text: The SIRP provides for the interaction and coordination of executive, strategic and tactical teams, depending on the severity level of the incident, aimed at facilitating coordination across multiple units and departments of the Company. The incident response plan is reviewed, updated and tested at least annually. The SIRP covers the major phases of incident response process, including preparation; detection and analysis; containment and investigation; where required, notification to federal or state regulators; eradication and recovery; and incident closure and post-incident analysis.


text: AFG's cybersecurity program is directed by its EISG leadership team that is headed by the AFG CISO and three divisional vice presidents that report to the CISO. This leadership group has collectively over 70 years of cybersecurity work experience, over 90 years of Information Technology ("IT") experience and over 20 years of IT audit experience. This experience involved various roles related to managing information security; developing cybersecurity strategy; implementing and monitoring effective cybersecurity controls and penetration testing. These individuals hold many industry-standard certifications including but not limited to Certified Information Systems Security Professional, Information Systems Security Management Professional, G2700 certification, GIAC Security Leadership Certification, Certified in Risk and Information Systems Control, Certified Information Security Manager, ITL certification and others. The CISO also holds a master's degree in information security. All members of this leadership team are active in their local cybersecurity communities and national conferences. They speak at local universities, local conferences, national conferences, and have conducted training sessions at international conferences like Black Hat, an internationally recognized cybersecurity event series providing the most technical and relevant information security research. Their work has also been used in various best practice case studies by industry leading consulting and research firms.

companyName: AMERICAN FINANCIAL GROUP INC

ticker: AFG

secItem: Item 1C


text: Risk Management and Strategy AFG recognizes the importance of assessing, identifying and managing material risks associated with cybersecurity threats as defined by the Securities and Exchange Commission. Like all businesses, AFG is a target for "cyber-attacks," "ransomware," "phishing," "hacking" and similar illegal or unauthorized intrusions into computer systems and networks. Such events can result in significant disruptions to information technology systems, the theft of information and financial assets and reputational harm. AFG could also incur significant expenses associated with investigating and remediating any such event.


text: AFG has adopted the National Institute of Standards and Technology ("NIST") Cybersecurity framework which provides a comprehensive method for developing a flexible, repeatable, performance-based and cost-effective approach to identifying and managing cybersecurity risks. The Company uses the framework to assess and improve its security posture.


text: AFG continues to integrate assessing cybersecurity threat risks associated with its use of third-party service providers, generally at the initial engagement or renewal of the relationship. When conducting these assessments, AFG's Enterprise Information Security Group ("EISG") considers the risk profile of the vendor or supplier, assesses security controls with the third parties and engages in contractual review to ensure appropriate security controls are in place.


text: AFG describes whether and how risks from identified cybersecurity threats are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition in its risk factor disclosures in Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference in this Item 1C.


text: AFG has designed its ERM program to reinforce the way the Company operates its business and reflects its culture, organizational structure and risks. The AFG Enterprise Risk Committee ("ERC"), consisting of AFG's Chief Administrative Officer and Chief Human Resources Officer, AFG's Chief Financial Officer, AFG's General Counsel and Great American's President, oversees the ERM process including risk identification, risk impact and mitigation strategies. Each member of the ERC directly reports to AFG's Co-CEOs. On a day-to-day basis, the Company's ERM process is overseen by an AFG Enterprise Risk Officer, who regularly meets with senior leaders, including the CISO, representing key areas throughout the organization. Cybersecurity risk has been identified as a significant risk monitored under the ERM program. In addition, Ms. Murray, one of AFG's independent Directors, completed the National Association of Corporate Directors' Cyber-Risk Oversight Program and received the CERT Certificate in Cybersecurity Oversight issued by the Software Engineering Institute at Carnegie Mellon University.


text: AFG has also adopted a Security Incident Response Plan ("SIRP") that is designed to provide a management framework across Company functions for a coordinated assessment and response to potential security incidents. The AFG CISO leads and facilitates the SIRP team, which also includes AFG's Chief Administrative Officer and Chief Human Resources Officer, AFG's Chief Financial Officer, AFG's Chief Information Officer, AFG's General Counsel and Great American's President and its General Counsel.


text: AFG's cybersecurity program is directed by its EISG leadership team that is headed by the AFG CISO and three divisional officers who report to the CISO. This leadership group has collectively over 70 years of cybersecurity work experience, over 90 years of Information Technology ("IT") experience and over 20 years of IT audit experience. This experience involved various roles related to managing information security; developing cybersecurity strategy; implementing and monitoring effective cybersecurity controls and penetration testing. These individuals hold many industry-standard certifications including but not limited to Certified Information Systems Security Professional, Information Systems Security Management Professional, G2700 certification, GIAC Security Leadership Certification, Certified in Risk and Information Systems Control, Certified Information Security Manager, ITL certification and others. The CISO also holds a master's degree in information security. All members of this leadership team are active in their local cybersecurity communities and national conferences. They speak at local universities, local conferences, national conferences, and have conducted training sessions at international conferences like Black Hat, an internationally recognized cybersecurity event series providing the most technical and relevant information security research. Their work has also been used in various best practice case studies by industry leading consulting and research firms.


text: Cybersecurity Risk Management and Strategy To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threats alongside other company risks as part of our overall risk assessment process. In addition, we perform an external, specific cybersecurity risk assessment every eighteen months. Included in our management of cybersecurity risk is our annual review of our Incident Response Plan/Policy, involving employees from all responsibility levels of the company. Our Chief Financial and Administrative Officer has primary responsibility for overseeing our information systems and information technology resources, including risks from cybersecurity threats. To assist our Chief Financial and Administrative Officer in discharging these responsibilities, we have a standing management committee to address information technology and cybersecurity risk matters comprised of our Chief Financial and Administrative Officer, the principal of a third-party, managed security service provider (an "MSSP"), our Vice President of Risk Management, our Chief Accounting Officer, our Senior Vice President of Human Resources and certain other members of our information technology staff and property management. This committee meets on a quarterly basis, with additional meetings held as-needed throughout the year, to: • monitor emerging data protection laws and implement changes to our processes designed to comply with these laws; • identify and assess material risks from cybersecurity threats; • provide guidance on our cybersecurity strategy development and implementation; • ensure that regular risk assessments and appropriate mitigation strategies are in place; • ensure the performance of regular vulnerability and penetration testing and remediation of findings; • oversee the implementation and management of cybersecurity-related tools such as security information and event management systems; and • review relevant service organization controls reports for the MSSP that serves as our Security Operation Center; and • require training and security awareness programs for our employees.

companyName: Piedmont Realty Trust, Inc.

ticker: PDM


text: Our Vice President of Risk Management monitors and tests these initiatives on a periodic basis. Additionally, our Chief Financial and Administrative Officer partners with the MSSP and our information technology staff throughout the organization to manage material risks from cybersecurity threats, as well as to provide managerial and operational support for our information systems and information technology resources on a daily basis.


text: Index to Financial Statements We also maintain an incident response plan to coordinate the actions we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response plan is tested annually, with tabletop exercises to assess the validity of the plan and to make necessary modifications, as needed, on a bi-annual basis.


text: We utilize external risk advisory and accounting firms to perform an audit focusing on entity-level, application and information technology general computer controls annually, as well as the full cybersecurity risk assessment mentioned above. Audit results and the risk assessments are reviewed by our Chief Financial and Administrative Officer, the principal of the MSSP, and our Vice President of Risk Management. Any exceptions are addressed with a remediation plan and implemented with appropriate resources. Audit results, risk assessments and remediation plans are discussed with the Audit Committee of the board of directors, who has responsibility for cybersecurity risk oversight, each quarter until all points are fully resolved.


text: We also identify and oversee cybersecurity risk from third-party service providers through our vendor management policy, which requires increasing levels of due diligence and required insurance coverages in proportion to each provider's access to our information systems.


text: Although we have never experienced a material information security breach nor have we incurred any expenses related to such a breach, we take a proactive approach to managing information security risk. Our process for managing existing and new service providers evaluates the degree to which such service providers will interface with our systems. This process dictates minimum insurance requirements and increased security documentation and protocols as interaction with our systems increases. We also have an information security training and compliance program which includes cybersecurity updates, notices, reminders, and simulated cyber-attacks emailed to all employees bi-weekly and that all employees are required to participate in at least annually. Further, we have a documented business continuity plan that is updated and tested on an annual basis and we carry an information security risk insurance policy.


text: See "We face risks related to the occurrence of cyber incidents, or a deficiency in our cybersecurity, which could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results" included as part of the risk factors described in Item 1A of this Annual Report on Form 10-K for additional information on the potential impact any cybersecurity incident may have on our business, results of operations, financial condition and cash flows.


text: Cybersecurity Governance The Audit Committee of the board of directors oversees cybersecurity risk and is comprised of three independent members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. The chair of our Audit Committee holds a Certificate in Cybersecurity Oversight from the National Association of Corporate Directors and has previous work experience at a large retailer with point-of-sale cybersecurity exposure. The Audit Committee receives quarterly updates summarizing on-going information technology and cybersecurity initiatives from our Chief Financial and Administrative Officer and reviews the results of our annual risk assessment and regular cyber risk assessment upon completion. Any significant issues identified are reported to the Audit Committee of the board of directors on a quarterly basis. As described above, our management team is responsible for the day-to-day assessment and management of material risks from cybersecurity threats through our Chief Financial and Administrative Officer, our standing management committee on information technology and cybersecurity risk matters and the MSSP. This group would be notified through our Incident Response Plan/Policy and appropriate actions undertaken in accordance with the plan document if a cyber attack were to occur.


text: Our Vice President of Risk Management is a Certificated Information Systems Auditor (CISA) and a Certified Internal Auditor (CIA) and holds a Certificate in Risk Management Assurance (CRMA). Personnel from the MSSP hold several certifications, including but not limited to: Certified Information Systems Security Professional ("CISSP"); ITIL Foundations; Fortinet Certified Network Security Administration and Professional; Microsoft Certified IT Professional, Technology Specialist, Solutions Associate; and Citrix Certified Administrator/Citrix Presentation Server 4.0. The external risk advisory and accounting firms that we use to perform our audits and assessments described above utilize personnel qualified as one or more of the following to perform our audits and assessments: Certified Information Systems Auditor (CISA), CISSP, Certified Information Security Manager (CISM), and Certified Information Technology Professional (CITP).


text: Cybersecurity Risk Management and Strategy To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threats alongside other company risks as part of our overall risk assessment process. In addition, we perform an external, specific cybersecurity risk assessment every eighteen months. Included in our management of cybersecurity risk is our bi-annual review of our Incident Response Plan/Policy, involving employees from all responsibility levels of the company. Our Chief Financial Officer has primary responsibility for overseeing our information systems and information technology resources, including risks from cybersecurity threats. To assist our Chief Financial Officer in discharging these responsibilities, we have a standing management committee to address information technology and cybersecurity risk matters comprised of our Chief Financial Officer, the principal of a third-party, managed security service provider (an "MSSP"), our Vice President of Risk Management, our Chief Accounting Officer, our Senior Vice President of Human Resources and certain other members of our information technology staff and property management. The members of this committee meet on a quarterly basis, with additional full or sub-committee meetings held as-needed throughout the year, to: • monitor emerging data protection laws and implement changes to our processes designed to comply with these laws; • identify and assess material risks from cybersecurity threats; • provide guidance on our cybersecurity strategy development and implementation; • ensure that regular risk assessments and appropriate mitigation strategies are in place; • ensure the performance of regular vulnerability and penetration testing and remediation of findings; • oversee the implementation and management of cybersecurity-related tools such as security information and event management systems; • review relevant service organization controls reports for the MSSP that serves as our Security Operation Center; and • require training and security awareness programs for our employees.


text: Our Vice President of Risk Management monitors and tests these initiatives on a periodic basis. Additionally, our Chief Financial Officer partners with the MSSP and our information technology staff throughout the organization to manage material risks from cybersecurity threats, as well as to provide managerial and operational support for our information systems and information technology resources on a daily basis.


text: Index to Financial Statements We also maintain an Incident Response Plan/Policy to coordinate the actions we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The Incident Response Plan/Policy is tested with tabletop exercises to assess the validity of the plan and to make necessary modifications, as needed, on a bi-annual basis. We utilize a third party Security Information and Event Management ("SIEM") service to collect, analyze, and correlate security logs and events from various sources across the Piedmont corporate and property networks to detect and respond to cyber threats in real-time. This service coordinates with the IT support team to contain threats and reduce impact. Verified cybersecurity incidents, should they occur, are reported to IT management and trigger response protocols detailed in the Incident Response Plan/Policy.


text: We utilize external risk advisory and accounting firms to perform an audit focusing on entity-level, application and information technology general computer controls annually, as well as the full cybersecurity risk assessment mentioned above. Audit results and the risk assessments are reviewed by our Chief Financial Officer, the principal of the MSSP, and our Vice President of Risk Management. Any exceptions are addressed with a remediation plan and implemented with appropriate resources. Audit results, risk assessments and remediation plans are discussed with the Audit Committee of the board of directors, who has responsibility for cybersecurity risk oversight, each quarter until all points are fully resolved.


text: We also identify and oversee cybersecurity risk from third-party service providers through our vendor management policy, overseen by our internal risk management and information technology functional areas, which requires increasing levels of due diligence and required insurance coverages in proportion to each provider's access to our information systems.


text: Although we have never experienced a material information security breach nor have we incurred any expenses related to such a breach, we take a proactive approach to managing information security risk. Our process for managing existing and new service providers evaluates the degree to which such service providers will interface with our systems. This process dictates minimum insurance requirements and increased security documentation and protocols as interaction with our systems increases. We also have a cybersecurity awareness training program which includes annual required online training, periodic updates, notices, and reminders, and bi-weekly simulated phishing attacks with required remedial training for failures. Further, we have a documented business continuity plan that is updated and tested on an annual basis and we carry an information security risk insurance policy.


text: Cybersecurity Governance The Audit Committee of the board of directors oversees cybersecurity risk and is comprised of three independent members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. The chair of our Audit Committee holds a Certificate in Cybersecurity Oversight from the National Association of Corporate Directors and has previous work experience at a large retailer with point-of-sale cybersecurity exposure. The Audit Committee receives quarterly updates summarizing on-going information technology and cybersecurity initiatives from our Chief Financial Officer and reviews the results of our annual risk assessment and regular cyber risk assessment upon completion. Any significant issues identified are reported to the Audit Committee of the board of directors on a quarterly basis. As described above, our management team is responsible for the day-to-day assessment and management of material risks from cybersecurity threats through our Chief Financial Officer, our standing management committee on information technology and cybersecurity risk matters and the MSSP. This group would be notified through our Incident Response Plan/Policy and appropriate actions undertaken in accordance with the plan document if a cyber-attack were to occur.


text: Our Vice President of Risk Management is a Certificated Information Systems Auditor (CISA) and a Certified Internal Auditor (CIA) and holds a Certificate in Risk Management Assurance (CRMA). Personnel from the MSSP hold several certifications, including but not limited to: Certified Information Systems Security Professional ("CISSP"); ITIL Foundations; Fortinet Certified Network Security Administration and Professional; and Microsoft Certified IT Professional, Technology Specialist, Solutions Associate. The external risk advisory and accounting firms that we use to perform our audits and assessments described above utilize personnel qualified as one or more of the following to perform our audits and assessments: Certified Information Systems Auditor (CISA), CISSP, Certified Information Security Manager (CISM), and Certified Information Technology Professional (CITP).


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity framework intended to assess, identify, and manage risks from threats to the security of our information, systems, products, and network using a risk-based approach. The framework is informed in part by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, NIST 800-53 and International Organization for Standardization 27001 ("ISO 27001") Framework, although this does not imply that we meet all technical standards, specifications, or requirements under the NIST or ISO 27001.

companyName: SONIDA SENIOR LIVING, INC.

ticker: SNDA


text: Our key cybersecurity processes include the following: • Risk-based controls for information systems and information on our networks: We seek to maintain an information technology infrastructure that implements physical, administrative and technical controls that are calibrated based on risk and designed to protect the confidentiality, integrity and availability of our information systems and information stored on our networks, including customer information, personal information, intellectual property and proprietary information. • Cybersecurity incident response plan and testing: We have a cybersecurity incident response plan and dedicated team to respond to cybersecurity incidents. When a cybersecurity incident occurs or we identify a vulnerability, we have a strategic partner (a Managed Security Service Provider ("MSSP")) that is responsible for leading the initial assessment of priority and severity. Our cybersecurity team assists in responding to incidents depending on severity levels and seeks to improve our cybersecurity incident management plan through periodic tabletops or simulations at the enterprise level. • Training: We provide security awareness training to help our employees understand their information protection and cybersecurity responsibilities at the Company. We also provide additional role-based training to some employees based on customer requirements, regulatory obligations, and industry risks. • Supplier risk assessments: We have implemented a third-party risk management process that includes expectations regarding information and cybersecurity. That process, among other things, provides for us to perform cybersecurity assessments on certain suppliers based on an assessment of their risk profile and a related rating process. We also seek contractual commitments from key suppliers to appropriately secure and maintain their information technology systems and protect our information that is processed on their systems. • Third-party assessments of the Company: We have engaged third-party cybersecurity companies to periodically assess our cybersecurity posture and to assist in identifying and remediating risks from cybersecurity threats.


text: We also consider cybersecurity, along with other risks to us, within our enterprise risk management framework. The enterprise risk management framework includes internal reporting at the enterprise level, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. In the last fiscal year, we have not identified risks from known cybersecurity threats, including any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, cash flow or financial condition.


text: Cybersecurity Governance The Audit Committee of our Board of Directors is responsible for board-level oversight of risks from cybersecurity threats, and the Audit Committee reports back to the full Board of Directors about this and other areas within its responsibility. As part of its oversight role, the Audit Committee receives reporting about the Company's practices, programs, notable threats or incidents and other developments related to cybersecurity throughout the year, including through periodic updates, from our Chief Technology Officer.


text: Our Chief Technology Officer reports to our Chief Executive Officer and leads the Company's overall cybersecurity function, including the assessment and management of cybersecurity risks. The Chief Technology Officer has over 25 years of experience in managing and leading information technology or cybersecurity teams and participates in various cybersecurity organizations. The Chief Technology Officer collaborates with operation vice presidents and department vice presidents to identify and analyze cybersecurity risks to us; considers industry trends; implements controls, as appropriate and feasible, to mitigate these risks; and enables business leaders to make risk-based business decisions that implicate cybersecurity considerations. The Chief Technology Officer meets with senior leadership to review and discuss our cybersecurity program, including emerging cyber risks, threats, and industry trends. The Chief Technology Officer also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including by collaborating with external security personnel and internal business stakeholders, and incorporating threat intelligence and other information obtained from governmental, public, or private sources to inform our cybersecurity technologies and processes.


text: Cybersecurity Risk Management and Strategy Our global reach and the ever-evolving threat landscape makes data security and privacy a critical priority for us. Our Director of Cybersecurity and Technology Risk Management and their global cybersecurity team reports to our Chief Technology Officer and together, they are responsible for our network security, cybersecurity risk management processes, and business continuity. This team partners with leaders from all of our global regions to align our cybersecurity risk management processes and strategic goals with our business priorities and to ultimately mitigate cybersecurity risk at C.H. Robinson.

companyName: C. H. ROBINSON WORLDWIDE, INC.

ticker: CHRW


text: Our global cybersecurity team has experience and expertise supporting mitigation of the potential cybersecurity threats facing our organization and vulnerabilities facing our technology infrastructure and potential cybersecurity threats. Our Director of Cybersecurity and Technology Risk Management has over a decade of experience leading cyber security oversight, and others on our global cybersecurity team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional, CompTIA, Offensive Security Certified Professional, Certificate of Cloud Security Knowledge, Global Information Assurance Certification ("GIAC"), Certified Incident Handler certifications. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete cybersecurity trainings at least once a year and have access to more frequent cybersecurity trainings. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings. Program performance is reported to and monitored by senior leadership and the Audit Committee on a quarterly basis.


text: The Company maintains an Enterprise Risk Management ("ERM") program, which includes processes for key risk identification, mitigation efforts, and day-to-day management of risks, including cybersecurity risks. The ERM program is administered by our Internal Audit department and involves our global cybersecurity team, which possesses significant knowledge and expertise in the area of cybersecurity risks.


text: Our global cybersecurity team ensures the cybersecurity risks identified from the ERM program are incorporated into our overall cybersecurity program. Programs to address key cybersecurity risks have been put into place including layered coverage with focus areas and practices designed to address network and endpoint security, application security, and security operations. We also employ automated detection and event correlation techniques and alerting as well as integrate cyber threat intelligence into our processes. Our security operations center serves as the front line of these alerts and investigates and remediates threats as necessary. Although it is difficult to determine the potential impacts from a cybersecurity incident, we may experience negative impacts such as reputational harm, inability to retain existing customers or attract new customers, exposure to legal claims and government action, among others. Previous attacks on our operating systems have not had a material financial impact on our operations, but we cannot guarantee future attacks will have little to no impact on our business. Furthermore, given the interconnected nature of the supply chain and our significant presence in the industry, we believe we may be an attractive target for such attacks. The impact of a cybersecurity incident may have a material adverse impact on our financial condition, results of operations, availability of our systems, and growth prospects, which makes cybersecurity risk management of critical importance to our organization.


text: Although we have internally developed the majority of our line of business applications, we also rely on technology provided by third parties. We have processes in place to oversee and identify risks from cybersecurity threats associated with the use of third-party technology including third-party risk management, process and partner intake risk assessments, and dedicated procurement functions. These processes help mitigate the risks associated with utilizing external technology platforms and help prevent disruptions to our business operations.


text: We also involve external cybersecurity experts to assess our cybersecurity program, risk management, and relevant internal controls. In addition to our cybersecurity programs and policies, the Company also purchases a cybersecurity risk insurance policy to limit its exposure to cybersecurity incidents.


text: We have processes and programs in place to meet our global compliance obligations and work with our employees and teams across the globe to ensure security and data protection principles are integrated into the way we do business every day. We utilize a set of controls that integrate guidance from the EU's General Data Protection Regulations and align with the U.S. National Institute of Standards and Technology's ("NIST") framework. We undergo a regular independent assessment of our operational and strategic maturity across NIST controls and summary performance is shared with senior leadership including our board of directors. In addition, we submit to independent assessments by external parties, including System and Organizational Controls ("SOC") 2 Type 2 audits, covering customer-facing and line-of-business applications to ensure all safeguards function as they should. These functions are also supported by internal compliance teams who perform additional layers of testing prior to SOC 2 Type 2 procedures.


text: Our Technology Continuity program follows industry standards for disaster recovery practices, including close alignment with ISO 27031:2011 and the Disaster Recovery Institute International's Professional Practices. Our program includes multiple components that act as an additional line of defense—among them are regular functional recovery and tabletop exercises; cybersecurity exercises; protected backups for critical data; recovery time objectives; and recovery point objectives including achievability metrics, application criticality tiering, program audit and maintenance, awareness and training, business impact analysis, and risk evaluation and controls.


text: Cybersecurity Governance The Board of Directors is tasked with oversight of the Company's cybersecurity, information governance, and privacy programs. The Audit Committee oversees our ERM program and receives semi-annual ERM updates, which include cyber-related risk items. In addition, our Audit Committee receives quarterly reports on cybersecurity from our Chief Technology Officer and our Director of Cybersecurity and Technology Risk Management. Our Director of Cybersecurity and Technology Risk Management and their global cybersecurity team has experience and expertise supporting mitigation of the potential cybersecurity threats facing our organization and vulnerabilities facing our technology infrastructure and potential cybersecurity threats.


text: We have also established a cross-functional project team of subject matter experts from across the organization to quickly analyze, mitigate, and remediate potential cybersecurity incidents or vulnerabilities and comply with cybersecurity related reporting requirements. The details of any such cybersecurity incidents or threats are included in the quarterly reports to the Audit Committee.


text: Cybersecurity Risk Management and Strategy Our global reach and the ever-evolving threat landscape makes data security and privacy a critical priority for us. Our Chief Information Security Officer and their global cybersecurity team reports to our Chief Technology Officer and together, they are responsible for our network security, cybersecurity risk management processes, and business continuity. This team partners with leaders from all our global regions to align our cybersecurity risk management processes and strategic goals with our business priorities and ultimately mitigate cybersecurity risk at C.H. Robinson.


text: Our global cybersecurity team has experience and expertise with potential cybersecurity threats and supporting mitigation of the potential cybersecurity threats facing our organization and vulnerabilities facing our technology infrastructure. Our Director of Cybersecurity and Technology Risk Management has over a decade of experience leading cyber security oversight, and others on our global cybersecurity team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional, CompTIA, Offensive Security Certified Professional, Certificate of Cloud Security Knowledge, Global Information Assurance Certification, Certified Incident Handler certifications. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete cybersecurity trainings at least once a year and have access to more frequent cybersecurity trainings. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings. Program performance is reported to and monitored by senior leadership and the Audit Committee on a quarterly basis.


text: Our global cybersecurity team helps ensure the cybersecurity risks identified from the ERM program are incorporated into our overall cybersecurity program. Programs to address key cybersecurity risks have been put into place including layered coverage with focus areas and practices designed to address network and endpoint security, application security, and security operations. We also employ automated detection and event correlation techniques and alerting as well as integrate cyber threat intelligence into our processes. Our security operations center serves as the front line of these alerts and investigates and remediates threats as necessary. We also perform regular vulnerability assessments and penetration tests. Although it is difficult to determine the potential impacts from a cybersecurity incident, we may experience negative impacts such as reputational harm, inability to retain existing customers or attract new customers, exposure to legal claims and government action, among others. Previous attacks on our operating systems have not had a material financial impact on our operations, but we cannot guarantee future attacks will have little to no impact on our business. Furthermore, given the interconnected nature of the supply chain and our significant presence in the industry, we believe we may be an attractive target for such attacks. The impact of a cybersecurity incident may have a material adverse impact on our financial condition, results of operations, availability of our systems, and growth prospects, which makes cybersecurity risk management of critical importance to our organization.


text: We have processes and programs in place to meet our global compliance obligations and work with our employees and teams across the globe to ensure security and data protection principles are integrated into the way we do business every day. We utilize a set of controls that integrate guidance from the EU's General Data Protection Regulations and align with the U.S. National Institute of Standards and Technology's ("NIST") framework. We undergo a regular independent assessment of our operational and strategic maturity across NIST controls and summary performance is shared with senior leadership including our board of directors. In addition, we submit to independent assessments by external parties, including System and Organizational Controls ("SOC") 2 Type 2 audits, covering customer-facing and line-of-business applications to ensure all safeguards function as they should. These functions are also supported by internal compliance teams that perform additional layers of testing prior to SOC 2 Type 2 procedures.


text: Our Technology Continuity program follows industry standards for disaster recovery practices, including close alignment with ISO 27031:2011 and the Disaster Recovery Institute International's Professional Practices. Our program includes multiple components that act as an additional line of defense—among them are regular functional recovery and tabletop exercises; cybersecurity exercises; protected backups for critical data; recovery time objectives; and recovery point objectives, including achievability metrics, application criticality tiering, program audit and maintenance, awareness and training, business impact analysis, and risk evaluation and controls.


text: Cybersecurity Governance The Board of Directors is tasked with oversight of the Company's cybersecurity, information governance, and privacy programs. The Audit Committee oversees our ERM program and receives semi-annual ERM updates, which include cyber-related risk items. In addition, our Audit Committee receives quarterly reports on cybersecurity from our Chief Technology Officer and our Director of Cybersecurity and Technology Risk Management. Our Director of Cybersecurity and Technology Risk Management and their global cybersecurity team has experience and expertise with potential cybersecurity threats and supporting mitigation of the potential cybersecurity threats facing our organization and vulnerabilities facing our technology infrastructure.


text: Cybersecurity Risk Management and Strategy The Company has processes in place to identify, assess, and monitor material risks from cybersecurity threats, which are part of the Company's overall cybersecurity risk management strategy and have been embedded in the information systems operating procedures and internal controls.

companyName: STONERIDGE INC

ticker: SRI


text: Our information technology ("IT") function manages IT operations and continually evolves our systems to meet the constantly changing digital environment. We enhanced our workstation, server, email security, and network monitoring with managed detection and response and alerting capabilities. We perform periodic cybersecurity risk assessments to identify, assess, and prioritize potential risks to information, data assets, and infrastructure. The Company addresses identified risks and develops and implements controls to mitigate issues. The Company engages third parties in connection with its cybersecurity processes as appropriate. The Company has established processes to identify risks from cybersecurity threats associated with its third-party service providers.


text: The Company has established a cybersecurity policy which requires mandatory compliance of all Company directors, officers, employees, interns, consultants, and contractors. The Company has also established cybersecurity and information security awareness training programs. Employees with access to the Company's network receive annual training on topics such as phishing, malware, and other cybersecurity risks. Training is administered and tracked through online learning modules.


text: We work to continually evolve our systems to meet the constantly changing digital environment and continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. There have been no risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. The nature of potential cybersecurity risks and threats are uncertain, and any future incidents, outages or breaches could have a material adverse effect on the Company's business, financial conditions or results of operations. For more information about the cybersecurity risks we face, refer to the Risk Factors in section "Information Technology and Cybersecurity Risks" in Part I, Item 1A, "Risk Factors".


text: Cybersecurity Governance The Company's Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. The Audit Committee of the Board of Directors is responsible for board-level oversight of cybersecurity risk, and the Audit Committee regularly reports risks and compliance actions to the Board. As part of its' oversight role, the Audit Committee receives reporting about the Company's strategy, programs, incidents and threats, and other developments and action items related to cybersecurity regularly throughout the year, including through periodic updates from the Chief Information Officer ("CIO").


text: Our cybersecurity program is managed by our Director of Global IT Architecture and Cybersecurity (the "Cybersecurity Director"), and our CIO, who reports directly to our Chief Executive Officer. Our CIO and Cybersecurity Director each have over 30 years of experience leading numerous business and technology initiatives and global cross-functional projects to improve the Company's business systems, infrastructure, and processes, including extensive experience assessing and managing cybersecurity programs and risk. Our CIO and the IT function monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the processes described above, including the operation of the Company's incident response plans, which include appropriate escalation to the executive team and the Audit Committee. As discussed above, the CIO reports at least semiannually to the Audit Committee about cybersecurity threat risks, among other cybersecurity related matters.


text: Our information technology ("IT") function manages IT operations and continually evolves our systems to meet the constantly changing digital environment. We enhanced our workstation, server, email security, and network monitoring with managed extended detection and response and alerting capabilities. We perform periodic cybersecurity risk assessments to identify, assess, and prioritize potential risks to information, data assets, and infrastructure. The Company addresses identified risks and develops and implements controls to mitigate issues. The Company engages third parties in connection with its cybersecurity processes as appropriate. The Company has established processes to identify risks from cybersecurity threats associated with its third-party service providers.


text: Cybersecurity Governance The Company's Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. The Audit Committee of the Board of Directors is responsible for board-level oversight of cybersecurity risk, and the Audit Committee regularly reports risks and compliance actions to the Board. As part of its oversight role, the Audit Committee receives reporting about the Company's strategy, programs, incidents and threats, and other developments and action items related to cybersecurity regularly throughout the year, including through periodic updates from the Chief Information Officer ("CIO").


text: Risk Management and Strategy Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats; effective management of security risks; and resiliency against incidents. Our cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, employee training, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. We implement risk-based controls to protect our information, the information of our customers, suppliers and other third parties, our information systems, our business operations, and our products and related services. We have adopted security-control principles based on the National Institute of Standards and Technology (the "NIST") Cybersecurity Framework.

companyName: SONIC AUTOMOTIVE INC

ticker: SAH


text: We leverage technology for our business advantage and have invested in internal and external business applications. Our regular operations involve handling sensitive data, including proprietary business information, intellectual property, and personally identifiable information of our customers, suppliers, and employees. To ensure the safety of this data, the Vice President of Information Security provides oversight and establishes central, standardized frameworks for identifying and tracking cyber-related business and compliance risks across the Company. Any risks from cybersecurity threats to our products and services are communicated to our general counsel and senior management and if deemed material, are further reviewed by the Audit Committee of our Board of Directors. We also periodically engage third-party consultants to help us assess, enhance, implement and monitor our cybersecurity risk management programs and respond to any incidents.


text: We have experienced, and may in the future experience, whether directly or through our supply chain or other channels, cybersecurity incidents. While prior incidents have not materially affected our business strategy, results of operations or financial condition, and although our processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cyber incident would not materially affect our business strategy, results of operations or financial condition. See "General Risk Factors" in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: Our Board of Directors is responsible for overseeing enterprise risk and has delegated the responsibility for the oversight of cybersecurity and information technology risks, and the Company's preparedness for these risks, to the Audit Committee. Our Vice President of Information Security provides periodic updates to the Audit Committee in order to assist the Audit Committee in understanding the implications of cybersecurity risks. The Audit Committee meets regularly to ensure a shared understanding of cybersecurity risks, to review new regulations or laws, and to provide guidance on complex risk issues.


text: Our Information Security team has gained their expertise in information technology ("IT") and cybersecurity through a combination of education, relevant degrees, certifications and prior work experience. As part of the cybersecurity process, their respective teams inform them about the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: The Information Security team has adopted the NIST Cybersecurity Framework as a reference to manage cybersecurity risks. This framework enables the team to implement a comprehensive statement of activities and responsibilities that cover data, information architecture, risk communications, emerging technology, third-party risk, IT operations, and regulation. By following industry best practices, the team has established a recognized baseline for engaging external firms to audit and test the resiliency of the cybersecurity program.


text: We have experienced, and may in the future experience, whether directly or through our supply chain or other channels, cybersecurity incidents. Specifically, on June 19, 2024, CDK, a third-party provider of certain information systems, notified us that CDK had suspended certain systems used by us in response to a cybersecurity incident impacting CDK. As a result, we experienced disruptions to our dealer management system (the "DMS"), our customer relationship management system (the "CRM") and other systems that support sales, inventory and accounting functions (collectively with the DMS and CRM the "Affected Systems"). On June 26, 2024, CDK began restoring access to certain of the Affected Systems. We performed internal risk assessments and data validation procedures on the Affected Systems, and beginning June 30, 2024, we resumed processing transactions in the DMS. As of July 31, 2024, we regained access to all of the Affected Systems, including the CRM and inventory management applications. As a result of the CDK outage, our business and results of operations during the second and third fiscal quarters of 2024 were adversely affected. Although we have been working with CDK and other information technology vendors and taking steps to strengthen our systems infrastructure, and our processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that another cyber incident would not materially affect our business strategy, results of operations or financial condition. See "General Risk Factors" in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: The Information Security team has adopted the NIST Cybersecurity Framework as a reference to manage cybersecurity risks. This framework enables the team to implement a comprehensive statement of activities and responsibilities that cover data, information architecture, risk communications, emerging technology, third-party risk, IT operations, and regulation. By following industry best practices, the team has established a recognized baseline for engaging external firms to audit and test the resiliency of the cybersecurity program. SONIC AUTOMOTIVE, INC.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, internal operational risks; system security risks; data protection; risks to proprietary business information; intellectual property theft; fraud; extortion; harm to employees, partners, or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage such material risks.

companyName: JUNIPER NETWORKS INC


text: To aide in identifying and assessing material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity risks alongside other significant company risks as part of our overall risk assessment process. As part of this process, the Company gathers input from subject matter specialists, as necessary, to gather insights to help in identifying and assessing material cybersecurity threat risks, as well as potential severity and mitigation measures. We also have a cybersecurity specific risk assessment process, which helps identify potential cybersecurity risks. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to inform our professionals' risk identification and assessment.


text: We manage these known risks by using internal security controls designed to align with standards set by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO"), and the Center for Internet Security ("CIS"), and by engaging third party experts to perform penetration tests to attempt to infiltrate our information systems, as such term is defined in Item 106(a) of Regulation S-K. These penetration tests are focused on specific objectives to assist us in managing our cybersecurity threat risks. Our maturity in these controls varies by control type and by business.


text: We also conduct the following activities at various intervals during the year, which vary in maturity across our business: • monitor emerging data protection laws and implement changes from time-to-time to our processes designed to comply; • undertake regular reviews of our customer facing policies and statements related to cybersecurity; • through policy, practice, and contract (as applicable) require employees, who provide services on our behalf, to treat customer information and data with care; • leverage the NIST incident handling framework to help us prepare, detect, analyze, contain, eradicate, respond, and recover when there is an actual or potential cybersecurity incident; • run exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • run exercises to simulate a response to a cybersecurity incident to provide training to our cyber incident response team; • run annual tabletop exercises to train our executives and increase their cybersecurity awareness; • conduct a variety of information security and privacy trainings, including new employee training, job-specific security training, specialized training for IT and security personnel, and phishing simulations. • hold an annual Cybersecurity Awareness Month programming, which is available for all employees during which we provide seminars, presentations, and employee engagement activities designed to reinforce our employee information security training and enhance the culture and knowledge of cybersecurity risks among our employees; • carry information security risk insurance to help defray potential losses that might arise from a cybersecurity incident.


text: Our cybersecurity incident response plan was developed to respond to the threat of security breaches, the threat of cyberattacks, and to protect and preserve the confidentiality, integrity, and continued availability of information owned by, or in the care of, the Company. Our incident response plan coordinates the activities that we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate material cybersecurity incidents to our global crisis management plan, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: Our processes also address cybersecurity threat risks associated with our use of third party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits.


text: We regularly engage with assessors, consultants, auditors, and other third parties, including by regularly having third parties, including independent Qualified Security Assessors review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.


text: In our risk factors, we describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. See our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Board has oversight responsibility for the Company's Enterprise Risk Management framework. The Board as a whole and through the various Board committees oversees the Company's management of material enterprise level risk, focusing on four areas of risk: strategic, compliance, operational, and financial. To fulfill its oversight responsibility, the Board also regularly reviews, consults, and discusses with management on strategic direction, challenges, and risks faced by the Company.


text: As part of our entire Board's operational risk management responsibilities, it has oversight of risks from cybersecurity threats. The Audit Committee has been designated with the responsibility to regularly review the Company's processes and procedures around managing cybersecurity threat risks and cybersecurity incidents. As discussed below, members of management report to the Audit Committee which reports to the entire Board about cybersecurity threat risks, among other cybersecurity related matters, at least annually.


text: In support of the Board's oversight of the Company's cybersecurity risk management program, the Audit Committee receives (i) quarterly updates or reports delivered directly from our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") and (ii) three reports delivered as part of the Company's enterprise risk management update to the Audit Committee. These reports may be supplemented, as needed, by the CIO, CISO, and other executives at the Company. These reports include a variety of cybersecurity topics, such as threat risk management updates, the results of exercises and response readiness assessments, our incident response plan, and steps management has taken to respond to such threat risks. In such sessions, the Audit Committee receives materials including a cybersecurity scorecard and other materials indicating current and emerging material cybersecurity threat risks, and describing the Company's ability to mitigate those risks, and discusses such matters with our CIO and CISO.


text: Members of the Board and Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, mergers and acquisitions, and other relevant matters.


text: Our CISO oversees our cybersecurity risk management program in partnership with our CIO and other business leaders, including our General Counsel. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above.


text: Our CIO has developed expertise in cybersecurity and compliance, enterprise architecture and road mapping, data and analytics, digital transformation and customer service through her 39 years of experience in the information technology space. She earned her computer science degree from Temple University and currently teaches in the Masters in Information Systems program at University of San Francisco. Our CISO has worked in cybersecurity for 25 years, including thirteen years as a CISO or deputy CISO. He is currently a Certified Information Systems Security Professional and holds an Information Systems Security Architecture Professional sub-certification (CISSP-ISSAP). He also holds a masters of science degree in computer science, with an information security specialization from James Madison University.


text: To aid in identifying and assessing material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity risks alongside other significant company risks as part of our overall risk assessment process. As part of this process, the Company gathers input from subject matter specialists, as necessary, to gather insights to help in identifying and assessing material cybersecurity threat risks, as well as potential severity and mitigation measures. We also have a cybersecurity specific risk assessment process, which helps identify potential cybersecurity risks. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to inform our professionals' risk identification and assessment.


text: We manage these known risks by using internal security controls incorporating principles from standards set by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO"), and the Center for Internet Security ("CIS"), and by engaging third party experts to perform penetration tests to attempt to infiltrate our information systems, as such term is defined in Item 106(a) of Regulation S-K. These penetration tests are focused on specific objectives to assist us in managing our cybersecurity threat risks. Our maturity in these controls varies by control type and by business.


text: We also conduct the following activities at various intervals during the year, which vary in maturity across our business: • monitor emerging data protection laws and implement changes from time-to-time to our processes designed to comply; • undertake regular reviews of our customer facing policies and statements related to cybersecurity; • through policy, practice, and contract (as applicable) require employees, who provide services on our behalf, to treat customer information and data with care; • leverage the NIST incident handling framework to help us prepare, detect, analyze, contain, eradicate, respond, and recover when there is an actual or potential cybersecurity incident; • run exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • run exercises to simulate a response to a cybersecurity incident to provide training to our cyber incident response team; • run tabletop exercises to train our executives and increase their cybersecurity awareness; • conduct a variety of information security and privacy trainings, including new employee training, job-specific security training, specialized training for IT and security personnel, and phishing simulations. • hold an annual Cybersecurity Awareness Month programming, which is available for all employees during which we provide seminars, presentations, and employee engagement activities designed to reinforce our employee information security training and enhance the culture and knowledge of cybersecurity risks among our employees; • carry information security risk insurance to help defray potential losses that might arise from a cybersecurity incident.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits.


text: Our CIO has developed expertise in cybersecurity and compliance, enterprise architecture and road mapping, data and analytics, digital transformation and customer service through her 40 years of experience in the information technology space. She earned her computer science degree from Temple University and currently teaches in the Masters in Information Systems program at University of San Francisco. Our CISO has worked in cybersecurity for 26 years, including thirteen years as a CISO or deputy CISO. He is currently a Certified Information Systems Security Professional and holds an Information Systems Security Architecture Professional sub-certification (CISSP-ISSAP). He also holds a masters of science degree in computer science, with an information security specialization from James Madison University.


text: The Company's Board of Trustees recognizes the critical importance of maintaining the trust and confidence of the Company's customers, business partners, employees and other stakeholders. The Board, in coordination with the Audit Committee, is actively involved in the oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cyber risk management program is fully integrated into the Company's broader ERM program and includes cybersecurity policies, standards, processes and practices that are based on recognized frameworks and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, company-wide cyber risk program that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: EPR PROPERTIES

ticker: EPR


text: The Company's cyber risk management program is led by the Company's Vice President of Information Systems, whose team is responsible for leading company-wide cybersecurity strategy, policy, and processes while reporting directly to the Company's Chief Financial Officer. While the Board has ultimate oversight for the risk management process, the Audit Committee is responsible for overseeing the Company's policies and procedures for assessing and managing its exposure to risk, including cybersecurity risks. The Company's Vice President of Information Systems provides regular reports to the Audit Committee on any cyber risks and threats to the Company, assessments of the Company's security program and projects in progress to enhance the Company's security systems. The Company's Board of Trustees also receives periodic updates relating to the Company's cybersecurity programs and emerging cybersecurity threats as part of its general oversight duties. Pursuant to the Company's response plan, the Board and the Audit Committee will receive prompt and timely information regarding any material cybersecurity incidents.


text: The Company has a documented response plan to follow in the event a cybersecurity incident occurs. The plan details how to determine the scope and risk of an incident, incident response, communication of incident results and risks to all stakeholders and how to reduce the likelihood of an incident occurring or reoccurring. On an annual basis, the Company conducts a test of the cyber response plan in order to test its pre-planned actions, facilitate discussions regarding the plan's effectiveness and identify useful strategies and tactics learned from the test. Additionally, the Company's security program is supported by external third-party experts, including outside cybersecurity professionals at a security operations center and expert legal counsel specializing in information technology and cybersecurity.


text: The Company's cyber risk management program includes processes for identifying and overseeing both internal cybersecurity risks and those presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third party systems.


text: In addition, the Company conducts frequent security awareness trainings for all employees, utilizes malware, antivirus, and spyware protections and has other protections in place for its network and users. The Company maintains robust end user and administrative user policies governing the use of Company technology. The Company also maintains cyber liability insurance coverage and performs regular vulnerability and penetration assessments.


text: The Company's Vice President of Information Systems has been with the Company for over 18 years and has overseen the Company's information systems, including its cyber risk management program, for the last five years. He is a member of the Global Information Assurance Certification Advisory ("GIAC") Board and has received various GIAC certifications in the areas of information security governance and technical controls focused on protecting, detecting and responding to cybersecurity issues. The Company's Chief Financial Officer has over 25 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: As of the date of this report, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition.


text: The Company's Board of Trustees recognizes the critical importance of maintaining the trust and confidence of the Company's customers, business partners, associates and other stakeholders. The Board, in coordination with the Audit Committee, is actively involved in the oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cyber risk management program is fully integrated into the Company's broader ERM program and includes cybersecurity policies, standards, processes and practices that are based on recognized frameworks and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, company-wide cyber risk program that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: In addition, the Company conducts frequent security awareness trainings for all associates, utilizes malware, antivirus, and spyware protections and has other protections in place for its network and users. The Company maintains robust end user and administrative user policies governing the use of Company technology. The Company also maintains cyber liability insurance coverage and performs regular vulnerability and penetration assessments.


text: The Company's Vice President of Information Systems has been with the Company for over 19 years and has overseen the Company's information systems, including its cyber risk management program, for the last six years. He is a member of the Global Information Assurance Certification Advisory ("GIAC") Board and has received various GIAC certifications in the areas of information security governance and technical controls focused on protecting, detecting and responding to cybersecurity issues. The Company's Chief Financial Officer has over 25 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Risk management and strategy We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address circumstances that arise when unexpected events such as a cybersecurity incident occur. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. Our information security management program generally follows processes outlined in frameworks such as the ISO 27001 international standard for Information Security and we evaluate and evolve our security measures as appropriate. We consult with external parties, such as cybersecurity firms and risk management and governance experts, on risk management and strategy.

companyName: NVIDIA CORP

ticker: NVDA


text: We also have a vendor risk assessment process consisting of the distribution and review of supplier questionnaires designed to help us evaluate cybersecurity risks that we may encounter when working with third parties that have access to confidential and other sensitive company information. We take steps designed to ensure that such vendors have implemented data privacy and security controls that help mitigate the cybersecurity risks associated with these vendors. We routinely assess our high-risk suppliers' conformance to industry standards (e.g., ISO 27001, ISO 28001, and C-TPAT), and we evaluate them for additional information, product, and physical security requirements. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K for additional information about cybersecurity-related risks.


text: Information security matters, including managing and assessing risks from cybersecurity threats, remain under the oversight of the Company's Board of Directors, or the Board. The Audit Committee of the Board, or the Audit Committee, also reviews the adequacy and effectiveness of the Company's information security policies and practices and the internal controls regarding information security risks. The Audit Committee receives regular information security updates from management, including our Chief Security Officer and members of our security team. The Board also receives annual reports on information security matters from our Chief Security Officer and members of our security team.


text: Our security efforts are managed by a team of executive cybersecurity, IT, engineering, operations, and legal professionals. We have established a cross-functional leadership team, consisting of executive-level leaders, that meets regularly to review cybersecurity matters and evaluate emerging threats. With oversight and guidance provided by the cross-functional leadership team, our information security teams refine our practices to address emerging security risks and changes in regulations. Our executive-level leadership team also participates in cybersecurity incident response efforts by engaging with the incident response team and helping direct the company's response to and assessment of certain cybersecurity incidents.


text: We have designated a Chief Security Officer that reports to our Senior Vice President of Software Engineering to manage our assessment and management of material risks from cybersecurity threats. Our Chief Security Officer's cybersecurity expertise includes over 17 years of combined government and private sector assignments.


text: Identifying, assessing, and managing cybersecurity risk is integrated into our overall risk management systems and processes, and we have in place cybersecurity and data privacy training and policies designed to (a) respond to new requirements in global privacy and cybersecurity laws and (b) prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats.


text: We also have a vendor risk assessment process consisting of, depending on the nature and sensitivity of the supplier and data they process on our behalf, the distribution and review of supplier questionnaires designed to help us evaluate cybersecurity risks that we may encounter when working with third parties that have access to confidential and other sensitive company information. We take steps designed to ensure that such vendors have implemented data privacy and security controls that help mitigate the cybersecurity risks associated with these vendors, depending on the nature and sensitivity of the supplier and data they process on our behalf. We routinely assess our high-risk suppliers' conformance to industry standards (e.g., ISO 27001, ISO 28001, and C-TPAT), and we evaluate them for additional information, product, and physical security requirements. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K for additional information about cybersecurity-related risks.


text: Risk Management and Strategy Enterprise Risk Management and Technology Risk Management. Within the Company's Enterprise Risk Management program, Technology Risk Management plays a pivotal role in overseeing the organization's risk posture, specifically focusing on the assessment of information and cybersecurity risks. Evaluated risks are subject to rigorous controls, ensuring both design and operational effectiveness and adherence to regulatory requirements. In instances where a risk is identified as inadequately controlled, prompt remediation measures are implemented to reduce the risk to an acceptable level.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: Identification of risks is a multifaceted process, encompassing diverse activities such as management self-disclosure, monitoring of regulatory and interagency authorities, engagement with professional and industry forums, internal and external audits, collaboration with third-party professional services, policy reviews and walkthroughs, adherence to best practice frameworks, leveraging subject matter expertise and industry experience, and maintaining a collaborative relationship with third-party service providers/vendors. The Technology Risk Management practice operates as a continuous model assessment, utilizing information gathered daily, weekly, monthly, and annually to provide insights into the state of controlled risk within the organization. Security testing and assurance activities may be outsourced to independent audit and security firms based on factors such as resource capacity, subject matter expertise, regulatory requirements, and the prevailing rate and condition of risk.


text: Daily operational activities are in place to ensure the achievement and implementation of security requirements, including the management of security architecture, monitoring for potential security events or incidents, and the reporting and response to detected threats in our technology environments. The Information and Cyber Security Policy and Program establish policies and standards required to be implemented in support of these practices and processes. Additionally, we maintain a compliant and comprehensive Security Incident Response Plan, incorporating accessible resources such as insurance providers, digital and cyber forensic experts, law enforcement, along with documentation of regulatory notification. Our practices are interdependent with service providers/vendors, and we collaborate appropriately with these partners on notification and investigation processes to ensure complete visibility into security risks and events.


text: As of the reporting period, the Company has not experienced any material cybersecurity events or incidents. Although third-party service providers have encountered cybersecurity events or incidents, these occurrences have not resulted in a material impact on our systems, computing environments, customers, or data.


text: Board Oversight: The Company's Board of Directors ("Board") provides active oversight of cybersecurity threats in accordance with the Board-approved Information and Cyber Security Policy and Program. These policies and programs aim to achieve a controlled risk environment while meeting regulatory, legislative, and compliance requirements, including but not limited to the Gramm-Leach-Bliley Act (GLBA), Health Insurance Portability and Accountability Act (HIPAA), Information Technology Sarbanes-Oxley Act (IT SOX) Compliance, and Payment Card Industry Data Security Standard (PCI-DSS) Compliance.


text: Direct oversight of cybersecurity risks is delegated to the Board's Risk and Technology Committee. The Committee meets at least quarterly and receives reports detailing current risks, the maturity and functioning of associated processes and controls, and emerging or anticipated risks and threats. Additionally, the Risk and Technology Committee Chair provides a verbal summarized report to the full Board. All Committee reports are available to the full Board for review. In the event of critical matters arising between scheduled meetings, the Chief Risk Officer promptly notifies the Board and Risk and Technology Committee.


text: To further ensure independence and effectiveness, the Board has delegated authority for the conduct of the cybersecurity program, including the referenced reports, to the Technology Risk Management Director. This position fulfills the role and responsibilities of a Chief Information Security Officer and reports to the Chief Risk Officer who in turn reports independently to the Chair of the Board's Risk and Technology Committee. Additional layers of oversight are integrated into the program through the Director of Internal Audit, who conducts independent audits of critical information technology and cybersecurity activities. The results of these audits are reported to the Board's Audit and Finance Committee, providing an extra layer of assurance and accountability. The Director of Internal Audit reports independently to the Chair of the Board's Audit and Finance Committee.


text: Management's Role in Assessing and Managing Cybersecurity Risks. Management's role in assessing and managing material risks from cybersecurity threats is integral to the Company's governance framework. The Board-approved Information and Cyber Security Policy and Program outline specific roles and responsibilities delegated to management and the Enterprise Risk Management program, which includes Technology Risk Management.


text: The Technology Risk Management Director, a seasoned information and cyber security expert with significant experience in financial institutions, oversees Technology Risk Management. This expert conducts comprehensive assessments of cybersecurity risks inherent in the industry and the Company's business activities, evaluating controls implemented to address identified risks.


text: The Technology Risk Management Director is responsible for maintaining the Company's information and cyber security risk management framework. This framework establishes standards and processes for the continuous assessment of material cybersecurity risks, covering identification, measurement, mitigation activities, monitoring, and reporting of the risk posture at any given time. Additionally, the Director ensures oversight and compliance with the Security Incident Response Plan, providing guidance during security incidents, whether within the Company or involving service provider/vendor engagements.


text: The Company's information technology department, including a dedicated security operations group, plays a crucial role in implementing practices aligned with the Information and Cyber Security Policy and Program requirements. Responsibilities include the maintenance and monitoring of systems, network(s), and application access and error logs, identification of unauthorized access attempts, adherence to access controls standards, configuration management, and the implementation of controls to mitigate risks related to information availability, integrity, and confidentiality.


text: Business activities, products, and services are managed by experts in their respective fields, with employees receiving training to detect and prevent material cybersecurity threats. Business leaders are expected to understand specific threats within their areas of responsibility and adhere to established processes and standards to control such threats.


text: To facilitate a transparent and collaborative approach to managing cybersecurity risk, an executive management level committee has been established. Chaired by the Chief Risk Officer and administered by the Technology and Risk Management Director, the committee ensures continual awareness of the information and cybersecurity risk posture, emerging threats, known threat actors, and vulnerabilities. Its purpose is to foster a security culture within the Company through active participation in planning and managing threat and security risk activities.


text: All committee activities are reported to the Board's Risk and Technology Committee through committee minutes and formal activity reports provided by the Technology and Risk Management Director.


text: Risk Management and Strategy Enterprise Risk Management and Technology Risk Management. The Company's Enterprise Risk Management program and team plays a pivotal role in overseeing the organization's risk posture, specifically focusing on the implementation of a holistic risk management program for overseeing the assessment and appropriate control of information and cybersecurity risks. Annually, the Information and Cyber Security Policy and Program and Risk Assessments are presented for approval to the Board to ensure the program is representative and supportive of the Bank's risk appetite and security testing expectations. Risks identified are subject to rigorous controls, ensuring both design and operational effectiveness and adherence to regulatory requirements. Instances where a risk is identified as inadequately controlled are promptly reported to Management requiring formal remediation activities that are tracked and reported to the Risk and Technology Committee of the Board, until measures are implemented to reduce the risk to an acceptable level Identification of risks is a multifaceted process, encompassing diverse activities such as the execution of formal risk assessments, as described above, management self-disclosures, monitoring of regulatory and interagency authorities, engagement with professional and industry forums, internal and external audits, collaboration with third-party professional services, policy reviews and walkthroughs, adherence to best practice frameworks, leveraging subject matter expertise and industry experience, and maintaining a collaborative relationship with third party service providers/vendors. The dedicated Technology Risk Management team operates a continuous risk management framework, utilizing information gathered daily, weekly, monthly, quarterly and annually to provide insights into the state of controlled risk within the organization. Security testing and assurance activities are performed internally and are outsourced to independent audit and security firms based on factors such as resource capacity, subject matter expertise, regulatory requirements, and the prevailing rate and condition of risk.


text: Daily operational activities are in place to ensure the achievement and implementation of security requirements, including the management of the Bank's security architecture, monitoring for potential security events or incidents, and the reporting and response to detected threats in our technology environments. The Information and Cyber Security Policy and Program establishes the additional policies and standards the Bank is required to implement in support of these practices and processes. Additionally, we maintain a compliant and comprehensive Security Incident Response Plan, incorporating accessible resources such as insurance providers, digital and cyber forensic experts and law enforcement, along with documentation of regulatory notification requirements. Our practices are interdependent with third party vendors, and we collaborate appropriately with these partners on notification and investigation processes to ensure complete visibility into security risks and events.


text: From time-to-time, we have identified cybersecurity threats that require us to make changes to our processes and to implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that threats and incidents we identify in the future could have a material adverse effect on our business strategy, reputation, results of operations and financial condition. During the reporting period, the Company had not experienced any material cybersecurity events or incidents. Although third party service providers that the Bank engages have encountered cybersecurity events or incidents during the year ended December 31, 2024, the Bank's investigation of each event or incident has shown that these occurrences have not resulted in a material impact on our systems, computing environments, customers, or data.


text: Board Oversight: The Board provides active oversight of cybersecurity threats in accordance with the Board-approved Information and Cyber Security Policy and Program. These policies and programs aim to achieve a controlled risk environment while meeting regulatory, legislative, and compliance requirements, including but not limited to the Gramm-Leach-Bliley Act (GLBA), Health Insurance Portability and Accountability Act (HIPAA), Information Technology Sarbanes-Oxley Act (IT SOX) Compliance, and Payment Card Industry Data Security Standard (PCI-DSS) Compliance.


text: Direct oversight of information and cybersecurity risks is delegated to the Risk and Technology Committee of the Board. The Risk and Technology Committee meets at least quarterly and receives reports detailing current risks, maturity and functioning of associated processes and controls, and emerging or anticipated risks and threats. Additionally, the Risk and Technology Committee Chair provides a verbal summarized report to the full Board following each quarterly meeting, and as needed on an interim basis to address developing risk. All Risk and Technology Committee reports are available to the full Board for review. In the event critical matters arise between scheduled meetings, the Chief Risk Officer promptly notifies the Board and Risk and Technology Committee.


text: To further ensure independence and effectiveness, the Board has delegated authority for the Information and Cybersecurity Policy and Program, including the referenced reports, to the Technology Risk Management Director. This position fulfills the role and responsibilities of a Chief Information Security Officer and reports to the Chief Risk Officer who in turn reports independently to the Chair of the Risk and Technology Committee. Additional layers of oversight are integrated into the program through the Director of Internal Audit, who conducts independent audits of critical information technology and cybersecurity activities. The results of these audits are reported to the Board's Audit and Finance Committee, providing an extra layer of assurance and accountability. The Director of Internal Audit reports independently to the Chair of the Board's Audit and Finance Committee.


text: Management's Role in Assessing and Managing Cybersecurity Risks. Management's role in assessing and managing material risks from cybersecurity threats is integral to the Company's governance framework. As discussed above, the Information and Cyber Security Policy and Program outline specific roles and responsibilities delegated to management and the Enterprise Risk Management Program, which includes the Technology Risk Management team, and responsibilities assigned to various employees and the Risk and Technology Committee.


text: The Technology Risk Management Director, a seasoned information and cyber security expert with significant experience in financial institutions, oversees the Technology Risk Management function. This expert conducts comprehensive assessments of cybersecurity risks inherent in the industry and the Company's business activities, evaluating controls implemented to address identified risks.


text: The Technology Risk Management Director is responsible for maintaining the Company's information and cyber security risk management framework. This framework establishes standards and processes for the continuous assessment of material cybersecurity risks, covering identification, measurement, mitigation activities, monitoring and reporting of the risk posture at any given time. Additionally, the Director ensures oversight and compliance with the Security Incident Response Plan, providing guidance during security incidents, whether within the Company or involving service provider/vendor engagements.


text: All committee activities are reported to the Risk and Technology Committee through committee minutes and formal activity reports provided by the Technology and Risk Management Director. The Risk and Technology Committee provides similar reports to the full Board quarterly, as well as on an as-needed basis. Results of cybersecurity-related audits are also reported to the Board's Audit and Finance Committee.


text: We face numerous cybersecurity risks that include cyber-based attacks and other security threats to our systems. We also could be adversely affected by cybersecurity incidents affecting our suppliers and other third-party service providers. To meet these threats, we expend considerable resources on cybersecurity risk management, strategy and governance.

companyName: Ingredion Inc

ticker: INGR


text: The Board of Directors, directly and through its Audit Committee, oversees our cybersecurity risk management. The Board of Directors reviews material cybersecurity risks we face, approves strategic priorities, and monitors progress made towards those priorities. The Audit Committee is responsible under its charter for reviewing with our management our policies and procedures with respect to cybersecurity risks and the processes management has implemented to monitor and mitigate those risk exposures. On a regular basis, the Audit Committee considers management's reports on significant changes to our cybersecurity policies and standards, as well as risk mitigation and remediation efforts being undertaken with respect to cybersecurity incidents and under the program generally. The Audit Committee regularly reports to the Board of Directors on its activities with respect to cybersecurity matters.