text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is involved in the oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management. The Company's cybersecurity policies, standards, processes, and practices are being integrated into the Company's enterprise risk management program and are based on recognized frameworks and other applicable industry standards, including without limitation the National Institute of Standards and Technology Cybersecurity Framework 2.0, Center for Internet Security controls and American Institute of Certified Public Accountants framework. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: FARO TECHNOLOGIES INC


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We also utilize a managed security provider (the "Security Provider") to identify and assess vulnerabilities. Our Security Provider monitors our network, conducts vulnerability scanning, provides event logging services, and raises potential and actual threats with the Company's security operations center when appropriate.

secItem: Item 1C


text: Incident Response Plan: The Company has established and maintains an incident response plan that governs the Company's response to a cybersecurity incident, and such plan is evaluated annually. Potentially material cybersecurity risks and incidents are escalated to management and the Board as applicable.


text: Our Board and Audit Committee oversee the Company's cybersecurity risk management. Management presents to, and discusses with, the Board the security of our systems and applications. Our Chief Digital Officer ("CDO") and our Information Security Senior Director provide strategic and technical leadership for the Company's cybersecurity program and lead teams across the Company that support the cybersecurity functions. Our CDO has 30 years of experience in IT, including being accountable for IT compliance and security, and previously served as Chief Information Officer for a publicly traded company for 5 years. Our Information Security Senior Director has nearly 30 years of experience in software development and IT, and, for 17 of those years, was responsible for security, compliance and privacy. These executives regularly report to the Chief Executive Officer and Chief Financial Officer with regards to our cybersecurity program and readiness.


text: Although we experience cybersecurity incidents from time to time as part of operations, these incidents have not had, and are not reasonably likely to have, a material impact on our business strategy, results of operations or financial condition. Any breach of our security measures, or those of our third-party service providers, could result in unauthorized access to and misappropriation of our information, corruption of data or disruption of systems, operations or transactions, any of which could have a material adverse effect on our business strategy, results of operations or financial condition. See "Risk Factors" on page 13 of this Form 10-K for further discussion of the risks related to cybersecurity threats.


text: Our Internal Audit department regularly assesses and reports to the Audit Committee on the effectiveness of our cybersecurity and information technology controls. Our Audit Committee reviews the Company's cybersecurity risk profile and risk management strategies at regular intervals. Management reviews with the Audit Committee categories of risk the Company faces, including cybersecurity risks, as well as the likelihood of the occurrence of cybersecurity risks, the potential impact of those risks and the steps management has taken to monitor, mitigate and control such risks. In addition, our CISO reports at least annually to the Board, and at least quarterly to the Board's Audit Committee, with respect to cybersecurity risks, including those identified through review of our business, of rising threats in the industry, and of the current state of Lazard's cybersecurity program. Updates on cybersecurity risks are reviewed at regular meetings of the Audit Committee and reported to the full Board.

companyName: Lazard, Inc.

ticker: LAZ


text: Our disclosure controls and procedures provide for the CSIHT to report high severity cybersecurity incidents to an Assessment Committee, consisting of our CFO, CISO and General Counsel, among others, for an assessment of materiality. The Assessment Committee in consultation with third-party experts, as warranted, makes the incident materiality determination consistent with SEC guidance.


text: Governance – Roles of our Board of Directors and Management Our Board has delegated both the Audit Committee and Technology & Operations Committee with responsibility for monitoring and oversight of the information technology and cybersecurity components of our risk assessment and risk management programs. The independent directors comprising our Audit Committee and our Technology & Operations Committee: • regularly review our cybersecurity and related information technology risks, controls and procedures, including data protection and privacy and our plans to mitigate cybersecurity risks and to respond to cybersecurity incidents; • oversee technology and operations processes that relate to or affect our internal control systems, information security, data protection and privacy, fraud and cybersecurity risks; and, • assist management in developing our risk management methodologies and the steps taken to identify, monitor and control such exposures.

companyName: WORLD KINECT CORP

ticker: WKC


text: Our Chief Information Officer ("CIO") and our Chief Information Security Officer ("CISO") are responsible for our company's overall information security activities and cyber risk programs. Our CISO reports to the CIO and leads our cyber and data-related incident response activities. Our current CIO and CISO have more than 40 years of combined experience in the digital and information technology field.


text: We have a cross-functional approach to addressing cybersecurity risk, with our information technology, legal, and internal audit functions regularly presenting to the Audit Committee and Technology & Operations Committee on key cybersecurity topics. Our CISO, together with our CIO and other members of the senior leadership in our information technology organization, also provide the Audit Committee and Technology & Operations Committee with these updates on at least a quarterly basis, and more often as needed. These reports include topics such as analyses of recent cybersecurity threats and incidents across the industry, as well as a review of our own security controls, assessments and program maturity, and risk mitigation status.


text: Cybersecurity Risk Management & Strategy We have strategically integrated cybersecurity risk management into our broader enterprise risk management program to ensure cybersecurity risks are identified, evaluated and addressed alongside our operational objectives. Overall, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of our data and information by identifying, preventing and mitigating cybersecurity threats and being prepared to effectively respond to cybersecurity incidents when they occur. As a global company, we are also committed to respecting individual privacy and complying with applicable data privacy laws throughout the world, such as the European Union's General Data Protection Regulation ("GDPR"), U.K. Data Protection Act and the California Consumer Privacy Act ("CCPA").


text: Our cybersecurity policies, standards, processes, and practices are designed to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We have achieved ISO 27001 certification. Our cybersecurity program also includes a detailed control catalog that maps to several other frameworks, providing a broad approach to managing cyber risks. However, we use NIST and other cybersecurity frameworks solely as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.


text: We conduct internal vulnerability scans, penetration tests, and breach simulation exercises, reinforcing our controls and our readiness to respond to potential threats. Recognizing the complexity and evolving nature of cybersecurity threats, we regularly engage with a range of external experts, including cybersecurity consultants, auditors and advisers, in evaluating and testing our risk management systems. Our collaboration with these third parties includes cybersecurity audits and testing, threat assessments and tabletop exercises, along with regular consultation on security enhancements.


text: We have implemented processes designed to mitigate risks related to data breaches or other security incidents originating from third parties. With our vendors, we conduct security assessments of key third-party providers before engagement and maintain ongoing monitoring to ensure their compliance with our cybersecurity standards.


text: Based on the information we have as of the date of this Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or cybersecurity incidents may not be fully insured. See Item 1A. – Risk Factors for additional information regarding cybersecurity threats.


text: The risks from cybersecurity threats have not to date materially affected us or are not reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Like other companies in the healthcare industry that handle protected health information and companies in all industries that rely on technology to run their operations, a material cybersecurity incident could potentially impact our results of operations and financial condition. Refer to the risk factor titled "Security breaches, cybersecurity attacks, loss of data and other disruptions to our information systems could compromise sensitive information related to our business and expose us to liability, which could adversely affect our operations, financial condition, cash flows and results of operation" in Item 1A of this Report for additional information about the risks associated with cybersecurity threats.

companyName: agilon health, inc.

ticker: AGL


text: At Lucid, cybersecurity risk management is an integral part of our overall enterprise risk management program. We have made significant investments in people, processes, and technology to protect Lucid's connected vehicles, services, confidential business information, and employee and consumer personal data. We have implemented multiple and varied processes and technologies for the avoidance, identification, assessment, mitigation, and remediation of risks from cybersecurity threats and incidents designated to protect against the cybersecurity risk landscape. We regularly assess and enhance our protection, detection, response, and recovery capabilities and engage with the cybersecurity communities including Auto-ISAC, third-party cybersecurity and compliance partners, internal stakeholders, and organizations leading best practices, to support our goals and objectives. Our cybersecurity risk management program integrates multiple teams across the organization, including our IT, digital and physical product, infrastructure, and legal teams, with leadership and oversight by executive management, the Audit Committee of the Board of Directors ("Audit Committee"), and the Board of Directors ("Board").

companyName: Lucid Group, Inc.

ticker: LCID


text: To date, Lucid is not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Lucid, including our business strategy, results of operations or financial condition. See Item 1A. "Risk Factors" of this Annual Report for further information about our cybersecurity risk.


text: Board and Committee Oversight Our Board has oversight responsibility for our overall enterprise risk management and delegates cybersecurity risk management oversight to the Audit Committee. The Audit Committee oversees Lucid's policies and practices with respect to risk assessment and risk management, including discussing with management (i) Lucid's major financial, cybersecurity, privacy and other information technology risk exposures; (ii) the steps that have been taken to monitor and control such exposures; and (iii) any material cybersecurity threats or incidents. The Audit Committee and the Board receive regular reporting from Lucid's management, including the leadership of our enterprise IT security and product cybersecurity departments ("Cybersecurity Leaders") on the status of our cybersecurity program and ad hoc reporting on material cybersecurity threats and incidents.


text: Management's Role At the management level, our Information Security Steering Committee ("ISSC"), with oversight by our VP of IT and General Counsel, is responsible for leading our cybersecurity risk management program and enterprise cybersecurity matters. Under the ISSC, we have various cybersecurity working committees, led by our Cybersecurity Leaders, which are primarily responsible for operational review of cybersecurity threats and incidents as part of our incident response process. Cybersecurity Leaders receive reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents. For potentially material cybersecurity threats and incidents, we escalate these to the ISSC, which, with additional oversight and support from our interim CEO, would raise such threats and incidents to our Audit Committee Chair and, as appropriate, to our Board as they arise. If the cybersecurity incident is determined to be material, disclosure would be filed with the SEC within four business days of determination.


text: Our Cybersecurity Leaders and the dedicated personnel on their teams have industry-recognized certifications such as Certified Information Security Manager, Certified Information Systems Security Professional, and Boardroom qualified Technology Expert, and experienced information systems security professionals and information security managers with many years of technical cybersecurity management experien ce.


text: Management of Cybersecurity Risk Our Cybersecurity Risk Management Processes Our cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents by identifying and escalating risks, issues, and key decisions to management, the Audit Committee, and our Board. We designed our program to protect our products and services, confidential business information (including intellectual property), and employee and consumer data and includes steps for detecting and monitoring cybersecurity threats and incidents, assessing the severity of such threats or incidents, identifying the source of such threats or incidents, including whether such threats or incidents are associated with a third-party vendor or service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management, the Audit Committee, and our Board of potentially material cybersecurity threats and incidents. In addition, our cybersecurity team provides cybersecurity training to employees during the onboarding process and on a periodic basis thereafter, with specialized training and tabletop exercises for our core incident response teams and executive management on at least an annual basis.


text: Under the oversight of the ISSC, our cybersecurity risk management program is implemented day-to-day by our cybersecurity team, who identifies, considers, and assesses risks from cybersecurity threats and incidents on a regular basis; establishes processes to monitor such cybersecurity risks; provides mitigation and remediation measures; engages in policy review and development; provides product support and deployment; and maintains our cybersecurity program. Our cybersecurity team also implements data loss prevention tools and capabilities, customer security measures, incident response measures, and processes for management of third-party vendors and service providers. Our cybersecurity incident response is driven by our Lucid Data and Security Incident Response Plan. Based upon the severity assessment and ranking, incidents are handled by the relevant teams for technical, operational, and legal risk management.


text: In addition, Lucid has implemented processes to integrate our cybersecurity risk management processes into our overall enterprise risk management system including within our greater product management, personnel management, and third-party vendor and service provider management processes.


text: Third-Party Auditors and Consultants in Cybersecurity Risk Management Our cybersecurity team also periodically engages third-party cybersecurity experts for risk assessment and system enhancements. We utilize third-party auditors and assessors in connection with our cybersecurity risk management program to identify gaps and develop policies, procedures, and strategies designed to improve the cybersecurity program. We also use third-party consultants to obtain and will use them to maintain relevant organizational cybersecurity certifications, including UN Regulation 155 Vehicle Cybersecurity Approval. As a general matter, we have from time-to-time utilized third-party cybersecurity consultants on an ad hoc basis in specific instances, including (i) to address potential cybersecurity threats and incidents, (ii) to conduct cybersecurity assessments and penetration testing on high-value systems and applications; and (iii) to develop internal capabilities to improve our cybersecurity defense.


text: Cybersecurity Risk Management of Third-Party Vendors and Service Providers We have also implemented risk management practices designed to minimize cybersecurity risks that arise from utilizing third-party vendors and service providers that receive or have access to Lucid confidential information or personal data. In order to oversee and identify such risks, we have implemented the following processes: (i) a third-party security risk management program designed to assess security risk of new third-party vendors or service providers and develop countermeasures to manage unacceptable risks; (ii) provisions in our third-party vendors and service provider contracts with added security requirements; (iii) training procurement teams on management of third-party vendor and service providers; (iv) role-based access controls for third-party personnel; and (v) data transfer mechanisms for the sharing of data with third parties. While we are in the process of increasing the resiliency of these capabilities across the board, our control over and ability to monitor the security posture of third-party vendors and service providers remains limited and there can be no assurance that we can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. In addition, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.


text: Our Board of Directors provides oversight of our enterprise-wide risk management, which includes cybersecurity risk-management, and the Audit Committee assists the Board with oversight of cybersecurity matters. The VP IT reports on cybersecurity matters to senior management on a regular basis and to the Audit Committee at least annually, and more often if needed. The Audit Committee, in turn, makes periodic reports to the Board on relevant cybersecurity matters.

companyName: Black Stone Minerals, L.P.

ticker: BSM


text: Our VP IT, the Director of the Infrastructure Team, and our General Counsel make up the Information Security Committee, which has the initial responsibility for the assessment of and response to cybersecurity incidents consistent with our formal incident-response plan. Pursuant to the incident-response plan, more serious incidents are escalated to other senior members of management, including the Chief Executive Officer, Chief Financial Officer, and Chief Accounting Officer, as well as to the Audit Committee and our external auditors, as appropriate.


text: We maintain the following processes to assess, identify, and manage risks from cybersecurity threats: • Ongoing Threat Assessment. We maintain multiple threat intelligence subscriptions, and we monitor relevant cybersecurity resources on an ongoing basis to identify and anticipate potential threats to our network infrastructure. • Layered Security. We use multiple tiers of security as part of our efforts to reduce our exposure to cyberattacks. We leverage and maintain perimeter network defense solutions to discourage network-intrusion attempts. Within our network, we leverage endpoint security and ransomware detection and prevention solutions, and we use continuous monitoring of alerts and activities to identify and respond to any irregularities that could be associated with threats. • Training and Awareness. We conduct awareness training for our employees as part of our efforts to enable them to identify and report cybersecurity threats. We require cybersecurity training during employee and contractor onboarding, and we seek to reinforce the training through phishing tests on at least a quarterly basis as part of our efforts to reduce the potential for successful phishing and social-engineering attacks. • Cybersecurity Tool and Processes and Industry Standards. We refer to industry standards, such as those issued by National Institutes of Standards and Technology ("NIST") and International Organization for standardization ("ISO"), as part of our efforts to maintain best practices across our environment and we use various cybersecurity tools and processes designed to manage cybersecurity threats including network and systems authentication, network and infrastructure architecture security, endpoint security, and operating system patching. • Third-Party Network Security Assessments. We engage a third-party consultant to conduct external penetration testing at least annually. Our cybersecurity processes are adjusted as needed based on the results of these assessments. The assessment results are reported to the Audit Committee and Board, and our external auditor reviews our cybersecurity solutions and posture on at least an annual basis. • Third-Party Risk Management. We conduct information-security assessments before allowing sensitive data to be hosted by third parties. We also ensure SOC-1 or SOC-2 compliance for our third party providers, including our banking, payroll, and stock-plan administration relationships.


text: While we and our service providers have experienced cybersecurity incidents in the past, as of the date of this Annual Report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operation, or financial condition. For more information regarding the risks we face, please read Part I, Item 1A. "Risk Factors—General Risk Factors—Various security risks, including cybersecurity threats, data breaches, and other disruptions, could significantly affect us."


text: The Company's cybersecurity measures are primarily focused on ensuring the security and protection of its IT systems and data. The Company's information security program is managed by a dedicated Chief Information Security Officer (CISO), whose group is responsible for leading enterprise-wide cybersecurity risk management, strategy, policy, standards, architecture, and processes. The CISO has worked in the cybersecurity and national security fields for more than 30 years. He has a Master of Science in Telecommunications and Computers. He has served as a board member of the Health Information Sharing and Analysis Center for 10 years. Oversight of the information security program has been integrated into the Company's overall enterprise risk management program.

companyName: Merck & Co., Inc.

ticker: MRK


text: The Company's information security group monitors the Company's information systems to prevent, detect, mitigate, and remediate cybersecurity incidents. The Company uses tools and techniques to continually assess and monitor, manage and mitigate cybersecurity threats to its IT systems in a manner consistent with industry practice. The Company engages with key vendors, industry participants, and intelligence and law enforcement communities as part of its continuing efforts to obtain current threat intelligence, collaborate on security enhancements, and evaluate and improve the effectiveness of its information security program. As part of this program, the Company conducts periodic tabletop and red-teaming exercises to assess its cybersecurity incident response processes and defenses. The Company also maintains vendor management diligence and oversight processes to identify and monitor potential risks from cybersecurity threats attendant to its use of third-party service providers. Additionally, the Company monitors cybersecurity threat intelligence received from key third-party service providers associated with the Company.


text: In the event of a cybersecurity incident, the Company has a process in place whereby members of the information security group will alert the CISO and the CISO will alert the appropriate levels of management, including an incident assessment team, as well as the legal and finance departments so that the materiality of any such event can be assessed in furtherance of fulfilling any reporting requirements. If warranted, senior management will notify the Audit Committee or the full Board, as appropriate.


text: Our cybersecurity processes align with the National Institute of Standards and Technology (NIST CSF) Framework. The Company conducts regular risk assessments on systems and applications to help detect potential risks, threats, and vulnerabilities. Additionally, annual assessments are conducted to evaluate the effectiveness of controls. Risk assessment, risk-based analysis, and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Several controls are employed to differing extents, encompassing but not restricted to endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring utilizing security information and event management (SIEM), multi-factor authentication (MFA), firewalls, intrusion detection, and prevention, as well as vulnerability and patch management.

companyName: WK Kellogg Co


text: Third-party security firms are used in different capacities to provide or operate some of these controls and technology systems. For example, third parties conduct assessments, such as vulnerability scans, penetration testing, and overall risk assessments, and third-party tools are utilized to identify potential vulnerabilities. The Company employs a variety of processes to address cybersecurity threats related to third-party technology and services, including privacy, solution and vendor risk assessments, imposition of contractual obligations, and performance monitoring. The Company also currently relies on services provided by Kellanova, under the Transition Service Agreement.


text: To support our preparedness, the Company has a written incident response preparedness plan that we update as business needs and the security landscape change. In the event of a cybersecurity incident, our incident response team refers to the plan, and the Company conducts tabletop exercises to enhance incident response preparedness. The plan sets out clear response procedures on how to define roles, categorize incidents, determine materiality, record responses, comply with regulatory standards, assist in public disclosure, and defines the process for assessing impact for materiality purposes. It is designed to enable a prompt, uniform, and efficient strategy to reduce the financial, operational, legal, and reputational risks associated with cybersecurity incidents. Business continuity and disaster recovery plans are used to prepare for the potential disruption of technology we rely on. The Company has implemented a user awareness program to enhance cybersecurity measures. These include phishing, malware, data handling, device security, cybersecurity education, password security, internet browsing and defenses to physical threats. As part of our overall risk mitigation strategy, the Company also maintains cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related breaches.


text: Governance The Company has a Governance, Risk, and Compliance (GRC) IT function to address enterprise risks; cybersecurity is a category handled by that function. Cybersecurity is a vital pillar within a comprehensive risk management framework, fostering cross-functional collaboration to fortify organizational resilience against digital threats. The Company has a privacy and security governance committee. The company operates a privacy and security governance committee and a cybersecurity team led by a Chief Information Security Officer. With cybersecurity experience across IT services, Telecom, and Manufacturing sectors, the Chief Information Security Officer spearheads cybersecurity risk and strategy and directly reports to the Chief Information Officer. Additionally, as part of our overall enterprise risk management strategy, our Audit Committee, which consists solely of independent directors, oversees cybersecurity and receives updates from the Chief Information Security Officer on a periodic basis on cybersecurity matters, which include a review of potential digital threats and vulnerabilities, cybersecurity priorities, and our cybersecurity framework.


text: As of February 25, 2025, we are not aware of any material cybersecurity incidents that impacted the Company or are reasonably likely to impact the Company materially. There have been instances of unauthorized access to company assets, including both those managed directly by the Company and those managed by vendors or stored in vendor systems containing company information. These systems have also been, and will likely continue to be, vulnerable to threats such as computer viruses, malware, malicious code, social engineering attacks, unauthorized access attempts, password theft, physical breaches, employee errors, misconduct, and cyber or phishing attacks. For a more detailed discussion of our cybersecurity risks, see "Risks Related to Our Intellectual Property and Technology - Technology failures, cyber-attacks, privacy breaches or data breaches could disrupt our operations or reputation and negatively impact our business."


text: Cybersecurity governance The Board provides regular oversight of the Company's cybersecurity risk management program. The CISO presents to the Board and the audit committee of our Board (the " Audit Committee ") at least annually and quarterly updates via business review dashboards. The Board provides guidance to the CISO, including with respect to any changes to business priorities, risk tolerance, or security initiatives. These briefings are also augmented by ongoing and continuous interactions between the Board and the CISO, as needed.

companyName: Ginkgo Bioworks Holdings, Inc.

ticker: DNA


text: Ginkgo's CISO has primary responsibility for assessing and managing Ginkgo's risks from cybersecurity threats. The CISO has over 20 years of public and private-sector experience in information technology and has served as Ginkgo's CISO since 2018. Executive leadership provides oversight and governance through monthly business reviews of the cybersecurity program.


text: At UCT, cybersecurity risk management forms a critical component of UCT's overall enterprise risk management program. Led by our Chief Information Security Officer ("CISO"), who has over 20 years of experience in information security and technology leadership, and under the oversight of our Board of Directors, we have implemented processes to assess, identify, manage and report cybersecurity risks, which, together with our broader business continuity plans, aim to not only address immediate response to cybersecurity incidents but also ensure swift restoration of critical systems and the maintenance of core business functions in the face of digital threats. Our senior management and information technology ("IT") security teams devote considerable time and resources to conducting regular evaluations of our systems and implementing necessary enhancements to our security infrastructure to better guard against evolving cybersecurity threats.

companyName: Ultra Clean Holdings, Inc.

ticker: UCTT


text: Our CISO, reporting directly to our Chief Information Officer ("CIO"), is responsible for designing, developing and implementing our overall information security program that sets forth a governance structure and processes to ensure regular risks assessments and timely reports regarding cybersecurity risks. We actively scan across our information infrastructure for security vulnerabilities inherent in our business as we rely extensively on information and technology systems for managing transactions, tracking financial performance, and storing sensitive data. We also continuously monitor and assess risks associated with the interconnected nature of many of our information and technology systems, such as ERP platforms, supply chain management systems, and electronic payment gateways. In the normal course of our monitoring process, our information security team also regularly conducts penetration testing of our business and information systems in close collaboration with a third-party expert, and promptly remediates identified vulnerabilities to prevent any potential compromise of our systems or data.


text: As part of our ongoing commitment to maintain a robust cybersecurity program to protect all stakeholders, including our customers, investors, employees, and vendors, we have allocated significant resources to improve our IT security. We have deployed various protocols as part of a larger preventive framework against cyber threats, including advanced security technologies and services, firewalls outfitted with cutting-edge capabilities, layers of encryption protocols, Identity and Access Management ("IAM") controls, security monitoring tools, and multi-factor authentication. Our employees are required to complete cybersecurity best practice training on a regular basis (no less than once a year), the results of which are collected and reported to the senior management for further evaluation. We regularly engage third-party experts to assess the effectiveness of our security protocols and infrastructure, to detect potential threats and assist with remediation efforts, and to generally monitor and adapt our cybersecurity protocols to constantly evolving cybersecurity threats. In addition, we have deployed a Third-Party Risk Management ("TPRM") tool that sends questionnaires to our vendors designed to assess their cybersecurity vulnerabilities. These and other cybersecurity risk management protocols at UCT are being governed by our comprehensive cybersecurity policies, plans and incident response playbooks, to manage both our preventive efforts against cyber threats and quick and effective response protocols in the event of cybersecurity breaches. In the event of an incident, we are prepared to follow the steps outlined in these playbooks, from initial detection to mitigation, as well as notification to all appropriate functions, including senior management and the Board.


text: Risk Management and Strategy We have developed a cybersecurity program that continuously evaluates material risks to our business and applies controls in an attempt to help avoid or mitigate them. Our key cybersecurity risks include, among others: brand and reputational damage, business disruption, regulatory and compliance risk, sensitive data loss, and reliance on third parties.

companyName: CAVA GROUP, INC.

ticker: CAVA


text: We recognize cybersecurity as an enterprise risk, and accordingly cybersecurity risk has been integrated into our overall risk management process. As part of our overall enterprise risk management process, we have established our management-level Risk Committee, composed of our Chief Information Officer, Chief Information Security Officer, Chief Legal Officer and Chief Financial Officer, among others, which assesses overall risks to the Company based on input from our other business leaders. We have also implemented an incident response process that is overseen by our Chief Information Security Officer, who reports to the Chief Information Officer and is supported by a multi-level incident response process led by our cybersecurity team. This is a documented framework that addresses our processes to assess, identify, and manage material risks from cybersecurity threats and incidents, which are prioritized for response and remediation efforts. Our incident response process includes analysis of the impact of a cybersecurity threat or incident for materiality to ensure proper reporting. Our incident response process is continually enhanced and validated through tabletop exercises and engagements with third-party partners.


text: We engage third parties and auditors to assess our cybersecurity program, including the use of select penetration testing and threat intelligence services, and to assist us in adopting and implementing industry-standard practices to improve our cybersecurity program. We have also retained third parties for cybersecurity incident response engagement in the event that a cybersecurity threat or incident requires capabilities beyond those of our own cybersecurity program. In addition, we have a third-party managed security operations center that provides 24/7 monitoring and alerting, threat intelligence, and posture recommendations. We are members of the Retail and Hospitality Information Sharing and Analysis Center, with more than 250 member companies from the retail, hospitality, and travel industries, which enables us to benchmark our cybersecurity risks, identify and adopt industry-standard practices for our cybersecurity program, subscribe to threat intelligence alerts, and contribute to the collective defense of our industries.


text: While we are subject to continuous cybersecurity threats and attacks like most companies, we are not aware of any current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed more fully under Item 1A. "Risk Factors," cybersecurity threats are continually evolving to become more sophisticated and there is a risk that we could experience compromise of our information technology systems and data. Accordingly, while we continue to make significant investment in physical and technological security measures, including third-party services designed to help us anticipate cyber-attacks and prevent breaches, we cannot provide assurance that we will be successful in adequately responding to, or preventing, cyber-attacks. We also maintain cybersecurity insurance that is regularly reviewed to assess whether there is appropriate coverage.


text: Role of the Board The Audit Committee of the Board of Directors is responsible for the primary oversight of strategic risk, including cybersecurity risk oversight. The Audit Committee receives regular reports on at least a quarterly basis from our cybersecurity team, typically on, among other things, our cybersecurity posture, cybersecurity benchmarking, potential cybersecurity vulnerabilities, and other cybersecurity interest items such as the external cybersecurity environment, items requiring Audit Committee input, and our broader cybersecurity program roadmap, in order to monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The Audit Committee regularly reports to the full Board of Directors regarding its activities, including those related to cybersecurity.


text: Role of Management We have established a management-level Risk Committee, that is led by the Chief Legal Officer, and also includes the Chief Information Officer and Chief Financial Officer, as well as certain of their respective Team Members. The Risk Committee meets on at least a quarterly basis to review enterprise risks, including with respect to cybersecurity, as applicable. Enterprise risks, including cybersecurity risk, are briefed to the Audit Committee on at least a quarterly basis by our Chief Legal Officer in coordination with the Chief Information Officer and Chief Financial Officer, or through general updates. In addition, our cybersecurity team, led by the Chief Information Officer, works cross functionally with our legal and other business functions to provide cybersecurity training and, as appropriate, manage cybersecurity risks and incidents.


text: Our Chief Information Officer and our Chief Information Security Officer each have more than two decades of experience in technology and cybersecurity. The cybersecurity team has related academic degrees, multiple certifications, and real-world experience managing cybersecurity incidents and risks and is responsible for building out the materials for review by leadership.


text: As part of its cybersecurity risk management program, Mattel utilizes cybersecurity assessors, consultants, auditors, and other third-parties to assist its internal team with network security, cloud security, endpoint security, identity and access management, data loss prevention, and security information and event management. In addition, Mattel utilizes a variety of third-party technology, information systems, and service providers to help identify, isolate, and mitigate security incidents.

companyName: MATTEL INC /DE/

ticker: MAT


text: Mattel is subject to cybersecurity threats that could have a material adverse impact on its results of operations, financial condition, and liquidity, as further discussed in Item 1A "Risk Factors" under the headings of Legal and Regulatory. Mattel is not aware of having experienced any cybersecurity threats or incidents to date that have materially affected or are reasonably likely to materially affect Mattel, its business strategy, results of operation or financial condition. However, there can be no assurance that Mattel will be able to mitigate negative impacts in the event of future attacks or other cyber incidents.


text: A team led by the CISO implements and maintains systems designed to detect and prevent cybersecurity threats, monitors important developments that may present risk to Mattel and third-party systems, and oversees the results of internal and third-party security reviews. The CISO provides regular updates to Mattel's CTO regarding critical and major severity security incidents involving Mattel systems, security incidents involving third parties that have the potential to impact Mattel's operations or involve sensitive customer, supplier, consumer, or employee data, and mitigation and remediation implemented to address such threats or incidents.


text: The Audit Committee of the Board of Directors (the "Audit Committee") oversees Mattel's assessment and management of material cybersecurity risks. The CTO reports to the Audit Committee on Mattel's cybersecurity, including material cybersecurity risks and mitigation, at least annually. The CTO reports and escalates cybersecurity incidents to management and the Audit Committee as appropriate.


text: Risk Management and Strategy. We have a multi-pronged approach to assess, identify, and manage material risks from cybersecurity threats that is aligned with the National Institute of Standards and Technology framework. This approach includes system testing and patching, continuous monitoring, end-user training and awareness, multi-layered security, redundancy mechanisms, encryption, and internal audits and assessments. Assessment of cybersecurity risk is part of our overall enterprise risk management ("ERM") process, which is reviewed by the Audit Committee of our Board of Directors, along with our strategies for managing our cybersecurity risks.

companyName: MGP INGREDIENTS INC

ticker: MGPI


text: We maintain technical and organizational safeguards, including regular employee training and phishing simulations, incident response capability reviews and exercises, cybersecurity insurance, and business continuity mechanisms for the protection of our assets. If faced with a cybersecurity incident, our IT team is trained to focus on responding to and containing the threat and minimizing any business impact, as appropriate. In the event of an incident, our IT team assesses, among other factors, safety impact, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost, and potential for reputational harm.


text: We rely on various third-party service providers and a cybersecurity incident at any of our third-party service providers could materially adversely impact us. We evaluate third-party service providers from a cybersecurity risk perspective using a range of measures, including information security and cybersecurity due diligence assessments, ongoing monitoring and evaluation of our providers, examination of available System and Organization Controls attestation reports, and inclusion security and privacy contractional provisions in our agreements with our providers. However, we rely on our third-party service providers to implement security programs commensurate with their risk, and we cannot ensure that their efforts will be successful.


text: Governance. The Audit Committee of our Board of Directors is responsible for overseeing risk assessments and risk management, including cybersecurity risks. Our IT team is responsible for assessing and managing our risks from cybersecurity threats. Our IT team is led by our Vice President of Information Technology and Security, who reported to our Chief Financial Officer during 2024. Our Vice President of Information Technology and Security provides updates on cybersecurity threats and risks to the Audit Committee of our Board of Directors throughout the year. In addition, the Audit Committee reviewed cybersecurity risks and mitigation strategies in 2024 as part of their oversight of our enterprise risk management process.


text: Our Vice President of Information Technology and Security monitors our processes for preventing, detecting, mitigating, and remediating cybersecurity incidents through his management of, and participation in, the cybersecurity risk management and strategy processes described above, including through the operation of our incident response plans, which include escalation to our Interim Chief Executive Officer and Chief Financial Officer, as appropriate.


text: If an incident is detected, our cybersecurity team follows the incident response policy to investigate, review and determine the potential impacts of such an incident. If the cybersecurity team determines that an incident could reasonably be expected to have an impact on the financial condition or operations of the Company, it escalates the incident to the crisis management team, which includes executive management. The crisis management team further evaluates the potential impact and materiality of an event and the appropriate response required. The crisis management team coordinates the appropriate response effort and communicates, as applicable, to the Audit Committee. To the extent that cybersecurity incident is determined to be material, the appropriate public disclosures are made.

companyName: Lantheus Holdings, Inc.

ticker: LNTH


text: As of the date of this report, we have not experienced any known cybersecurity incidents, or a series of related incidents, that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. For an additional description of these cybersecurity risks and potential related impacts on us, see "Risk Factors" in Part I, Item 1A of this Form 10-K.


text: Management, including our Chief Information Officer, who has over 25 years of experience serving primarily in the life science industry and is a recognized industry leader, is responsible for monitoring and assessing cybersecurity risks. Management reviews and determines the effectiveness of both internal and third-party leveraged expertise to ensure we have the appropriate knowledge base for risk coverage.


text: We are increasingly dependent on sophisticated software applications and computing infrastructure to conduct key operations. We depend on our own systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.

companyName: MADRIGAL PHARMACEUTICALS, INC.

ticker: MDGL


text: Cybersecurity Program Given the importance of cybersecurity to our business, we maintain a cybersecurity program to support the effectiveness of our systems and our preparedness for information security risks. This program includes a number of administrative, physical, and technical safeguards. We have conducted and continue to conduct evaluations of our cybersecurity program through periodic external audits and penetration tests. We also require cybersecurity trainings when onboarding new employees, contractors and other workforce members, as well as annual cybersecurity awareness training for our employees, contractors and other workforce members. Our program is based on industry frameworks, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") to strengthen our program effectiveness and reduce cybersecurity risks.


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and performing additional risk screenings and procedures, as appropriate. We use a number of means to assess cyber risks related to our third-party service providers, including collecting vendor questionnaires and conducting due diligence in connection with onboarding new vendors. We also collect and assess cybersecurity audit reports and other supporting documentation when available and include appropriate security terms in our contracts where applicable as part of our oversight of third-party providers.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a cybersecurity incident, we maintain an incident response program. Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat; containing the threat; remediating the threat, including recovery of data and access to systems; analyzing any reporting obligations associated with the incident and performing post-incident analysis. We have relationships with a number of third-party service providers to assist with cybersecurity monitoring, containment and remediation efforts.


text: Management Oversight Our controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Information Technology ("IT") Security and Risk Committee, which consists of our Chief Information Officer ("CIO") and internal and third-party cybersecurity professionals. Our CIO has more than 25 years of experience as an IT professional overseeing and supporting IT operations in the biopharmaceutical industry, including several years of experience in cybersecurity. The members of the IT Security and Risk Committee also have expertise in cybersecurity. The IT Security and Risk Committee is responsible for the day-to-day management of our cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engaged to help ensure that the cybersecurity program functions effectively in the face of evolving cybersecurity threats. Our CIO provides regular briefings to our senior management team on cybersecurity matters, including threats, events and program enhancements.


text: While our board of directors has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, discussing with management and overseeing our data privacy, information technology and security and cybersecurity risk exposures, including: (i) the potential impact of those exposures on the Company's business, financial results, operations and reputation; (ii) the programs and steps implemented by management to monitor and mitigate any exposures; (iii) our information governance and cybersecurity policies and programs and (iv) major legislative and regulatory developments that could materially impact our data privacy and cybersecurity risk exposure. On a quarterly basis, our General Counsel, Chief Financial Officer ("CFO") and CIO report to the Audit Committee on information technology and cybersecurity matters, including, as appropriate, key risks, a detailed threat assessment relating to information technology risks, as applicable, the potential impact of those exposures on our business, financial results, operations and reputation, the programs and steps implemented by management to monitor and mitigate exposures and any major legal developments that could significantly impact our cybersecurity risk exposure.


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall Enterprise Risk Management ("ERM") process. As part of our ERM process, department leaders identify, assess and evaluate risks impacting our operations across our organization, including those risks related to cybersecurity. While we believe we maintain an effective cybersecurity program, the techniques used to infiltrate IT systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures.


text: We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our systems, networks and technology.


text: To date, there have not been any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations or financial condition. See the section titled "Risk Factors—General Risk Factors—A failure of our information technology infrastructure and cybersecurity threats may adversely affect our business and operations." in this Annual Rep ort for more information.


text: Information and cybersecurity risk management fall under the oversight of the Audit Committee. T he Audit Committee receives an annual review, followed by quarterly updates, of the Company's cybersecurity systems, enhancements, strategies and risk management efforts, and the Chair of the Audit Committee will be promptly notified of any material cybersecurity breach incident. In addition, the full Board reviews cybersecurity as part of its regular risk reviews. Linde has appointed a Global Chief Information Officer (CIO) reporting to the Chief Financial Officer (CFO). A Chief Information Security Officer reports to the CIO and is supported by a global IT security team.

companyName: LINDE PLC

ticker: LIN


text: Index to Financial Statements Managing Material Risks & Integrated Overall Risk Management We take an integrated approach to assessing and identifying cybersecurity risks and threats. At the corporate level, cybersecurity is identified as a key risk within our Enterprise Risk Management (ERM) program. Our management of cyber risk is based on the National Institute of Standards and Technology's (NIST) cybersecurity framework. While the NIST cybersecurity framework is our foundation, we combine that with the Center for Internet Security's (CIS) control framework.

companyName: GULFPORT ENERGY CORP

ticker: GPOR


text: We utilize a defense-in-depth approach, layering security starting with cloud-based tools through our perimeter all the way to the client and server end points with End Point Detection and Response solutions. We continue to invest and align advances in technology to strengthen our security posture. This year we implemented tools that provide additional visibility into lateral movement, enhancements for multifactor authentication, and patching of servers. Cyber risks and incidents are categorized by severity, evaluated for materiality, responded to based on defined incident response playbooks and then remediated accordingly. We perform organized tabletop exercises to test these practices and identify areas where opportunities for improvement can occur.


text: Risks from Cybersecurity Incidents As of December 31, 2024, and for the past five years, we have identified no security incidents or breaches that are material, or likely to be material, to our business strategy, results or financial condition. Cybersecurity Governance We involve multiple levels of oversight as a part of our approach to cybersecurity risk management.


text: Cybersecurity Risk Management and Strategy Overview of Cybersecurity Risk Management The Company maintains a cybersecurity program that is designed to identify, prevent, detect, respond to, and recover from cybersecurity threats, and protect the confidentiality, integrity, and availability of our information technology, including the information residing on such systems. The Company has a dedicated Chief Information Security Officer ("CISO") with overall responsibility for developing and implementing the global cyber strategy, risk management, and operational initiatives. The Company leverages recognized cybersecurity frameworks to organize, improve, and assess its cybersecurity program and to manage and reduce cybersecurity risk. The global information security team, under the direction of the CISO, develops, implements, and manages cybersecurity-related internal controls and risk processes for the Company, with internal controls consisting of a mix of administrative, technical, and physical controls.

companyName: SEALED AIR CORP/DE

ticker: SEE


text: We deploy, configure, and maintain numerous technologies to enforce security policies, detect and protect against cybersecurity threats, and help safeguard the Company's information systems and assets. We operate a Security Operation Center ("SOC") to monitor cybersecurity threats, coordinate incident response resources, and reduce response times. Our internal SOC team is augmented by a third-party managed security services provider. The Company maintains a cybersecurity incident response plan that provides a structured approach for the Company's response to cybersecurity incidents. Under the plan, cybersecurity incidents are escalated based on a defined incident severity scale, including to the Board of Directors as appropriate. To improve preparedness for a cybersecurity incident, we conduct tabletop exercises multiple times throughout the year. These exercises are conducted by internal team members and in some instances with assistance from third-party experts. The Company's cybersecurity program also includes regular cybersecurity trainings for staff. We actively evaluate the training effectiveness and adjust the trainings based on the evaluations.


text: Third Party Service Provider Risk Management Vendor risk assessment is part of the Company's cybersecurity program, which facilitates management of third-party service providers' IT-related risks. Third-party service providers that have access to the Company's network, data and information are subject to a cybersecurity due diligence process and the corresponding security contractual and control requirements based on the nature of the engagement. The vendor risk assessment process is reviewed at least annually.


text: Risks from Material Cybersecurity Threats Cybersecurity risk and the failure to maintain the integrity of our operational or security systems or infrastructure, or those of third parties with which we do business, could have a material adverse effect on our business, consolidated financial condition, results of operations, or cash flows. Refer to Part I, Item 1A, "Risk Factors," for more information on Sealed Air's risks relating to our technologies, systems, and networks.


text: Our Chief Information Officer ("CIO") and CISO provide cybersecurity updates to the Audit Committee three times each year and the Board at least annually. These updates cover various topics, including information relating to cybersecurity strategy, program management, and performance trends. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated on as needed basis to the Audit Committee and the Board of Directors.


text: The Company's management team is responsible for the day-to-day assessment and management of cybersecurity risks. As mentioned above, a dedicated CISO leads the information security team and is responsible for the Company's cybersecurity risk management and strategy. The CISO has a master's degree in cybersecurity from the University of Maryland Global Campus, a degree in computer science from Presbyterian College and more than 15 years of experience in technology, information security and risk management with companies in various sectors. The CISO reports to the CIO, who is responsible for global IT strategy and IT operations across the enterprise. The CIO has a degree in computer science and mathematics from Wofford College and has over 30 years of experience in the IT industry, spanning various roles and sectors.


text: As part of its overall Enterprise Risk Management ("ERM") program, the Company identifies and assesses cybersecurity risks on an annual basis. These assessments are integrated into the Company's cybersecurity program to ensure alignment with broader risk management objectives. The ERM program includes identification, assessment and management of risks, including cybersecurity risks. Business process owners incorporate risk management philosophy, exposures, mitigating activities, and key indicators to develop strategies and actions. The ERM Steering Committee, comprised of senior level executives, is responsible for assessing cybersecurity risks, providing direction and oversight for risk mitigation actions, and assisting the Board of Directors in overseeing the Company's cybersecurity risks.


text: Risk management and strategy We maintain an information security program designed to identify, assess, and manage material risks arising from cybersecurity threats to our critical networks, third-party hosted services, communications systems, hardware, software, and data, including intellectual property and confidential, proprietary, or sensitive information, such as customer data.

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: Our President, Product and Technology ("President of P&T"), Chief Data Officer ("CDO"), the senior-most employee responsible for cybersecurity management, and other members of our cybersecurity and audit teams, help identify, assess, and manage cybersecurity threats and risks that may affect our business and operations. To help us in assessing these threats, we use various methods, including, as applicable, using a combination of manual and automated tools, subscribing to threat reports and external intelligence feeds, conducting vulnerability assessments and penetration tests, collaborating with law enforcement, and operating a bug bounty program.


text: Depending on the environment, systems, and data, we employ various technical, physical, and organizational measures designed to mitigate material cybersecurity risks, including an incident response plan, incident detection and response processes, a vulnerability management program, disaster recovery/business continuity plans, risk assessments, data encryption, network and access controls, a vendor risk management program, physical security, employee training, cybersecurity insurance, and dedicated cybersecurity staff.


text: In maintaining these measures, we consider certain principles from recognized frameworks, such as those published by the Committee of Sponsoring Organizations of the Treadway Commission, the International Organization for Standardization, and other applicable industry standards. Our approach to addressing cybersecurity risk is cross-functional and is designed to preserve the confidentiality, integrity, and availability of data by identifying, preventing, and mitigating cybersecurity incidents.


text: From time to time, we engage third-party service providers, including professional services firms, threat intelligence services, cybersecurity consultants, penetration testing firms, and forensic investigators, to assist with identifying, assessing, and managing cybersecurity risks.


text: We also rely on data-hosting companies and other third parties for certain business operations. We mitigate the associated cybersecurity risks through a third-party risk management program, which may include vendor risk assessments, security questionnaires, reviews of vendor security programs, and contractual obligations for vendors to maintain specific security measures.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under the heading "Risk Factors" in Part I of this Annual Report on Form 10-K, including the risk factor titled "If our IT systems or data, or those of third parties with which we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse consequences, any of which could materially adversely affect our business, financial condition, results of operations, and prospects."


text: Our Board oversees our enterprise risk management program, including cybersecurity risk. The audit committee of our Board (the "Audit Committee") is responsible for oversight of our cybersecurity risk management processes, and a cross-functional cybersecurity committee (the "Cybersecurity Committee"), which is comprised of members of our management team, reports to the Audit Committee.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management team, including our President of P&T, CDO, and the senior-most employee responsible for cybersecurity management. Our President of P&T has over 25 years of experience in senior executive roles that involved ownership of, and accountability for, cybersecurity matters, including Chief Information Officer, Chief Technology Officer, and Senior Vice President / General Manager. Our CDO has over 15 years of experience in IT and previously served as the Chief Information and Digital Experience Officer for a home automation company. Prior to that, she held various leadership roles at a computer software company.


text: Members of our management team, including our President of P&T, CDO, and the senior-most employee responsible for cybersecurity management, lead our cybersecurity assessment and management processes. Their responsibilities include hiring appropriate personnel, approving budgets, integrating cybersecurity considerations into our risk management strategy, overseeing security-related reports, communicating key priorities, and helping prepare for cybersecurity incidents.


text: We conduct periodic training to keep personnel informed of cybersecurity threats and to communicate evolving information security policies, standards, processes, and practices. Our cybersecurity incident response and vulnerability management processes are designed to escalate significant cybersecurity incidents to members of management, including to our President of P&T, CDO, the senior-most employee responsible for cybersecurity management, and the Cybersecurity Committee. Our President of P&T, CDO, the senior-most employee responsible for cybersecurity management, and the Cybersecurity Committee work with our incident response team to mitigate and remediate potential issues. These processes include reporting significant cybersecurity threats, risks, and mitigation activities to the Audit Committee and/or the Cybersecurity Committee, as appropriate.


text: The Audit Committee and the Cybersecurity Committee receive periodic reports, summaries, and presentations from management regarding our significant cybersecurity risks and threats, incidents, and response initiatives. Through our cybersecurity governance practices, we strive to achieve a strong cybersecurity posture and to refine our security measures to respond to emerging threats.


text: We rely on our systems and networks to support our business activities. As some networks and systems are managed by third parties, the HHH cybersecurity program also includes evaluation and monitoring of cybersecurity risks associated with its use of third-party service providers. We also leverage third-party experts and vendors to help manage our cybersecurity program, audit the effectiveness of our existing cybersecurity controls, and make recommendations for improvements and best practices. We utilize a Managed Detection and Response service that provides threat intelligence, technology, and specialist expertise to protect our systems and networks from cyber threats. We require all third parties with access to our information systems or data to maintain industry standard cybersecurity programs and to report actual or suspected security incidents to us.

companyName: Howard Hughes Holdings Inc.

ticker: HHH


text: We employ a range of tools and strategies to mitigate cybersecurity risks and regularly test them for effectiveness. Additionally, we continuously assess and improve our cybersecurity stance by conducting vulnerability scans, internal and external network penetration tests, and by integrating threat intelligence updates. We also have specific tools to provide real time, continuous monitoring and protection of our endpoints. To the extent that our proactive monitoring and testing identifies weakness in our cybersecurity readiness, these weaknesses are tracked and remediated as part of our cybersecurity program. Our employees receive security awareness training at a minimum on an annual basis and are subjected to phishing training and phishing tests throughout the year. Annually, we perform tabletop exercises to test our cybersecurity incident response plan. Our cybersecurity program is aligned with industry standards and best practices such as the National Institute of Standards and Technology Cybersecurity Framework.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, along with all companies of comparable size, we face common cybersecurity threats. These threats include ransomware and denial-of-service, including sophisticated attacks from criminal ransomware groups and nation state actors. Our customers, supply-chain providers, and subcontractors face similar cybersecurity threats, and an incident impacting us or any of these entities could materially adversely affect our business operations.


text: Governance Management is responsible for measuring and managing cybersecurity risk, specifically the prevention, mitigation, detection, and remediation of cybersecurity incidents as well as the Company's overall information security strategy, policy, and operations. The cybersecurity program is executed by the Company's Senior Vice President of IT Governance, Risk, and Compliance, who has over 15 years of cybersecurity experience in overseeing and managing cybersecurity risk. He is also responsible for maintaining and, in the event of an actual or suspected security incident, executing the Company's incident response plan.


text: The Board of Directors' Technology Committee governs and oversees HHH's cybersecurity program. This includes reviewing the cybersecurity program's strategy and effectiveness, the cybersecurity landscape and emerging threats, and reports from any cybersecurity events. The Technology Committee also oversees cybersecurity and digital strategy and, whenever necessary, will communicate with, or advise management to consult with, the Audit Committee regarding technology, digital, and other innovation-related matters that relate to or affect the Company's internal control systems. The Technology Committee will actively participate in strategic cybersecurity decisions and will be responsible for approving major initiatives. Management will provide updates to the Technology Committee on a quarterly basis and will continue to provide updates to the full Board of Directors on an annual basis. When appropriate, the Technology Committee will inform the Board of Directors on important matters. Furthermore, the Board of Directors would be notified in accordance with the Company's incident response plan, of any suspected cyber incidents that may have at least a moderate business impact on the Company.


text: The Company has processes in place designed to protect its information systems and to assess, identify and manage material risks from cybersecurity threats. Accordingly, the Company has designed and implemented an Information Security Program, designed to protect the confidentiality, integrity, and availability of its information systems and data (including nonpublic information in its possession, custody, or control), as well as to comply with privacy and Information Security Program requirements for insurers as set forth in applicable state laws and regulations. As part of the Information Security Program, the Company has implemented an information security and privacy training and awareness program for Root employees, which includes new-hire training, ongoing periodic training and regular phishing simulation and exercises. In addition, the Company has engaged third parties in connection with these processes.

companyName: Root, Inc.

ticker: ROOT


text: We have experienced cybersecurity threats to our information technology infrastructure and have experienced cybersecurity incidents that have resulted in threat actors obtaining customer personal information, attempts to breach our systems, fraudulent activity and other incidents. As of the filing of this Annual Report on Form 10-K, we are not aware of any such incidents that have occurred since the beginning of 2024 that have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. However, future threats could materially affect our business strategy, results of operations or financial condition. Risks related to cybersecurity events are detailed in the section of this Annual Report on Form 10-K titled "Risk Factors—Risks Related to Our Business—Cybersecurity incidents, or real or perceived errors, failures or bugs in our or our vendors' systems, or our website or app could impair our operations, compromise our confidential information or our customers' personal information, damage our reputation and brand, and harm our business, financial condition, operating results and prospects."


text: Additionally, the board of directors is informed of material information security incidents, as needed, by the Computer Security Incident Response Team, which is led by the Company's General Counsel.


text: The Company's CISO is responsible for assessing and managing risks from cybersecurity threats. The Company's CISO also leads the Information Security group and is responsible for the day-to-day management of the Information Security Program. Katelynn Sandy is the Company's CISO and reports directly to the Company's President and Chief Technology Officer. Ms. Sandy has an extensive background in cybersecurity, technology, and risk management across a variety of industries, including financial services, healthcare, and technology. Additionally, Ms. Sandy holds various information security certifications.


text: Board of Directors' Oversight and Management's Role Management is responsible for assessing, identifying, and managing risks from cybersecurity threats. The Company's IT function focuses on current and emerging cybersecurity matters. The Company's IT department is led by the Director of IT, who reports to the Company's Executive Vice President, Operations, including with respect to emerging cybersecurity incidents. They are responsible for implementing cybersecurity policies, programs, procedures, and strategies. To facilitate effective oversight, the Director of IT holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks. The Director of IT has served at Sitio since 2022 and has over 19 years of experience in managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs at Sitio and similar companies.

companyName: Sitio Royalties Corp.


text: Through the Company's enterprise risk management program, the Board is responsible for overseeing cybersecurity, information security, and IT risks, as well as management's actions to identify, assess, mitigate, and remediate those risks. The Audit Committee assists the Board in exercising oversight of the Company's cybersecurity, information security, and IT risks. As appropriate, the Board or Audit Committee reviews and discusses with management the Company's procedures and practices as well as any potential identified incidents with respect to cybersecurity, information security and information and operational technology, including related risks. In addition, our Executive Vice President, Operations is responsible for keeping the Board apprised of cybersecurity incidents and the Board is charged with determining the materiality of such incident.


text: In the normal course of business, we collect and store personal information and other sensitive information, including proprietary and confidential business information, intellectual property, information regarding patients and clinical trial participants, sensitive third-party information and employee information. To protect this information, we use managed detection and response services to monitor our network infrastructure and associated endpoints for possible cybersecurity threats. In addition, we use multi-factor authentication, perform penetration testing and engage third parties to assess the effectiveness of our cybersecurity practices. We conduct a thorough risk assessment by identifying critical assets, recognizing potential threats and vulnerabilities, and implement strategies to mitigate these risks and their possible impac ts. We establish incidence response plans and provide cybersecurity training to our employees and monitor their activity to ensure adherence to our security protocols. No risks from cybersecurity threats have occurred that have affected our business strategy, results of operations, or financial condition.

companyName: CORCEPT THERAPEUTICS INC

ticker: CORT


text: We design and assess our program based on various cybersecurity frameworks, such as the NIST and the CIS, and align our security program closely to the NIST Cyber Security Framework. We use these cybersecurity frameworks and information security standards as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: Clearwater Analytics Holdings, Inc.

ticker: CWAN


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO oversees the Company's risk management function generally and relies on the FS Investments CISO to assist with assessing and managing material risks from cybersecurity threats. The CISO has over fifteen years of experience in activity managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as CCO to the Company for ten years and has worked in the financial services industry for over 40 years, during which the CCO has gained expertise in assessing and managing risk applicable to the Company.

companyName: FS KKR Capital Corp

ticker: FSK


text: Cybersecurity Risk Management and Strategy CRH leverages its Enterprise Risk Management (ERM) framework, which accords with internationally recognized standards, to identify, assess, respond, monitor and report material cybersecurity risks facing the Company. CRH manages cybersecurity risk at multiple levels within the Company. Given CRH's wide geographic spread, the frequency and possible scale of acquisition activity, the diversity of the types of IT systems operated by CRH companies and the decentralized nature of its operations, CRH implements an amalgam of centralized and decentralized processes for IT management. Under this model, Company-level management and the management of CRH's operating companies and business units share responsibility for cybersecurity management and collaborate on assessing, identifying, and managing material risks.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: CRH's operating companies and business units use a variety of tools and processes to identify and manage material cybersecurity risks. CRH utilizes multiple monitoring tools and practices to identify and detect unusual activities and/or potential cybersecurity incidents, including potential system breaches, and to verify the effectiveness of protective measures. CRH's operating companies and business units implement various risk mitigation strategies, including continuously strengthening security measures, improving incident response plans through post-incident evaluations and assessments, investing in security technologies, providing regular and focused employee training, and transferring risk through cybersecurity insurance.


text: At the Group level, CRH conducts a semi-annual bottom-up risk assessment focused on CRH's operating companies and business units, including cybersecurity-related risks, which evaluates the impact and likelihood of the identified cyber risks and the effectiveness of existing security measures, policies, and procedures. CRH also requires that each operating company completes a self-assessment regarding its cyber controls and risk, including user awareness training, email security protection, multi-factor authentication, system patch management, identity management, network segregation, antivirus and web protections, asset inventory, privileged access management, logging, monitoring, and incident response capabilities. As described further below under "Cybersecurity Governance", CRH's Board and senior management receive regular briefings on cybersecurity risks facing CRH and are closely involved in identifying cybersecurity risks, developing CRH's plan for managing such risks, and continuously refining CRH's cyber defenses in response to the information gathered through the above-mentioned risk assessments.


text: To manage the risk of a material impact on CRH's operations or financial performance due to a cybersecurity incident, CRH has implemented a mandatory Cybersecurity Incident Escalation Standard as part of its Company-wide Information Security Policy. This Standard, which is supported by relevant guidelines and procedural documentation, provides a structured approach adapted to the systems of each CRH operating company and business unit to manage the incident response process through a series of pre-defined phases, including triage, containment, eradication, recovery, and post-incident analysis.


text: The Audit Committee receives updates at least annually from the Chief Information Security Officer (CISO) on the design and progress of key information security initiatives in addition to regular briefings on cybersecurity and management of cybersecurity-related risks from relevant members of management, including the Head of ERM and our CISO. Recent updates from the CISO have focused on the Company's information security strategy, ongoing security assessments and ongoing projects. The Audit Committee is responsible for updating the Board on identified risks related to cybersecurity.


text: Our Global Leadership Team is responsible for the execution of CRH's strategy and governance, including implementation and review of our ERM framework, which has identified cybersecurity as a core risk for CRH. CRH has established the role of CISO to provide technical leadership on a day-to-day basis in assessing and managing the Company's material cybersecurity risks and liaising with the chief information officers of CRH's Divisions. Our CISO has 25 years of experience working in IT, including more than a decade spent in prior technical and senior management roles related to cybersecurity. The divisional chief information officers have in excess of 20 years of experience, on average, in IT-related and cybersecurity-related roles and, together with the CISO, hold a variety of recognized and specialized credentials related to cybersecurity and IT.


text: CRH also maintains a Company-wide incident response function centered in our Group Information Security (GIS) team, led by the CISO. GIS responds to potential incidents across CRH in accordance with predetermined severity classifications. In line with CRH's Cybersecurity Incident Escalation Standard and supporting guidelines and procedural documentation, incidents that are deemed potentially material to the Company and/or which may lead to the exposure of confidential or sensitive data are immediately escalated to GIS for review and, as necessary, mitigation and remediation actions are taken. GIS and the CISO also review regular attestation reports that are required to be prepared by CRH's operating companies and business units regarding cybersecurity incidents that did not meet the threshold for immediate escalation.


text: Following cybersecurity incidents, GIS, in conjunction with members of management of CRH's operating companies and business units as necessary, conduct post-incident analysis and exercises designed to strengthen CRH's cybersecurity practices. The Risk Committee and Global Leadership Team are briefed on the occurrence, mitigation and remediation of cybersecurity incidents on a regular basis, including ad-hoc briefings covering significant or potentially material incidents.


text: The Risk Committee, which is made up of our Chief Financial Officer, Group General Counsel, Chief Operating Officer and the Divisional Presidents of CRH Americas and CRH International, is the executive oversight body for risk management, including cybersecurity risks and the work of the CISO, GIS and related teams. The Risk Committee meets quarterly with the Head of ERM to assess risks facing CRH, and, on an as-needed basis, meets with other members of CRH management regarding cybersecurity risks and developments. The Risk Committee also reviews the half-yearly risk updates that are provided to the Audit Committee prior to dissemination.


text: The responsibilities of the Chief Information Officer ("CIO") include overseeing cybersecurity measures with the global Chief Information Security Officer ("CISO "). The CIO's background includes nearly 19 years of IT leadership at a major medical technology company and experience in various industries such as financial services, manufacturing, oil and gas, and chemicals. He holds an undergraduate degree in Management Information Systems from Augsburg University and a Master of Business Administration from Carlson School of Management at the University of Minnesota.

companyName: APi Group Corp

ticker: APG


text: The CISO has appointed experienced security leaders over the North American and International regions to create additional alignment and collaboration.


text: Risk Management and Strategy Our cybersecurity risk management program primarily leverages the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). We routinely assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our risk management program also assesses third party risks to attempt to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. As part of our cybersecurity risk management program, we also gather Threat Intelligence through our multiple security partners and tools. This intelligence (including tactics, techniques and procedures used by cyber criminals) provides insights into potential threats and vulnerabilities, which helps us to defend against cyber-attacks.


text: Cybersecurity Risk Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. We face a multitude of increasing cybersecurity threats, including those that target the Nation's critical infrastructure sectors. Reliable service and operational continuity are critical to our success and the welfare of those we serve, including our ability to safely and reliably deliver energy to our customers through our transmission, distribution, and generation systems. We are committed to maintaining robust governance and oversight of these risks and to investing in the implementation of mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks in an evolving landscape.

companyName: CHESAPEAKE UTILITIES CORP

ticker: CPK


text: To mitigate the threat to our business, we take a comprehensive, cross-functional approach to cybersecurity risk management. Our management team is actively involved in the oversight and implementation of our risk management program, of which cybersecurity represents an important component. At least annually, we conduct a cybersecurity risk assessment that evaluates information from internal stakeholders and external sources. The results of the assessment inform our alignment and prioritization of initiatives to enhance our security controls. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats which are designed to follow nationally recognized frameworks. These include, among other things: security awareness training for employees; mechanisms to detect and monitor unusual network activity; services that identify cybersecurity threats; conducting scans of the threat environment; evaluating our industry's risk profile; utilizing internal and external audits; conducting threat and vulnerability assessments; and containment and incident response tools. We also actively engage with industry groups for benchmarking and awareness of best practices. We maintain controls and procedures that are designed for prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made in a timely manner.


text: Our approach to cybersecurity risk management includes the following key elements: • Multi-Layered Defense and Continuous Monitoring: Our approach to cybersecurity involves multiple layers of defense, incorporating detection capabilities, analytics, and real-time monitoring. We utilize data insights to identify potential anomalies, monitor evolving threats, and identify emerging risks. Safeguards are regularly evaluated and refined based on vulnerability assessments, threat intelligence, and insights gained from monitoring activities. • Information Sharing and Collaboration: We share and receive threat intelligence with industry peers, government agencies, Information Sharing and Analysis Centers ("ISACs"), trade organizations, and cybersecurity forums. These collaborations provide a means for information exchange to improve threat detection and vulnerability mitigation. • Third-Party Risk Assessments: We engage independent firms to assist with multiple phases of our cybersecurity program. This work includes testing, audits, and consulting to validate and strengthen our cybersecurity posture, and the design and operational effectiveness of our controls. • Companywide Policies and Procedures: Our companywide cybersecurity policies and procedures cover areas such as encryption standards, endpoint security, remote access protocols, multi-factor authentication, and data protection. These policies undergo regular review to address the latest security standards and operational requirements, and to consider best practices and industry trends. • Training and Awareness: We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees routinely participate in simulated phishing campaigns, education that reinforces compliance with our policies, standards and practices, and other awareness training. We also periodically perform tabletops and other exercises with management and incorporate external resources and advisors as needed. Our cybersecurity team collaborates with stakeholders across our business units to further analyze the risk to the Company, and form detection, mitigation and remediation strategies. • Supplier Engagement: We work collectively with our suppliers to support cybersecurity resiliency in our supply chain. The Company uses a variety of processes to address third-party cybersecurity threats, including reviewing the cybersecurity practices of such provider(s), contractually imposing obligations on the provider(s), notifications in the event of any known or suspected cyber incident, conducting security assessments, and periodic reassessments during the course of the Company's engagement with such provider(s).


text: As of the date of this Form 10-K, there have not been any cybersecurity incidents that have materially affected our business strategy, critical business operations, results of operations or financial condition. There can be no guarantee that our policies and procedures will be followed or, if followed, will be effective in protecting our systems and information. As such, this could impact, among other considerations, the execution of our business strategy and business operations, our financial condition and/or results of operations, and the security and effectiveness of our information technology systems. For more information regarding the risks we face from cybersecurity threats, please see Item 1A, Risk Factors, which should be read in conjunction with this Item 1C.


text: Cybersecurity Risk Governance and Oversight The Company's Board, in conjunction with its Audit Committee, oversees management's approach to cybersecurity risk and its alignment with the Company's enterprise risk management program. The Board and Audit Committee receive reports from Management regarding the prevention, detection, and mitigation of cybersecurity incidents, including security risks and vulnerabilities. Additionally, the Audit Committee receives updates on cybersecurity risk assessments, risk mitigation strategies, and relevant cybersecurity matters. The Company's information technology team is responsible for developing and implementing its information security program and reporting on cybersecurity matters to the Board of Directors and Audit Committee.