text: Use of Consultants and Advisors We engage with a range of external experts, including cybersecurity assessors, consultants, auditors, and legal counsel in evaluating and testing our risk management systems. This enables us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain current.


text: We have engaged a managed security services company to provide 24x7x365 monitoring to detect cyber threats and support us in containing and responding to cyber threats. The services provided by the managed security services company include monitoring for and updating us regarding emerging cybersecurity threats, real-time monitoring of our firewalls and other security controls, and support for the development and execution of our Incident Response Plan. The managed security services company performs monthly vulnerability scanning and generates reports. Our cybersecurity team has access to dashboards providing status updates on the managed security services company's cybersecurity-related activity, meets regularly with the managed security services company's staff, and receives regular reporting from the managed security services company.

companyName: Silk Road Medical Inc

secItem: Item 1C


text: We also receive and participate in other third-party cybersecurity assessments, such as: quarterly vulnerability scanning as part of our PCI DSS compliance requirements, annual network assessments, annual penetration testing, and vulnerability scans as part of our cyber insurance underwriting process.


text: In addition, we engage specialized consultants and third-party managed service providers on a project-specific basis to assist us with projects that will improve our IT infrastructure, strengthen our security posture, and improve our cyber readiness.


text: Cybersecurity Strategy and Risk Management We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our cybersecurity program is designed for assessing, identifying and managing material risks from cybersecurity threats to the confidentiality, integrity, and availability of our assets and information. Risk management is embedded into our IT processes and we continuously monitor risk by evaluating emerging threats and vulnerabilities.


text: We have established security controls based on the CIS CSC framework. Key components of our cybersecurity program include, but are not limited to, asset management, encryption, data loss prevention technology, access controls, multi-factor authentication, vulnerability management, independent penetration testing, email and web gateway protection, multi-faceted backup and data recovery solutions, anti-malware, firewalls, IDS and IPS, auditing and monitoring, regular policy updates, security awareness training, anti-phishing campaigns, and third-party risk management. We also subscribe to third-party threat intelligence tools and services that support monitoring, analyzing, and responding to emerging risks and threats.


text: We have established an Incident Response Plan and a Security Operations Center to manage any cyber incident. We have retained a third-party incident response firm to support incident detection, management, and mitigation. We also maintain appropriate levels of cyber insurance. We implement processes to oversee and manage the risks associated with third-party service providers. We conduct security assessments of critical third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes ongoing assessments by our Information Security team. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: At least annually, we conduct information security awareness training for all employees. In addition, we have retained a third-party vendor to provide regular online awareness training modules for our employees. Each module contains a video extract followed by a short quiz.


text: To date, we have not experienced any material security incidents or data breaches as a result of a compromise of our information systems and are not aware of any cybersecurity incidents that have had a material impact or are reasonably likely to materially affect our business strategy, operating results, or financial condition.


text: Cybersecurity Risk Management and Strategy We maintain an information security program (the "Program") to help manage material risks and cybersecurity threats to our business, operations and assets. As part of our Program, we maintain policies, procedures and standards that outline the Company's expectations, guidelines and structured approach to managing cybersecurity risks. We leverage established security frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, as guides to organize, assess and improve our Program. In addition, our employees are required to complete a cybersecurity and privacy training program each year, which is supplemented with additional awareness efforts, including phishing campaigns and informational articles.

companyName: LPL Financial Holdings Inc.

ticker: LPLA


text: We operate a security operation center to ingest threat intelligence, monitor for cybersecurity threats and coordinate incident response resources. In the event of a cybersecurity incident, the Company has developed a security incident response plan that establishes a structured approach for the Company's response. The security incident response plan includes processes through which cybersecurity incidents are escalated based on a defined incident risk rating to business stakeholders and a security incident response team, as well as to the Company's executive officers, which may result in engagement with management's risk oversight committee (the "ROC"), the Board and the Audit and Risk Committee of the Board ("ARC"), as needed. To improve preparedness for a cybersecurity incident, we conduct tabletop exercises at least annually. These exercises are conducted by internal personnel and with assistance from third-party experts, as needed.


text: Cybersecurity Governance The Program is situated within the Company's information security department, which is comprised of multiple teams, including security operations, security architecture and engineering, technology governance, mergers and acquisitions information security, and advisor security. The information security department is led by the chief information security officer, who has primary responsibility for managing the Program. The current chief information security officer has over 20 years of experience in information security, including a lead auditor certification from the International Organization for Standardization, an international standard for information security management systems.


text: The Board has delegated oversight of the Program to the ARC, including oversight of the Company's cyber- and technology-related risks and the steps management has taken to identify, assess, monitor, and manage those risks. In addition, the Board has established a reporting structure and cadence related to oversight of the Program, which includes respective oversight responsibilities for the Board, the ARC and management risk committees, including the Technology Risk Committee, the Operational Risk Oversight Committee and the Risk Oversight Committee. Each of the Board and the ARC receive staggered periodic reports on the Program's effectiveness and progress on at least an annual basis.


text: The assessment, identification and management of cybersecurity-related risks are integrated into the Company's overall Enterprise Risk Management ("ERM") process. Cybersecurity risk is included among the significant residual risks identified during the Company's assessment of business risk. This risk assessment process is used to inform the Company's strategic planning process, and to develop action plans to appropriately address and manage risk. It is also used to focus our Board and its committees on the most significant risks to our Company. In addition, the enterprise risk function has established foundational frameworks for assessing, monitoring and overseeing the Company's risks, including risks from cybersecurity threats. This includes reporting on issues, risk events or incidents and emerging risks to applicable risk committees to provide monitoring of key risk exposures.


text: Engagement of Third Parties We engage third-party subject matter experts and consultants to conduct evaluations of our security controls, including, but not limited to, penetration testing, maturity assessments or consulting on our response to emerging threats. Results of these evaluations are used to help determine priorities and initiatives to improve the overall Program. As necessary, we also engage third-party experts and consultants to assist with the incident response process to augment our internal security operation center team.


text: We use a third-party risk performance management program to evaluate cybersecurity risk for third-party service providers. Vendor cybersecurity controls are then assessed to determine if the vendor's control environment meets the Company's standards. Vendors are also assessed on a periodic ongoing basis according to their risk classification.


text: We have not identified any cybersecurity incidents that individually, or in the aggregate, have materially affected or are reasonably likely to materially affect the Company. Regardless, we recognize cybersecurity threats are ongoing and evolving, and there can be no guarantee that we will not be subject to a cybersecurity incident that has a material effect on our business. Please consult the "Risks Related to Our Technology" section within Part I, "Item 1A. Risk Factors" for more information about the risks associated with cybersecurity.


text: Cybersecurity Governance The Program is situated within the Company's information security department, which is composed of multiple teams, including security operations, security architecture and engineering, technology governance, mergers and acquisitions information security, and advisor security. The information security department is led by the chief information security officer, who has primary responsibility for managing the Program. The current chief information security officer has over 20 years of experience in information security.


text: The Board, which includes a director with cybersecurity expertise, has delegated responsibility for primary oversight of the Program to the ARC, including oversight of the Company's cyber- and technology-related risks and the steps management has taken to identify, assess, monitor, and manage those risks. In addition, the Board has established a reporting structure and cadence related to oversight of the Program, which includes respective oversight responsibilities for the Board, the ARC and management risk committees, including the Technology Risk Committee, the Operational Risk Oversight Committee and the Risk Oversight Committee. Each of the Board and the ARC receive periodic reports on the Program's effectiveness and progress on at least an annual basis.


text: The assessment, identification and management of cybersecurity-related risks are integrated into the Company's overall Enterprise Risk Management ("ERM") process. Cybersecurity risk is included among the significant residual risks identified during the Company's assessment of business risk. This risk assessment process is used to inform the Company's strategic planning process, and to develop action plans to appropriately address and manage risk. It is also used to focus our Board and its committees on the most significant risks to the Company. In addition, the enterprise risk function has established foundational frameworks for assessing, monitoring and overseeing the Company's risks, including risks from cybersecurity threats. This includes reporting on issues, risk events or incidents and emerging risks to applicable risk committees to provide monitoring of key risk exposures.


text: The Advisor and its Information Security Team, on behalf of the Fund, have established a comprehensive risk management program, which includes processes to identify, assess, and manage cybersecurity risks, including material risks from cybersecurity threats, and to put in place appropriate controls to mitigate these risks and reduce the potential impact to the Fund and its shareholders. The Fund does not currently have any employees and relies upon the Advisor and its Information Security team for the Fund's day-to-day operations and to establish strategies, policies, and standards for the security of, and operations in, cyberspace.

companyName: GUGGENHEIM CREDIT INCOME FUND


text: The Fund depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. Through its vendor management program, and on behalf of the Fund, the Advisor oversees and identifies risks from cybersecurity threats associated with the use of third-party service providers. This vendor oversight program includes periodic reviews of the cybersecurity controls of third-party service providers, the frequency of such reviews is generally based on the nature of the the Advisor's information processed by the vendor and the vendor's criticality to business operations.


text: On behalf of the Fund, the Advisor engages third-party consultants to assess, identify, and/or manage material risks from cybersecurity threats. For example, the Advisor engages third-party consultants to perform audits of its cybersecurity measures and risk management processes, including those applicable to the Fund. The Advisor has also hired qualified independent assessors to review applicable security controls in accordance with the AICPA's System and Organization Controls assurance programs. Additionally, the Advisor utilizes third-party consultants with specific areas of cybersecurity expertise to review and report on various aspects of its cybersecurity program, including those applicable to the Fund. The results of these consulting engagements are shared with the Fund's Board of Trustees as part of periodic reports.


text: The Advisor's Information Security team has a threat intelligence program which monitors for emerging cyber threats. Taking information gathered from public and private sources, including industry groups such as the U.S. Cybersecurity and Infrastructure Security Agency and the Financial Services Information Sharing and Analysis Center, the organization analyzes such information and incorporates tactics, techniques, and procedures into the program's security monitoring and detection tools and processes.


text: The potential impact of risks from cybersecurity threats on the Fund are assessed on an ongoing basis, and how such risks could materially affect the Fund's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Fund did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Fund, including its day-to-day operations, financial condition, and business strategies.


text: The Advisor's Enterprise Information Security Team participates in regular testing of applicable incident response processes to ensure appropriate escalation, mitigation, communication and reporting processes are in place. These processes are led by the crisis management team as outlined within the crisis management plan.


text: The Board provides strategic oversight regarding cybersecurity risks and threats. The Board receives and reviews periodic reports from senior executives in the Advisor's Information Security Team and the Fund's management, including the Advisor's Chief Information Security Officer ("CISO") and members of the CISO's staff. These reports contain information about risks from cybersecurity threats, including the results of recent independent reviews of the cybersecurity program, summaries of recent cybersecurity threat intelligence assessments, progress on key initiatives and strategies, and updates on recent regulatory activities, including new regulations and examinations.


text: The Fund's management, including the CCO of the Fund, is responsible for assessing and managing material risks from cybersecurity threats. In connection with the Fund's reliance on the Advisor and the Firms information security team, the CCO relies on the cybersecurity expertise of the Advisor's CISO and members of the CISO's staff to assist in assessing and managing the Fund's material risks from cybersecurity threats. The CISO has over 8 years of experience as a technology and information security leader. The CISO has served as the Advisor's CISO since 2023. Prior to this role, the CISO was the Deputy CISO for 3 years. The CCO has been responsible for this oversight function as CCO to the Fund for 6 years, and has worked in the financial services industry for over 30 years, during which the CCO has gained expertise in assessing and managing risks applicable to the company.


text: Management of the Fund is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Fund, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Advisor. The Board is also made aware of material cybersecurity incidents which impacted the Fund.


companyName: GUGGENHEIM CREDIT INCOME FUND 2019


companyName: GUGGENHEIM CREDIT INCOME FUND 2016 T


text: The Fund's management, including the CCO of the Fund, is responsible for assessing and managing material risks from cybersecurity threats. In connection with the Fund's reliance on the Advisor and the Firms information security team, the CCO relies on the cybersecurity expertise of the Advisor's CISO and members of the CISO's staff to assist in assessing and managing the Fund's material risks from cybersecurity threats.


text: The CISO has over 8 years of experience as a technology and information security leader. The CISO has served as the Advisor's CISO since 2023. Prior to this role, the CISO was the Deputy CISO for 3 years. The CCO has been responsible for this oversight function as CCO to the Fund for 6 years, and has worked in the financial services industry for over 30 years, during which the CCO has gained expertise in assessing and managing risks applicable to the company.


text: Cybersecurity risk management is an essential part of our enterprise risk management program. We are committed to maintaining governance and oversight of these risks and to implementing controls, technologies, and processes designed to help us identify, assess, and manage these risks.

companyName: Genpact LTD

ticker: G


text: Our cybersecurity program aims to incorporate industry best practices, including standards such as ISO 27001 and the NIST Cybersecurity Framework, and focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, manage and address cybersecurity risks, threats and incidents. Our practices include, among other things, security awareness training and simulations, technologies and processes to monitor our systems, assessments of controls, and incident response processes. We engage with industry groups and forums to stay informed of industry practices and developments. We monitor developments in the threat landscape that may affect our systems or services and assess their potential impacts on and risks to our cybersecurity posture. We engage external service providers, where appropriate and from time to time, to assist us with aspects of our program, such as assessing and testing controls, providing threat intelligence information and incident response. We also have processes in place to manage cybersecurity risks associated with third-party service providers. Certain key security controls are tested annually by independent third-party auditors. We regularly refine our cybersecurity processes as we determine necessary to address developments in the threat landscape, advance our control and technology capabilities, respond to regulatory requirements and standards, and implement improvements based on the results of internal and external assessments.


text: Our cybersecurity incident response process involves a multi-functional approach for investigating, containing, and mitigating incidents, including reporting findings to senior management and other key stakeholders, including if appropriate the audit committee and the board, and keeping them informed and involved as appropriate. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that has had a material impact on our business or operations, we have experienced incidents that did not have a material impact on our business or operations, and there can be no guarantee that we will not experience an incident that results in a material impact to our business or operations in the future. In addition, cybersecurity threats are constantly evolving and increasing in sophistication, which increases the difficulty of successfully defending against them or implementing adequate preventative measures. See "Risk Factors" above for more information about the cybersecurity risks we face.


text: Our board of directors has ultimate responsibility for oversight of our risk management, and delegates cybersecurity risk management oversight to the audit committee. The audit committee, which is responsible for ensuring that management has processes in place designed to identify, evaluate and manage cybersecurity risks and incidents, regularly reviews our cybersecurity program with management and reports to the board of directors. Cybersecurity reviews by the audit committee generally occur at least quarterly. A number of our directors have experience in assessing and managing cybersecurity risk, including by serving on other public company audit committees having responsibility for cybersecurity oversight. One of our directors has also served as a Chief Technology Officer for multiple companies.


text: Our cybersecurity program is run by our Chief Information Security Officer (CISO), who reports to our Head of Enterprise Risk Management and receives input and support from our Head of Enterprise Risk Management and our Chief Technology and Transformation Officer. Our CISO has extensive experience leading and managing cybersecurity programs and in cybersecurity risk management. Our CISO has served in this position since 2014 and, before Genpact, was previously CISO at another US-listed public company. Our CISO is supported by our information security team, many of whom hold cybersecurity certifications and who collectively possess relevant experience in different areas of cybersecurity.


text: Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our information security team, internal governance processes, and by reviewing the results of internal and third-party assessments and audits. Our CISO regularly reports directly to the audit committee on our cybersecurity program and our efforts to prevent, detect, mitigate, and remediate cybersecurity risks. In addition, we have a Security Governance Council, made up of members of our senior management team as well as relevant security personnel, that meets periodically to discuss and address relevant cybersecurity matters.


text: Our cybersecurity program aims to incorporate industry best practices, including standards such as ISO 27001 and the NIST Cybersecurity Framework, and focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, manage and address cybersecurity risks, threats and incidents. Our practices include, among other things, security awareness training and simulations, technologies and processes to monitor our systems, assessments of controls, and incident response processes. We engage with industry groups and forums to stay informed of industry practices and developments. We monitor developments in the threat landscape that may affect our systems or services and assess their potential impacts on and risks to our cybersecurity posture. We engage external service providers, where appropriate and from time to time, to assist us with aspects of our program, such as assessing and testing controls, providing threat intelligence information and incident response. We also have processes in place to manage cybersecurity risks associated with third-party service providers. Certain key security controls are tested annually by independent third-party auditors as well as our internal auditors. We regularly refine our cybersecurity processes as we determine necessary to address developments in the threat landscape, advance our control and technology capabilities, respond to regulatory requirements and standards, and implement improvements based on the results of internal and external assessments.


text: Our cybersecurity incident response process involves a multi-functional approach for investigating, containing, and mitigating incidents, including reporting findings to senior management and other key stakeholders, including if appropriate the audit committee and the board, and keeping them informed and involved as appropriate. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that has had a material impact on our business or operations, we have experienced incidents that did not have a material impact on our business or operations, and there can be no guarantee that we will not experience an incident that results in a material impact to our business or operations in the future. In addition, cybersecurity threats are constantly evolving and increasing in sophistication, which increases the difficulty of successfully defending against them or implementing adequate preventative and detective measures. See "Risk Factors" above for more information about the cybersecurity risks we face.


text: Our cybersecurity program is run by our Chief Information Security Officer (CISO), who reports to our Head of Enterprise Risk Management and receives input and support from our Head of Enterprise Risk Management and our Chief Technology and Transformation Officer. Our CISO has extensive experience leading and managing cybersecurity programs and in cybersecurity risk management. Our CISO has served in this position since 2014 and, before Genpact, was previously CISO at another US-listed public company. Our CISO is supported by our information security team, many of whom hold cybersecurity certifications and who collectively possess relevant experience in different areas of cybersecurity, and by our information technology team who operate several critical controls.


text: Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our information security team, internal governance processes, and by reviewing the results of internal and third-party assessments and audits. Our CISO regularly reports directly to the audit committee on our cybersecurity program and our efforts to prevent, detect, mitigate, and remediate cybersecurity risks. In addition, we have an Information Security Governance Council, made up of members of our senior management team as well as relevant information security personnel, that meets periodically to discuss and address relevant cybersecurity matters.


text: The Board and management believe that cybersecurity is vital to protecting proprietary and confidential information, company operations and maintaining the trust of our customers, agents, franchisees, and employees. The Company has a cybersecurity risk management strategy and a governance framework to assess, identify and manage material risks from cybersecurity threats. As discussed below, the Company utilizes both internal and external resources as part of its cybersecurity program.

companyName: Anywhere Real Estate Group LLC


text: Risk Management and Strategy Anywhere views its cybersecurity strategy through a multi-pronged lens encompassing prevention, detection and response to ensure holistic coverage of the program and our environments.


text: Prevention. Our cybersecurity program starts with prevention, which includes risk assessment and identification and utilizing that information to design an effective layer of controls as a baseline.


text: Our cybersecurity program includes robust risk assessment and identification processes that are aligned with our overall enterprise risk management (ERM) program. As part of the annual integrated risk assessment process, the cybersecurity team works with ERM, internal audit and our legal compliance function to assess and identify cybersecurity and related risks to our business. These risks are then included, as appropriate, in the updated ERM profile, and with top risks being addressed in the cybersecurity yearly plan. As part of that process, we utilize both internal and third-party resources to identify risks. In addition, Internal Audit regularly conducts operational audits of the cybersecurity processes.


text: In evaluating the risks posed by third parties, our cybersecurity program also includes a dedicated function for Third Party Risk Management, that oversees the identification and mitigation of risk associated with outsourcing to third party vendors and service providers, particularly focused on vendors who process personal information, intellectual property, or other sensitive information.


text: Finally, with regard to compliance risk, we utilize third party firms to help us determine compliance with industry standards and regulations. We also maintain a Data Privacy Steering Committee, which is a group of internal legal, risk and IT professionals, to assist management with fulfilling applicable data privacy regulations.


text: In order to protect our assets, we utilize a multi-layer defense strategy to control who logs on to our network and uses our computers and other devices. We have enforced multi-factor authentication, implemented firewalls, and deployed a VPN alternative solution that delivers a zero trust model for access to our network and resources. We also protect our data through our use of security software, which is regularly updated, encryption of sensitive data, both at rest and in transit, and by conducting regular data backups. We have formal policies for safely disposing of electronic files and old devices and we train all employees annually on cybersecurity and their crucial role in protecting the Company's assets.


text: Detection. Our cybersecurity program includes robust tools and processes designed to detect breaches and other cybersecurity incidents as well as unauthorized access and unusual network activity. We utilize a security operations program with 24/7 monitoring by both internal and third parties that includes a variety of detection tools. We also utilize backstop detection and preventative measures, like malware detection.


text: Response. Our Cyber Security Incident Response Plan (the "Response Plan") provides the methodology used by the Company to identify and respond to cyber security incidents. The Response Plan serves as a guide to facilitate a consistent and systematic response to cyber security incidents and is designed to (a) prevent or minimize disruption of critical information systems; (b) minimize loss or theft of sensitive information and/or funds; (c) quickly and efficiently remediate, report (including any public or internal company communications or required reporting) and recover from cyber security incidents; and (d) provide a centralized enterprise investigations process. The Response Plan also provides for incorporating lessons learned after an event to prevent future breaches of the same nature.


text: We utilize internal and external resources to evaluate the effectiveness and maturity of our cybersecurity program. We conduct regular penetration and vulnerability testing. We conduct annual tabletop exercises to test and iterate our Response Plan, while also providing training for the Response Plan working group. In addition, we conduct compliance training and regular phishing assessments for our employees.


text: To date, we have not experienced any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial condition. The cybersecurity risks that could materially affect Anywhere, including our business strategy, results of operations, or financial condition, are set forth in "Item 1A.—Risk Factors".


text: Effective risk management is critical to Anywhere's ability to achieve its strategy. The Board oversees management in exercising its responsibility for managing risk, considering our framework of policies, procedures, and processes to anticipate, identify, assess, prioritize, and mitigate risks across the Company.


text: Our Audit Committee shares oversight responsibility with the full Board for our information security and technology risks, including cybersecurity. Anywhere's Chief Information Security Officer (CISO) reports to the Audit Committee on a quarterly basis and once a year to the full Board on the cybersecurity program, including the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. Two Audit Committee members have significant business experience with respect to cybersecurity risks, namely the chair of the committee, who oversaw information security and data privacy as an Enterprise Risk Officer of a Fortune 500 publicly-traded company and a member who is the Chief Product Data, Analytics and Technology Officer of a Fortune 500 publicly-traded company.


text: While the Board and the committees oversee our risk management, our CEO and other members of senior management (including the Risk Management Committee) are primarily responsible for day-to-day risk management analysis and mitigation and report to the full Board or the relevant committee regarding risk management. We believe this division of responsibility is the most effective approach for addressing our risk management.


text: Our CISO leads a dedicated internal Global Information Security ("GIS") team that is responsible for leading enterprise-wide information cybersecurity strategy, policy, standards, architecture, and processes, all of which are designed to prevent, detect and respond to information security threats, as further described in "—Cybersecurity Strategy" above. The CISO's experience includes more than 20 years in the security and fraud profession in multiple high-risk industries, including the critical infrastructure sector, and encompasses various cybersecurity leadership roles and almost seven years as a CISO. She is a Certified Information Systems Security Professional (CISSP) and has a Master's Degree in Information Systems Management.


text: In support of the GIS team, the CISO leads the Information Security Steering Committee, a group of internal security leadership positions that ensure alignment between the company's information security program and company objectives.


text: Overseeing enterprise-wide risk management is our Risk Management Committee, chaired by our General Counsel and comprised of key members of our executive management team, including the CISO. The Risk Management Committee meets regularly and plays a core role in the identification, monitoring, mitigation, and management of the risks the Company faces and oversees our enterprise risk management framework, including cybersecurity and data protection/privacy.


text: Through this dynamic risk assessment and governance process, the Risk Management Committee and Board consistently evaluate the risk environment and adjust the Company's risk profile, including cybersecurity and data privacy risks, and focus as needed to respond to industry and macroeconomic changes and to protect the Company.


text: The Board of Directors ("Board") and management believe that cybersecurity is vital to protecting proprietary and confidential information, company operations and maintaining the trust of our customers, agents, franchisees, and employees. The Company has a cybersecurity risk management strategy and a governance framework to assess, identify and manage material risks from cybersecurity threats. As discussed below, the Company utilizes both internal and external resources as part of its cybersecurity program.


text: Risk Management and Strategy Anywhere views its cybersecurity strategy through a multi-pronged lens encompassing prevention, detection and response to ensure holistic coverage of the program and our environments.


text: Prevention. Our cybersecurity program starts with prevention, which includes risk assessment and identification and utilizing that information to design an effective layer of controls as a baseline.


text: Our cybersecurity program includes risk assessment and identification processes that are aligned with our overall enterprise risk management ("ERM") program. As part of the annual integrated risk assessment process, the cybersecurity team works with our ERM, internal audit and legal compliance functions to assess and identify cybersecurity and related risks to our business. These risks are then included, as appropriate, in the updated ERM profile, and with top risks being addressed in the cybersecurity yearly plan. As part of that process, we utilize both internal and third-party resources to identify risks. In addition, Internal Audit regularly conducts operational audits of the cybersecurity processes.


text: In evaluating the risks posed by third parties, our cybersecurity program also includes a dedicated function for Third Party Risk Management, that oversees the identification and mitigation of risk associated with outsourcing to third party vendors and service providers, particularly focused on vendors who process personal information, intellectual property, or other sensitive information.


text: Finally, with regard to compliance risk, we utilize third party firms to help us determine compliance with industry standards and regulations. We also maintain a Data Privacy Steering Committee, which is a group of internal legal, risk and IT professionals, to assist management with fulfilling applicable data privacy regulations.


text: In order to protect our assets, we utilize a multi-layer defense strategy to control who logs on to our network and uses our computers and other devices. We have enforced multi-factor authentication, implemented firewalls, and deployed a VPN alternative solution that delivers a zero trust model for access to our network and resources. We also protect our data through our use of security software, which is regularly updated, encryption of sensitive data, both at rest and in transit, and by conducting regular data backups. We have formal policies for safely disposing of electronic files and old devices and we train all employees annually on cybersecurity and their crucial role in protecting the Company's assets.


text: Detection. Our cybersecurity program includes tools and processes designed to detect breaches and other cybersecurity incidents as well as unauthorized access and unusual network activity. We utilize a security operations program with 24/7 monitoring by both internal and third parties that includes a variety of detection tools. We also utilize backstop detection and preventative measures, like malware detection.


text: Response. Our Cyber Security Incident Response Plan (the "Response Plan") provides the methodology used by the Company to identify and respond to cyber security incidents. The Response Plan serves as a guide to facilitate a consistent and systematic response to cyber security incidents and is designed to (a) prevent or minimize disruption of critical information systems; (b) minimize loss or theft of sensitive information and/or funds; (c) quickly and efficiently remediate, report (including any public or internal company communications or required reporting) and recover from cyber security incidents; and (d) provide a centralized enterprise investigations process. The Response Plan also provides for incorporating lessons learned after an event to prevent future breaches of the same nature.


text: We utilize internal and external resources to evaluate the effectiveness and maturity of our cybersecurity program. We conduct regular penetration and vulnerability testing. We conduct annual tabletop exercises to test and iterate our Response Plan, while also providing training for the Response Plan working group. In addition, we conduct compliance training and regular phishing assessments for our employees.


text: As of December 31, 2024, no known cybersecurity threats have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial condition. The cybersecurity risks that could materially affect Anywhere, including our business strategy, results of operations, or financial condition, are set forth in "Item 1A.—Risk Factors".


text: Effective risk management is critical to Anywhere's ability to achieve its strategy. The Board oversees management in exercising its responsibility for managing risk, considering our framework of policies, procedures, and processes to anticipate, identify, assess, prioritize, and mitigate risks across the Company.


text: Our Audit Committee shares oversight responsibility with the full Board for our information security and technology risks, including cybersecurity. Anywhere's Chief Information Security Officer (CISO) reports to the Audit Committee on a quarterly basis and once a year to the full Board on the cybersecurity program, including the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. Two Audit Committee members have significant business experience with respect to cybersecurity risks, namely the chair of the committee, who oversaw information security and data privacy as an Enterprise Risk Officer of a Fortune 500 publicly-traded company and a member who, from June 2018 to March 2024, was Chief Product Data, Analytics and Technology Officer of a Fortune 500 publicly-traded company.


text: While the Board and the committees oversee our risk management, our CEO and other members of senior management (including the Risk Management Committee) are primarily responsible for day-to-day risk management analysis and mitigation and report to the full Board or the relevant committee regarding risk management. We believe this division of responsibility is the most effective approach for addressing our risk management.


text: Our CISO leads a dedicated internal Global Information Security ("GIS") team that is responsible for leading enterprise-wide information cybersecurity strategy, policy, standards, architecture, and processes, all of which are designed to prevent, detect and respond to information security threats, as further described in "Risk Management and Strategy" above. The CISO's experience includes more than 20 years in the security and fraud profession in multiple high-risk industries, including the critical infrastructure sector, and encompasses various cybersecurity leadership roles and almost seven years as a CISO. She is a Certified Information Systems Security Professional (CISSP) and has a Master's Degree in Information Systems Management.


text: In support of the GIS team, the CISO leads the Information Security Steering Committee, a group of internal security leadership positions that ensure alignment between the company's information security program and company objectives.


text: Overseeing enterprise-wide risk management is our Risk Management Committee, chaired by our General Counsel and comprised of key members of our executive management team, including the CISO. The Risk Management Committee meets regularly and plays a core role in the identification, monitoring, mitigation, and management of the risks the Company faces and oversees our enterprise risk management framework, including cybersecurity and data protection/privacy.


text: Through this dynamic risk assessment and governance process, the Risk Management Committee and Board consistently evaluate the risk environment and adjust the Company's risk profile, including cybersecurity and data privacy risks, and focus as needed to respond to industry and macroeconomic changes and to protect the Company.


text: Protection is ensured through weekly oversight from the CEO and Accounting Supervisor and quarterly oversight from the Board of Directors.

companyName: BrewBilt Brewing Co


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: iHeartMedia, Inc.

ticker: IHRT


text: We design and assess our program based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for certain service providers, suppliers, and vendors.


text: The Company (or third parties it relies on) may not be able to fully, continuously, and effectively implement security controls as intended. We utilize a risk-based approach and judgment to determine and prioritize the security controls and measures utilized. In addition, security controls and measures, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board of Directors (the "Board") considers cybersecurity risk as part of its risk oversight function and has delegated to the Board's Audit Committee (the "Audit Committee") oversight of information security matters and risks, including reviewing information technology procedures and controls. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives annual reports from management on information security matters, including our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer ("CISO"), internal security staff and/or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our CISO, Chief Financial Officer, and General Counsel, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes a combined 30 years of experience in cybersecurity and risk management. Our CISO holds the CRISC, CISA, CDPSE, and PMP industry certifications.


text: Our management team supervises efforts to identify, prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: The Board and the Audit Committee receive updates from management at least annually on information security matters, including our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: We maintain a cybersecurity program designed to protect our information, and that of our customers, suppliers and other third parties we engage with, against cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: FORUM ENERGY TECHNOLOGIES, INC.

ticker: FET


text: Board of Directors Our board of directors has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives reports and presentations from members of our team responsible for overseeing the Company's cybersecurity risk management, including senior members of our IT, Finance and Accounting, and Legal teams. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Audit Committee.


text: The executive management team, including our Chief Executive Officer, Chief Financial Officer and General Counsel, receives periodic reports from the IT Director regarding cybersecurity objectives and risk management measures being implemented by the Company and discusses these updates to identify and mitigate data protection and cybersecurity risks. The cybersecurity objectives established by the IT Director are based on industry best practices and are designed to further develop the security IT infrastructure.


text: Our IT Director has cybersecurity knowledge and skills gained from over 15 years of information technology experience at the Company and elsewhere. Under his supervision, the IT Department, with the advice of outside consultants, is responsible for developing, implementing, monitoring and maintaining cybersecurity and data protection practices across our business and reports directly to the Company's Vice President of Operations. The IT Director receives regular reports on cybersecurity threats from the internal cybersecurity team and reviews risk management measures designed and implemented by the Company to identify and mitigate data protection and cybersecurity threats. Our IT Director works with the General Counsel and other members of the Legal Department to oversee compliance with legal, regulatory and contractual security requirements. The IT Director also periodically attends the Board's Audit Committee meetings to report on developments impacting the IT Department and discuss annual cybersecurity goals and initiatives.


text: Internal Cybersecurity Team Our internal cybersecurity team is responsible for the development, implementation, monitoring, and maintenance of the cybersecurity and data protection practices across the Company. Reporting to our IT Director are experienced personnel with training to assist with managing cybersecurity objectives and to implement related policies and tools. Our internal cybersecurity team includes a manager who is a Certified Information Systems Security Professional and Systems Security Certified Practitioner. Also, the internal cybersecurity team conducts periodic security awareness training for employees. In addition to our internal cybersecurity capabilities, we also regularly engage consultants to assist with assessing, identifying, and managing cybersecurity risks and optimize infrastructure.


text: Risk Management and Strategy Assessing, identifying and managing cybersecurity risks are integral to our enterprise risk management activities. Our cybersecurity program leverages people, processes, and technology to timely identify and respond to cybersecurity threats. The Company has access control systems to limit physical and virtual access into our system to authorized users. In addition, we utilize services and software from third-party providers to monitor the Company's network and obtain expeditious alerts of anomalous activity. The Company takes a risk-based approach to manage cybersecurity risks and reviews third-party reports to oversee and identify cybersecurity threats. The Company maintains cybersecurity insurance to defray costs associated with an information security incident.


text: Security Policy and Requirements The Company has information security policies to (i) protect information processed and stored by the Company in accordance with applicable laws; (ii) protect the Company's information from current and emerging threats to computing systems and the energy industry in particular; and (iii) establish appropriate levels of protection for the Company's information systems. The IT Department is responsible for designing and implementing information system controls, procedures and solutions to accomplish the Company's cybersecurity and data protection objectives. The executive management team, including our Chief Executive Officer, Chief Financial Officer and General Counsel, is responsible for (i) approving and reviewing any changes to the policies; (ii) ensuring necessary resources; (iii) defining information that is considered strategically important; (iv) reviewing and approving information security objectives on annual basis; and (v) driving continued improvement and communicate importance of information security to the organization. All Company employees, contractors, managers and partners are responsible for (i) following applicable information security controls and (ii) reporting violations of controls or suspicious incidents to their business manager or directly to the IT Department. We are regularly audited by certain customers to assess the adequacy of our cybersecurity controls.


text: Incident Response We have implemented a Cybersecurity Incident Response Plan that applies in the event of a cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to cybersecurity incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process follows the National Institute of Standards and Technology framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all Company personnel, including third-party contractors, vendors and partners, that perform functions or services require access to secure Company information, and to all devices and network services that are owned or managed by the Company.


text: Material Cybersecurity Risks, Threats and Incidents Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents.


text: While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful threats or incidents.


text: We also rely on information technology and third party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continuously improve our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems. Cybersecurity incidents may lead to reputational harm, revenue and client loss, legal actions, and statutory penalties, among other consequences. Additional information on cybersecurity risks we face are discussed in Item 1A "Risk Factors," which should be read in conjunction with the foregoing information.


text: Board of Directors Our board of directors has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives reports and presentations from members of our team responsible for overseeing the Company's cybersecurity risk management, including senior members of our IT, Finance and Accounting, and Legal teams. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Audit Committee and/or Board.


text: Our IT Director has cybersecurity knowledge and skills gained from over 15 years of information technology experience at the Company and elsewhere. Under his supervision, the IT Department, with the advice of outside consultants, is responsible for developing, implementing, monitoring and maintaining cybersecurity and data protection practices across our business and reports directly to the Company's Vice President of Operations. The IT Director receives regular reports on cybersecurity threats from the internal cybersecurity team and reviews risk management measures designed and implemented by the Company to identify and mitigate data protection and cybersecurity threats. Our IT Director works with the General Counsel and other members of the Legal Department to ensure compliance with legal, regulatory and contractual security requirements. The IT Director also periodically attends the Board's Audit Committee meetings to report on developments impacting the IT Department and discuss annual cybersecurity goals and initiatives.


text: Internal Cybersecurity Team Our internal cybersecurity team is responsible for the development, implementation, monitoring, and maintenance of the cybersecurity and data protection practices across the Company. Reporting to our IT Director are experienced personnel who assist with managing cybersecurity objectives and to implement related policies and tools. Also, the internal cybersecurity team conducts periodic security awareness training for employees. In addition to our internal cybersecurity capabilities, we also regularly engage consultants to assist with assessing, identifying, and managing cybersecurity risks and optimize infrastructure.


text: Risk Management and Strategy Assessing, identifying and managing cybersecurity risks are integral to our enterprise risk management activities. Our cybersecurity program leverages people, processes, and technology to timely identify and respond to cybersecurity threats. The Company has access control systems to limit physical and virtual access into our system to authorized users. In addition, we utilize services and software from third-party providers to monitor the Company's network and obtain expeditious alerts of anomalous activity. The Company takes a risk-based approach to manage cybersecurity risks and reviews third-party reports to oversee and identify cybersecurity threats. The Company maintains cybersecurity insurance to defray costs associated with a cybersecurity incident.


text: Security Policy and Requirements The Company has information security policies to (i) protect information processed and stored by the Company in accordance with applicable laws; (ii) protect the Company's information from current and emerging threats to computing systems and the energy industry in particular; and (iii) establish appropriate levels of protection for the Company's information systems. The IT Department is responsible for designing and implementing information system controls, procedures and solutions to accomplish the Company's cybersecurity and data protection objectives. The executive management team, including our Chief Executive Officer, Chief Financial Officer and General Counsel, is responsible for (i) approving and reviewing any changes to the policies; (ii) ensuring necessary resources; (iii) defining information that is considered strategically important; (iv) reviewing and approving information security objectives on annual basis; and (v) driving continued improvement and communicating the importance of information security to the organization. All Company employees, contractors, managers and partners are responsible for (i) following applicable information security controls and (ii) reporting violations of controls or suspicious incidents to their business manager or directly to the IT Department. We are regularly audited by certain customers to assess the adequacy of our cybersecurity controls.


text: Incident Response We have implemented a Cybersecurity Incident Response Plan (the "IRP") that applies in the event of a cybersecurity incident to provide a standardized framework for responses. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process follows the National Institute of Standards and Technology framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all Company personnel, including third-party contractors, vendors and partners, that perform functions or services require access to secure Company information, and to all devices and network services that are owned or managed by the Company.


text: Risk Management and Strategy As is the case for other companies in our industry, we may be the target of cyberattacks and other cyber incidents and, therefore, cybersecurity is an important element of our overall enterprise risk management, or ERM, program. Our management performs a semi-annual assessment of enterprise-wide risks to help assess, identify, and manage existing and emerging risks for our company, including cybersecurity risks. Through our ERM program we assess the characteristics and circumstances of the evolving business environment at the time and seek to identify the potential impacts to our company of a particular risk.

companyName: Dare Bioscience, Inc.

ticker: DARE


text: Primary responsibility for assessing, identifying, and managing our cybersecurity risks rests with our management. To assist our management with such responsibility, we engage and consult with an external third party information technology consultant who reports to our Chief Accounting Officer. We also perform an annual cybersecurity assessment designed to help improve the systems and processes we have implemented designed to safeguard our information assets and operational integrity from cyber threats, protect employee information from unauthorized access or attack, as well as secure our networks and systems. Network and information systems and other technologies, including those related to our network management, are important to our business activities. As a result, we have multiple layers of security designed to detect and deter cybersecurity incidents. As part of our overall ERM program, we monitor and test our safeguards and train our employees on these safeguards, in certain instances with the assistance of our external third party information technology consultant. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings. We also maintain an incident response plan designed to respond to, mitigate and remediate cybersecurity incidents according to a defined set of severity ratings based on the potential impact to our business, information technology systems, network or data, including data held or information technology services provided by third-party vendors or other service providers.


text: As of the date of filing this report, we do not believe there are any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Our board of directors administers its cybersecurity risk oversight function through its audit committee. The audit committee is responsible for overseeing our policies, practices and assessments with respect to cybersecurity, and provides periodic updates to our board of directors. The audit committee receives periodic updates from management and our external third party information technology consultant regarding the effectiveness of the systems and processes we have implemented designed to safeguard our information assets and operational integrity from cyber threats, protect employee information from unauthorized access or attack, as well as secure our networks and systems, and regarding other cybersecurity matters, including the results from cybersecurity systems testing and any recent cybersecurity incidents and related responses. Our audit committee is also notified between such updates as soon as practicable regarding significant new cybersecurity threats or incidents. The audit committee also receives a report on cybersecurity matters and related risk exposures at least semi-annually from our Chief Accounting Officer. Many of our board members have achieved the National Association of Corporate Directors Carnegie Mellon University CERT Certification in Cybersecurity Oversight.


text: Our board of directors administers its cybersecurity risk oversight function through its audit committee. The audit committee is responsible for overseeing our policies, practices and assessments with respect to cybersecurity, and provides periodic updates to our board of directors. The audit committee receives periodic updates from management and our external third party information technology consultant regarding the effectiveness of the systems and processes we have implemented designed to safeguard our information assets and operational integrity from cyber threats, protect employee information from unauthorized access or attack, as well as secure our networks and systems, and regarding other cybersecurity matters, including the results from cybersecurity systems testing and any recent cybersecurity incidents and related responses. Our audit committee is also notified between such updates as soon as practicable regarding significant new cybersecurity threats or incidents. The audit committee also receives a report on cybersecurity matters and related risk exposures at least semi-annually from our Chief Accounting Officer. The chair of our audit committee has a National Association of Corporate Directors Carnegie Mellon University CERT Certification in Cybersecurity Oversight.


text: We have a dedicated team of information security professionals who leads our enterprise-wide cyber security strategy, risk management, cyber defense, software security, security monitoring and other related functions. This team is overseen by our Chief Information Security Officer ("CISO"), who reports to our Chief Technology Officer ("CTO"). The CISO has extensive background in that role at an enterprise level and has over 20 years of experience in the field of cybersecurity. Additionally, the processes overseen by our global information security team are integrated with our enterprise risk management program, including routine reporting on cyber risk through the different levels of the enterprise risk management governance structure and alignment on risk management frameworks and processes.

companyName: CDW Corp

ticker: CDW


text: Our information security management program is ISO 27001 certified, and we undergo routine audits by an independent, certified accreditation body to maintain this certification. Our program is designed to guide our practices which are based on relevant industry frameworks and laws. This program consists of policies, practices and procedures designed to manage material risks from cybersecurity threats, including training requirements, threat monitoring and detection and threat containment and risk assessments. Additionally, we leverage third-party firms to conduct routine external and internal penetration testing to emulate the common tactics and techniques of cyber threat actors and have processes to address identified vulnerabilities, although it may take time to mitigate or manage such vulnerabilities. We also have policies and procedures to oversee and identify the cybersecurity risks associated with our use of third-party service providers for both internal use and external use. These policies and procedures include onboarding risk assessments prior to engagement and, as appropriate based on identified risk, may include cybersecurity-related contractual terms and periodic risk assessments throughout the life cycle of the third-party relationship. Lastly, we maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business to cover certain costs related to cybersecurity incidents. We refine our cybersecurity program by staying informed on security threats, leveraging third-party cybersecurity firms and investing in enhancements to our preventive and defensive capabilities. In addition to our policies and procedures to manage and identify cybersecurity risks, we have an incident response plan designed to analyze, contain, remediate and communicate cybersecurity matters to help ensure a timely and robust response to actual or attempted incidents. As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, we cannot provide assurance that these threats will not result in such an impact in the future. For more information regarding risks relating to information technology and cybersecurity, see "Item 1A. Risk Factors."


text: The Audit Committee is primarily responsible for overseeing our enterprise risk management process on behalf of the Board of Directors, including cybersecurity risks. The CTO and CISO regularly provide reporting on cybersecurity matters to both senior management and the Audit Committee and at least annually to the Board of Directors. This reporting includes updates on our information security strategy, key cyber risks and threats and our progress towards protecting the Company from such risks and threats, assessments of our cybersecurity program and emerging trends. Depending on the criticality of a cybersecurity incident, certain matters are required to be reported promptly to the Board of Directors, as appropriate, in accordance with our incident response plan.


text: Our corporate information security management program is ISO 27001 certified, and we undergo routine audits by an independent, certified accreditation body to maintain this certification. Our program is designed to guide our practices which are based on relevant industry frameworks and laws. This program consists of policies, practices and procedures designed to manage material risks from cybersecurity threats, including training requirements, threat monitoring and detection and threat containment and risk assessments. Additionally, we leverage third-party firms to conduct routine external and internal penetration testing to emulate the common tactics and techniques of cyber threat actors and have processes to address identified vulnerabilities, although it may take time to mitigate or manage such vulnerabilities. We also have policies and procedures to oversee and identify the cybersecurity risks associated with our use of third-party service providers for both internal use and external use. These policies and procedures include onboarding risk assessments prior to engagement and, as appropriate based on identified risk, may include cybersecurity-related contractual terms and periodic risk assessments throughout the life cycle of the third-party relationship. Lastly, we maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business to cover certain costs related to cybersecurity incidents. We refine our cybersecurity program by staying informed on security threats, leveraging third-party cybersecurity firms and investing in enhancements to our preventive and defensive capabilities. In addition to our policies and procedures to manage and identify cybersecurity risks, we have an incident response plan designed to analyze, contain, remediate and communicate cybersecurity matters to help ensure a timely and robust response to actual or attempted incidents. As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, we cannot provide assurance that these threats will not result in such an impact in the future. For more information regarding risks relating to information technology and cybersecurity, see "Item 1A. Risk Factors."


text: The Audit Committee is primarily responsible for overseeing our enterprise risk management process on behalf of the Board of Directors, including cybersecurity risks. The CTO and CISO regularly provide reporting on cybersecurity matters to both senior management and the Audit Committee and at least annually to the Board of Directors. This reporting includes updates on our information security strategy, key cyber risks and threats, our progress towards protecting the Company from such risks and threats, assessments of our cybersecurity program and emerging trends. Depending on the criticality of a cybersecurity incident, certain matters are required to be reported promptly to the Board of Directors, as appropriate, in accordance with our incident response plan.


text: Risk Management and Strategy We have implemented and maintain a robust cybersecurity program to safeguard our information systems and protect the confidentiality, integrity and availability of our data.

companyName: Orion Group Holdings Inc

ticker: ORN


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader enterprise risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our information technology ("IT") department continuously evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs.


text: Cybersecurity Insurance Coverage Our internal cybersecurity risk management processes are supported by cybersecurity insurance that we have secured through industry leading underwriters. We believe that our cybersecurity insurance provides sufficient coverage to protect our assets, operations, and our employees from the financial impact of any cyber-attacks.


text: Engage Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity insurers, assessors, consultants and auditors in evaluating and assessing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third parties includes regular audits, threat assessments and consultation on security enhancements.


text: The Board's Role in Overseeing Cybersecurity Risk The Board of Directors is acutely aware of the critical nature of managing cybersecurity risks. Given the potential significance of cybersecurity threats to our operational integrity and stakeholder confidence, the Board has established robust oversight mechanisms to ensure effective governance in managing our cybersecurity risks. The Board is comprised of directors with diverse backgrounds and expertise, including risk management, technology and finance equipping them to oversee cybersecurity risks effectively. In addition to our scheduled Board meetings, the Board, Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), and Vice-President of Information Technology ("VPIT") maintain an ongoing dialogue regarding emerging or potential cybersecurity risks, ensuring the Board's oversight is proactive and responsive. The Board actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives. The Board conducts an annual review of our cybersecurity program and the effectiveness of our applicable risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of our cybersecurity efforts with our overall risk management framework.


text: Management's Role in Managing Cybersecurity Risk Our CEO, CFO, and VPIT play a pivotal role in informing the Board regarding cybersecurity risks. They provide an annual comprehensive briefing to the Board, as well as interim updates throughout the year, as needed. The VPIT holds a Certified Information Systems Security Professional certification and an Engineering degree from Queen's University in Canada, and he has over twenty years of experience in cybersecurity. Our executive leadership team (composed of our CEO, CFO, and other senior officers representing functional and business areas) has ultimate management responsibility for our cybersecurity program. The executive leadership team meets regularly to discuss our strategy, opportunities and risks, including our risk management measures used to identify and mitigate cybersecurity threats.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the VPIT. Our VPIT oversees our governance programs, tests our compliance with standards, remediates known risks and leads our employee training program. Reporting to our VPIT are a number of experienced information security officers responsible for various parts of our business, each of whom is supported by a team of trained cybersecurity professionals.


text: Monitoring Cybersecurity Incidents The VPIT stays informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation and remediation of cybersecurity incidents. The VPIT implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the VPIT is equipped with a well-defined, robust incident response plan. This plan includes immediate actions to mitigate the impact, report the incident, if required, and develop and implement long-term strategies for the remediation and prevention of future incidents.


text: Material Cybersecurity Incidents We are not aware of any cybersecurity incidents that have materially impaired our operations or financial reporting responsibilities or performance historically.


text: Internal Communication of Cybersecurity Matters The VPIT regularly informs the executive leadership team of cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks we face. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board on a timely basis, ensuring that the Board has comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: External Reporting of Cybersecurity Matters We have adopted protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated and, where appropriate, reported promptly to the public. We have empowered a cross-functional team of management to determine whether established reporting thresholds have been met and whether public disclosure is necessary or required.


text: Visa's Approach to Cybersecurity As a global company providing payment services to consumers and companies around the world, trust is an indispensable asset. A strong cybersecurity program is a key element to maintaining this trust. As a result, we consider cybersecurity risk one of our key enterprise risks and we assess, identify, and manage such risk as part of our overall enterprise risk management framework. See Item 1A for further discussion on our overall risk factors, including technology and cybersecurity risks.

companyName: VISA INC.

ticker: V


text: Cybersecurity Program Visa's cybersecurity program has been established to identify, analyze, mitigate, monitor, and govern cybersecurity risk and was designed around widely accepted international standards, such as ISO 27002 and the Payment Card Industry Data Security Standards, as well as applicable legal and regulatory requirements. We implement our cybersecurity program primarily through our Key Controls, which define the requirements for the protection of Visa information and technology assets. All employees must complete annual training on our Key Controls and are required to comply with the requirements. Exceptions to the Key Controls must be approved by an established senior management working group, which is overseen by our Corporate Risk Committee (CRC), the management committee responsible for overseeing Visa's cybersecurity program and other operational risks. The Key Controls are updated and reviewed annually by our Cybersecurity Governance, Risk and Compliance team and approved by management committees to ensure they continue to address evolving cybersecurity threats and associated legal and regulatory obligations.


text: As part of our overall business strategy, we have acquired a number of companies for which our full cybersecurity standards may not be appropriate. These designated entities may deliver products and services using systems which are not fully integrated with our standard technology platforms or hosted in our data centers. We have established a separate set of Key Controls for designated entities appropriate to their size and operations that are designed around the same widely accepted international standards noted above, but tailored to the operational reality and business needs of these entities. Regular reporting of our acquired entities' cybersecurity program is provided to our Chief Information Security Officer (CISO), President of Technology, management committees and the board of directors. For additional information about our structural and organizational risks, see Item 1A of this report.


text: Incident Response Plans Visa's global cyber security incident response team provides monitoring of Visa networks and digital assets across three cyber fusion centers in the U.S., United Kingdom, and Singapore. In addition, Visa's threat intelligence and research teams monitor commercial and government intelligence sources for new and emerging threats. Our cybersecurity awareness team regularly publishes and shares information with Visa employees on emerging threats, such as deepfake and generative AI-powered social engineering schemes.


text: To address significant cybersecurity incidents and other crisis events, we maintain a business incident response plan, which identifies key stakeholders, defines escalation processes, and sets the thresholds above which our cybersecurity, legal, and crisis management teams will inform management's Executive and Disclosure Committees as well as when the CEO and his designee will inform the board of directors of an incident. For cybersecurity incidents below these crisis thresholds, we maintain subordinate incident response plans and standard operating procedures used by our security incident response team. Like many companies, we, and some third parties on which we rely periodically experience cybersecurity incidents. However, as of September 30, 2024, we were not aware of any direct or third-party cybersecurity incidents in the past three fiscal years that have materially affected our business strategy, results of operations, or financial condition.


text: Internal and External Testing We proactively manage our cybersecurity risk by continually seeking to identify and mitigate potential cybersecurity threats to and vulnerabilities in our information and technology assets, with both internal and external assessments, as appropriate. For example, public-facing technology assets are subject to both internal security assessments and external security researcher testing under our vulnerability disclosure and bug bounty programs. Identified threats and vulnerabilities are required to be remediated within stringent timelines, for which compliance and exceptions are tracked in reporting to management and the board of directors.


text: As further discussed in our risk factors in Item IA of this report, our cybersecurity policies and controls may not be implemented or followed appropriately to mitigate all of our risks. We employ three lines of defense designed to address this risk. The first line of defense consists of the technology teams who develop, build, and deploy our products and services. These teams are trained on and accountable for following our Key Controls. The second line of defense includes separate internal security and risk teams that conduct security assessments of our networks and products, overseeing the remediation of any findings. Finally, our independent internal audit function operates as the third line of defense, assessing the effectiveness of our policies and controls and implementation thereof. We are also subject to regular, detailed examinations by financial regulators and external auditors which often contain a significant cybersecurity component.


text: Third-party Risk Management We also apply this same overall framework to our oversight and management of cybersecurity risk from service providers, vendors, suppliers, and other third parties. Our policies require due diligence on our service providers, vendors and suppliers prior to engagement and impose audit rights in our contracts in order to identify cybersecurity risks associated with third-party relationships, proportionate to the inherent risk associated with the products and services provided and the criticality and sensitivity of our information and technology assets to which the third party may have access. As noted in our risk factors in Item IA of this report, our third-party risk management framework may not be implemented effectively or may not be successful or sufficient to mitigate all of our risks. When we become aware that a service provider, vendor, supplier, or other third party has experienced any compromise or failure in the cybersecurity infrastructure owned or controlled by such third party, we may attempt to mitigate our risk, including by terminating such third party's connection to our information and technology assets where appropriate.


text: Management's Role and Responsibilities Our CISO is responsible for day-to-day management and oversight of our information security program and leads our cybersecurity organization, which comprises approximately 1,000 professionals globally as of September 30, 2024. Our CISO and President of Technology receive regular reports from our cybersecurity personnel in connection with monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO reports directly to our President of Technology and provides quarterly reports on our cybersecurity performance to the CRC.


text: Our current CISO has over 30 years of industry experience leading enterprise cybersecurity teams and enabling secure and scalable ecommerce and payment platforms at multiple Fortune 500 companies. Since joining Visa in November 2015, he has been a core part of building Visa's Zero Trust Architecture and advancing VisaNet's cybersecurity defense capabilities. Our current President of Technology joined Visa in November 2013 and has over 30 years of experience in leading the development and deployment of commerce and transaction technologies, which includes overseeing cybersecurity risk and transformational technology initiatives. At Visa, our President of Technology is responsible for the Company's technology innovation and investment strategy, product engineering, cybersecurity, global IT, and operations infrastructure, and for accelerating the integration of engineering and product teams.


text: Board Governance Visa's board of directors exercises oversight and control of Visa's overall enterprise risk management framework and delegates oversight and control of Visa's cybersecurity program to our audit and risk committee (ARC), which is responsible for ensuring that management has risk-based processes in place designed to assess, identify, and manage cybersecurity risks to which Visa is exposed. As noted in Item 1A, however, these processes may not be sufficient to mitigate all cybersecurity risks. Our CISO provides an update on our cybersecurity program to the ARC twice per year and to the full board of directors annually. The updates to the ARC and the full board of directors provide an overview of our cybersecurity performance, progress against goals, cybersecurity threat landscape, and other relevant developments.


text: Incident Response Plans Visa's global cybersecurity incident response team provides monitoring of Visa systems and digital assets from three cyber fusion centers in the U.S., United Kingdom, and Singapore. In addition, Visa's threat intelligence and research teams monitor commercial and government intelligence sources for new and emerging threats. Our cybersecurity awareness team regularly publishes and shares information with Visa employees on emerging threats, such as deepfake and GenAI-powered social engineering schemes.


text: To address significant cybersecurity incidents and other crisis events, we maintain a business incident response plan, which identifies key stakeholders, defines escalation processes, and sets the thresholds above which our cybersecurity, legal, and crisis management teams will inform management's Executive and Disclosure Committees as well as when the CEO and his designee will inform the board of directors of an incident. For cybersecurity incidents below these crisis thresholds, we maintain subordinate incident response plans and standard operating procedures used by our security incident response team. Like many companies, we, and some third parties on which we rely periodically experience cybersecurity incidents. However, as of September 30, 2025, we were not aware of any direct or third-party cybersecurity incidents in the past three fiscal years that have materially affected our business strategy, results of operations, or financial condition.


text: Third-party Risk Management We also apply this same overall framework to our oversight and management of cybersecurity risk from service providers, vendors, suppliers, and other third parties. Our policies require due diligence on our service providers, vendors and suppliers prior to engagement and impose audit rights in our contracts in order to identify cybersecurity risks associated with third-party relationships, proportionate to the inherent risk associated with the products and services provided and the criticality and sensitivity of our information and technology assets to which the third party may have access. As noted in our risk factors in Item IA of this report, our third-party risk management framework may not be implemented effectively or may not be successful or sufficient to mitigate all of our risks. When we become aware that a service provider, vendor, supplier, or other third party has experienced any compromise or failure in the technology infrastructure owned or controlled by such third party, we may attempt to mitigate our risk, including by terminating such third party's connection to our information and technology assets where appropriate. We also regularly and proactively engage relevant vendors and other third parties to assess risk to Visa information assets when a new vulnerability or compromise is reported that may affect those third parties.


text: Management's Role and Responsibilities Our CISO is responsible for day-to-day management and oversight of our information security program and leads our cybersecurity organization, which comprises approximately 1,000 professionals globally as of September 30, 2025. Our CISO and President of Technology receive regular reports from our cybersecurity personnel in connection with monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO reports directly to our President of Technology and provides quarterly reports on our cybersecurity performance to the CRC.


text: Our current CISO has over 30 years of industry experience leading enterprise cybersecurity teams and enabling secure and scalable ecommerce and payment platforms at multiple Fortune 500 companies. Since joining Visa in November 2015, he has been a core part of building Visa's Zero Trust Architecture and advancing VisaNet's cybersecurity defense capabilities. Our current President of Technology joined Visa in November 2013 and has over 30 years of experience in leading the development, deployment and operations of broad technology platforms including commerce and transaction technologies, which includes overseeing cybersecurity risk and transformational technology initiatives. At Visa, our President of Technology is responsible for the Company's technology innovation and investment strategy, product engineering, cybersecurity, global IT, and operations infrastructure, and for accelerating the integration of engineering and product teams.


text: Cybersecurity Risk Management, Strategy, and Governance The Company recognizes that the security of our banking operations is critical to protecting our customers and maintaining our reputation. The cybersecurity landscape is constantly evolving. To mitigate these risks, the Company deploys a comprehensive and resilient information security program that consists of a layered security model using industry leading hardware, software, and services to protect customers' and the Bank's data and to ensure the confidentiality, integrity, and availability of our information systems. This information security program is a critical component of our overall enterprise risk management program.

companyName: Bank of Marin Bancorp

ticker: BMRC


text: The Company leverages the following guidelines and frameworks to continue to refine and maintain the information security program: FFIEC Information Security IT Examination Handbook, FFIEC Business Continuity Planning Handbook, FFIEC Cybersecurity Assessment Tool, Center for Internet Security Critical Security Controls, National Institute of Standards and Technology (NIST) Cybersecurity Framework.


text: Key components of the information security program include: • A risk assessment process that identifies and prioritizes material cybersecurity risks; refines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the Board of Directors. • A third-party Managed Detection and Response ("MDR") service, which monitors the security of our network, infrastructure and computer systems 24x7, 365 days a year. • An incident response plan that outlines the steps the Bank will take to respond to a cybersecurity incident, which is tested on a periodic basis. • Annual recurring cybersecurity controls testing program, which includes independent third-party penetration testing, cybersecurity procedures and system testing, and third-party independent network traffic monitoring. • A training and awareness program that educates and tests employees on how to avoid and identify cybersecurity risks. • A Cyber Security Insurance Policy that covers insurance, incident response, incident mitigation, and legal support.