text: Regions regularly tests and assesses its environment so it can update and maintain its systems and controls to mitigate the risks from cyber threats and vulnerabilities. These include risk assessments and penetration testing as well as testing against security controls. Layered security controls are designed and maintained to complement each other and enhance risk mitigation efforts. Regions is aiming to continue to develop and enhance controls, processes and technology to respond to evolving disruptive technology and to protect its systems from attacks or unauthorized access. In addition, Regions' TPRM function establishes the risk-based framework that governs all associates, subsidiaries, and affiliates who are engaged in the sourcing, planning, risk assessment, due diligence, contracting, ongoing monitoring, and governance of vendor engagements, including those that present cybersecurity risks for Regions. The TPRM framework includes the initial inherent-risk assessment conducted at onboarding and the applicable due diligence risk assessments, based on the engagement's risk profile. Upon completion of the applicable due diligence, the contract is constructed and negotiated, with efforts made to ensure appropriate terms are in place to further mitigate the risks presented. Thereafter, each engagement is reassessed on the established cadence associated with the inherent-risk tier, and performance scorecards are completed to to denote material changes in the engagement.


text: Risk Management and Strategy. As a company that deals with large volumes of sensitive customer information and financial transactions, Regions treats cybersecurity risk as a key operational risk within its enterprise-wide risk management framework. As part of this framework, Regions utilizes the "Three Lines of Defense" concept to clearly designate risk management activities within the Company, and this concept is applicable to cybersecurity risk (see the "Risk Management" section of Item 7. "Management's Discussion and Analysis of Financial Condition and Results of Operations" of this Annual Report on Form 10-K). To manage cybersecurity risk, the Company has designed and implemented an IS Program that is led by our Chief Information Security Officer. The IS Program includes information security policies, procedures, and controls designed to prevent, detect, limit and respond to cyber-attacks or other similar incidents which might impact Regions' technologies, systems, and networks. Regions' IS Program is designed and implemented to substantially align with standards promulgated by the NIST. Regions' Information Security Policy establishes technical, administrative, and physical control directives that are implemented to protect informational assets from reasonably foreseeable risks and threats. The IS Program is supplemented by cybersecurity operations that protect the integrity and availability of information systems. As discussed above, Regions' TPRM function also conducts due diligence and ongoing oversight of the Company's third-party vendors. The Company maintains a Cyber Incident Response Plan, which is part of broader business continuity planning and the Crisis Management Program, to help the Company respond to a possible data breach.

companyName: REGIONS FINANCIAL CORP

ticker: RF

secItem: Item 1C


text: The Company engages with external experts and advisors, as needed, to review, enhance, and support our IS Program. For example, third parties may be used to assist in the event of a breach or to mitigate certain threats to Regions' environment. Internally, the Company regularly provides associates with cybersecurity training and education at least annually. To bolster these practices, Regions maintains cybersecurity insurance, which is reviewed annually, to cover potential financial losses from cyber events. In addition, Regions participates in information sharing organizations to gather and share information with peer banks and other financial institutions to better prepare and protect its information systems from attack.


text: Governance. Regions' system of internal controls also incorporates an organization-wide protocol for the reporting and escalation of cybersecurity matters, including to management and the Board. The Board also receives updates on the Company's enterprise services, which includes resilience, information technology, and cybersecurity. The Board considers both business and technical resilience, cybersecurity and technological innovation, and privacy considerations, along with related risk considerations and mitigation efforts, within the Company's strategic plan. The Board is actively engaged in the oversight of Regions' continuous efforts to reinforce and enhance its operational resilience and receives education on the cybersecurity landscape. The Board oversees the management of cybersecurity and related risks primarily through its Risk Committee, which is supported at the management level by the ERMC, ORC, and TOROC which fall under the Risk Committee's purview. The Board's Risk Committee annually reviews and approves Regions' Information Security Policy; reviews information and regular reports on the topic from members of management on at least a quarterly basis; and recommends actions and other steps to be taken, as it deems appropriate. Additionally, the Board's Audit Committee periodically receives reports on the IS Program prepared by the Chief Information Security Officer and the Company's Risk Management and Internal Audit functions. The Board's Technology Committee is charged with oversight of the overall role of technology in executing Regions' business strategy and coordinates with the Risk Committee on risk assessment and management associated with technology-related strategic investments, major technology vendor relationships, and risks associated with information technology and security activities. The Board annually reviews the IS Program and, through its various committees, is briefed at least quarterly on cybersecurity matters. In addition, our management follows a risk-based escalation process to notify the Audit Committee and Risk Committee outside of the regular reporting cycle when they identify an emerging or risk or material issue.


text: Our Chief Information Security Officer, who has close to two decades of experience in the cybersecurity field, including leadership roles at multiple financial services organizations, has primary responsibility for our IS Program.


text: Cybersecurity Incidents. We have not experienced any material losses relating to cybersecurity threats or incidents for the year ended December 31, 2024. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see the "Technology Risks" discussion within in Item 1. "Risk Factors".


text: Material Risks from Cybersecurity Threats Our operations and other aspects of our business rely heavily on various information technology systems, some of which are managed by third parties. We face significant cybersecurity threats, which are continuously increasing in sophistication, including computer viruses, internal and external security breaches, and other cyber-attacks. These threats could disrupt our operations, lead to the loss of confidential information (such as the personally identifiable information of individuals, including our employees), and hinder our ability to process transactions with customers, operate our manufacturing facilities, and accurately report transactions in a timely manner. To manage these cybersecurity risks, our organization leverages the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We have implemented comprehensive policies and procedures that facilitate the timely identification and reporting of cyber incidents.

companyName: NEWMARKET CORP

ticker: NEU


text: Additionally, we have established protective measures for the forensic analysis of cyber incidents. While we are proactive in our efforts to mitigate these threats through robust security processes and disaster recovery plans, the evolving nature of cybersecurity threats means that our systems may not always be able to identify or protect against a threat promptly or at all. As a result, there is a continuous risk of potential financial, legal, business, and reputational damage to our company stemming from cybersecurity threats.


text: We employ a number of people who are part of our Information Technology group and are dedicated to and responsible for assessing and managing cybersecurity threats. Our Information Technology Director, who has over 25 years of experience in information security serving in roles of increasing responsibility, works with our cybersecurity employees to set priorities and is responsible for cybersecurity oversight and the escalation of incidents with business impact to senior leadership based on our Information Security Incident Management Policy.


text: We utilize specialized third-party services and tools for identifying, protecting against, and detecting cyber incidents, and also partner with external cybersecurity experts and vendors to augment our internal security team. Through these third-party services, our detection capabilities include, but are not limited, to, real-time monitoring, intrusion detection systems, and advanced analytics to identify abnormal patterns of behavior. These third-party detection tools provide real-time alerts, log aggregation, and threat intelligence feeds, which are integrated into our incident response platform.


text: Additionally, we engage third-parties to conduct independent assessments of our cybersecurity posture that evaluate the efficiency and effectiveness of our detection capabilities, along with our response mechanisms, and overall risk management.


text: Third-party service providers are integral to our business operations and are incorporated into our enterprise-wide risk management program, which subjects the providers to rigorous vetting processes and ongoing oversight. We use specialized monitoring tools that evaluate the cybersecurity posture of our third-party providers using a cybersecurity scorecard. This allows us to continually assess the cybersecurity risk levels associated with these external partners.


text: Our approach to managing cybersecurity risks (including third-party risk) is part of a continuous improvement process, both in the context of cybersecurity and broader operational risk management. This ongoing process, which includes employee training, is aimed at routinely reviewing and, as necessary, improving, our oversight processes and tools to ensure they remain effective and resilient in their management of cybersecurity risk.


text: Material Impact of Cybersecurity Threats While we have yet to experience a material cybersecurity event, we acknowledge the persistent and evolving nature of these threats, which have the potential to materially impact our business strategy, operations, and financial standing adversely. See Item 1A, "Risk Factors" under the operational risks section for more information. We maintain robust policies and procedures focused on cybersecurity incident management, ensuring timely communication and escalation to all relevant stakeholders. This enables faster response and effective communication, including public disclosure if a material cybersecurity event were to occur.


text: Board of Directors Oversight The Board of Directors oversees risks related to cybersecurity, including the security of corporate information and the steps management is taking to monitor and control these risks. Management regularly briefs the Board on our cybersecurity risk profile, emerging threats, and the efficacy of our risk mitigation strategies, including our continuous improvement initiatives. These initiatives aim to enhance the resiliency of our cybersecurity program as well as our broader operational risk management strategies.


text: Material Risks from Cybersecurity Threats Our operations and other aspects of our business rely heavily on various information technology systems, some of which are managed by third parties. We face significant cybersecurity threats, which are continuously increasing in sophistication, including computer viruses, internal and external security breaches, and other cyber attacks. These threats could disrupt our operations, lead to the loss of confidential information (such as the personally identifiable information of individuals, including our employees), and hinder our ability to process transactions with customers, operate our manufacturing facilities, and accurately report transactions in a timely manner. To manage these cybersecurity risks, our organization leverages the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We have implemented comprehensive policies and procedures that facilitate the timely identification and reporting of cyber incidents.


text: Risk Management and Strategy Our Cybersecurity Approach and Integration We have implemented processes for overseeing and identifying material risks from cybersecurity threats, and our cybersecurity processes are integrated into the Company's overall risk management system and processes. As part of management's oversight of cybersecurity, our Chief Security Officer ("CSO") presents on our cybersecurity practices to the Nominating and Corporate Governance Committee of our Board of Directors (the "NCG Committee") and to our full Board of Directors on a periodic basis. Our Senior Vice President, Internal Audit & Risk Management (the "Chief Audit Executive"), periodically presents enterprise risks, including cybersecurity risks, to the Audit Committee of our Board of Directors (the "Audit Committee"). Our Chief Compliance Officer regularly attends meetings at the NCG Committee providing insights from the compliance perspective relating to cybersecurity.

companyName: T-Mobile US, Inc.

ticker: TMUS


text: Cyber risk management is a core component of the Company's governance structure. We utilize the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF") as a guide in cyber risk management to identify, assess, and assist the CSO in managing cybersecurity risks. Cyber risk management encompasses partnerships among teams that are responsible for cyber governance, prevention, detection, and remediation activities within the Company's cybersecurity environment. As part of our cyber risk management efforts, we conduct periodic reviews and collaborate with enterprise-wide risk assessments to assess and manage cybersecurity risks. Our cybersecurity team also provides enterprise-wide cybersecurity training for employees to continuously improve our mitigation against human-driven vulnerabilities.


text: Our management also conducts a quarterly enterprise-wide risk assessment that considers a wide spectrum of risks facing the Company, including cybersecurity. Through these quarterly risk assessments, management informs the Audit Committee on the cyber risk landscape facing the Company and the Company's preparedness to manage such risk. The enterprise-wide risk assessment is a top-down risk assessment that leverages the assessments performed by cyber risk management.


text: Engagement with External Experts The Company engages top-tier external cyber security firms, as needed, leveraging their expertise as part of our ongoing effort to evaluate and enhance our cybersecurity program. They help with cyber defense capabilities (including staff enhancement of certain functions) and transformation to mitigate associated threats, reduce risk, enhance our cybersecurity posture, and meet the Company's evolving needs.


text: Oversight of Third-Party Service Providers Our third-party risk management program includes processes for identifying and managing material cybersecurity risks arising from third-party providers. Our third-party risk management program actively engages with the enterprise-wide risk assessment process and partners with cyber risk management to report relevant risks to the NCG Committee, the Audit Committee and our internal Enterprise Risk & Compliance Committee. Our third-party risk management program includes cybersecurity as an aspect of its risk assessment of third parties with the objective that key risks are identified and addressed. Moreover, the program also considers risks associated with certain fourth parties, entities that are partners or subcontractors of our direct third-party vendors, through assessments carried out by our third-party service providers.


text: Cybersecurity Incident Impact As previously disclosed, in August 2021, we experienced a cybersecurity incident that resulted in numerous lawsuits, including mass arbitration claims and multiple class action lawsuits. In January 2023, we experienced another cybersecurity incident that also resulted in consumer class actions and regulatory inquires. As a result of the August 2021 cyberattack and the January 2023 cyberattack, we have incurred and may continue to incur significant costs or experience other material financial impacts, which may not be covered by, or may exceed the coverage limits of, our cyber liability insurance, and such costs and impacts may have a material adverse effect on our business, reputation, financial condition, cash flows and operating results. For additional details regarding the impact of both cybersecurity incidents, see Note 17 – Commitments and Contingencies of the Notes to the Consolidated Financial Statements.


text: We have not identified other known risks from previous cybersecurity threats that have materially affected or are reasonably likely to materially affect us. However, we face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect business strategy, results of operations, or financial condition. See "Risk Factors – We have experienced criminal cyberattacks and could in the future be further harmed by disruption, data loss or other security breaches, whether directly or indirectly through third parties whose products and services we rely on in operating our business."


text: Disclosure of Management's Responsibilities Transformation and Chief Information & Digital Officer The Transformation and Chief Information & Digital Officer under the direction of the Company's Chief Executive Officer, is responsible for overseeing the Company's information technology systems, digital capabilities, and cybersecurity practices. The CSO, under the direction of the Transformation and Chief Information & Digital Officer, is responsible for overseeing the cybersecurity organization and promoting a security-centric culture throughout our business and operational functions. The CSO is at the forefront of enhancing our cybersecurity framework and strengthening the overall cybersecurity program. This involves upgrading tools and capabilities, which are part of a broader, multi-year strategy to continue to enhance security measures. The CSO oversees the cyber risk management function, which identifies cybersecurity threats, assesses cybersecurity risks and supports the Transformation and Chief Information & Digital Officer and the Company in managing such risks.


text: As the Company's Executive Vice President, Transformation and Chief Information & Digital Officer, N stor Cano has served in several leadership positions at both the Company and Sprint, including as Sprint's Chief Operating Officer, overseeing, among other things, Sprint's digital architecture and delivery. Mr. Cano studied industrial engineering at Barcelona Polytechnic University, attended the Executive Distribution Academy by INSEAD Business School in Fontainebleau, France, and also completed his post-graduate degree in executive management at IESE Business School in Barcelona, Spain.


text: As the Company's CSO, Jeff Simon has extensive experience in risk management and information security, including serving as the Chief Information Security Officer at Fidelity National Information Services, Inc. Mr. Simon received his Master of Science in Computer Science, Software Engineering & Artificial Intelligence from the Johns Hopkins Whiting School of Engineering and Bachelor of Science in Business Administration and Applied Economics from Marquette University. Mr. Simon is a Certified Information Systems Security Professional.


text: Enterprise Risk & Compliance Committee Our Enterprise Risk & Compliance Committee is comprised of a collective of senior management representatives and subject matter experts from across the Company. The Enterprise Risk & Compliance Committee is chaired by the Chief Financial Officer ("CFO") of the Company, with the Executive Vice President & General Counsel as the co-chair and comprises core members including the Transformation and Chief Information & Digital Officer, while the CSO serves in an advisory capacity. The purpose of the Enterprise Risk & Compliance Committee is to oversee and govern the Company's risk management, environmental, social, corporate governance, cybersecurity, and operational compliance activities, as well as provide a means of bringing risk issues to the attention of management. Specific to cybersecurity, the Transformation and Chief Information & Digital Officer and the CSO have the expertise to provide insights into the nature of cyber threats, the Company's readiness, and actions taken to mitigate such risks.


text: Disclosure of the Board's Roles and Responsibilities Our Board of Directors oversees risks from cybersecurity threats using a multi-faceted approach that involves the NGC Committee and Audit Committee and various executive roles. Additionally, our Transformation and Chief Information & Digital Officer and CSO report on cybersecurity to the full Board.


text: Nominating and Corporate Governance Committee The NCG Committee oversees risks associated with data privacy and information security, which encompasses cybersecurity. Our CSO and Chief Compliance Officer, among other executives, provide periodic reports to the NCG Committee and also meet with the NCG Committee to discuss any material events when they arise. The periodic reports are designed to keep the NCG Committee abreast of the Company's cybersecurity practices, risks and trends in cybersecurity threats. The NCG Committee also has discussions with management focused on evaluating the Company's exposure to cybersecurity risks and cybersecurity practices in place to mitigate such risks. These discussions enable the NCG Committee to be informed of the steps management is taking to detect, monitor and manage cybersecurity risks. These reports to the NCG Committee typically include information on any significant incidents that have occurred, how they were managed, and any changes to the risk profile of the Company. The NCG Committee seeks updates to facilitate proactive governance and to allow the NCG Committee to address emerging cybersecurity issues with management.


text: The Audit Committee is integral to overseeing the Company's overall risk management strategies, including cybersecurity risks and disclosures. To keep the Audit Committee informed, the Chief Audit Executive maintains a direct and open communication channel with the Audit Committee. Regular meetings are held for the Chief Audit Executive to report to the Audit Committee. These include an enterprise-wide risk assessment that highlights cybersecurity risks and cybersecurity risk mitigation actions. Additionally, the Audit Committee receives updates on significant incidents and cybersecurity risks that have been presented to or discussed with the Enterprise Risk and Compliance Committee.


text: Risk Management and Strategy Our Cybersecurity Approach and Integration We have implemented processes for overseeing and identifying material risks from cybersecurity threats, and our cybersecurity processes are integrated into the Company's overall risk management system and processes. As part of management's oversight of cybersecurity, our Chief Security Officer ("CSO") presents on our cybersecurity practices to the Nominating and Corporate Governance Committee of our Board of Directors (the "NCG Committee") and to our full Board of Directors on a periodic basis. Our Senior Vice President, Internal Audit & Risk Management (the "Chief Audit Executive"), periodically presents enterprise risks, including cybersecurity risks, to the Audit Committee of our Board of Directors (the "Audit Committee"). Our Chief Compliance Officer regularly attends meetings of the NCG Committee to provide insights from the compliance perspective relating to cybersecurity.


text: Cyber risk management is a core component of the Company's governance structure. We utilize the National Institute of Standards and Technology's Cybersecurity Framework as a guide in cyber risk management to identify, assess, and assist the CSO in managing cybersecurity risks. Cyber risk management encompasses partnerships among teams that are responsible for cyber governance, prevention, detection, and remediation activities within the Company's cybersecurity environment. As part of our cyber risk management efforts, we conduct periodic reviews and collaborate with enterprise-wide risk assessments to assess and manage cybersecurity risks. Our cybersecurity team also provides enterprise-wide cybersecurity training for employees to continuously improve our mitigation against human-driven vulnerabilities.


text: Cybersecurity Incident Impact As previously disclosed, in August 2021, we experienced a cybersecurity incident that resulted in numerous lawsuits, including mass arbitration claims and multiple class action lawsuits. In January 2023, we experienced another cybersecurity incident that also resulted in consumer class actions and regulatory inquiries. As a result of the August 2021 cyberattack and the January 2023 cyberattack, we have incurred and may continue to incur significant costs or experience other material financial impacts, which may not be covered by, or may exceed the coverage limits of, our cyber liability insurance, and such costs and impacts may have a material adverse effect on our business, reputation, financial condition, cash flows and operating results. For additional details regarding the impact of both cybersecurity incidents, see Note 18 – Commitments and Contingencies of the Notes to the Consolidated Financial Statements.


text: Enterprise Risk & Compliance Committee Our Enterprise Risk & Compliance Committee is comprised of a collective of senior management representatives and subject matter experts from across the Company. The Enterprise Risk & Compliance Committee is chaired by the Chief Financial Officer of the Company, with the Executive Vice President & General Counsel as the co-chair and comprises core members including the Transformation and Chief Information & Digital Officer, while the CSO serves in an advisory capacity. The purpose of the Enterprise Risk & Compliance Committee is to oversee and govern the Company's risk management, environmental, social, corporate governance, cybersecurity, and operational compliance activities, as well as provide a means of bringing risk issues to the attention of management. Specific to cybersecurity, the Transformation and Chief Information & Digital Officer and the CSO have the expertise to provide insights into the nature of cyber threats, the Company's readiness, and actions taken to mitigate such risks.


text: Disclosure of the Board's Roles and Responsibilities Our Board of Directors oversees risks from cybersecurity threats using a multi-faceted approach that involves the NCG Committee and Audit Committee and various executive roles. Additionally, our Transformation and Chief Information & Digital Officer and CSO report on cybersecurity to the full Board.


text: The Audit Committee is integral to overseeing the Company's overall risk management strategies, including cybersecurity risks and disclosures. To keep the Audit Committee informed, the Chief Audit Executive maintains a direct and open communication channel with the Audit Committee. Regular meetings are held for the Chief Audit Executive to report to the Audit Committee. These include an enterprise-wide risk assessment that highlights cybersecurity risks and cybersecurity risk mitigation actions. Additionally, the Audit Committee receives updates on significant incidents and cybersecurity risks that have been presented to or discussed with the Enterprise Risk & Compliance Committee.


text: Cybersecurity is a crucial component of our enterprise risk management program. Like many companies, both we and our external providers have been subject to, and expect to continue to be subject to, a range of cybersecurity threats and risks. We have invested significant resources into cybersecurity and risk management processes to adjust to the continuing evolution in cybersecurity and respond to related threats.

companyName: COHEN & STEERS, INC.

ticker: CNS


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature and information relating to our clients and investments (Information Systems and Data).


text: Our cybersecurity risk management function is led by our Chief Information Security Officer (CISO) and Chief Technology Officer (CTO) and includes members of our Information Technology (IT) department and other personnel that oversee our information security and engineering operations. Input and guidance are also provided by members of our Legal and Compliance departments. Together, these employees (collectively referred to as members of our Cybersecurity Management) are primarily responsible for developing, implementing and monitoring our cybersecurity program and reporting on cybersecurity matters to senior management as well as our board of directors.


text: Members of our Cybersecurity Management identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's enterprise risk profile using various manual and automated tools as well as by: (i) utilizing shared information about vulnerabilities and exploits from various professional security organizations, reports or other services that identify cybersecurity threats and through the use of external intelligence feeds; (ii) analyzing reports of threats and actors; (iii) conducting scans of the Company's threat environment; (iv) evaluating our and our industry's risk profile; (v) evaluating threats that are reported to us; (vi) coordinating with law enforcement concerning threats; (vii) conducting internal and external audits of our information security control environment and operating effectiveness; and (viii) conducting threat assessments for internal and external threats, including through the use of third party threat assessments and vulnerability threat assessments.


text: Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, but not limited to: • technical and physical safeguards: (i) systems monitoring, including anti-virus/anti-malware software for workstations and servers, reports about correlated events detected from server log reviews, desktop forensics software and suspicious firewall traffic, firewall logs and alerts from users about blocked websites, systems monitoring of Company websites, network monitoring software alerts and scheduled internal and external vulnerability scans; (ii) asset management tracking and disposal; (iii) incident detection and response; (iv) data encryption; (v) notification monitoring from Company personnel and from third parties regarding issues and signs of potential incidents; and (vi) access controls and network security controls; and • organizational safeguards: (i) incident response plans that address our response to a cybersecurity incident; (ii) personnel and vendors dedicated to overseeing the Company's cybersecurity program; (iii) periodic mandatory employee cybersecurity training; (iv) periodic risk assessments and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents, such as audits, tabletop exercises, threat modeling and vulnerability testing; (v) policies and programs such as security standards, a vendor risk management program, a vulnerability management policy and disaster recovery and business continuity plans; and (vi) insurance coverage dedicated to losses resulting from cybersecurity incidents.


text: Cybersecurity risk management is integrated into the Company's overall enterprise risk management (ERM) process. For example, (i) enterprise risk management-level cybersecurity risks are reviewed at least annually by our information technology security team; (ii) internal and external penetration tests are performed to identify any vulnerabilities and findings are risk ranked based on potential likelihood and impact; and (iii) members of Cybersecurity Management report on cybersecurity risk management and related matters to the board of directors and the audit committee, as part of their ongoing evaluation and oversight of overall enterprise risk.


text: Third-party service providers play a key role in our cybersecurity program. We use third-party service providers to assist us in identifying, assessing and monitoring material risks from cybersecurity threats, including through penetration testing, provision of threat intelligence and monitoring our environment 24 hours a day and seven days a week. We have currently engaged with professional services firms, including legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, dark web monitoring firms and cyber insurance brokers and providers. We report key findings of such assessments to our board of directors and the audit committee and we adjust our cybersecurity policies, standards, processes and practices as necessary based in part on information provided by these assessments and engagements.


text: We also use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies and supply chain resources. We maintain a risk-based approach to identifying and overseeing cybersecurity risks and vulnerabilities presented by our engagement of third parties, including key vendors, service providers and other external users of our information systems, as well as the information systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue and the identity of the provider, our vendor risk management program may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider. Our vendor risk management program may entail: (i) vendor risk assessments; (ii) security questionnaires; (iii) vendor audits; (iv) vulnerability scans relating to vendors; (v) security assessment calls with the vendor's security personnel and our review of the vendor's written security program, security assessments and other reports; (vi) provision from the vendor of a System and Organization Controls (SOC) 1 or SOC 2 report to evidence cybersecurity preparedness; and (vii) the imposition of contractual obligations on the vendor.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including under the caption "We could incur financial losses, reputational harm and regulatory penalties if we fail to implement effective information security policies and procedures."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by members of our Cybersecurity Management, including our CISO, CTO and our Head of IT Infrastructure.


text: • Our CISO oversees the information security group and program within our IT department and holds a Bachelor of Arts degree in computer science. Our CISO has served in various roles in information technology for over 24 years within the financial services industry, including previously serving as Head of Information Security and Enterprise Infrastructure, Head of IT Audit and Chief Information Security Officer at other companies, and holds the Certified Information Systems Auditor (CISA) and Certified in Risk and Information Systems Control (CRISC) certifications and is registered with FINRA for the Series 99. • Our CTO oversees our IT department and holds a PhD in computer science, an MBA and Postgraduate Diploma in physics. Our CTO has served in various roles in information technology for over 28 years, including senior leadership roles for the investment banking division of a financial services company. • Our Head of IT Infrastructure oversees the infrastructure and service desk departments within our IT department and holds a Bachelor of Business Administration degree in finance and computer information systems. Our Head of IT Infrastructure has served in various roles in information technology for over 20 years.


text: Members of our Cybersecurity Management, including our CISO and our CTO, are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy and communicating key priorities to relevant personnel. Members of our Cybersecurity Management, including our CISO and our CTO, are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is a key component of our cybersecurity program. The response plan is designed to report certain cybersecurity incidents to members of Cybersecurity Management, who then work with the Company's incident response team to help the Company control, mitigate and remediate cybersecurity incidents of which they are notified. In addition, the response plan includes prompt reporting to the board of directors (or audit committee) of certain cybersecurity incidents and of the company's materiality and disclosure determinations relating thereto.


text: The audit committee and board of directors actively participate in discussions regarding cybersecurity risk exposures and steps taken by management to monitor and mitigate such risks, further to their responsibility to manage, oversee and remain informed about the most significant risks to Company and align our risk exposure with our strategic and business objectives. At least annually, the audit committee reviews with our CTO the Company's cybersecurity program, including the robustness and efficacy of the Company's overall cybersecurity program, steps taken to enhance defenses and security measures in place and our established plans to identify, detect and respond to threats we may encounter. The audit committee also annually reviews and discusses with management the ERM process and annual risk assessment, as well as the Company's cyber insurance coverage and annual SOC-1 report provided by an independent services firm. More frequently, the audit committee and board of directors receive reports and communications from our CTO and our Chief Operating Officer regarding material risks and specific developments related to the changing cybersecurity landscape and the Company's operating, technology and control environment. Such reports may cover topics such as: recent investments made in our cyber infrastructure; the undertaking of new technology projects and initiatives; vulnerability assessments and key findings from external cyber experts retained by the Company; the impact of new cybersecurity-related rules and regulations; changes in the threat environment including new and emergent risks; and evolving information security standards and market practices including with respect to peers and third parties.


text: Risk Management and Strategy Cybersecurity is a crucial component of our enterprise risk management program. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature and information relating to our clients and investments.


text: Our cybersecurity risk management function is led by our Cybersecurity Management team which is comprised of our Chief Information Security Officer (CISO), Chief Technology Officer (CTO), members of our Information Technology (IT) department, as well as members of our Legal and Compliance Departments. Our Cybersecurity Management team is primarily responsible for developing, implementing and monitoring our cybersecurity program and reporting on cybersecurity matters to senior management as well as our board of directors.


text: Members of our Cybersecurity Management identify and assess risks from cybersecurity threats by monitoring our threat environment and the Company's enterprise risk profile using various manual and automated tools as well as by: (i) utilizing shared information about vulnerabilities and exploits from professional security organizations, reports or other services that identify cybersecurity threats and through the use of external intelligence feeds; (ii) analyzing reports of threats and actors; (iii) conducting periodic vulnerability scans of the Company's IT environment; (iv) evaluating our and our industry's risk profile; (v) evaluating threats that are reported to us; (vi) coordinating with law enforcement concerning threats; (vii) conducting internal and external audits of our information security control environment and operating effectiveness; and (viii) conducting threat assessments for internal and external threats, including through the use of third party threat assessments and vulnerability threat assessments.


text: We implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats, including, but not limited to: • technical and physical safeguards: (i) real-time security information and event monitoring of systems, workstations, servers and networks, and periodic internal and external vulnerability scans; (ii) asset management tracking and disposal; (iii) incident detection and response; (iv) data encryption; (v) notification monitoring from Company personnel and from third parties regarding issues and signs of potential incidents; and (vi) logical access controls and network security controls; and • organizational safeguards: (i) incident response plans that address our response to a cybersecurity incident; (ii) personnel and vendors dedicated to overseeing the Company's cybersecurity program; (iii) periodic mandatory employee cybersecurity training; (iv) periodic risk assessments and testing of our policies, standards, processes and practices designed to address cybersecurity threats and incidents; (v) policies and programs such as security standards, a vendor risk management program, a vulnerability management policy and disaster recovery and business continuity plans; and (vi) insurance coverage dedicated to losses resulting from cybersecurity incidents.


text: Cybersecurity risk management is integrated into the Company's overall enterprise risk management (ERM) process. For example, (i) enterprise risk management-level cybersecurity risks are reviewed at least annually by our information technology security team; (ii) internal and external penetration tests are performed to identify vulnerabilities and findings are risk ranked based on potential likelihood and impact; and (iii) members of Cybersecurity Management report on cybersecurity risk management and related matters to the audit committee of the board of directors, as part of their ongoing evaluation and oversight of overall enterprise risk pursuant to non-exclusive authority delegated by the board of directors.


text: We use third-party service providers to assist us in identifying, assessing and monitoring material risks from cybersecurity threats, including through penetration testing, provision of threat intelligence and continuous monitoring of our environment. We report key findings to the audit committee of the board of directors and, if appropriate, the board of directors and adjust our cybersecurity policies, standards, processes and practices as necessary based in part on information provided by these assessments and engagements.


text: We also use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies and supply chain resources. We maintain a risk-based approach to identifying and overseeing cybersecurity risks and vulnerabilities presented by our engagement of third parties, as well as the information systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. Our vendor risk management program may involve different assessments designed to help identify cybersecurity risks including: (i) vendor risk assessments; (ii) security questionnaires; (iii) vendor audits; (iv) vulnerability scans relating to vendors; (v) security assessment calls with the vendor's security personnel and our review of the vendor's written security program, security assessments and other reports; (vi) evidence of cybersecurity preparedness through a System and Organization Controls (SOC) 1 or SOC 2 report; and (vii) the imposition of contractual obligations on the vendor.


text: For a description of the risks from cybersecurity threats that may materially affect the Company, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including under the caption "We could incur financial losses, reputational harm and regulatory penalties if we fail to implement effective information security policies and procedures."


text: • Our CISO oversees the information security group and program within our IT department with over 25 years of experience, including similar roles at other financial services companies, and holds the Certified Information Systems Auditor (CISA) and Certified in Risk and Information Systems Control (CRISC) certifications and is registered with FINRA for the Series 99. • Our CTO oversees our IT department and has served in various roles in information technology for over 29 years, including senior leadership roles at another financial services company. • Our Head of IT Infrastructure oversees the infrastructure and service desk within our IT department and has served in various roles in information technology for over 21 years.


text: Our cybersecurity incident response plan is a key component of our cybersecurity program. The response plan is designed to report certain cybersecurity incidents to members of Cybersecurity Management, who then work with the Company's incident response team to help control, mitigate and remediate cybersecurity incidents. In addition, the response plan includes prompt reporting to the board of directors (or audit committee) of certain cybersecurity incidents and related materiality and disclosure determinations.


text: The audit committee of the board of directors actively participates in discussions regarding cybersecurity risk exposures and steps taken by management to monitor and mitigate such risks, further to their responsibility to manage, oversee and remain informed about the most significant risks to Company and align our risk exposure with our strategic and business objectives. At least annually, the audit committee reviews with our CTO and CISO the Company's cybersecurity program, including the robustness and efficacy of the overall cybersecurity program, steps taken to enhance defenses and security measures in place and our established plans to identify, detect and respond to potential threats. The audit committee also annually reviews and discusses the ERM process and risk assessment, as well as the Company's cyber insurance coverage. Additionally, the audit committee of the board of directors receives reports and communications from our CTO and our Chief Operating Officer regarding material risks and specific developments related to the changing cybersecurity landscape and the Company's operating, technology and control environment. Such reports may cover topics such as: investments made in our cyber infrastructure; technology projects and initiatives; vulnerability assessments and key findings from external cyber experts; the impact of new cybersecurity-related rules and regulations; changes in the threat environment; and evolving information security standards and market practices. As of December 31, 2024, we have not experienced any cyber incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Our Company places a high priority on cybersecurity, information security, and securing confidential business information and personal information that we receive and store related to our customers and employees. Our Company's Audit Committee oversees the cybersecurity risks faced by the Company. In connection therewith, a Cybersecurity Steering Committee, which consists of our Chief Financial Officer, Chief Operating Officer, General Counsel, Vice President of Software Development, and Vice President of Regulatory Affairs, was formed to identify material risks and cybersecurity threats arising in our business.

companyName: ClearPoint Neuro, Inc.

ticker: CLPT


text: Our Audit Committee receives updates from the Cybersecurity Steering Committee at least annually, which cover topics related to information security, privacy, and cyber risks and risk management processes, including the status of significant cybersecurity incidences and projects designed to strengthen our information security posture. Our Audit Committee is also responsible for ensuring that the Board of Directors also receives periodic reports with respect to the status and management of our cybersecurity risks.


text: The Cybersecurity Steering Committee, in collaboration with delegates from our business and functions, is responsible for implementing the Company's enterprise-wide cyber security and information security strategy, employee training and compliance, and managing policies and processes for the Company's information technology standards, product security, and privacy. As a member of the Cybersecurity Steering Committee, our Vice President of Software Development provides experience devising effective cybersecurity management practices in the areas of both software and product development, including risk evaluation, impact assessment, security threat modelling, cybersecurity mitigation strategies, residual risk acceptability and methodologies for security risk verification. He has led the integration of our medical device software into some of the largest hospital and research institutions in the world in compliance with the extensive cybersecurity requirements of these institutions. In addition to utilizing internal Company resources, the Cybersecurity Steering Committee also regularly consults with external advisors and specialists regarding opportunities and enhancements to strengthen its practices and policies. We also engage with third-party consultants to manage the infrastructure and security of our information technology landscape.


text: Our cybersecurity program includes: • Penetration testing of internal information technology systems and review of program maturity based on the National Institute of Standards and Technology ("NIST") cybersecurity framework; • Phishing, social engineering, and cyber hygiene training; • Continuous security event monitoring, management, and incident response plans; • Continuous enhancements to security capabilities based on evolving threats; • Information security policies and procedures; • Privacy controls and compliance with applicable legislative and regulatory requirements; • Assessment of applicable third-party vendors' cybersecurity and information security practices; and • A cross-functional approach to addressing cybersecurity risk with participation from representatives across the business and functions.


text: As part of our cybersecurity program, we have adopted an incident response plan, under which the Chairs of our Board of Directors and Audit Committee are informed by the Cybersecurity Steering Committee of any cybersecurity incidents that have the potential to materially adversely impact the Company or its information systems. To date, no attempted cyber-attack or other attempted intrusion on our information technology networks has resulted in a material adverse impact on our operations or financial results, or in any penalties or settlements.


text: Cybersecurity Risk Management Process The Company relies extensively on IT systems to operate and manage its business and process transactions. As a result, our business is at risk from, and may be impacted by, cybersecurity incidents. The Company's cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.

companyName: KITE REALTY GROUP TRUST

ticker: KRG


text: As risk management is an ongoing process, the Company regularly assesses its cybersecurity risks and adjusts its program accordingly. Via multiple monitoring solutions, potential cyber threats are automatically logged and proactively addressed. Our monitoring tools use well-established vulnerability scoring to aid in the overall risk assessment. The scoring ranks by potential severity and likelihood and includes a review of mitigating factors. The Company prioritizes its cybersecurity investments based on the likelihood and impact of potential threats.


text: From onboarding and at least annually thereafter, the Company educates and trains its workforce on cybersecurity leading practices using a variety of methods. The Company regularly performs internal and external penetration testing and vulnerability scanning with the support of well-established third-party providers. Any identified deficiencies or vulnerabilities are reviewed by the IT staff and management and remediation steps are taken based on the criticality of the results.


text: Cybersecurity tools and services are configured to identify threats and risks that may be associated with the use of third-party applications or solutions.


text: The Company has developed incident response plans to contain, investigate, respond to and recover from cybersecurity incidents. Our response plans require prompt notification to members of senior management in the event of a significant cybersecurity incident and prompt briefings on further developments as appropriate.


text: Risks And Impact From Cybersecurity Threats To date, we are not aware of any risks from cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents. For more information regarding our cybersecurity risks, refer to Item 1A. "Risk Factors – We and our tenants face risks related to cybersecurity attacks that could cause loss of confidential information and other business disruptions." included elsewhere within this Annual Report on Form 10-K.


text: Board of Trustees Oversight Our Board of Trustees oversees various risks that the Company may face from time to time. While the full Board of Trustees has primary responsibility for risk oversight, it has delegated to the Audit Committee the responsibility for overseeing the Company's enterprise risk management and risk mitigation policies and programs, including matters related to privacy and cybersecurity. The Audit Committee reviews the Company's cybersecurity risks and the effectiveness of its cybersecurity program every quarter. Reports on these topics are provided to the Audit Committee by the Senior Vice President, Chief Technology Officer and the Vice President, Internal Audit and Enterprise Risk Management on a quarterly basis. In addition, when appropriate, cybersecurity risks and incidents will be reported to the Board of Trustees by the Company's Chief Financial Officer.


text: Management's Role The Company's management team is responsible for implementing and managing the Company's cybersecurity risk management program. The management team regularly reviews the Company's cybersecurity risks and adjusts the program as needed. Risk data analyzed includes summary and detailed data from monitoring and protection systems along with remediation reports to ensure the constant evolution of the program.


text: Key members of the IT team responsible for information security include several individuals with over 20 years of experience within various industries including real estate, global retail, fintech and insurance along with experience working for several top IT service and solutions providers.


text: The IT team provides quarterly reports to the Company's senior management. Such reports typically address, among other things, the Company's cybersecurity strategy, initiatives, key security metrics, business response plans, and the evolving cybersecurity threat landscape.


text: The Company has cybersecurity insurance designed to cover certain expenses relating to cybersecurity incidents. The Company also carries other insurance that may cover ancillary aspects of a cybersecurity incident; however, damage and claims arising from a cybersecurity incident may exceed the amount of any insurance available.


text: Cybersecurity Risk Management Process The Company relies extensively on IT systems to operate and manage its business and process transactions. As a result, our business is at risk from, and may be impacted by, cybersecurity incidents. The Company's cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, which is used to benchmark and tailor the Company's strategies and program to our risk profile and specific operational needs and goals.


text: We recognize that cybercriminals frequently target employees to gain unauthorized access to information systems. Therefore, from onboarding and at least annually thereafter, the Company educates and trains its employees on cybersecurity leading practices using a variety of methods, which is supplemented throughout the year with regular phishing and other cyber-related testing. The Company regularly performs internal and external penetration testing and vulnerability scanning with the support of well-established third-party providers. Identified deficiencies or vulnerabilities are reviewed by the IT staff and management, and remediation steps are taken based on the criticality of the results.


text: Cybersecurity tools and services are configured to identify threats and risks that may be associated with the use of third-party applications or solutions. We prioritize our cybersecurity efforts relating to third parties based on the likelihood and potential impact of cybersecurity threats. These efforts may include reviewing security documentation or protocols of key vendors, service providers, and external users of our systems.


text: The Company has developed cybersecurity incident response plans to contain, investigate, respond to, and recover from cybersecurity incidents that may jeopardize the confidentiality, integrity, or availability of our IT systems. Key members of management, including the Company's Chief Financial Officer, Chief Operating Officer, and Chief Legal Officer, as well as employees from IT, internal audit, marketing and communications, and human resources, serve on the Company's security incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. Our response plans require prompt notification to members of senior management in the event of a significant cybersecurity incident and prompt briefings on further developments as appropriate.


text: Risks And Impact From Cybersecurity Threats As of December 31, 2024, we are not aware of any risks from cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents. For more information regarding our cybersecurity risks, see "We and our tenants face risks related to cyber attacks that could cause loss of confidential information and other business disruptions" in Item 1A. "Risk Factors" within this Annual Report on Form 10-K.


text: Board of Trustees Oversight Our Board of Trustees oversees various risks that the Company may face from time to time. While the full Board of Trustees has primary responsibility for risk oversight, it has delegated to the Audit Committee the responsibility for overseeing the Company's enterprise risk management and risk mitigation policies and programs, including matters related to privacy and cybersecurity. The Audit Committee reviews the Company's cybersecurity risks and the effectiveness of its cybersecurity program every quarter, including current threat levels and ongoing program enhancements. Reports on these topics are provided to the Audit Committee by the Vice President, Chief Information Security Officer ("CISO") and the Vice President, Internal Audit and Enterprise Risk Management on a quarterly basis. In addition, when appropriate, cybersecurity risks and incidents will be reported to the Board of Trustees by the Company's Chief Financial Officer.


text: Management's Role The Company's management team is responsible for implementing and managing the Company's cybersecurity risk management program. The management team regularly reviews the Company's cybersecurity risks and adjusts the program as needed. Risk data analyzed includes summary and detailed data from monitoring and protection systems along with remediation reports to help ensure the constant evolution of the program.


text: Key members of the IT team responsible for information security include several individuals with over 20 years of experience within various industries, including real estate, global retail, fintech, and insurance, along with experience working for several top IT service and solutions providers. The IT team provides quarterly reports to the Company's senior management, which typically address, among other things, the Company's cybersecurity strategy, initiatives, key security metrics, business response plans, and the evolving cybersecurity threat landscape.


text: The Company has cybersecurity insurance designed to cover certain expenses related to cybersecurity incidents. The Company also carries other insurance that may cover ancillary aspects of a cybersecurity incident; however, damage and claims arising from a cybersecurity incident may exceed the amount of any insurance available.


text: Cybersecurity Risk Management and Strategy We identify, assess and manage material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to personnel and customers, violation of privacy and security laws and other litigation and legal risk, and reputational risks. We have implemented and continue to maintain various cybersecurity processes, technologies, and controls designed to aid in our efforts to assess, identify, and manage such material risks.

companyName: LEGALZOOM.COM, INC.

ticker: LZ


text: To identify, assess and manage material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk management committee, a multidisciplinary committee that includes our Chief Financial Officer, Chief Operating Officer and Chief Technology Officer and is chaired by our General Counsel, collaborates with internal subject matter specialists in an effort to gather information for identifying, assessing and managing material cybersecurity risks, such as information related to their severity, likelihood of occurrence and potential mitigation strategies. At least quarterly, our Chief Information Officer and Senior Director, Information Security, meet with our enterprise risk management committee, together with the rest of our senior leadership team, to present and discuss a cybersecurity risk assessment. Key cybersecurity risks are then incorporated into our enterprise risk management framework. To help inform our cybersecurity risk identification, assessment and management, we also employ a range of tools and services, including network and endpoint monitoring, vulnerability assessments, and periodic penetration testing and tabletop exercises.


text: In an effort designed to provide for the availability of critical data and systems, manage our material risks from cybersecurity threats, and protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we also undertake the below listed activities: • closely monitor emerging data protection laws and implement any necessary changes to our processes; • conduct annual security training for all our employees; • conduct annual cybersecurity management and incident training designed for certain employees such as those who handle sensitive data; • conduct phishing email simulations for personnel with access to corporate email systems in an effort to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable) require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • hold regular meetings of an internal multidisciplinary working group to discuss our cybersecurity incident preparedness; • run tabletop exercises to simulate a cybersecurity incident and use findings from such exercises in an effort to improve our processes and technologies; • maintain and regularly review and test a framework designed to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; • carry information security risk insurance designed to mitigate potential losses arising from cybersecurity incidents.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes designed to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: As part of the above processes, from time to time we work with third parties that are intended to help us to identify, assess, and manage cybersecurity risks, including professional services firms, threat intelligence service providers, managed cybersecurity service providers and penetration testing firms.


text: To operate our business, we utilize certain service providers to perform a variety of functions, such as professional services, data center facilities and other functions. Our processes are designed to address cybersecurity threat risks associated with our use of service providers, including those in our supply chain or who have access to our customer and employee data or our information systems. Certain risks associated with our use of service providers are included within our enterprise risk management assessment program, as well as our processes designed to identify, assess and manage cybersecurity-specific risks, both of which are discussed above. In addition, cybersecurity considerations may affect the selection and oversight of our service providers. We perform diligence on certain service providers that have access to our systems, data or facilities that house such systems or data. This diligence may include a review of the service providers' internal and/or external security audits and certifications. Additionally, we may impose specific cybersecurity obligations on certain service providers.


text: We face a number of cybersecurity risks in connection with our business. We have, from time to time, experienced threats to and breaches of our data and systems. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see Item 1A, "Risk Factors" of this Annual Report on Form 10-K. Cybersecurity Governance Cybersecurity is an area of focus for our board of directors and management.


text: The audit committee of our board of directors is responsible for overseeing the adequacy and effectiveness of the Company's information security policies and practices, as well as risks related to information security and cybersecurity. At least semiannually, and more frequently depending upon applicable facts and circumstances, our audit committee receives an overview of our cybersecurity threat risk management and strategy processes, which covers topics such as our incident response plan, results from third-party assessments, our cybersecurity risk roadmap and any threat risks, cybersecurity incidents or developments, and our progress towards risk-mitigation-related goals. The audit committee receives information related to the foregoing matters from our Chief Information Officer and Senior Director, Information Security, as well as with representatives from our enterprise risk management committee. Our audit committee also receives an annual information security report, which contains information regarding, among other things, the data security processes and procedures that have been implemented across company business units.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer and Senior Director, Information Security. Such individuals have collectively over 20 years of prior work experience in various roles involving managing and safeguarding information security, formulating and executing strategies for cybersecurity, and instituting programs for information and cyber protection, as well as several relevant degrees and certifications, including Certified Information Systems Security Professional, or CISSP, Offensive Security Certified Professional, or OCSP, M.S. Cybersecurity and Information Assurance, M.B.A. Information Systems. These individuals are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: To identify, assess and manage material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk management committee, a multidisciplinary committee that includes our Chief Financial & Operating Officer and Chief Revenue Officer and is chaired by our Chief Legal Officer, collaborates with internal subject matter specialists in an effort to gather information for identifying, assessing and managing material cybersecurity risks, such as information related to their severity, likelihood of occurrence and potential mitigation strategies. At least quarterly, our Chief Information Officer and Senior Director, Information Security, meet with our enterprise risk management committee to present and discuss a cybersecurity risk assessment. Key cybersecurity risks are then incorporated into our enterprise risk management framework. To help inform our cybersecurity risk identification, assessment and management, we also employ a range of tools and services, including network and endpoint monitoring, vulnerability assessments, periodic penetration testing, bug bounty program and tabletop exercises.


text: In an effort designed to provide for the availability of critical data and systems, manage our material risks from cybersecurity threats, and protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we also undertake the below listed activities: • closely monitor emerging data protection laws and implement any necessary changes to our processes; • conduct annual security training for all our employees; • conduct annual cybersecurity management and incident training designed for certain employees such as those who handle sensitive data; • conduct phishing email simulations for personnel with access to corporate email systems in an effort to enhance awareness and responsiveness to such possible threats; • periodically evaluate customer support interactions to help ensure compliance with security protocols and service standards; • through policy, practice and contract (as applicable) require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • hold regular meetings of an internal multidisciplinary working group to discuss our cybersecurity incident preparedness; • run tabletop exercises to simulate a cybersecurity incident and use findings from such exercises in an effort to improve our processes and technologies; • maintain and regularly review and test a framework designed to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; • carry information security risk insurance designed to mitigate potential losses arising from cybersecurity incidents.


text: We face a number of cybersecurity risks in connection with our business. We have, from time to time, experienced threats to and breaches of our data and systems. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K. Cybersecurity Governance Cybersecurity is an area of focus for our board of directors and management.


text: The audit committee of our board of directors is responsible for overseeing the adequacy and effectiveness of the Company's information security policies and practices, as well as risks related to information security and cybersecurity. At least semiannually, and more frequently depending upon applicable facts and circumstances, our audit committee receives an overview of our cybersecurity threat risk management and strategy processes, which covers topics such as our incident response plan, results from third-party assessments, our cybersecurity risk roadmap and any threat risks, cybersecurity incidents or developments, and our progress towards risk-mitigation-related goals. The audit committee receives information related to the foregoing matters from our Chief Information Officer and Senior Director, Information Security, as well as with representatives from our enterprise risk management committee. Our audit committee also receives an annual information security report, which contains information regarding, among other things, the data security processes and procedures that have been implemented across company business units. In addition, our full board of directors is presented with updates on our cybersecurity threat risk management and strategy processes at least annually.


text: Cybersecurity Risk Management and Strategy As an externally managed closed-end management investment company that has elected to be regulated as a BDC under the 1940 Act, our day-to-day operations are managed by the Investment Adviser, Administrator and our executive officers under the oversight of our Board of Directors. As such, we rely on the cybersecurity policies and procedures implemented by Prospect Capital Management, for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details that Prospect Capital Management has provided to us regarding its cybersecurity program that are relevant to us.

companyName: PROSPECT CAPITAL CORP

ticker: PSEC


text: Prospect Capital Management has processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on, or through, our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems.


text: In accordance with the Prospect Capital Management Information Technology Operations and Procedures, the cross-functional Change Advisory Board ("CAB") governs and oversees the advancement and implementation of policies and procedures to reasonably prevent security incidents. Prospect Capital Management's cybersecurity program also includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Prospect Capital Management's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement.


text: Prospect Capital Management uses processes to oversee and identify material risks from cybersecurity threats, including those associated with the use of third-party service providers. Additionally, Prospect Capital Management uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process. Prospect Capital Management, also maintains an incident response plan that is utilized when cybersecurity incidents impacting us, our Investment Adviser, or our Administrator are detected.


text: Prospect Capital Management conducts regular phishing tests where educational materials are provided in each test for those who fail. Prospect Capital Management is implementing security awareness training which will be conducted annually for staff with a high failure rate on the phishing tests.


text: In the last three fiscal years, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion on risks posed by cybersecurity threats, see "Item 1A. Risk Factors - Risks Relating to Our Business- We may experience cybersecurity incidents and are subject to cybersecurity risks. The failure in cybersecurity systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively.


text: Board of Director Oversight of Cybersecurity Risks Our Board of Directors provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board of Directors receives periodic updates from the Company's Chief Compliance Officer ("CCO"), which incorporates updates provided by the Adviser regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, manage the Company's cybersecurity program. The CCO supervises the Company's oversight function generally and relies on the Adviser's technology team to assist with assessing and managing material risks from cybersecurity threats. The CCO has been responsible for this oversight function as CCO of the Company for more than five years and has worked in the financial services industry for more than 20 years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: Prospect Capital Management uses processes to oversee and identify material risks from cybersecurity threats, including those associated with the use of third-party service providers. Additionally, Prospect Capital Management uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process, Prospect Capital Management also maintains an incident response plan that is utilized when cybersecurity incidents impacting us, our Investment Adviser, or our Administrator are detected.


text: Prospect Capital Management conducts regular phishing tests where educational materials are provided in each test for those who fail. Prospect Capital Management also utilizes a security awareness training platform as supplementary cybersecurity training for staff with a high failure rate on the phishing tests.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: MAXLINEAR, INC

ticker: MXL


text: We conduct quarterly risk assessments to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. As part of our risk management process, we may engage third party experts to help identify and assess risks from cybersecurity threats. Our risk management process also encompasses cybersecurity risks associated with our use of third-party service providers.


text: Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. We have allocated adequate resources and have designated high-level personnel, including our Chief Information Security Officer, to manage the cybersecurity risk assessment and mitigation process.


text: As part of our overall risk management program, we regularly provide required training to employees at all levels and in all departments on cybersecurity. The Company also participates in a cybersecurity risk insurance policy.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "We have been and may in the future be subject to information technology failures, including security breaches, cyber-attacks, design defects or system failures, that could disrupt our operations, damage our reputation and adversely affect our business, operations, and financial results," "We are subject to governmental laws, regulations and other legal obligations related to privacy, data protection, and cybersecurity," and "We face risks related to security vulnerabilities in our products."


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Cybersecurity Committee of the Board of Directors (the "Cybersecurity Committee"). Members of the Cybersecurity Committee are appointed by, and serve at the discretion of, the Board. The Cybersecurity Committee consists of at least three members of the Board, all of whom are independent. Each member has a working familiarity and/or experience with cybersecurity, IT strategy, IT development and deployment, or IT risk assessment and management, including information security management.


text: Our Chief Information Security Officer and the Cybersecurity Committee are primarily responsible to assess and manage material risks from cybersecurity threats. Our Chief Information Security Officer has twenty-five years of cybersecurity experience, has completed a Masters in Information Security Engineering, and holds several cybersecurity certifications.


text: Our Chief Information Security Officer and the Cybersecurity Committee oversee key cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Chief Information Security Officer and the Cybersecurity Committee are informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Our Chief Information Security Officer and representatives from the Cybersecurity Committee provide quarterly briefings to the Audit Committee of the Board regarding our company's cybersecurity risks and activities, including but not limited to any recent cybersecurity incidents and related responses, and any cybersecurity systems testing. The Audit Committee provides regular updates to the Board on relevant information regarding cybersecurity. In addition, our Chief Information Security Officer and representatives from the Cybersecurity Committee provide annual briefings to the Board on cybersecurity risks, related mitigation, and other related responses and activities.


text: The last known cybersecurity breach occurred in 2020. The Company has not experienced any material cybersecurity breach in the years ended December 31, 2023, 2022 and 2021. The Company also has not incurred any net expenses from penalties and/or settlements from any material cybersecurity breaches during the years ended December 31, 2023, 2022, and 2021.


text: We conduct quarterly risk assessments to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. As part of our risk management process, we may engage third party experts to help identify and assess risks from cybersecurity threats. Our risk management process also encompasses cybersecurity risks associated with our use of third-party service providers. This process involves evaluating their infrastructure security policies and controls to ensure high levels of code quality. Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. We follow the Critical Security Controls, or CIS, guidance to defend our systems and networks against the most prevalent cyber-attacks. We have allocated adequate resources and have designated executives and IT management personnel to manage the cybersecurity risk assessment and mitigation process. We track quarterly Risk Register scores, which are derived from assessments of impact and likelihood, and monitor adoption rates of CIS controls to gauge our progress. These metrics are systematically tracked and reported to the board on a quarterly basis. As part of our overall risk management program, we regularly provide required training to employees at all levels and in all departments on cybersecurity.


text: Our Cyber Security Operations Control center integrates feeds from all key areas of our infrastructure (email, network, endpoint, identity, firewall) into a centralized security information event management, or SIEM, system. This system is integrated with our Incident Response Plan, or IRP, which provides a process for responding to different types of cybersecurity incidents and designates responsibilities and actions to be taken in responding to such incidents. The IRP aims to eradicate problems as quickly as possible, while gathering actionable intelligence, restoring business functions, improving detection, and preventing reoccurrence. It includes guidelines for determining incident type, severity, roles and responsibilities, and escalation points.


text: Furthermore, we perform regular third-party security penetration testing and cyber tabletop exercises with key stakeholders to simulate responding to a hypothetical cybersecurity incident.


text: We contract with third-party security monitoring services, performing active, automated searches of indexed darknet databases. Additionally, we perform quarterly vulnerability scans against our network infrastructure and systems exposed to the Internet. The Company also participates in a cybersecurity risk insurance policy.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Members of the Cybersecurity Committee are appointed by, and serve at the discretion of, the Board. The Cybersecurity Committee consists of at least three members of the Board, all of whom are independent. Each member has a working familiarity and/or experience with cybersecurity, IT strategy, IT development and deployment, or IT risk assessment and management, including information security management.


text: Our executives and IT management and the Cybersecurity Committee are primarily responsible to assess and manage material risks from cybersecurity threats. Our executives and IT management and the Cybersecurity Committee oversee key cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our executives and IT management and the Cybersecurity Committee are informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our cybersecurity risk management is overseen by a senior IT executive with ten years of cybersecurity experience, which includes both Fortune 500 and large semiconductor companies, and thirty-five years of experience in various technology domains, such as IT Infrastructure, Cloud, Cybersecurity, and Application Development.


text: Our executives and IT management and representatives from the Cybersecurity Committee provide quarterly briefings to the Audit Committee of the Board regarding our company's cybersecurity risks and activities, including but not limited to any recent cybersecurity incidents and related responses, and any cybersecurity systems testing. The Audit Committee provides regular updates to the Board on relevant information regarding cybersecurity. In addition, our executives and IT management and representatives from the Cybersecurity Committee provide annual briefings to the Board on cybersecurity risks, related mitigation, and other related responses and activities.


text: The Company has not experienced any material cybersecurity breach in the years ended December 31, 2024, 2023 and 2022. The Company also has not incurred any net expenses from penalties and/or settlements from any material cybersecurity breaches during the years ended December 31, 2024, 2023 and 2022.


text: We are dedicated to safeguarding our invaluable assets and ensuring the well-being of personnel, as demonstrated through the preparation of our cybersecurity program.

companyName: EnerSys

ticker: ENS


text: Cybersecurity Risk Management and Strategy Our cyber risk management program is designed to comprehensively address the spectrum of cybersecurity threats that confront our organization. Within this program, we integrate an analysis of the risks facing the organization to guide our preparedness against cybersecurity threats to ensure a holistic approach that encompasses cross-functional and geographical visibility under the oversight of executive leadership through regular risk management meetings.


text: To aid our cybersecurity risk management strategy, we contract with dedicated third-party firms and assessors to identify risks and threats to our organization. These assessments adhere to leading cybersecurity standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework aligning with industry best practices. Additionally, our organization adheres to compliance with the Cybersecurity Maturity Model Certification (CMMC) and is undergoing International Organization for Standardization (ISO) accreditation, further demonstrating our commitment to adhering to rigorous cybersecurity standards. To oversee incident response and mitigation we utilize our incident response plan and processes to standardize our processes for assessing, identifying, and managing cybersecurity incidents. This includes a comprehensive reporting structure and analysis processes to provide visibility and determine incident business impact. Were a cybersecurity incident to occur, we have also implemented a cross-functional business team to aid in the determination of incident impact, severity, and materiality, with the support of standing external counsel and third-party incident response advisors. Additional to our third-party incident response advisors and support contracts, we undergo regular penetration tests to bolster our readiness in the event of cybersecurity incidents. Furthermore, we have also obtained cybersecurity insurance coverage to enhance protection and minimize potential financial losses arising from cyber threats.


text: We prioritize cybersecurity within our supply chain, both nationally and globally, by assessing our third-party cybersecurity posture to provide secure visibility with our partnerships. As part of our due diligence processes, we conduct security questionnaires and service provider reviews, to align our cybersecurity standards on the onset of our partnerships. Additionally, we collaborate closely with a third-party vendor to enhance supply chain resilience. This collaboration involves leveraging their expertise to inform decision-making and enhance risk oversight processes, ensuring greater robustness, and adaptability in managing supply chain challenges.


text: While we maintain a strong cybersecurity posture, we continuously strive for improvement and vigilance to mitigate evolving threats within this dynamic environment and protect our stakeholders' interests. Our organization has not experienced any unauthorized access resulting from cybersecurity incidents with a materially adverse effect on our business, operations, or financial condition and we remain cognizant of the potential impact of insufficient cybersecurity measures on our operations. For further insights into additional organizational risks, please refer to the General Risk Factors section of Item 1(A) Risk Factors.


text: Cybersecurity Governance The Board delegated primary oversight authority to the Audit Committee who plays a pivotal role in ensuring the effectiveness of our cybersecurity strategy. Through regular updates provided by our leadership team, the committee actively evaluates the organization's cybersecurity posture and aids in prioritizing risk mitigation efforts aligned with our strategic objectives. These updates encompass detailed quarterly reports during audit committee meetings, covering key metrics, ongoing initiatives, and any cybersecurity incidents. Additionally, on an annual basis, the entire board receives updates on the progress of our cybersecurity program and strategy, including insights into emerging risks and industry trends. Moreover, the board benefits from supplementary educational briefings delivered by both internal and external experts, providing invaluable global threat visibility and enhancing the Board's understanding of cybersecurity challenges and opportunities.