO, he served as SVP and Director of Information Security & ERM for six years and prior to that served five years as Vice President and Senior Information Security Officer of the Company. Prior to joining the Company, the CRO had a ten year career in information technology and began his career serving with the United States Air Force, specializing in information technology, cybersecurity, risk mitigation, and encrypted communications.


text: The Company's DIS joined the Company in 2023 and has over 20 years of experience in information technology and cybersecurity. The DIS has held senior management positions in information security for the past ten years. The DIS holds several industry certifications including Certified Information Systems Security Professional ("CISSP"), Certified Information Systems Auditor ("CISA"), Certified in Risk and Management Systems Controls ("CRISC") and Certified Data Privacy Solutions Engineer ("CDPSE").


text: Cybersecurity Threats During the fiscal year ended December 31, 2024, the Company did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or that are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition other than the risks described in Item 1A. "Risk Factors".


text: Management Oversight. While the Board of Directors and its Audit and Technology Committees oversee management's processes related to cybersecurity risks, management is responsible for identifying, monitoring and mitigating the material cybersecurity risks that face the Company. The Company's CRO is directly responsible for the overall cybersecurity risk management program which is a part of the Company's ERM Program. The CRO and the DIS oversee the information security department's implementation and maintenance of the cybersecurity risk management program, including oversight of Vendors and regular reporting to the Board of Directors and its Audit and Technology Committees on the effectiveness of the cybersecurity risk management program. The DIS updates the CRO as appropriate, including as new developments or information related to cyber incidents arise.


text: The Company's CRO has over 27 years of experience in cybersecurity and information technology. The CRO joined the Company in 2011 and became CRO in July 2023. Prior to becoming CRO, he served as SVP and Director of Information Security & ERM for six years and prior to that served five years as Vice President and Senior Information Security Officer of the Company. Prior to joining the Company, the CRO had a ten year career in information technology and began his career serving with the U.S. Air Force, specializing in information technology, cybersecurity, risk mitigation, and encrypted communications.


text: Risk Management and Strategy Cybersecurity risk management is included in NEE's, including FPL's, overall risk management program. NEE, including FPL, operates a cybersecurity program which, among other objectives, seeks to identify potential unauthorized occurrences on or conducted through the electronic information resources owned or used by NEE or FPL (information systems) that may result in adverse effects on the confidentiality, integrity or availability of its information systems or any information residing on those systems (cybersecurity threats) as well as on its operations. The cybersecurity program includes controls to reduce the risk and potential impact of a cybersecurity incident and to align its processes, controls and implemented technologies with industry standard frameworks and regulations. In addition, outside experts assess NEE's, including FPL's, cybersecurity program capabilities, technology environment and security controls to regularly evaluate effectiveness.

companyName: FLORIDA POWER & LIGHT CO


text: NEE, including FPL, operates a cybersecurity operations center and has cyber threat intelligence capability to identify, monitor, detect and respond to cybersecurity threats which is led by a cybersecurity incident response team. NEE, including FPL, uses these resources to identify cybersecurity threats and monitor for anomalies that may result in cybersecurity incidents on their systems, and monitors for impacts to external vendors or suppliers. Assessment of an incident includes, but is not limited to, analysis of the urgency and operational or business impact of an incident and the status and effectiveness of incident defenses. NEE, including FPL, invests in personnel and technologies with the objective of limiting the frequency and impact of cybersecurity incidents. Following documented cybersecurity incident response procedures, the cybersecurity incident response team escalates information about cybersecurity incidents as appropriate to oversight committees charged with managing specific aspects of cybersecurity risk, including, among others, the Cybersecurity and Resiliency Committee, the Cybersecurity Governance Executive Committee and NEE's Board of Directors.


text: NEE, including FPL, conducts an annual internal cybersecurity drill with the participation from time to time of local, state and federal agencies to test its capability of dealing with a simulated cyber-attack. NEE, including FPL, also participates in industry forums and trade groups, as well as in NERC activities to learn and apply these learnings to its cybersecurity policies and procedures.


text: NEE, including FPL, uses third parties to periodically assess the extent to which its cybersecurity risk management protocols align with the DOE's Cybersecurity Capability Maturity Model standard. Certain functions within NEE, including FPL, are required to comply with certain regulatory standards that are designed to protect against cybersecurity incidents, including the NERC Critical Infrastructure Protection standards, as well as the NRC cybersecurity protection standards. Further, NEE, including FPL, has a cybersecurity training program and a mock phishing program to educate and train employees on potential cybersecurity risks and on privacy and data protection. Given geopolitical events, NEE, including FPL, continues to take steps to protect against cybersecurity threats to its critical infrastructure, including communications with its employees to ensure heightened awareness of increased cybersecurity threats worldwide.


text: The cybersecurity capabilities of third-party vendors providing system solutions to NEE or FPL or accessing NEE's or FPL's systems or data is evaluated as part of the new vendor establishment process. NEE, including FPL, retains the right to audit vendors for cybersecurity of products and services. Where applicable in NEE's or FPL's contracts with third-party vendors accessing its systems or data, standard data security terms and conditions are utilized and minimum amounts of insurance coverage based on the risk of exposure are required.


text: NEE, including FPL, operates U.S. critical infrastructure. There have been cyberattacks and other physical attacks within the energy industry on energy infrastructure such as substations, gas pipelines and related assets in the past and there may be such attacks in the future. Although there have been no cybersecurity incidents or threats with a material impact on NEE's nor FPL's business strategy, results of operations, or financial condition, NEE's or FPL's information technology systems could fail or be breached, and such systems could be inoperable, causing NEE and FPL to be unable to fulfill critical business operations. The disclosures herein should be reviewed with the risk factors included in Part I, Item 1A.


text: The chief information officer, the vice president, IT infrastructure and cybersecurity and the chief information security officer are responsible for assessing and managing material risks from cybersecurity threats and have careers that represent more than 75 years of combined experience related to the management and protection of technologies. These individuals participate in or receive updates from not only the cybersecurity incident response team but also cybersecurity oversight committees, such as the Cybersecurity and Resiliency Committee comprised of various members of management, including the chief executive officers of FPL and NEER, the chief financial officer and the chief legal officer and the Cybersecurity Governance Executive Committee comprised of various members of management, including vice president of internal audit and executive director of emergency preparedness. These committees are charged with governing cybersecurity, cyber risks and resilience activities as well as the cyber and physical security policies and programs for NEE and its subsidiaries.


text: NEE's Board of Directors is responsible for the oversight of risks from cybersecurity threats and receives cybersecurity reports from NEE's chief information officer and its vice president, IT infrastructure and cybersecurity. The cybersecurity reports to the Board of Directors include various information, such as updates on the cybersecurity threat landscape, risk assessments, mitigation plans, including cyber defenses, notable incidents and a summary of the annual cyber drill results. Significant active cybersecurity incidents and threats are communicated to the Board of Directors as they occur.


text: NEE, including FPL, operates a cybersecurity operations center and has cyber threat intelligence capability to identify, monitor, detect and respond to cybersecurity threats which is led by a cybersecurity incident response team. NEE, including FPL, uses these resources, and leverages third-party resources, to identify cybersecurity threats and monitor for anomalies that may result in cybersecurity incidents on its systems, and monitors for impacts to its vendors or suppliers. Assessment of incidents includes, but is not limited to, analysis of the urgency and operational or business impact of an incident and the status and effectiveness of incident defenses. NEE, including FPL, invests in personnel and technologies with the objective of limiting the frequency and impact of cybersecurity incidents. Following documented cybersecurity incident response procedures, the cybersecurity incident response team escalates information about cybersecurity incidents depending on circumstances to oversight committees and personnel charged with managing specific aspects of cybersecurity risk, including, among others, the Cybersecurity and Resiliency Committee, the Cybersecurity Governance Executive Committee and NEE's Board of Directors.


text: NEE, including FPL, conducts periodic desktop exercises and an annual cybersecurity drill with the participation from time to time of local, state and U.S. federal agencies to test its capability of dealing with a simulated cyberattack. NEE, including FPL, also participates in industry forums and various trade groups, as well as in NERC activities, to learn and apply these incident preparedness learnings to its cybersecurity policies and procedures.


text: NEE, including FPL, uses third parties to periodically assess the extent to which its cybersecurity risk management protocols align with the U.S. Department of Energy's Cybersecurity Capability Maturity Model standard. Certain functions within NEE, including FPL, are required to comply with certain regulatory standards that are designed to protect against cybersecurity incidents, including the NERC Critical Infrastructure Protection standards, as well as the NRC cybersecurity protection standards. Further, NEE, including FPL, has a cybersecurity training program and a mock phishing program to educate and train employees on potential cybersecurity risks and on privacy and data protection. Given geopolitical events, NEE, including FPL, continues to take steps to defend against cybersecurity threats to its critical infrastructure, including communications with personnel to ensure heightened awareness of increased cybersecurity threats worldwide.


text: The cybersecurity capabilities of third-party vendors providing services to NEE or FPL or accessing NEE's or FPL's systems or data are evaluated as part of the new vendor establishment process. NEE, including FPL, retains the right to audit vendors for cybersecurity of products and services. Where applicable in NEE's or FPL's contracts with third-party vendors accessing its systems or data, standard data security terms and conditions are utilized and minimum amounts of insurance coverage based on the risk of exposure are required.


text: NEE, including FPL, operates U.S. critical infrastructure. There have been cyberattacks and other physical attacks within the energy industry on energy infrastructure such as substations, gas pipelines and related assets and there may be such attacks in the future. In addition, the advancement of artificial intelligence has given rise to new security risks. Although there have been no cybersecurity incidents or threats with a material impact on NEE's nor FPL's business strategy, results of operations, or financial condition, NEE's or FPL's information technology systems could fail or be breached, and such systems could be inoperable, causing NEE and FPL to be unable to fulfill critical business operations. The disclosures herein should be reviewed with the risk factors included in Item 1A.


text: The vice president and chief information officer, the vice president cybersecurity and the executive director cybersecurity are responsible for assessing and managing material risks from cybersecurity threats. They have careers that represent more than 50 years of combined experience related to the management and protection of technologies. These individuals participate in or receive updates from not only the cybersecurity incident response team but also cybersecurity oversight committees, such as the Cybersecurity and Resiliency Committee comprised of various members of management, including the executive vice president and chief risk officer, presidents and chief executive officers of FPL and NEER, the executive vice president, finance and chief financial officer and the executive vice president, chief legal, environmental & federal regulatory affairs officer, and the Cybersecurity Governance Executive Committee comprised of various members of management, including the vice president, internal audit and the executive director, emergency preparedness. These committees are charged with governing cybersecurity, cyber risks and resilience activities as well as the cyber and physical security policies and programs for NEE and its subsidiaries.


text: NEE's Board of Directors is responsible for the oversight of risks from cybersecurity threats and receives cybersecurity reports from NEE's vice president and chief information officer and its vice president cybersecurity. The cybersecurity reports to the Board of Directors include various information, such as updates on the cybersecurity threat landscape, risk assessments, mitigation plans, including cyber defenses, notable incidents and a summary of the annual cyber drill results. Significant active cybersecurity incidents and threats are communicated to the Board of Directors as they occur.


text: Risk Management and Strategy The Company's Cybersecurity Program ("CSP") drives an end-to-end, continuous process that protects our customers, colleagues, assets, premises, systems, and information (electronic and non-electronic), and is designed to ensure compliance with current and emerging federal and state laws and regulations. The CSP is designed to ensure the effective implementation of the Corporate Security and Resilience Operating Model across all business lines of the Company and is under the supervision of the Chief Security Officer ("CSO").

companyName: CITIZENS FINANCIAL GROUP INC/RI

ticker: CFG


text: Non-Financial Risk Management coordinates the development, maintenance, and day-to-day oversight of the Company's Enterprise Risk Management Governance Framework ("the Framework"), which defines an integrated enterprise-wide approach to risk management. This centrally managed program is designed to ensure that all business lines play a role in the successful implementation of the CSP. The CSP aligns with the Framework, enabling the CSO to provide risk oversight to and drive accountability from the business lines.


text: The CSP is designed to assess and mitigate threats and risks to the Company. New and emerging threats are assessed through an intelligence lifecycle, which includes threat modeling. In addition, risk assessment processes drive risk identification and measurement related to security. Once risks are identified and measured, the Framework is leveraged to track and mitigate them. Control testing is utilized to demonstrate that risks are managed effectively, identify gaps in expected control operation, and develop appropriate remediation plans, in order to manage risk to the Company within tolerable limits.


text: As part of the Company's Third Party Risk Management Program and in support of the CSP, reviews for cybersecurity, business continuity, fraud, and other policy-related topics are performed for the onboarding of new vendors and ongoing monitoring of existing vendors. Ratings assigned to a vendor determine review frequency and scope. Results are reported to key stakeholders and identified issues are tracked and monitored.


text: The Company regularly reviews the nature of its business activities and modifies the CSP as appropriate. Many of the elements of the CSP are cyber defense related and are in place to reduce our risk to a wide range of potential cyber threats that may target our assets and information daily. The effectiveness of the CSP is assessed and measured periodically by various lines of defense within the Company and is conducted primarily through risk assessments, assurance testing, and an independent audit. External organizations are also routinely engaged to assess our CSP and test our perimeter defenses. The effectiveness of the CSP is reported periodically to the appropriate governance committees.


text: Under the guidance of our CSO, we maintain a comprehensive CSP designed to protect our employees, customers, assets, premises, systems, and information against unauthorized access, misuse, alteration, or destruction that could result in substantial harm or inconvenience to our customers, and loss or reputational damage. The CSP incorporates all of our security policies and covers the core elements of access control, infrastructure security, cybersecurity event and incident management, data protection, third-party vendor cyber risk oversight, payment security, and training and awareness. Independent assessment and benchmarking of the CSP are regularly completed, and the CSP is reviewed and assessed by federal regulators. While we look to numerous frameworks to ensure the CSP is maintained in line with regulatory expectations and industry best practices, the National Institute of Standards and Technology cybersecurity framework is the primary standard against which we benchmark ourselves.


text: Both the Risk and Audit Committees have oversight of the management of our cybersecurity risk. The Audit Committee is responsible for overseeing the CSP under its risk oversight responsibilities as it relates to financial controls. The Risk Committee is responsible for oversight of the management of cybersecurity risk consistent with the Framework.


text: The CSP is presented by the CSO to the Risk Committee annually for approval in conjunction with an annual cybersecurity briefing. This briefing provides an overall assessment of the effectiveness of the CSP and an outlook for the upcoming year. In addition to the annual cybersecurity briefing, the CSO provides updates on cybersecurity to the Risk Committee at each of its meetings. The Audit Committee and Board also receive regular cybersecurity updates as part of the reporting provided by the Technology/Cyber Oversight Committee, a management committee chaired by the CEO which provides executive oversight, guidance and transparency to key transformative initiatives designed to enhance our technology stability, cyber defenses and risk management capabilities. Further, to ensure the Board maintains the appropriate knowledge for providing effective oversight, it is provided with relevant cybersecurity training on an annual basis, with any additional training provided as requested.


text: Operational Risk Management coordinates the development, maintenance, and day-to-day oversight of the Company's Enterprise Risk Management Governance Framework ("the Framework"), which defines an integrated enterprise-wide approach to risk management. This centrally managed program is designed to ensure that all business lines play a role in the successful implementation of the CSP. The CSP aligns with the Framework, enabling the CSO to provide risk oversight to and drive accountability from the business lines.


text: Under the guidance of our CSO, we maintain a comprehensive CSP designed to protect our employees, customers, assets, premises, systems, and information against unauthorized access, misuse, alteration, or destruction that could result in substantial harm or inconvenience to our customers, and loss or reputational damage. The CSP incorporates all of our security policies and covers the core elements of access control, infrastructure security, cybersecurity event and incident management, data protection, third-party vendor cyber risk oversight, and training and awareness. Independent assessment and benchmarking of the CSP are regularly completed, and the CSP is reviewed and assessed by federal regulators. While we look to numerous frameworks to ensure the CSP is maintained in line with regulatory expectations and industry best practices, the National Institute of Standards and Technology cybersecurity framework is the primary standard against which we benchmark ourselves.


text: Both the Risk and Audit Committees of our Board have oversight of the management of our cybersecurity risk. The Audit Committee is responsible for overseeing the CSP under its risk oversight responsibilities as it relates to financial controls. The Risk Committee is responsible for oversight of the management of cybersecurity risk consistent with the Framework.


text: Cybersecurity Risk Management and Strategy The Company depends on the proper functioning, availability and security of its information systems, including financial, data processing, communications and operating systems. Several information systems are software applications provided by third parties. Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, like other companies in our industry, we could, from time to time, experience threats and security incidents related to our and our third-party vendors' information systems, including attempts to gain unauthorized access to our confidential data, and other electronic security breaches. Such cybersecurity attacks can range from individual attempts to gain unauthorized access to our information technology systems to more sophisticated security threats. While we employ a number of measures to prevent, detect and mitigate these threats, there is no guarantee such efforts will be successful in preventing a cybersecurity attack. A cybersecurity attack could compromise the confidential information of our employees, tenants and vendors. A successful cybersecurity attack could disrupt and otherwise adversely affect our business operations.

companyName: CEDAR REALTY TRUST, INC.

ticker: CDR-PC


text: Assessment, identification and management of cybersecurity related risks are integrated into our overall risk management process. Cybersecurity related risks are included in the risk universe we evaluate to assess top risks to the Company at least annually. To the extent our processes identify a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risk strategy and governance and of other information technology risks to the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Senior management, including the Company's CEO, CFO, and General Counsel, is responsible for assessing and managing cybersecurity risk, and provides briefings regarding the assessment and management of such risk to the Audit Committee, which then reports, as necessary, to the Board of Directors. Although members of our senior management do not have direct cybersecurity expertise obtained through certifications, their experience managing the Company, which includes consulting and coordinating as necessary with a third party information technology expert referred to below, enables them to effectively assess and manage material risks from cybersecurity threats.


text: The Company retained an information technology expert third party company to assist in managing relevant risks. In particular, the Company outsources its information technology function and monitoring to a third party provider whereby it benefits from a professionally managed network monitoring, management, maintenance, detection and response system and a 24/7 security operations center with both onsite and remote support services. Any cybersecurity incident would be reported to the Company promptly by our third party consultant and material and potentially material incidents would be assessed by management and the Audit Committee for remediation and future prevention and detection.


text: The Company, at least annually, updates its policies or procedures that could help mitigate cybersecurity risks. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. The Company has incorporated cybersecurity coverage in its insurance policies; however, there is no assurance that the insurance the Company maintains will cover all cybersecurity breaches or that policy limits will be sufficient to cover all related losses.


text: The Company does not believe that it has experienced any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company and its business strategy, results of operations and/or financial condition.


text: Assessment, identification and management of cybersecurity related risks are integrated into our overall risk management process. Cybersecurity related risks are included in the risk universe we evaluate to assess top risks to the Company at least annually.


text: To the extent our processes identify a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion.


text: Cybersecurity Governance The Board of Directors of our parent company, WHLR, has primary oversight over cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risk strategy and governance and of other information technology risks to the Audit Committee of WHLR's Board of Directors (the "Audit Committee"). The Audit Committee reports to the full Board of Directors of WHLR regarding its activities, including those related to cybersecurity. Senior management, including the Company's CEO, CFO, and General Counsel, is responsible for assessing and managing cybersecurity risk, and provides briefings regarding the assessment and management of such risk to the Audit Committee, which then reports, as necessary, to WHLR's Board of Directors. Although members of our senior management do not have direct cybersecurity expertise obtained through certifications, their experience managing the Company, which includes consulting and coordinating as necessary with a third party information technology expert referred to below, enables them to effectively assess and manage material risks from cybersecurity threats.


text: Through WHLR, the Company retained an information technology expert third party company to assist in managing relevant risks. In particular, the Company outsources its information technology function and monitoring to a third party provider whereby it benefits from a professionally managed network monitoring, management, maintenance, detection and response system and a 24/7 security operations center with both onsite and remote support services. Any cybersecurity incident would be reported to the Company promptly by our third party consultant and material and potentially material incidents would be assessed by management and the Audit Committee for remediation and future prevention and detection.


text: The Corporation regards information as one of its most valuable assets. As a result, safeguards have been implemented to protect corporate informational assets and associated technology resources have been established to maintain the integrity, availability, and privacy of confidential information of those assets. The Corporation has established an Information and Cyber Security Program ("Program") that includes standards and procedures to ensure that all information belonging to or held by the Corporation will be appropriately evaluated, classified, and protected against likely forms of unauthorized or inappropriate access, use, disclosure, modification, destruction, and denial.

companyName: CHEMUNG FINANCIAL CORP

ticker: CHMG


text: Enterprise Risk Management embeds risk management into the oversight of cybersecurity as an integral part of the business with comprehensive internal control and assurance processes linked to key risks which are then reported to the Board of Directors ("Board"). Risk oversight, including cybersecurity is a key risk which has been delegated to the Enterprise Risk Committee of the Board ("ERC"). Cybersecurity is integrated into the Corporation's Enterprise Risk Management Policy, Enterprise Risk Management Committee Charter, Escalation Policy, Risk Appetite Statement, Information Technology Steering Meetings, and Division Risk Meetings. Employees are trained on their first day of employment with regards to cybersecurity and additional training is rolled out for all employees throughout the year.


text: The Corporation engages with a multitude of third-party assessors, consultants, auditors and other third parties to support and maintain a robust information security practice. These partners are credentialed cybersecurity firms that assist to monitor and maintain the performance and effectiveness of our processes, procedures, and internal controls, as well as the various products and services that are deployed in our environment. The Corporation has a Third Party Risk Management program in place to monitor for any potential material risks from cybersecurity threats regarding any third-party service providers. Through our Third Party Risk Management Program we risk rate our vendors and conduct a thorough review prior to the execution of any agreement and then on an ongoing risk-based basis. The review consists of due diligence documents and information such as the Service Organizational Control ("SOC") Reports, Information and Data Security, Business Continuity Testing and Penetration Testing.


text: The risks from cybersecurity threats, including any previous cybersecurity incidents, have not materially affected the Corporation to date, including our business strategy, operations, or financial condition. Cybersecurity is an evolving threat that does have the potential to materially affect the Corporation, including our business strategy, operations, or financial condition. However, with our system of internal controls, cyber defense mechanisms in place and the tenure and experience of our Chief Information Security Officer ("CISO") and Information Security Analysts, we have sought to reduce the residual risk that is inherent of cybersecurity.


text: The CISO reports to ERC on a quarterly basis regarding the cybersecurity program and material cybersecurity risks. The quarterly report includes the following information: information security incidents, internal phishing risk, defensive coverage and response of our endpoints, and internal and external vulnerability scan results. The ERC is also apprised of training, regulation or guidance changes, and new products and services utilized by the Information Security Department. In addition to a cybersecurity risk assessment that is performed by the CISO, management is responsible for conducting a risk assessment to identify data security, information technology, and cybersecurity risk factors impacting their business line. The results are reviewed by the Risk Division and presented to ERC.


text: The CISO has over 26 years of experience with information technology management, information security, compliance, audit, and process improvement. Our Information Security Analysts have a combined 22 years of experience with information security, information technology servers and information technology networks. The CISO and Information Security Analysts are active members of the following management level committees at the Bank: Information Technology Steering Committee and the Change Control Committee.


text: The Program is led by our CISO, who reports directly to the Senior Risk Officer. Additionally, the CISO meets regularly and works in tandem with the Chief Information Officer and various members of Information Technology. The Information Security Department meets regularly with employees through hosted educational sessions, all-employee call presentations, Officers' meeting presentations and individual Branch network visits. Line of business leaders regularly reach out to the CISO with regards to cybersecurity risk prevention, questions, and training. The CISO has a standing agenda item for the Information Technology Steering Committee meeting as well as ERC in order to inform the committees about prevention, detection, mitigation and remediation of cybersecurity incidents. If there are any incidents that require information to be presented to the Executive Management Team or the Board, the Senior Risk Officer presents that information. The CISO reports to ERC on a quarterly basis regarding the cybersecurity program and material cybersecurity risks.


text: The risks from cybersecurity threats, including any previous cybersecurity incidents, have not materially affected the Corporation to date, including our business strategy, operations, or financial condition. Cybersecurity is an evolving threat, and the increasing sophistication of threat actors is supported by new technologies, including artificial intelligence and machine learning, which does have the potential to materially affect the Corporation, including our business strategy, operations, or financial condition. However, with our system of internal controls, cyber defense mechanisms in place and the tenure and experience of our Chief Information Security Officer ("CISO") and Information Security Analysts, we have sought to reduce the residual risk that is inherent of cybersecurity.


text: The CISO has over 27 years of experience with information technology management, information security, compliance, audit, and process improvement. Our Information Security Analysts have a combined 23 years of experience with information security, information technology servers and information technology networks. The CISO and Information Security Analysts are active members of the following management level committees at the Bank: Information Technology Steering Committee and the Change Control Committee.


text: The Program is led by our CISO, who reports directly to the Chief Risk Officer. Additionally, the CISO meets regularly and works in tandem with the Chief Information Officer and various members of Information Technology. The Information Security Department meets regularly with employees through hosted educational sessions, all-employee call presentations, Officers' meeting presentations and individual branch network visits. Line of business leaders regularly reach out to the CISO with regards to cybersecurity risk prevention, questions, and training. The CISO has a standing agenda item for the Information Technology Steering Committee meeting as well as ERC in order to inform the committees about prevention, detection, mitigation and remediation of cybersecurity incidents. If there are any incidents that require information to be presented to the Executive Management Team or the Board, the Chief Risk Officer presents that information.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: LCI INDUSTRIES

ticker: LCII


text: Our cybersecurity risk management program is aligned to the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors, which is part of our global information security policy.


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors - "Risks Related to our Business, Operations and Strategy."


text: Cybersecurity Governance The Board of Directors established its Risk Committee with specific responsibility for overseeing risks from cybersecurity threats, among other things. Our Vice President of Global Information Security provides the Risk Committee periodic reports on our cybersecurity risks and any material cybersecurity incidents. In addition, our cybersecurity team provides annual reports to our Board of Directors.


text: Our team of cybersecurity professionals is led day-to-day by our Vice President of Global Information Security who reports to our Chief Information Officer. Our Vice President of Global Information Security has a combined 20 years of experience in IT operations and cybersecurity leadership. The Vice President of Global Information Security also serves as the Chair of our Enterprise Risk and Compliance Committee where leaders from across the Company discuss cyber risk and other risk matters. The cybersecurity team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our cybersecurity team also monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business strategy, results of operations or financial condition, as further described in Item 1A. Risk Factors - "Risks Related to our Business, Operations and Strategy."


text: Our team of cybersecurity professionals is led day-to-day by our Vice President of Global Information Security who reports to our Chief Information Officer. Our Vice President of Global Information Security has over 20 years of experience in IT operations and cybersecurity leadership and is a Certified Information Systems Security Professional (CISSP). The Vice President of Global Information Security also serves on our Enterprise Risk and Compliance Committee where leaders from across the Company discuss cyber risk and other risk matters. The cybersecurity team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Management of cybersecurity risks is an integral part of our overall risk management framework and is essential for safeguarding our business and data. We have developed an information security program to assess, identify and manage material risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls drawn from multiple security frameworks are developed, implemented and maintained. Our cybersecurity risk management program works to balance critical infrastructure, network, application, cloud and information security objectives with overall business objectives and risk tolerance. Specific controls that are used include endpoint threat detection and response, identity and access management, privileged access management, logging and monitoring involving the use of security information and event management, multi-factor authentication, firewalls and intrusion detection and prevention, and vulnerability and patch management.

companyName: CLEVELAND-CLIFFS INC.

ticker: CLF


text: We use threat intelligence to inform our defensive measures. We use external and internal threat intelligence sources, including information from industry vendors and government agencies. Evolving threats and risks we are also monitoring and working to protect against include artificial intelligence, ransomware and nation-state attacks.


text: We believe in continuous improvement as part of the effort to optimize security, and we work to foster that culture through various initiatives: • Cybersecurity Awareness Trainings: We educate employees on best practices for online safety and for identifying potential cybersecurity threats, including by initiating quarterly training programs for our non-represented salaried workforce. • Simulated Cyberattacks: With assistance from qualified third-party experts, we periodically conduct penetration testing and tabletop exercises to test our technical controls and incident response plans. • Security Monitoring: We monitor our information technology environment with both our internal cybersecurity resources and third-party service providers. We also have processes in place to monitor the cybersecurity practices of various third-party service providers, including certain vendors that have access to our information systems or sensitive data. • Proactive Reporting and Investigation: As part of our training initiatives, we regularly educate employees on how to report any suspicious cyber activity or potential cybersecurity issues, and we investigate reported concerns.


text: Third-party security firms are used in different capacities to provide or operate some of these programs, controls and technology systems, including cloud-based platforms and services.


text: Our Board of Directors has overall oversight responsibility for our enterprise risk management program and delegates cybersecurity risk management oversight to the Audit Committee of the Board of Directors. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Management, including the Chief Information Officer with support from our cybersecurity team, updates the Audit Committee on at least a biannual basis regarding our cybersecurity programs and material cybersecurity risks and mitigation strategies. The Audit Committee also regularly reports on discussions regarding cybersecurity risks to our full Board of Directors. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Information Officer, who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our cybersecurity team includes personnel that have obtained credentials from the International System Security Certification Consortium and the SANS Institute, such as Certified Information Systems Security Professional (CISSP) and GIAC Certified Incident Handler, as well as experienced information systems security professionals and information security managers. Additionally, our internal Information Security Committee, composed of leaders from key departments, collaborates on a cross-functional basis to identify practices that can counter threats and to monitor our cybersecurity programs and our cybersecurity incident response plans.


text: We recognize the ever-present global risk of cyberattacks from diverse threat actors, including nation-states, cybercriminals, hacktivists, insiders and organized crime. In spite of our efforts, we (or third parties we rely on) may not be able to fully, continuously and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement, but it is possible we may not implement appropriate controls if we do not recognize or we underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. Further, even events that are detected by security tools or third parties may not always be immediately understood or acted upon. While no organization is immune to attack attempts and we cannot eliminate all risks from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident, in 2023 we did not identify any material cybersecurity events that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For more information about these risks, please see Part I - Item 1A. Risk Factors - IV. Operational Risks - A disruption in or failure of our IT systems, including those related to cybersecurity, could adversely affect our business operations, reputation and financial performance.


text: We believe in continuous improvement as part of the effort to optimize security, and we work to foster that culture through various initiatives: • Cybersecurity Awareness Trainings: We educate employees on best practices for online safety and for identifying potential cybersecurity threats, including by maintaining quarterly training programs for our non-represented salaried workforce. • Simulated Cyberattacks: With assistance from qualified third-party experts, we periodically conduct penetration testing and tabletop exercises to test our technical controls and incident response plans. • Security Monitoring: We monitor our information technology environment with both our internal cybersecurity resources and third-party service providers. We also have processes in place to monitor the cybersecurity practices of various third-party service providers, including certain vendors that have access to our information systems or sensitive data. • Proactive Reporting and Investigation: As part of our training initiatives, we regularly educate employees on how to report any suspicious cyber activity or potential cybersecurity issues, and we investigate reported concerns.


text: Our Board of Directors has overall oversight responsibility for our enterprise risk management program and delegates cybersecurity risk management oversight to the Audit Committee of the Board of Directors. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Management, including the Chief Information Officer with support from our cybersecurity team, updates the Audit Committee on at least a biannual basis regarding our cybersecurity programs and material cybersecurity risks and mitigation strategies. The Audit Committee also regularly reports on discussions regarding cybersecurity risks to our full Board of Directors. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Information Officer, who has three years of experience overseeing information technology and cyber functions and who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our cybersecurity team includes personnel that have obtained credentials from the International System Security Certification Consortium and the SANS Institute, such as Certified Information Systems Security Professional (CISSP) and GIAC Certified Incident Handler, as well as experienced information systems security professionals and information security managers. Additionally, our internal Information Security Committee, composed of leaders from key departments, collaborates on a cross-functional basis to identify practices that can counter threats and to monitor our cybersecurity programs and our cybersecurity incident response plans.


text: We recognize the ever-present global risk of cyberattacks from diverse threat actors, including nation-states, cybercriminals, hacktivists, insiders and organized crime. In spite of our efforts, we (or third parties we rely on) may not be able to fully, continuously and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement, but it is possible we may not implement appropriate controls if we do not recognize or we underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. Further, even events that are detected by security tools or third parties may not always be immediately understood or acted upon. While no organization is immune to attack attempts and we cannot eliminate all risks from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident, in 2024 we did not identify any material cybersecurity events that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For further information about these risks, please see Part I - Item 1A. Risk Factors - IV. Operational Risks - A disruption in or failure of our IT systems, including those related to cybersecurity, could adversely affect our business operations, reputation and financial performance and could expose us to third-party liability.


text: Risk Management and Strategy We rely extensively on information technology, much of which is managed by third-party service providers (such as cloud data service providers), to support a variety of business processes and activities, including: complying with regulatory, legal, financial reporting and tax requirements; engaging in marketing and e-commerce activities; managing and improving the effectiveness of our operations; researching, developing, manufacturing and distributing our products; collecting and storing sensitive data and confidential information; and communicating with employees, investors, suppliers, trade customers, adult tobacco consumers and others. Recognizing the critical importance of cybersecurity in today's digital landscape, we are committed to safeguarding our information assets, protecting consumer data and maintaining the integrity and availability of our systems. Accordingly, we have implemented an extensive cybersecurity risk management framework designed to identify, assess, mitigate and prevent potential cybersecurity risks and to align with industry best practices and all applicable regulatory requirements. We evaluate our cybersecurity risk management framework against the National Institute of Standards and Technology's Cybersecurity Framework, which outlines the core components and responsibilities necessary to sustain a healthy and well-balanced cybersecurity program. We also align our security standards for infrastructure configuration with the Center for Internet Security's Benchmarks, which are prescriptive recommendations based upon the consensus of global cybersecurity experts.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: Our framework is built around the following key principles: (i) risk assessment and threat intelligence; (ii) security controls; (iii) incident response; (iv) employee awareness and training; and (v) third-party risk management. We have integrated our cybersecurity framework into our broad enterprise risk management processes, which allows us to leverage our existing enterprise-wide experience in managing risk and adapting to change in the cybersecurity threat landscape.


text: Risk Assessment and Threat Intelligence: We conduct regular risk assessments to identify potential cybersecurity vulnerabilities and threats. Our Information Technology ("IT") Risk Management function, overseen by our Chief Information Security Officer ("CISO"), leads internal self-assessments, which involve evaluating the security posture of critical systems, networks and applications as well as the potential impact of cybersecurity threats on our business operations, financial condition and reputation. IT Risk Management also conducts ongoing threat monitoring and has implemented monitoring systems, including technologies such as intrusion detection systems, security information and event management tools and threat intelligence programs.


text: We regularly engage third-party consulting services to conduct audits and assessments of the effectiveness of our cybersecurity controls and processes and identify areas for improvement based on developments in industry best practices. We also leverage third parties to evaluate our cybersecurity and risk management strategy, review policies and procedures to address new risks and maintain ongoing compliance with evolving legal and regulatory requirements. For example, we partner with leading global security providers to leverage various threat intelligence channels as input to monitor and tune our controls to prevent a cybersecurity attack.


text: Security Controls: We employ a layered approach to cybersecurity, implementing a range of technical and procedural controls to protect critical systems and data. These controls include (i) firewalls and intrusion detection and prevention systems to monitor and block unauthorized access attempts, detect and prevent malicious activity and safeguard network infrastructure, (ii) encryption, including secure protocols and multi-factor authentication, to protect information in transit and at rest and (iii) secure network architecture that segregates critical systems from the public internet, limiting exposure to potential threats. We also conduct regular security patching to manage emerging cyber threats.


text: Incident Response: We have established an incident response plan and playbooks, which include procedures designed to respond to and recover from cybersecurity incidents. These procedures, which our IT Risk Management function reviews on an ongoing basis both internally and with third-party consultants, provide detailed descriptions of the roles and responsibilities of key stakeholders and the procedures for communication and coordination during an incident. The procedures also provide guidelines for escalating information to senior management, our Disclosure Controls Committee, our Audit Committee, which, as discussed below, has been delegated responsibility for our Board's cybersecurity risk oversight function, and our full Board and for providing timely public disclosure, when necessary.


text: To maintain incident readiness and resilience, we conduct periodic disaster recovery exercises and cybersecurity incident management exercises led by our IT Risk Management function. These exercises involve simulating various scenarios and testing our response strategies, allowing us to identify vulnerabilities, refine procedures and enhance our overall crisis management and recovery capabilities. We believe regular practice and evaluation allows us to minimize the impact of potential disruptions and safeguard our operations, data and reputation.


text: Employee Awareness and Training: We recognize that employees play a critical role in maintaining a strong cybersecurity posture. Our Information Governance Policy sets forth the requirements for employee conduct relating to company information and company-managed devices, including relevant privacy, data security and data retention policies. We believe that our Information Governance Policy is aligned with industry best practices and applicable legal and regulatory requirements. In addition to our Information Governance Policy, we conduct regular cybersecurity training programs emphasizing the importance of cybersecurity awareness. These programs address relevant cybersecurity topics, such as common cybersecurity threats, phishing awareness and best practices for safeguarding sensitive information. Employees are held accountable for completing all assigned cybersecurity programs and meeting certain performance thresholds in phishing awareness exercises, and there is a range of consequences for underperformance that includes termination.


text: Third-Party Risk Management: We acknowledge the potential cybersecurity risks inherent in our relationships with third-parties. Accordingly, we have implemented a third-party risk management program to identify and oversee such risks. This program relies on key elements including risk assessment, due diligence, contractual provisions and ongoing monitoring to identify and mitigate impacts from high-risk third-parties and of specific risks. We use security risk assessment questionnaire tools to identify high-risk third-parties, allowing us to effectively assess and mitigate potential security vulnerabilities.


text: Our third-party risk assessment framework evaluates the cybersecurity practices and controls of third-parties. For high-risk third-parties, we perform rigorous due diligence inquiries, reviewing documentation with respect to their security policies, incident response capabilities, data protection measures and regulatory compliance. We also review evidence of cybersecurity certifications and the results of independent audits. For high-risk third-parties with access to sensitive data or systems, we conduct more in-depth assessments. Our contracts with high-risk third-parties contain provisions related to data protection, confidentiality, incident reporting and compliance with all applicable laws and regulations. Throughout our engagements with high-risk third-parties, we maintain a monitoring program with respect to their cybersecurity posture. Leveraging tools such as security questionnaires, security ratings and external threat intelligence, we regularly review and update third-party risk assessments based on changes in the third-party's services or practices and the risk landscape.


text: Our Board devotes significant time and attention to our cybersecurity and information technology risks. Our Board executes its cybersecurity risk oversight function as a whole and by delegating responsibility to our Audit Committee. Our CISO and Chief Information Officer present to our Board annually and to our Audit Committee at least twice each year on a broad range of topics, such as recent and potential cybersecurity threats and incidents across our industry, best practices and policies, emerging trends, vulnerability assessments and management's ongoing efforts to prevent, detect and address internal and external cybersecurity threats specific to us. These briefings also include periodic third-party cybersecurity program assessments and benchmarks and updates from our cybersecurity incident management exercises. Cybersecurity risks are documented in an IT Risk Dashboard, which is shared with our Audit Committee for awareness several times each year. Our full Board also has access to these materials. Finally, we provide periodic cybersecurity training to our Audit Committee and Board to further cybersecurity awareness and risk oversight.


text: While our Board and Audit Committee oversee cybersecurity risk, senior management is responsible for actively managing cybersecurity risk, including by overseeing and executing the risk management strategies discussed above. Our Risk Oversight Committee, which is chaired by our Chief Compliance Officer and comprised of members of senior management, including our Chief Financial Officer, Chief Operating Officer, Chief Strategy and Growth Officer and General Counsel, oversees the management of key enterprise risks, including cybersecurity risks. Senior management reports annually to the Board with respect to our overall enterprise risk management processes. Our CISO presents to the Risk Oversight Committee quarterly to review the status of management's key cybersecurity risk management strategies. The Risk Oversight Committee also receives the quarterly IT Risk Dashboard.


text: Our CISO is responsible for assessing and managing cybersecurity risks and maintaining our cybersecurity program. Our CISO has over 20 years of experience, including five years as our CISO, managing technology risks across multiple industries, including financial services, technology and manufacturing. Through strategic hiring and internal development, our CISO increases the levels of skill and experience on our IT Risk Management team to stay ahead of evolving cybersecurity threats. As of the date of this filing, 94% of our IT Risk Management team has technical industry certification, and members of the IT Risk Management team have an average of 15 years of cybersecurity experience. Our CISO currently serves as an advisor to multiple industry groups. Our cybersecurity program undergoes an annual controls effectiveness assessment and bi-annual program maturity evaluation against industry peers and consistently receives assessments indicating that it is ahead of the cybersecurity programs of our peer group.


text: As of the date of this filing, we are not aware of any current cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. For further discussion of the risks related to cybersecurity, see Item 1A. Risk Factors - Risks Relating to Our Business - Information Technology and Data Privacy Risks.


text: Risk Management and Strategy We rely extensively on information technology, much of which is managed by third-party service providers (such as cloud data service providers), to support a variety of business processes and activities, including: complying with regulatory, legal, financial reporting and tax requirements; engaging in marketing and e-commerce activities; managing and improving the effectiveness of our operations; researching, developing, manufacturing and distributing our products; collecting and storing sensitive data and confidential information; and communicating with employees, investors, suppliers, trade customers, adult tobacco consumers and others. Recognizing the critical importance of cybersecurity in today's digital landscape, we are committed to safeguarding our information assets, protecting consumer data and maintaining the integrity and availability of our systems. Accordingly, we have implemented an extensive cybersecurity risk management framework designed to identify, assess, mitigate and prevent potential cybersecurity risks and to align with industry best practices and all applicable regulatory requirements. We leverage the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and industry best practices to identify and prioritize cybersecurity risks based on their potential impacts. We also use the NIST framework and industry best practices to drive enhancements to our program that are designed to protect our assets and third-party partners. The NIST framework also helps us maintain ongoing compliance with regulatory requirements. We align our security standards for infrastructure configuration with the Center for Internet Security's Benchmarks, which are prescriptive recommendations based upon the consensus of global cybersecurity experts.


text: We regularly engage third-party consulting services to conduct audits and assessments of the effectiveness of our cybersecurity controls and processes and identify areas for improvement based on developments in industry best practices. We typically engage these services annually, though the cadence can differ based on the results of the audits and assessments. We also leverage third parties to evaluate our cybersecurity and risk management strategy, review policies and procedures to address new risks and maintain ongoing compliance with evolving legal and regulatory requirements. For example, we partner with leading global security providers to leverage various threat intelligence channels as input to monitor and tune our cybersecurity controls.


text: Security Controls: We employ a layered approach to cybersecurity, implementing a range of technical and procedural controls designed to protect critical systems and data. These controls include (i) firewalls and intrusion detection and prevention systems to monitor and block unauthorized access attempts, detect and deter malicious activity and safeguard network infrastructure, (ii) encryption, including secure protocols and multi-factor authentication, to protect information in transit and at rest and (iii) secure network architecture that segregates critical systems from the public internet, limiting exposure to potential threats. We also conduct regular security patching to manage emerging cyber threats.


text: Incident Response: We have established an incident response plan and playbooks, which include procedures designed to respond to and recover from cybersecurity incidents. These procedures, which our IT Risk Management function reviews on an ongoing basis both internally and with third-party consultants, provide detailed descriptions of the roles and responsibilities of key stakeholders and the procedures for communication and coordination during an incident. The procedures also provide guidelines for escalating information to senior management, our Disclosure Controls Committee, our Audit Committee, which, as discussed below, has been delegated cybersecurity program oversight responsibility, and our full Board and for providing timely public disclosure, when necessary.


text: To maintain incident readiness, business continuity and IT resilience, we conduct periodic disaster recovery exercises and cybersecurity incident management exercises led by our IT Risk Management function. These exercises involve simulating various scenarios and testing our response strategies, allowing us to identify vulnerabilities, refine procedures and enhance our overall crisis management and recovery capabilities. We believe regular practice and evaluation allows us to minimize the impact of potential disruptions and safeguard our operations, data and reputation.


text: Employee Awareness and Training: We recognize that employees play a critical role in maintaining a strong cybersecurity posture. Our Information Governance Policy sets forth the requirements for employee conduct relating to company information and company-managed devices, including relevant privacy, data security and data retention policies. We believe that our Information Governance Policy is aligned with industry best practices and applicable legal and regulatory requirements. In addition to our Information Governance Policy, we conduct cybersecurity training programs emphasizing the importance of cybersecurity awareness at least annually and more frequently as necessary or advisable. These programs address relevant cybersecurity topics, such as common cybersecurity threats, phishing awareness and best practices for safeguarding sensitive information. Employees are held accountable for completing all assigned cybersecurity programs and meeting certain performance thresholds in phishing awareness exercises, and there is a range of consequences for underperformance that includes termination.


text: Third-Party Risk Management: We acknowledge the potential cybersecurity risks inherent in our relationships with third-parties. Accordingly, we have implemented a third-party risk management program to identify and oversee such risks. This program relies on key elements including risk assessment, due diligence, contractual provisions and ongoing monitoring to identify and mitigate impacts from high-risk third-parties and of specific risks. We use security risk assessment questionnaire tools to identify high-risk third-parties, which we believe allows us to effectively assess and mitigate potential security vulnerabilities.


text: Our third-party risk assessment framework evaluates the cybersecurity practices and controls of third-parties. For high-risk third-parties, we perform due diligence inquiries, reviewing documentation with respect to their security policies, incident response capabilities, data protection measures and regulatory compliance. We also review evidence of cybersecurity certifications and the results of independent audits. For high-risk third-parties with access to sensitive data or systems, we conduct more in-depth assessments. Our contracts with high-risk third-parties contain provisions related to data protection, confidentiality, incident reporting and compliance with all applicable laws and regulations. Throughout our engagements with high-risk third-parties, we maintain a monitoring program with respect to their cybersecurity posture. Leveraging tools such as security questionnaires, security ratings and external threat intelligence, we regularly review and update third-party risk assessments based on changes in the third-party's services or practices and the risk landscape.


text: Our Board devotes significant time and attention to our cybersecurity and information technology risks. Our Board executes its cybersecurity risk oversight as a whole and by delegating responsibility to our Audit Committee. Our CISO and Chief Information Officer present to our Board annually and to our Audit Committee at least twice each year on a broad range of topics, such as recent and potential cybersecurity threats and incidents across our industry, best practices and policies, emerging trends, vulnerability assessments and management's ongoing efforts to prevent, detect and address internal and external cybersecurity threats specific to us. These briefings also include reporting on periodic third-party cybersecurity program assessments and benchmarks and updates from our cybersecurity incident management exercises. Cybersecurity risks are documented in an IT Risk Dashboard, which is shared with our Audit Committee for awareness several times each year. Our full Board also has access to these materials. Finally, we provide periodic cybersecurity training to our Audit Committee and Board to further cybersecurity awareness and risk oversight.


text: Our CISO is responsible for assessing and managing cybersecurity risks and maintaining our cybersecurity program. Our CISO has over 25 years of experience, including five years as our CISO, managing technology risks across multiple industries, including financial services, technology and manufacturing. Through strategic hiring and internal development, our CISO enhances the levels of skill and experience on our IT Risk Management team to stay ahead of evolving cybersecurity threats. As of the date of this filing, 100% of our IT Risk Management team has technical industry certification, and members of the IT Risk Management team have an average of 15 years of cybersecurity experience. Our CISO currently serves as an advisor to multiple industry groups. Our cybersecurity program undergoes an annual third-party controls effectiveness assessment and bi-annual program maturity evaluation against industry peers and consistently receives assessments indicating that it is ahead of the cybersecurity programs of our peer group.


text: As of the date of this filing, we are not aware of any current cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. From time-to-time, we and our third-party service providers, suppliers and trade customers experience attempts to infiltrate and interrupt information systems. To date, we have not experienced any interruptions of these information systems as a result of infiltration attempts. For further discussion of the risks related to cybersecurity, see Risks Relating to Our Business - Information Technology and Data Privacy Risks in Item 1A.


text: We rely heavily on information technology systems to operate and manage all key aspects of our business. We also process substantial volumes of confidential business information and sensitive consumer and employee personal information, which if impacted by cyber threats could result in financial and reputational harms and regulatory sanction. We have developed and implemented, and update on an ongoing basis, a risk-based information security program designed to identify, assess and manage material risks from cybersecurity threats.

companyName: BEST BUY CO INC

ticker: BBY


text: Cybersecurity Risk Management and Strategy Our information security program comprises administrative, technical and physical safeguards designed, under a risk-based approach, to reasonably mitigate cybersecurity risks to the confidentiality, integrity or availability of our information systems and information. These include safeguards designed to oversee service-provider relationships in a manner consistent with the risks presented by the engagement and use of the service provider.


text: The program deploys multiple layers of controls designed to identify, protect against, detect, respond to and recover from information security and cybersecurity incidents and our Cyber Security Incident Response Team, which is part of our Enterprise Information Protection ("EIP") organization, plays a core role in detecting, mitigating and remediating cybersecurity incidents. Based on the nature and severity of the incident, our response is to be guided by documented incident response plans. These plans outline steps to be followed, functional areas to be engaged, internal escalations to be pursued (which may include, as appropriate, senior management, executive management and the Board) and stakeholders to be notified.


text: Third parties also play a role in our cybersecurity. We engage third parties for advice and support in the design and implementation of certain program elements and leverage third-party tools to help identify and mitigate cybersecurity risks. Certain specific, defined components of our technology environment are assessed by third-party auditors with a view to alignment with industry standards such as, for example, the Payment Card Industry Data Security Standards.


text: We also periodically retain outside expertise to conduct a maturity assessment of our program against industry standards and participants. Our program is informed by industry standards such as, for example, the National Institute of Standards and Technology's Framework for Improving Critical Infrastructure Cybersecurity ("NIST CSF"), but this does not imply that we meet all technical standards, specifications or requirements under the NIST CSF or other sources.


text: We have combatted cybersecurity threats in the normal course of business, but prior cybersecurity incidents have not materially affected, and do not appear likely to materially affect, our operations, business strategy, results of operations or financial condition. However, our Enterprise Risk Management program has recognized that we face ongoing risks from cybersecurity threats that, if not successfully prevented or mitigated, could materially affect us, including our operations, business strategy, results of operations or financial condition. For additional information on this risk, see Item 1A, Risk Factors, of this Annual Report on Form 10-K.


text: Cybersecurity Governance Our Board, with oversight by the Audit Committee, oversees management's processes for identifying and mitigating cybersecurity risks. Executive management including our Chief Information Security Officer ("CISO"), who reports to our General Counsel & Chief Risk Officer, updates the Audit Committee on our cybersecurity posture no less frequently than quarterly and periodically update the full Board.


text: Our EIP organization, led by our CISO, is responsible for the design and implementation of our information security program. Our current CISO has been with the Company for more than eight years—serving as our CISO for nearly seven years—and has extensive cybersecurity experience through leadership and consulting roles. His current leadership team comprising seven individuals has over 130 years of combined cybersecurity experience. These and other EIP team members work closely with stakeholders across the Company to implement the program's policies, standards and processes and help ensure awareness that securing customer information and honoring our privacy promises are core employee obligations, as highlighted in our Code of Ethics and reinforced through our Valuable Information Protection training program.


text: We rely heavily on information technology systems to operate and manage all key aspects of our business. We also process substantial volumes of confidential business information and sensitive consumer and employee personal information, which if impacted by cyber threats, could result in financial and reputational harms and regulatory sanction. We have developed and implemented, and update on an ongoing basis, a risk-based information security program designed to identify, assess and manage material risks from cybersecurity threats.


text: Third parties also play a role in our cybersecurity. We engage third parties for advice and support in the design and implementation of certain program elements and leverage third-party tools to help identify and mitigate cybersecurity risks. Certain specific, defined components of our technology environment are assessed by third-party auditors with a view to align with industry standards such as, for example, the Payment Card Industry Data Security Standards.


text: We also periodically retain outside expertise to conduct a maturity assessment of our program against industry standards and participants. Our program is informed by industry standards such as, for example, the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF"), but this does not imply that we meet all technical standards, specifications or requirements under the NIST CSF, NIST CSF 2.0 or other sources.


text: We have combatted cybersecurity threats in the normal course of business, but prior cybersecurity incidents have not materially affected, and do not appear likely to materially affect, our operations, business strategy, results of operations or financial condition. However, our Enterprise Risk Management program has recognized that we face ongoing risks from cybersecurity threats that, if not successfully prevented or mitigated, could materially affect us, including our operations, business strategy, results of operations or financial condition. For additional information on such risks, see Item 1A, Risk Factors, of this Annual Report on Form 10-K.


text: Cybersecurity Governance Our Board, with oversight by the Audit Committee, oversees management's processes for identifying and mitigating cybersecurity risks. Executive management including our Chief Information Security Officer ("CISO"), who reports to our General Counsel & Chief Risk Officer, update the Audit Committee on our cybersecurity posture no less frequently than quarterly and periodically update the full Board.


text: Our EIP organization, led by our CISO, is responsible for the design and implementation of our information security program. Our current CISO has been with the Company for more than nine years—serving as our CISO for nearly eight years—and has extensive cybersecurity experience through leadership and consulting roles. His current leadership team has over 100 years of combined cybersecurity experience. These and other EIP team members work closely with stakeholders across the company to implement the program's policies, standards and processes. They also help ensure awareness that securing customer information and honoring our privacy promises are core employee obligations, as highlighted in our Code of Ethics and reinforced through our Valuable Information Protection training program.


text: The Company prioritizes and maintains a high level of commitment to responsible and secure cybersecurity practices given the critical nature of its services and the potential consequences of a successful cyber-attack on the Company and the electric grid. A successful cyber-attack could have far-reaching consequences, from compromising the integrity of sensitive data to disrupting power supply. To that end, the Company implements a robust risk management, strategy, and governance regime aimed at ensuring effective controls are in place to identify, mitigate, remediate, and communicate cyber threats at appropriate levels within the organization.

companyName: ARIZONA PUBLIC SERVICE CO


text: APS's cybersecurity group (the "Cybersecurity Group") is comprised of cybersecurity analysts, engineers, architects, and others, led by the Director of Cybersecurity, who reports to APS's Vice President, Operations Support. The Director of Cybersecurity has more than twenty years of experience in information technology and cybersecurity roles, with more than ten of those years at the Company. The Director of Cybersecurity also holds cybersecurity certifications from multiple certifying bodies and is active in utility cybersecurity professional organizations. The Cybersecurity Group has day-to-day responsibility for safeguarding the Company's critical assets and assessing, identifying, and managing material risks from cybersecurity threats.


text: In fulfilling its responsibility, the Cybersecurity Group manages formal documented internal processes such as risk management and vulnerability scanning, as well as other processes, such as assessing threat intelligence, that include outside partners. Intelligence sharing comes from industry sources such as the Electricity Information Sharing and Analysis Center, government sources, as well as commercially purchased information sources. The Cybersecurity Group also engages third parties for assessments and audits of its systems periodically and as needed. Such assessments and audits may include, among other things, pre-production evaluation of technologies, overall program assessments, and compliance program assessments including audits by our regulators.


text: Depending on the products and services provided and the potential for data exchange and technology risk, we may require vendors and service providers to pass APS's vendor risk management program, which sets forth security and data protection requirements, as a condition to doing or continuing to do business with us. For contracts with vendors that will handle or have access to certain sensitive data, APS requires contractual provisions setting forth cybersecurity controls, vulnerability management, secure development practices, and other security and data protection requirements. A subset of vendors that meet a predetermined risk profile due to strategic relationships, technology risk, or other factors is continually monitored by a third-party risk management service, and the Company annually reviews independent assessments of these vendors.


text: The Cybersecurity Group also has documented processes for identifying, responding to, and internally escalating cybersecurity incidents. Once an incident meets certain criteria, the Company's Cybersecurity Incident Command or, in the most severe cases that impact the entire Company, the Corporate Emergency Operations Center is activated and formal response procedures are followed to address the incident. The Cybersecurity Group has a formal incident response plan that details response and escalation procedures, including activation of a Cybersecurity Disclosure Committee, consisting of the Chief Financial Officer and the General Counsel, to assess an incident's materiality with input as needed from the Director of Cybersecurity, Chief Accounting Officer, Chief Information Officer, and others, including outside advisors.


text: Cybersecurity risk management has been integrated into the Company's overall enterprise risk management program (the "Enterprise Risk Management Program") through policies and processes that implement a risk management framework designed to identify, manage, and monitor business unit risks throughout the organization. The Enterprise Risk Management Program is overseen by an executive committee (the "Executive Risk Committee"), which meets at least quarterly and is comprised of members holding executive leadership positions in the Company, including the Chairman and Chief Executive Officer, President, and other Executive and Senior Vice Presidents, and is chaired and sponsored by the Chief Financial Officer. Every year, as a part of the Enterprise Risk Management Program, the top risks affecting the Company are identified. For 2023, cybersecurity was identified as a top risk. The applicable subject matter experts brief the Company's Board of Directors on the status of all top enterprise risks at least once per year. Finally, the Nuclear and Operating Committee of the Company's Board of Directors provides ultimate oversight of cybersecurity risk and also receives briefings at least twice per year from the Cybersecurity Group, and notable audit findings relating to cybersecurity are aggregated and provided to the Board of Directors' Audit Committee.


text: To date, we do not believe there have been risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Pinnacle West or APS. However, there is no assurance that will continue to be the case. If a significant cybersecurity event or incident were to occur, our ability to fulfill our critical business functions and our business strategy, results of operations, and financial condition could all be materially impacted. See the risk factor entitled, "We are subject to cybersecurity risks and risks of unauthorized access to our systems that could adversely affect our business and financial condition" in Item 1A—Risk Factors for more information.


text: The Cybersecurity Group also has documented processes for identifying, responding to, and internally escalating cybersecurity incidents to management and the Board of Directors. Once an incident meets certain criteria, the Company's Cybersecurity Incident Command or, in the most severe cases that impact the entire Company, the Corporate Emergency Operations Center is activated and formal response procedures are followed to address the incident. The Cybersecurity Group has a formal incident response plan that details response and escalation procedures, including activation of a Cybersecurity Disclosure Committee, consisting of the Chief Financial Officer and the General Counsel, to assess an incident's materiality with input as needed from the Director of Cybersecurity, Chief Accounting Officer, Chief Information Officer, and others, including outside advisors.