text: We conduct risk assessments at least annually to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls and other safeguards we have put in place to manage such risks. Our risk management process also encompasses cybersecurity risks associated with the use of our major third-party vendors and service providers.


text: Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. We believe we have allocated adequate resources related to our cybersecurity risk management processes and have designated our Chief Executive Officer responsible with the responsibility of managing the cybersecurity risk assessment and mitigation process.

companyName: Enertopia Corp.

ticker: ENRT

secItem: Item 1C


text: As part of our overall risk management program, we provide required training to consultants and employees in high risk areas on cybersecurity. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Our internal computer systems, or those of our contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our technology development programs," "Our proprietary information, or that of our customers, suppliers and business partners, may be lost or we may suffer security breaches," and "Failure of our information technology systems could significantly disrupt the operation of our business.


text: Disclosure of cybersecurity risk management, & strategy Management is responsible for the oversight and administration of cyber security protocols. Our strategy is to mitigate risks preventatively through cybersecurity strategies and preventative measures carried out by third-party providers. The Company regularly assesses, identifies, and manages these material risks in partnership with its third-party providers.

companyName: PISMO COAST VILLAGE INC


text: Our management team relies on our third-party providers to administer cybersecurity assessments and to identify, manage, mitigate, and respond to cybersecurity threats. Management of the cybersecurity environment also includes patch management, and a managed network, security, and 24/7 support. Management updates the Board as necessary, regarding any significant cybersecurity occurrences. Pismo Coast Village is not aware of any material cybersecurity incidents in the 2025 fiscal year.


text: Risk Management and Strategy Peabody uses digital technology to conduct its business operations and engage with its customers, vendors and partners. As the Company invests in technologies such as cloud, analytics, automation and artificial intelligence, it strives to provide the necessary controls to protect these digital assets from continuously evolving cybersecurity risks.

companyName: PEABODY ENERGY CORP

ticker: BTU


text: Peabody's cybersecurity strategy emphasizes reduction of cybersecurity risk exposure and continuous improvement of its controls and policies based on industry recognized best practices for cybersecurity and information technology, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). This strategy includes: (i) proactive management of cybersecurity risk to ensure compliance with contractual, legal and regulatory requirements; (ii) performing due diligence on third parties to ensure they have sound cybersecurity practices in place; (iii) ensuring essential business services remain available during a business disruption; (iv) annual cybersecurity assessments to include NIST CSF maturity assessments, penetration testing and red team assessments, as well as table top exercises with subsequent remediation of key findings; (v) participation in Information Sharing and Collaboration industry groups; (vi) maintaining an updated cybersecurity policy and incident response plan; (vii) exercising cyber incident response plans and risk mitigation strategies to address potential incidents should they occur; and (viii) annual cybersecurity awareness training for all employees and directors, including formal training and simulated phishing events.


text: Third-party experts are engaged to conduct NIST CSF maturity assessments, penetration testing assessments, periodic red team assessments and table top exercises. At a minimum, at least one of these assessments is conducted annually by a third-party expert. Peabody also engages a third-party expert to assess the risk of its business and operational vendors.


text: Peabody's enterprise risk management (ERM) framework considers cybersecurity risk alongside other company risks as part of the Company's overall risk assessment process. The ERM team collaborates with the Chief Information Security Officer (CISO), to gather insights for assessing, identifying and managing cybersecurity threat risks, their severity, and potential mitigations.


text: Peabody's Board of Directors maintains direct oversight over cybersecurity risks and oversees an enterprise-wide approach to risk management, designed to support the achievement of organizational objectives to enhance long-term performance and stockholder value. The Board, as a whole, and through its committees, is responsible for the oversight of risk management and Peabody's management is responsible for the day-to-day management of the risks the Company faces. Senior leadership, including Peabody's CISO, regularly briefs the Board on cybersecurity matters and the Board is informed of cybersecurity incidents deemed to have a moderate or higher business impact, even if such incidents are determined to be immaterial, on an ongoing basis.


text: Peabody's global cybersecurity department is responsible for overall cybersecurity strategy, policy, operations and cybersecurity incident response. Team members who support the Company's cybersecurity program invest in ongoing skills development including maintaining industry recognized certifications such as the ISC2 CISSP, GIAC GCIH, Comp TIA Security+, as well as platform specific certifications focused on Peabody's current cybersecurity infrastructure.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition While Peabody has experienced cybersecurity incidents in the past, to date none have materially affected the Company's business strategy, results of operations or financial condition. Peabody continues to invest in the cybersecurity and resiliency of its networks and to enhance its internal controls and processes, which are designed to help protect its systems and infrastructure, and the information they contain.


text: Peabody Energy Corporation For more information regarding the risks the Company faces from cybersecurity threats, refer to Item 1A. "Risk Factors."


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition While Peabody has experienced cybersecurity incidents in the past, to date none have materially affected the Company's business strategy, results of operations or financial condition. Peabody continues to invest in the cybersecurity and resiliency of its networks and to enhance its internal controls and processes, which are designed to help protect its systems and infrastructure, and the information they contain. For more information regarding the risks the Company faces from cybersecurity threats, refer to Item 1A. "Risk Factors."


text: Managing cybersecurity risk is critical to Centrus. Centrus expects that the complexity of cybersecurity incidents will continue to evolve. To assess the changing cyber environment, Centrus includes the evaluation of cybersecurity risk as part of its enterprise risk management process and provides periodic reporting to the Board. Assessed risks, whether general or specific to the Company, include operational risk, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy laws and other litigation and legal risk, and reputational risk. This process includes evaluating risks from cybersecurity threats associated with the Company's use of third-party service providers.

companyName: CENTRUS ENERGY CORP

ticker: LEU


text: To continually evaluate the sufficiency of Centrus' cybersecurity posture, Centrus aligns with the National Institute of Standards and Technology Cybersecurity Framework, has external experts complete assessments of Centrus' cybersecurity posture, completes internal self-assessments and engages with third-party experts for assistance in monitoring, deterring, detecting, and addressing potential breaches. The results of any internal or external assessment are reported to senior management and the Board.


text: Based on our monitoring and evaluations to date, including any previously identified cybersecurity incidents, there has not been, and there is not reasonably expected to be, a material effect on the Company's business strategy, results of operations or financial condition, as a result of risks from cybersecurity threats.


text: Centrus has policies, procedures, and strategies in place to assist in assessing and managing cybersecurity risks. To help safeguard the Company's network and information maintained on that network, the Company maintains and executes a cybersecurity program designed to monitor, prevent, detect, mitigate, and remediate cyberattacks.


text: The Board exercises its oversight of material risks from cybersecurity threats through the Board's Audit and Finance Committee and the Board's Technology, Competition and Regulatory Committee. The Chief Financial Officer has delegated the assessment and management of material risks from cybersecurity threats to the Cybersecurity Risk Committee which is comprised of members of senior management, including the Director, Information Technology. The Cybersecurity Risk Committee regularly provides those delegating oversight with updates on the Company's cybersecurity program which includes the current cybersecurity risk landscape and efforts employed to assist in preventing those risks, the Company's cybersecurity policies and practices, the ongoing efforts to improve security, as well as the Company's efforts regarding significant cybersecurity events. In addition, the Company maintains a cybersecurity incident response plan, which includes the Company's processes for monitoring, preventing, detecting, mitigating, remediating, and recovery from cybersecurity incidents that is updated regularly. Disclosure with regard to a cybersecurity incident will be considered by the Cybersecurity Risk Committee, with material issues raised with our Board.


text: To evaluate the sufficiency of Centrus' cybersecurity posture, Centrus aligns with the National Institute of Standards and Technology Cybersecurity Framework. We periodically (i) have external experts complete assessments of Centrus' cybersecurity posture, (ii) complete internal self-assessments and (iii) engage with third-party experts for assistance in monitoring, deterring, detecting, and addressing potential breaches. The results of any internal or external assessment are reported to senior management and the Board.


text: The Board exercises its oversight of material risks from cybersecurity threats through the Board's newly established Cyber Risk Committee. Per its charter, the Board's Cyber Risk Committee oversees the Company's cybersecurity policies, procedures, and plans, including the quality and effectiveness of the related security, confidentiality, availability, recoverability, integrity, and disaster or incident response programs. It coordinates with the Audit and Finance Committee and the Board's Technology, Competition and Regulatory Committee on cross disciplinary issues such as cybersecurity.


text: The Chief Financial Officer has delegated the assessment and management of material risks from cybersecurity threats to management's Cybersecurity Risk Committee which is comprised of members of senior management, including the Director, Information Technology. Management's Cybersecurity Risk Committee regularly provides those delegating oversight with updates on the Company's cybersecurity program which includes the current cybersecurity risk landscape and efforts employed to assist in preventing those risks, the Company's cybersecurity policies and practices, the ongoing efforts to improve security, as well as the Company's efforts regarding significant cybersecurity events. In addition, the Company maintains a cybersecurity incident response plan, which includes the Company's processes for monitoring, preventing, detecting, mitigating, remediating, and recovery from cybersecurity incidents that is updated regularly. Disclosure with regard to a cybersecurity incident will be considered by management's Cybersecurity Risk Committee, with material issues raised with our Board.


text: We have an enterprise-wide information security program designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools, and a bug bounty program to allow security researchers to assist us in identifying vulnerabilities in our products before they are exploited by malicious threat actors. We also maintain a third party security program to identify, prioritize, assess, mitigate and remediate third party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: NETFLIX INC

ticker: NFLX


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program and also leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, red team exercises, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We also engage an external auditor to conduct an annual payment card industry data security standard review of our security controls protecting payment information, as well as third-party penetration testing of our cardholder environment and related systems. The results of these assessments are reported to the Audit Committee.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property, and we have experienced an unauthorized release of certain digital content assets. However, to date these incidents have not had a material impact on our service, systems or business. Any significant disruption to our service or access to our systems could result in a loss of members and adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See "Risk Factors - Any significant disruption in or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized access, disclosure or destruction of data, including member and corporate information, or theft of intellectual property, including digital content assets, which could adversely impact our business."


text: The Vice President of Security and Privacy Engineering leads our global information security organization responsible for overseeing the Netflix information security program. Our VP of Security and Privacy Engineering has over 30 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at large technology companies. The teams provide regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings.


text: The Board oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. The Audit Committee of the Board oversees our cybersecurity risk and receives regular reports from our VP of Security and Privacy Engineering on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.


text: Our systems and those of third parties with which we do business have experienced and may continue to experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property, and we have experienced unauthorized releases of certain digital content assets and unintended disclosure of personal information due to incidents related to third parties. However, to date these incidents have not had a material impact on our service, systems or business. Any significant disruption to our service or access to our systems could result in a loss of members and adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See "Risk Factors - Any significant disruption in or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized access, disclosure or destruction of data, including member and corporate information, or theft of intellectual property, including digital content assets, which could adversely impact our business."


text: Our Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's operations and are based on recognized frameworks established by the International Organization for Standardization, the National Institute of Standards and Technology and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: LKQ CORP

ticker: LKQ


text: Risk Management and Strategy As one of the critical elements of the Company's overall risk management approach, the Company's cybersecurity program is focused on the following key areas:


text: Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which interacts with and receives cybersecurity information or reports from members of the Company's Risk Management Committee, the Company's Chief Information Security Officer ("CISO") and other members of management.


text: Collaborative Approach: The Company's Board and management have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made in a timely manner. The Company also purchases cybersecurity insurance to mitigate the financial risk associated with cybersecurity breaches.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including but not limited to secure web gateways, secure e-mail gateways, multi-factor authentication, endpoint detection and response, cloud security posture management, privileged access management, firewalls, intrusion detection/prevention systems, and web application firewalls.


text: Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are maintained, tested and evaluated on a regular basis.


text: Third-Party Risk Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's information security policies, standards, processes and practices.


text: The Company engages in the periodic assessment and testing of adherence to the Company's policies, standards, processes and practices that are designed to address cybersecurity risks, threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Risk Management Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Board, in coordination with the Audit Committee and the Risk Management Committee, which is comprised of senior management of the Company, oversees the Company's risk management process, including the management of risks arising from cybersecurity threats. The Board, Audit Committee and Risk Management Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board, Audit Committee and Risk Management Committee also receive prompt and timely information regarding any cybersecurity incident that meets materiality reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a quarterly basis, the CISO holds security risk meetings with LKQ's business segment leadership to highlight the security risk environment, policies, controls, and remedial actions planned to address risks or vulnerabilities. On an annual basis, the Board and the Company's Chief Information Officer ("CIO") and CISO discuss the Company's approach to cybersecurity risk management.


text: The CISO, in coordination with the Risk Management Committee, which includes, among others, our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), CIO and General Counsel ("GC"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and reports significant (including potentially material) threats and incidents to executive leadership.


text: The CISO has served in various roles in IT and information security for over 26 years, including serving as the Chief Information Security Officer of two large public companies. The CISO holds an undergraduate degree in computer science and a graduate degree in business and attained professional certification as a Certified Information System Security Professional ("CISSP"), Certified Information Security Manager ("CISM") and GIAC Certified Incident Handler ("GCIH"). The CIO holds an undergraduate degree in Economics and a master's degree in business administration, and has served in various roles in IT for over 25 years, including serving as the Chief Information Officer of three public companies. The Company's CEO, CFO and GC each hold undergraduate and graduate degrees in their respective fields, and each has experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition.


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's operations and are based on recognized frameworks established by the International Organization for Standardization, the National Institute of Standards and Technology and other industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects and stores and maintaining access to critical systems by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with the Company's Chief Information Security Officer ("CISO") and other members of management.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Third Party Risk Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third party systems.


text: Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats and best practices as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's information security policies, standards, processes and practices.


text: The Board, in coordination with the Risk Management Committee, oversees the Company's risk management process, including the management of risks arising from cybersecurity threats. The Board, Audit Committee and the Risk Management Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Risk Management Committee also receive prompt and timely information regarding any cybersecurity incident that meets or could potentially meet materiality reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Company's senior executives and CISO discuss the Company's approach to cybersecurity risk management.


text: The CISO, in coordination with the Risk Management Committee, which includes our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Senior Vice President of Policy and Administration, and General Counsel ("GC"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and reports significant (including potentially material) threats and incidents to executive leadership.


text: The CISO has served in various roles in IT and information security for over 27 years, including serving as the Chief Information Security Officer of two large public companies. The CISO holds an undergraduate degree in computer science and a graduate degree in business and attained professional certification as a Certified Information System Security Professional ("CISSP"), Certified Information Security Manager ("CISM") and GIAC Certified Incident Handler ("GCIH"). The Company's CEO, CFO, Senior Vice President of Policy and Administration, and GC each hold degrees in their respective fields, and each has experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: To date, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security incidents of these types, and we may not be able to implement effective preventive measures against such security incidents in a timely manner. See the risk factor titled "We rely on information technology and communication systems in critical areas of our operations and a disruption relating to such technology and systems, including cybersecurity threats, could harm our business." in Part I, Item 1A of this Annual Report on Form 10-K for further information.


text: utmost importance on the security of our systems and the data we handle. We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes.

companyName: YOUNEEQAI TECHNICAL SERVICES, INC.

ticker: YQAI


text: To identify and assess risks from cybersecurity threats, we evaluate a variety of developments including threat intelligence, vulnerabilities of third parties, including any auditors or consultants who advise on our cybersecurity systems, evolving regulatory requirements, and observed cybersecurity incidents, among others. We regularly conduct risk assessments to evaluate the maturity and effectiveness of our systems and processes in addressing cybersecurity threats and to identify any areas for remediation and opportunities for enhancements. The results of such assessments are evaluated by management and reported to our board of directors, and we continue to adjust our cybersecurity policies, standards, processes, and practices as necessary.


text: responsible for the oversight of risks from cybersecurity threats and directly oversees our cybersecurity policies and practices, internal controls regarding information security, and compliance with legal and regulatory requirements regarding cybersecurity risks. The Board receives regular reports and updates on cybersecurity matters from our management, including developments on existing and new cybersecurity risks and how management is addressing and/or mitigating such risks, cybersecurity and data privacy incidents (if any), the status of key information security initiatives, vulnerability assessments, as well as on existing and emerging threat landscapes. Additionally, on at least an annual basis, the Board reviews and discusses with management our policies and programs with respect to cybersecurity threats.


text: a dedicated security team, but our Chief Executive Officer monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in accordance with our incident response and recovery plans. Threats and incidents that are identified as potentially significant are promptly reported to the Board. Our dedicated CEO has over 10 years of experience in managing and monitoring cybersecurity.


text: from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.


text: See "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K for further information regarding cybersecurity risks.


text: utmost importance on the security of our systems and the data we will handle once BDTP TM is operational. We plan to implement a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes.

companyName: BLACKSTAR ENTERPRISE GROUP, INC.


text: To identify and assess risks from cybersecurity threats, we will evaluate a variety of developments including threat intelligence, vulnerabilities of third parties, including any auditors or consultants who advise on our cybersecurity systems, evolving regulatory requirements, and observed cybersecurity incidents, among others. We will regularly conduct risk assessments to evaluate the maturity and effectiveness of our systems and processes in addressing cybersecurity threats and to identify any areas for remediation and opportunities for enhancements. The results of such assessments will be evaluated by management and reported to our board of directors, and we will continue to adjust our cybersecurity policies, standards, processes, and practices as necessary.


text: a dedicated security team, but our Chief Executive Officer monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in accordance with our incident response and recovery plans. Threats and incidents that are identified as potentially significant are promptly reported to the Board.


text: Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents to date.

companyName: Saxon Capital Group, Inc./DE


text: We place the utmost importance on the security of our systems and the data we will handle once BDTP TM is operational. We plan to implement a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes.


text: Our Board is responsible for the oversight of risks from cybersecurity threats and directly oversees our cybersecurity policies and practices, internal controls regarding information security, and compliance with legal and regulatory requirements regarding cybersecurity risks. The Board receives regular reports and updates on cybersecurity matters from our management, including developments on existing and new cybersecurity risks and how management is addressing and/or mitigating such risks, cybersecurity and data privacy incidents (if any), the status of key information security initiatives, vulnerability assessments, as well as on existing and emerging threat landscapes. Additionally, on at least an annual basis, the Board reviews and discusses with management our policies and programs with respect to cybersecurity threats.


text: We do not have a dedicated security team, but our Chief Executive Officer monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in accordance with our incident response and recovery plans. Threats and incidents that are identified as potentially significant are promptly reported to the Board.


text: While risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. See "Risk Factors" in


text: Risk Management and Strategy We consider cybersecurity risk management, confidentiality and information security to be critical to our corporate visions and values. We employ a combination of people, technical safeguards and processes to manage these risks and protect information for which we are responsible. Our security program, policies, standards, processes, tools and talent are aligned with the purpose of preventing and mitigating any potential cybersecurity incidents and data leakage.

companyName: HEIDRICK & STRUGGLES INTERNATIONAL INC


text: We have a program in place designed to detect and respond to cybersecurity incidents. Our Chief Information Security Officer ("CISO") and the cybersecurity team are responsible for defining, implementing and administering appropriate measures to protect information across the Company. Cybersecurity risks are also identified and considered when conducting our annual Enterprise Risk Management ("ERM") exercise. Pursuant to our ERM program, material cybersecurity risks are identified, assigned to an individual owner with the organization, reviewed twice annually with the CISO, Chief Legal Officer and Corporate Secretary, and Chief Information Officer and tracked to evaluate containment and mitigation efforts on a go-forward basis. As further described below, management also reviews and discusses the ERM program with the Audit & Finance Committee ("AFC") of our Board of Directors ("Board"), as well as the full Board, at least annually.


text: Some key safeguards we have undertaken to assess, identify and manage material risks from cybersecurity threats include, but are not limited to: • Engaging an independent audit firm to conduct a System and Organization Controls ("SOC") 2 audit of the Company in 2023; • Designing information security policies based on the International Organization Standardization ("ISO") 27001 framework; • Maintaining well-documented processes to provide and remove access, for security incident response, for IT change control and for secure software development lifecycle; • Conducting regular system patching; • Conducting frequent, independent third-party vulnerability and penetration testing; • Providing access on a "need to know" basis applied with "least privilege" principle; • Requiring multi-factor authentication for system access; • Protecting the use of data centers with physical and environmental controls; • Encrypting data at rest and in transit; • Requiring regular, independent SOC 1 and/or SOC 2 audits for key SaaS providers; • Requiring third-parties to have information risk management processes; • Requiring regular security awareness training, including annual online security awareness training, for all users of our systems, which covers topics like phishing, social engineering, mobile and device security and protection of sensitive information; • Testing awareness by sending regular test phishing emails; • Monitoring security 24/7/365; and • Providing for system redundancy and resilience to help ensure business continuity.


text: We regularly engage third party service providers to assist with management of cybersecurity risks. For instance, as noted above, we engage third parties to conduct frequent, independent vulnerability and penetration testing of our systems. In addition, in 2023, we engaged Grant Thornton LLP to conduct a SOC 2 audit of our systems and controls. Further, our enterprise level IT general controls are audited annually by our independent registered public accounting firm.


text: We also monitor and oversee risks from cybersecurity threats associated with all third-party service providers that handle data or information for us. In connection with engaging any third-party service provider that will handle data or information for us, we review its internal controls, require that it fill out our security and/or privacy questionnaires and ensure there is appropriate contractual language regarding data privacy, security, and confidentiality. For example, we require all third-party service providers that handle personal data to sign data privacy addenda. We also annually audit compliance of those third-party service providers with these requirements, including through a review of their SOC 1 and/or SOC 2 audits, have them update our security and/or privacy questionnaires and, as appropriate, we conduct on-site audits for certain significant third-party service providers.


text: We face a number of cybersecurity risks in connection with our business. To date and to our knowledge, we have not experienced a material cybersecurity incident, and cybersecurity threats have not had a material impact on our business strategy, results of operations, or financial condition. However, we have, from time to time, experienced threats to and infringement of our data, policies and systems in the ordinary operation of our business. For more information about the cybersecurity risks we face, see the risk factors in Part I, Item 1A. Risk Factors entitled "Increased cybersecurity vulnerabilities, threats and more sophisticated and targeted cyber-related attacks could pose a risk to our systems, networks, solutions, services and data." and "We are dependent on third parties for the execution of certain critical functions and the failure or inability to perform on the part of one or more of these third parties could materially and adversely affect our reputation and our business.".


text: The AFC, comprised entirely of independent directors, assists the Board in its responsibilities of ensuring that the Company has established, documented and maintained, and periodically reevaluates, its processes with respect to cybersecurity. Our CISO briefs the AFC on cybersecurity matters, including on the evolving threat landscape and the Company's enhanced efforts in light of emerging risks, no less than twice per year, and in 2023, our CISO provided cybersecurity updates to the AFC two times during the course of the year. In addition to formal updates provided to the AFC, our CISO maintains regular communication throughout the year with members of the AFC on these issues. The chair of the AFC also briefs the full Board on cybersecurity matters discussed amongst the AFC. Furthermore, and as discussed above, cybersecurity risks are also reviewed and discussed with the AFC and the full Board as part of the annual ERM assessment.


text: Our CISO has experience managing a risk-based, effective, practical and appropriately-sized cybersecurity program that aligns with our strategic business objectives and leads our cybersecurity team, which is responsible for assessing and managing the Company's material risks from cybersecurity threats. Our CISO has 28 years of experience in the technology domain and 24 years of experience in information security. Our CISO is also a CISSP (Certified Information Systems Security Professional) and a CIPP/E (Certified Information Privacy Professional/Europe).


text: We have a specifically outlined incident response plan that documents the requirements of notification, classification, analysis and communication of security incidents, including cybersecurity incidents, based on the identified severity level. The CISO is informed of incidents at all severity levels pursuant to the incident response plan. The incident response plan also includes initial steps to convene the response team, contain the incident, consider insurance notification requirements, determine the type of incident and escalation, consider the communications protocol and consider involving law enforcement. In addition, the CISO is informed of potential cybersecurity incidents through the Company's IT incident response system, which contains security logs that are reviewed by the Company's 24/7/365 security operations center, and through the Company's enterprise incident response system, which involves both daily reports of potential issues and alerts that may be initiated by an employee or former employee of the Company.


text: Some key safeguards we have undertaken to assess, identify and manage material risks from cybersecurity threats include, but are not limited to: • Engaging an independent audit firm to conduct a System and Organization Controls ("SOC") 2 audit of the Company in 2024; • Designing information security policies based on the International Organization Standardization ("ISO") 27001 framework; • Maintaining well-documented processes to provide and remove access, for security incident response, for IT change control and for secure software development lifecycle; • Conducting regular system patching; • Conducting frequent, independent third-party vulnerability and penetration testing; • Providing access on a "need to know" basis applied with "least privilege" principle; • Requiring multi-factor authentication for system access; • Protecting the use of data centers with physical and environmental controls; • Encrypting data at rest and in transit; • Requiring regular, independent SOC 1 and/or SOC 2 audits for key SaaS providers; • Requiring third-parties to have information risk management processes; • Requiring regular security awareness training, including annual online security awareness training, for all users of our systems, which covers topics like phishing, social engineering, mobile and device security and protection of sensitive information; • Testing awareness by sending regular test phishing emails; • Monitoring security 24/7/365; and • Providing for system redundancy and resilience to help ensure business continuity.


text: We regularly engage third party service providers to assist with management of cybersecurity risks. For instance, as noted above, we engage third parties to conduct frequent, independent vulnerability and penetration testing of our systems. In addition, in 2023 and 2024, we engaged Grant Thornton LLP to conduct a SOC 2 audit of our systems and controls. Further, our enterprise level IT general controls are audited annually by our independent registered public accounting firm.


text: The AFC, comprised entirely of independent directors, assists the Board in its responsibilities of ensuring that the Company has established, documented and maintained, and periodically reevaluates, its processes with respect to cybersecurity. Our CISO briefs the AFC on cybersecurity matters, including on the evolving threat landscape and the Company's enhanced efforts in light of emerging risks, no less than twice per year, and in 2024, our CISO provided cybersecurity updates to the AFC two times during the course of the year. In addition to formal updates provided to the AFC, our CISO maintains regular communication throughout the year with members of the AFC on these issues. The chair of the AFC also briefs the full Board on cybersecurity matters discussed amongst the AFC. Furthermore, and as discussed above, cybersecurity risks are also reviewed and discussed with the AFC and the full Board as part of the annual ERM assessment.


text: Our CISO has experience managing a risk-based, effective, practical and appropriately-sized cybersecurity program that aligns with our strategic business objectives and leads our cybersecurity team, which is responsible for assessing and managing the Company's material risks from cybersecurity threats. Our CISO has 29 years of experience in the technology domain and 25 years of experience in information security. Our CISO is also a CISSP (Certified Information Systems Security Professional) and a CIPP/E (Certified Information Privacy Professional/Europe).


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the "Board"). The Board, Audit Committee, senior management and the Enterprise Risk Management Council (a taskforce comprised of senior representatives from primary corporate functions as well as senior representatives from field operations) devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our information technology (IT) security team reviews enterprise risk management-level cybersecurity risks annually, and key cybersecurity risks are incorporated into the Enterprise Risk Management Council's framework. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include an IT security manual as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.

companyName: UNITED RENTALS NORTH AMERICA INC


text: The Company's Chief Information Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. Our Chief Information Officer has over a decade of experience leading cyber security oversight, and others on our IT security team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete cybersecurity trainings at least once every three years and have access to more frequent cybersecurity trainings through online trainings. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings.


text: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also prepares a monthly cyber scorecard, regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment. Further, we conduct periodic external penetration tests, red team testing and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: The Audit Committee and the full Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. The Audit Committee performs an annual review of the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation. The Audit Committee's annual review also includes review of recent enhancements to the Company's defenses and management's progress on its cybersecurity strategic roadmap. In addition, the Board receives quarterly cybersecurity reports, which include a review of key performance indicators, test results and related remediation, and recent threats and how the Company is managing those threats. Further, at least annually, the Board receives updates on the Company's Crisis Management Plan, which covers, among other things, potential cybersecurity incidents, data privacy and its compliance programs. To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on these topics. For example, in 2022, the Board hosted an expert to discuss developments in the cybersecurity threat landscape and speakers who discussed digital, technology and innovation trends across industries.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. For more information about the cybersecurity risks we face, see the risk factor entitled "Disruptions in our information technology systems or a compromise of security with respect to our systems could adversely affect our operating results by limiting our ability to effectively monitor and control our operations, adjust to changing market conditions, implement strategic initiatives or support our online ordering system" in Item 1A- Risk Factors.


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the "Board"). The Board, Audit Committee, senior management and the Enterprise Risk Management Council (a taskforce comprised of senior representatives from primary corporate functions as well as senior representatives from field operations) devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") framework, which organizes cybersecurity risks into six categories: govern, identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our information technology ("IT") security team reviews enterprise risk management-level cybersecurity risks annually, and key cybersecurity risks are incorporated into the Enterprise Risk Management Council's framework. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include an IT security manual as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. In the event we identify a cybersecurity incident, we have defined procedures to respond to and remediate such incident. These policies and procedures go through an internal review process and are approved by appropriate members of management.


text: We have continued to expand investments in IT security to mitigate cybersecurity risks, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also prepares a monthly cyber scorecard, regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment. Further, we conduct periodic external penetration tests, red team testing and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: The Audit Committee and the full Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. The Audit Committee performs an annual review of the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation. The Audit Committee's annual review also includes review of recent enhancements to the Company's defenses and management's progress on its cybersecurity strategic roadmap. In addition, the Board receives quarterly cybersecurity reports, which include a review of key performance indicators, test results and related remediation, and recent threats and how the Company is managing those threats. Further, at least annually, the Board receives updates on the Company's Crisis Management Plan, which covers, among other things, potential cybersecurity incidents, data privacy and its compliance programs. To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on these topics. For example, in 2024, the Board hosted an expert to discuss developments in the cybersecurity threat landscape and current cybersecurity trends across industries.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. For more information about the cybersecurity risks we face, and how, if realized, those risks are reasonably likely to materially affect us, see the risk factor entitled "Our financial performance and our reputation could be adversely affected, and we could be subject to legal liability or regulatory enforcement actions, if we are unable to protect against, or effectively respond to, cyberattacks or other cyber incidents" in Item 1A- Risk Factors.


text: Management of cybersecurity risks is an integral part of our overall risk management framework. We have developed an information security program designed to assess, identify and manage material risks from cybersecurity threats, which is integrated into our overall risk management program and governance structure. The program includes policies and procedures that identify how security measures and controls drawn from relevant frameworks are developed, implemented and maintained. Our cybersecurity risk management program works to balance critical infrastructure, network, application, cloud and information security objectives with overall business objectives and risk tolerance. Specific controls that are used include endpoint threat detection and response, identity and access management, privileged access management, logging and monitoring involving the use of security information and event management, multi-factor authentication, firewalls, and intrusion detection and prevention, and vulnerability and patch management.

companyName: PARK OHIO INDUSTRIES INC/OH


text: We also use threat intelligence to inform our defensive measures. We use external and internal threat intelligence sources, including information from vendors and Information Sharing and Analysis Centers.


text: We have the following security processes in place: • Cybersecurity Awareness Trainings: We educate employees on best practices for online safety and for identifying potential cybersecurity threats, including by initiating quarterly training programs for our non-represented salaried workforce. • Simulated Cyberattacks: With assistance from third-party providers, we periodically conduct penetration and vulnerability testing to test our technical controls and incident response plans. • Security Monitoring: We monitor our information technology environment with both our internal cybersecurity resources and third-party service providers. We also have processes in place to monitor the cybersecurity practices of various third-party service providers, including certain vendors that have access to our information systems or sensitive data. • Proactive Reporting and Investigation: As part of our training initiatives, we educate certain employees depending on their role on how to report any suspicious cyber activity or potential cybersecurity issues, and we investigate reported concerns.


text: Third-party security firms are used in different capacities to provide or operate some of these programs, controls, and technology systems, including cloud-based platforms and services.


text: Our Board of Directors ("Board") has overall oversight responsibility for our enterprise risk management framework and cybersecurity risk management. The Board is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Management, including the Vice President of Information Technology with support from our Information Technology Council, updates the Board on at least an annual basis regarding our cybersecurity programs and material cybersecurity risks and mitigation strategies. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our Vice President of Information Technologies receives reports from our Information Technology Council and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our information technology council includes experienced information systems security professionals and information security managers. Our Information Technology Council, which is composed of technology leaders from each of our business units, collaborates on a cross-functional basis to identify practices that can counter threats and to monitor our cybersecurity programs and our cybersecurity incident response plans.


text: In 2023 we did not identify any material cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For more information about these risks, please see Part I - Item 1A. "Risk Factors - We may experience breaches of, or disruptions to, our information technology systems or those of our third-party providers, or other compromises of our data, including the improper disclosure of personal or confidential data, which may adversely affect our operations and reputation."


text: Our Board of Directors ("Board") has overall oversight responsibility for our enterprise risk management framework and cybersecurity risk management. The Board is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Management, including the Vice President of Information Technology with support from our Information Technology Council, updates the Board on at least an annual basis regarding our cybersecurity programs and material cybersecurity risks and mitigation strategies. Our Vice President of Information Technology, who has more than 30-years of global information technology, systems, and IT audit experience, is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis; establishing processes to ensure that such potential cybersecurity risk exposures are monitored; putting in place appropriate mitigation measures; and maintaining cybersecurity programs. The Vice President of Technology oversees a cybersecurity team that includes experienced cybersecurity professionals with credentials such as CISSP (Certified Information Systems Security Professional), CompTIA Security+, and ISO 27001. Our Vice President of Information Technology receives reports from our Information Technology Council and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our Information Technology Council includes experienced information systems security professionals and information security managers. Our Information Technology Council, which is composed of technology leaders from each of our business units, collaborates on a cross-functional basis to identify practices that can counter threats and to monitor our cybersecurity programs and our cybersecurity incident response plans.


text: In 2024 we did not identify any material cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For more information about these risks, please see Part I - Item 1A. "Risk Factors - We may experience breaches of, or disruptions to, our information technology systems or those of our third-party providers, or other compromises of our data, including the improper disclosure of personal or confidential data, which may adversely affect our operations and reputation."


text: The Company maintains an Information Security Program to support the management of cybersecurity risk as an integral component of the Company's ERM framework. The Information Security Program encompasses the Company's cybersecurity policies and practices, which focus on prevention, detection, mitigation and recovery from cybersecurity incidents. In addition, as part of the Information Security Program, the Company has a Security Incident Response Policy and Plan to enable a coordinated response to protect the integrity, security and resiliency of the Company's information systems, to mitigate the risk of cybersecurity incidents and to escalate information regarding certain cybersecurity incidents to the appropriate management personnel and Board members in a timely fashion. The Information Security Program follows established industry frameworks, including the National Institute of Standards and Technology Cybersecurity Framework, and standards set by the relevant legal and regulatory authorities.

companyName: EAST WEST BANCORP INC

ticker: EWBC


text: The Board's Risk Oversight Committee has primary oversight responsibility for management's efforts to mitigate cybersecurity risk and respond to cybersecurity incidents. The Risk Oversight Committee receives quarterly cybersecurity reports, including any reportable incidents, and reviews and approves the Information Security Program at least annually or whenever significant changes to the program are made. The full Board of Directors also receives quarterly cybersecurity reports. These updates include information regarding management's ongoing efforts to manage cybersecurity risk and the steps management has taken to address and mitigate the evolving cybersecurity threat environment. The Risk Oversight Committee members are independent directors and have expertise in areas relevant to their responsibilities over cybersecurity, including senior leadership experience in financial services and information technology.


text: At the management level, the Company has designated the Chief Risk Officer as the Chief Privacy Officer, who has oversight for managing cybersecurity risk. The Chief Privacy Officer coordinates with the Chief Information Security Officer to ensure the Company's cybersecurity risk profile is managed in a manner consistent with its risk appetite. The Chief Privacy Officer also provides periodic reports to the Board's Risk Oversight Committee, outlining the overall status of the Company's Information Security Program and its compliance with regulatory guidelines, and coordinating and reporting on incident response. The Chief Information Security Officer is responsible for the day-to-day management of the Information Security Program and Security Incident Response Policy and Plan. The Chief Privacy Officer has held various leadership roles at the bank, including over 13 years previously serving as the Company's Chief Financial Officer. The Chief Information Security Officer has over 20 years of work experience in cybersecurity at financial institutions.


text: The Information Security Program is supported by three lines of defense. The Information Security Team is the first line of defense under the Chief Information Security Officer and provides the day-to-day cybersecurity operations including identification and reporting of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, recovery planning, performing vulnerability and third party information security assessments, and employee awareness and training programs. In addition, the Information Security Team works in coordination with the individual business lines that have direct and primary responsibility and accountability for identifying, controlling and monitoring cybersecurity risk embedded in their business activities. The Information Security Team uses reputable industry service providers for security operations, monitoring, investigation and incident response. The internal Information Risk Management team conducts periodic assessments in collaboration with consulting services with expertise in the cybersecurity domains. Furthermore, the Third Party Risk Management Team, in conjunction with the Information Security Team, oversees, identifies, monitors, investigates and addresses material risks from cybersecurity threats associated with the Company's use of third-party service providers. As the second line of defense, the ERM Team under the Chief Privacy Officer independently monitors cybersecurity risk across the Company, as well as the effectiveness of the Information Security Program, third party vendors' vulnerability and penetration tests against the Company's network. The ERM Team reports the status of the annual assessment of the effectiveness of the Information Security Program to the Chief Privacy Officer, who reports to the Board's Risk Oversight Committee. When applicable, the Company obtains Statement on Standards for Attestation Engagement 18 reports or equivalent reports for vendor products and services hosted by third parties. Internal Audit serves as the third line of defense and provides additional independent assurance and evaluates the effectiveness of cybersecurity risk management.


text: In addition, the Company uses several internal training methods, through annual mandatory courses on security and privacy for all employees, as well as multiple simulated phishing attacks and regularly providing information security awareness materials throughout the year. The Company also maintains cybersecurity insurance. To date, the Company has not experienced cybersecurity incidents that have materially affected its business strategy, results of operations or financial condition. For additional information regarding cybersecurity threats, please refer to Item 1, Business – Supervision and Regulation – Privacy and Cybersecurity and Item 1A, Risk Factors – Risks Related to Our Operations.


text: Risk Management and Strategy The Company maintains an Information Security Program to support the management of cybersecurity risk as an integral component of the Company's ERM framework. The Information Security Program encompasses the Company's cybersecurity policies and practices, which focus on prevention, detection, mitigation and recovery from cybersecurity incidents. In addition, as part of the Information Security Program, the Company has a Security Incident Response Policy and Plan to enable a coordinated response to protect the integrity, security and resiliency of the Company's information systems, to mitigate the risk of cybersecurity incidents and to escalate information regarding certain cybersecurity incidents to the appropriate management personnel and Board members in a timely fashion. The Information Security Program follows a National Institute of Standards and Technology based Cybersecurity Framework and other applicable industry standards.


text: The Information Security Program is supported by our three lines of defense model of risk management. The Information Security Team is the first line of defense under the Chief Information Security Officer and provides day-to-day cybersecurity operations including identification and reporting of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, recovery planning, performance of vulnerability and third party information security assessments, and employee awareness and training programs. In addition, the Information Security Team works in coordination with the individual business lines that have direct and primary responsibility and accountability for identifying, controlling and monitoring cybersecurity risk embedded in their business activities. The Information Security Team uses reputable industry service providers for security operations, monitoring, investigation and incident response. The Information Risk Management team conducts periodic assessments in collaboration with consulting services with expertise in the cybersecurity domains. As the second line of defense, the ERM Team under the Chief Risk Officer independently monitors the cybersecurity risk framework across the Company, as well as the effectiveness of the Information Security Program, and third party vendors' vulnerability and penetration tests against the Company's network. Furthermore, the Third-Party Risk Management Team, in conjunction with the ERM Team and the Information Security Team, oversees, identifies, monitors, investigates and addresses material risks from cybersecurity threats associated with the Company's use of third-party service providers. The Third-Party Risk Management Team is also part of the independent risk management function of the Bank and included in the second line of defense. The ERM Team reports the status of the annual assessment of the effectiveness of the Information Security Program to the Chief Risk Officer, who reports to the Board's ROC. When applicable, the Company obtains Statement on Standards for Attestation Engagement 18 reports or equivalent reports for vendor products and services hosted by third parties. Internal Audit serves as the third line of defense and provides additional independent assurance and evaluates the effectiveness of cybersecurity risk management. In addition, the Company regularly engages independent external assessors to perform assessments of its cybersecurity control environment and operating effectiveness.


text: In addition, the Company uses several internal training methods, through annual mandatory courses on security and privacy for all employees, as well as multiple simulated phishing attacks and regularly providing information security awareness materials throughout the year. The Company also maintains cybersecurity insurance.


text: The Board's ROC has primary oversight responsibility for management's efforts to mitigate cybersecurity risk and respond to cybersecurity incidents. The ROC receives quarterly cybersecurity reports, including any reportable incidents, and reviews and approves the Information Security Program at least annually or whenever significant changes are made to the program. These updates include information regarding management's ongoing efforts to manage cybersecurity risk and the steps management has taken to address and mitigate the evolving cybersecurity threat environment. The ROC members include independent directors from the Board who have expertise in areas relevant to their responsibilities over cybersecurity, including senior leadership experience in financial services and information technology.


text: Role of Management At the management level, the Information Technology Steering Committee has overall responsibility for identifying, assessing, and managing information security risks, including cybersecurity risk. The Information Technology Steering Committee provides cybersecurity reports periodically to the ROC and is comprised of the Company's senior information technology, information security and third party risk management leaders, including the Chief Risk Officer and Chief Information Security Officer. The Chief Risk Officer is responsible for managing cybersecurity risk and coordinating with the Chief Information Security Officer to ensure the Company's cybersecurity risk profile is managed in a manner consistent with its risk appetite. The Chief Risk Officer also provides periodic reports to the Board's ROC, outlining the overall status of the Company's Information Security Program and its compliance with regulatory guidelines, and coordinating and reporting on incident response. The Chief Information Security Officer is responsible for the day-to-day management of the Information Security Program and Security Incident Response Policy and Plan. The Chief Risk Officer has held various leadership roles at the bank, including over 13 years previously serving as the Company's Chief Financial Officer. The Chief Information Security Officer has over 20 years of work experience in cybersecurity at financial institutions. The majority of Information Security Team members have over 10 years of cybersecurity experience and cumulatively hold over 50 active professional certifications in related fields.


text: Material Cybersecurity Threat Risk To date, the Company has not experienced any known cybersecurity incidents that have materially affected its business strategy, results of operations or financial condition. However, we can provide no assurance that all of our security measures will be effective. For additional information regarding cybersecurity threats, please refer to Item 1, Business – Supervision and Regulation – Privacy and Cybersecurity and Item 1A, Risk Factors – Risks Related to Our Operations.


text: Our business is highly dependent on our information systems, including our ability to operate them effectively and to successfully implement new technologies, methods and processes, as well as adequate controls and cybersecurity incident recovery plans. We rely on our information systems to manage our business, data, communications, supply chain, ordering, pricing, billing, inventory replenishment, accounting functions and other processes. In addition, we must protect the confidentiality and integrity of the data of our business, employees, customers and other third parties. Our business involves the collection, processing, storage and transmission of personally identifiable information and other sensitive and confidential information. This data is wide ranging and relates to our employees, customers and third parties, including the subjects of law enforcement. Our compliance obligations include those prescribed under the laws and regulations that dictate whether, how and under what circumstances we can receive, process, hold and/or transfer certain data that is critical to our operations, including data shared between countries or regions in which we operate and data shared among our products and services.

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: As part of our company-wide culture of security, we maintain a formal cybersecurity and information security program that is aligned with the standards set forth by the International Organization for Standardization ("ISO"), the American Institute of Certified Public Accountants in Systems and Organization Controls 2, the Criminal Justice Information Services, the Federal Risk and Authorization Management Program and the National Institute of Standards and Technology. The Company's Information Security Team maintains the program, which is designed to ensure proper monitoring, prevention, detection, mitigation and remediation of cybersecurity vulnerabilities, including the prompt investigation and management of all reported or discovered security events, including cybersecurity threats and incidents, in the ordinary course of the business of the Company.


text: Our cybersecurity and information security program is designed to comply with key global financial regulations and cybersecurity laws in the jurisdictions in which we operate. The program includes taking several proactive steps to prepare for attempts to compromise our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material cybersecurity risks, and protect against, detect and respond to cybersecurity threats and incidents, we undertake the below listed activities: closely monitor emerging data protection laws and implement changes to our processes designed to comply; undertake regular reviews (at least annually) of our consumer facing and internal policies and statements related to cybersecurity; proactively inform our customers of substantive changes related to customer data handling; conduct annual information security training for all our employees;


text: recruit and retain highly skilled cybersecurity professionals, and provide regular training and development opportunities for our cybersecurity and information security employees;


text: conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats;


text: through policy, practice and contract (as applicable), require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care;


text: perform due diligence on third-party vendors and, based on our risk assessment, put in place contractual undertakings and oversight to manage and reduce the risks associated with third-party vendors;


text: run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our technologies, methods and processes;


text: conduct regular risk assessments of our information systems to identify weaknesses, and develop and implement mitigations to improve our cybersecurity and information security program;


text: conduct regular security assessments, vulnerability scans, and penetration tests (including by third-party assessment firms) of products systems and internal systems to discover vulnerabilities and apply appropriate mitigations within standardized timelines;


text: maintain, implement, evaluate and update our cybersecurity technologies to address threats and vulnerabilities; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Third Party Monitoring and External Reviews Axon utilizes the assistance of third-party technology and providers to support our objective of protecting our information, information systems and network. Services provided by third parties to assess the performance of our cybersecurity risk management systems and procedures and to identify cybersecurity risks to the Company include assessing products and internal systems for vulnerabilities, incident response services such as computer forensics, internal and external audits for security certifications globally and overall security program maturity evaluations. Axon and our service providers have also developed systems and processes that are designed to protect our and our customers' data, to prevent data loss, and to prevent or detect cybersecurity threats and incidents.


text: Material findings, notable weaknesses and suggestions are presented to the Enterprise Risk and Compliance Committee of the Company's Board of Directors (the "ERC Committee") as discussed below.


text: Cybersecurity Management Team Our cybersecurity and information security program, which includes data privacy, is the responsibility of our Chief Information Security Officer ("CISO"), who oversees our global information security program. Our current CISO has served in various information technology and information security roles over the past 20 years, having built the Company's information security program over the last 10 years, and serving as CISO since December 2017. We expect our current CISO to transition his responsibilities to our new CISO over the coming quarter. Our new CISO brings diverse perspectives and significant skills and experience leading security organizations across a number of technology companies.


text: Our CISO attends quarterly meetings of the Company's Disclosure Committee and provides input on the Company's disclosures in its Quarterly Reports on Form 10-Q and Annual Reports on Form 10-K, including the relevant risk factors set forth therein. The Company's CISO, along with the Information Security Team, also leads our Security Incident Response Team, which is responsible for investigating suspected cybersecurity threats and incidents. In the event of a possibly material cybersecurity incident, the Information Security Team also includes the following executive team members: Corporate General Counsel, Chief Legal Officer, Chief Accounting Officer, Chief Financial Officer and, to the extent practicable or relevant, other senior executives.


text: Board of Directors Oversight As a part of its oversight of the key risks facing the Company, our Board of Directors devotes significant time and attention to data and systems protection, including cybersecurity and information security risk. While the Audit Committee of the Company's Board of Directors (the "Audit Committee") reviews any significant legal, compliance or regulatory matters that may have a material impact on the Company's business, financial statements or compliance policies generally, it does so in consultation with our ERC Committee with respect to any such matters that involve cybersecurity, data privacy or information technology. The Chair of our ERC Committee is also a member of our Audit Committee, which facilitates close coordination between the two committees on cybersecurity, data privacy and information technology matters.


text: Our ERC Committee oversees our overall approach to enterprise risk management, of which cybersecurity is an important component. The ERC Committee and its Chair, in coordination with the Information Security Team and CISO, regularly review the categories of risk the Company faces, including any cybersecurity risk exposures, as well as the likelihood of occurrence, the potential impact of those risks, and the steps management has taken to monitor, mitigate and control such exposures. To facilitate these reviews, the Information Security Team and CISO report at least quarterly to the ERC Committee with respect to cybersecurity risks, including those identified through review of our business, of rising threats in the industry, and of the current state of the Company's cybersecurity and information security program. The ERC Committee makes regular reports to the full Board of Directors regarding updates on cybersecurity and other risks.


text: Incident Response and Assessment Policies and Procedures Axon has implemented our cybersecurity and information security program and cybersecurity incident response plan to protect our and our customers' data from, and mitigate the effects of, unintentional disclosure as well as cybersecurity threats and incidents of all severity levels. Our program and response plan outline actions to be taken after identifying a suspected cybersecurity threat or incident and the people responsible for managing those actions. We have also implemented disclosure controls and procedures for determining the materiality of a cybersecurity incident to outline disclosure and communications responsibilities during cybersecurity incidents of all severity levels.


text: In the event of a possibly material cyber incident, the Security Incident Response Team, under the direction of the Corporate General Counsel and/or the Chief Legal Officer, would collect and document information relevant to materiality and make a threshold determination as to whether such cybersecurity incident (including those occurring on the information systems of third parties) is potentially material. The Security Incident Response Team would meet with the Chair of the ERC Committee to review the preliminary findings of the Security Incident Response Team, including the possible factors in determining materiality. If the Security Incident Response Team and the Chair of the ERC Committee determine that the cybersecurity incident warrants further review after consideration of such findings and factors, the Audit Committee would be convened for a meeting (to which all members of the ERC Committee would be invited) to review the cybersecurity incident and the findings of the Security Incident Response Team and the Chair of the ERC Committee. The Audit Committee would then make a materiality determination consistent with SEC guidance and by considering relevant quantitative and qualitative factors, informed by any recommendations of the ERC Committee and/or its Chair.


text: Any materiality assessment that results in a determination that a cybersecurity incident is not material would be reported by the Information Security Team, or appropriate members of management, to the ERC Committee at its next scheduled meeting.


text: At this time, we have not identified any risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial conditions. However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. See " Risk Factors—If our security measures or those of our third-party cloud storage providers are breached and unauthorized access is obtained to customers' data or our data, our network, data centers and products and services may be perceived as not being secure, customers may curtail or stop using our service and we may incur significant legal and financial exposure and liabilities " and " Risk Factors—Catastrophic events could materially adversely affect our business, results of operations and/or financial condition. "


text: Cybersecurity Risk Management and Strategy Our business is highly dependent on our information systems, including our ability to operate them effectively and to successfully implement new technologies, methods and processes, as well as adequate controls and cybersecurity incident recovery plans. We rely on our information systems to manage our business, data, communications, supply chain, ordering, pricing, billing, inventory replenishment, accounting functions and other processes. In addition, we must protect the confidentiality and integrity of the data of our business, employees, customers and other third parties. Our business involves the collection, processing, storage and transmission of personally identifiable information and other sensitive and confidential information. This data is wide ranging and relates to our employees, customers and third parties, including the subjects of law enforcement. Our compliance obligations include those prescribed under the laws and regulations that dictate whether, how and under what circumstances we can receive, process, hold and/or transfer certain data that is critical to our operations, including data shared between countries or regions in which we operate and data shared among our products and services.