text: The Company emphasizes continuous risk evaluation and mitigation to improve the Cybersecurity Risk Management Program's resilience and to instill a culture of vigilance across the Company's business. To promote employee awareness of best practices, the Company socializes policies and tips through its intranet site, sends regular phishing simulations, emails newsletters and hosts cybersecurity learning exercises, all in addition to standard company-wide cybersecurity awareness trainings. The Company also participates in various cybersecurity network memberships, including: • H-ISAC: a global cybersecurity best practice-sharing and threat intelligence network for health care stakeholders and • Domestic Security Alliance Council: a partnership between U.S. government agencies and private sector organizations that exchanges security and intelligence information.


text: The Company has also implemented a risk management process designed to mitigate cybersecurity risks that arise from utilizing third-party service providers. The Company's control over and ability to monitor the security posture of third parties with whom it does business remains limited and there can be no assurance that the Company can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including the Company's right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on its business from any such compromise or failure.

companyName: Bausch & Lomb Corp

ticker: BLCO

secItem: Item 1C


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors—Risks Relating to Information Technology—We have become increasingly dependent on information technology systems and infrastructure and any breakdown, interruption, breach or other compromise of our information technology systems or those of our third party service providers could subject us to liability or interrupt the operation of our business, which could have a material adverse effect on our business, financial condition, cash flows and results of operations and could cause the market value of our common shares to decline" under Item 1A of this Annual Report on Form 10-K.


text: Because cybersecurity and data privacy can affect all facets of the Company's business, the Company employs governance structures that facilitate cross-functional, proactive risk management. The Board is responsible for oversight of the Company's risks from cybersecurity threats and incidents and the Audit Committee maintains primary responsibility related to monitoring this oversight. As noted above, the Company has in place the following teams who are responsible for maintaining various phases of the Cybersecurity Risk Management Program: • Cybersecurity and Risk Management Team which is led by the VP, IT Security and Risk Management, who reports directly to the interim Chief Information Officer ("CIO"). The Cybersecurity and Risk Management Team is overseen by: (i) the Executive Committee, which consists of, among others, the Chief Executive Officer, Chief Financial Officer, Chief Legal Officer and Chief Compliance and Privacy Officer, and (ii) the Audit Committee. The Cybersecurity and Risk Management Team is responsible for maintaining and carrying out the Cybersecurity Risk Management Program. • Materiality Committee, which is led by the interim CIO, Controller and Chief Accounting Officer, and SVP, Assistant General Counsel. The Cybersecurity and Risk Management Team informs the Materiality Committee of Severity 1 incidents and the Materiality Committee is then responsible for assessing whether a threat or an incident has materially affected or is likely to materially affect the Company's business strategy, results of operations or financial condition. Once it is determined that a matter has had a material impact or it is reasonably likely to have a material impact on the Company, the Materiality Committee is required to immediately report the incident to the Disclosure Committee and Audit Committee. • Audit Committee, which is comprised of independent directors, oversees the Cybersecurity and Risk Management Team and the team's implementation of its Cybersecurity Risk Management Program. The Audit Committee receives quarterly updates regarding cybersecurity risks and/or policy. In addition, the Materiality Committee updates the Audit Committee, as necessary, regarding any material cybersecurity incidents. • Disclosure Committee, which is led by the Chief Legal Officer and Chief Financial Officer. The Disclosure Committee is informed of potentially material threats and incidents by the Cybersecurity and Risk Management Team and Materiality Committee and the Disclosure Committee is responsible for the preparation, review and filing of any disclosure required by applicable law.


text: The Company's VP, IT Security and Risk Management and interim CIO, who collectively lead our Cybersecurity and Risk Management Team, have relevant degrees and certifications in Information Technology and Security and have extensive experience in their current and prior roles related to IT Security. Along with leading the Company's cybersecurity learning and awareness trainings, they also regularly participate in various third-party industry conferences and trainings.


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are fully integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by the Company's Board of Directors (the "Board"). The Company's cybersecurity policies, standards and practices follow recognized frameworks established by the National Institute of Standards and Technology ("NIST"). The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with specific the goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: A.K.A. BRANDS HOLDING CORP.

ticker: AKA


text: Risk Management and Strategy Consistent with overall ERM policies and practices, the Company's cybersecurity program focuses on the following areas: • Vigilance: The Company maintains a global presence, with cybersecurity threat operations functioning 24/7 with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides periodic mandatory training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management, internal audit and other key business functions, as well as the members of the Board and the Audit Committee of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. • Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the company's ERM function and the Company's Chief Information Security Officer.


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.


text: The Board, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least once each year, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with the Company's Chief Information Security Officer.


text: The Company's Chief Information Security Officer reports to the Company's Chief Information Officer who is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Chief Information Security Officer works in coordination with Company management. The Company's Chief Information Security Officer has served in various roles in information technology and information security for 25 years, including several Fortune 500 companies as a consultant specializing in risk management and security architecture, VP of Engineering for a payment solutions provider and security principal for an international telecommunications company in the Fortune 100, and has held many of the information security industry's most advanced certifications including ISC2's CISM (Chief Information Security Manager) and CISSP (Chief Information Security Professional), as well as an early adopter of the Cloud Security Alliance's CCSK (Certificate of Cloud Security Knowledge). The Company's Chief Information Officer has served in various roles in information technology for 21 years.


text: The Company's Chief Information Security Officer, in coordination with Company management, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. The Chief Information Security Officer and Company management monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.


text: Risk Management and Strategy Consistent with overall ERM policies and practices, the Company's cybersecurity program focuses on the following areas: • Vigilance: The Company maintains a global presence, with cybersecurity threat operations functioning 24/7 with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments, vendor available software updates and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms and services established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to vetting, identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides periodic mandatory training for personnel regarding cybersecurity and information technology threats, which reinforces the Company's information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested, evaluated and updated on a regular basis. • Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management, internal audit and other key business functions, as well as the members of the Board and the Audit Committee of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. Cybersecurity incidents are assessed for materiality based on potential impacts to operations, financial condition or sensitive data. Material incidents are publicly disclosed within four business days of determining materiality, in compliance with SEC requirements. For the reporting period, no material cybersecurity incidents were identified that required disclosure. • Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the company's ERM function and the Company's Chief Information Security Officer.


text: • Artificial Intelligence ("AI"): The Company has established an AI Governance Policy and framework, overseen by the Company's Chief Information Architect, to ensure that all AI systems utilized or developed follow our data privacy standards, safeguard sensitive information and minimize potential vulnerabilities.


text: The Company's Chief Information Security Officer reports to the Company's Chief Information Officer who is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Chief Information Security Officer works in coordination with Company management. The Company's Chief Information Security Officer has served in various roles in information technology and information security for 26 years, including several Fortune 500 companies as a consultant specializing in risk management and security architecture, VP of Engineering for a payment solutions provider and security principal for an international telecommunications company in the Fortune 100, and has held many of the information security industry's most advanced certifications including ISC2's CISM (Chief Information Security Manager) and CISSP (Chief Information Security Professional), as well as an early adopter of the Cloud Security Alliance's CCSK (Certificate of Cloud Security Knowledge). The Company's Chief Information Officer has served in various roles in information technology for 22 years.


text: Risk Management and Strategy We recognize that risk management is an integral part of achieving our organizational goals, enhancing stockholder value and increasing the likelihood of long-term corporate success. Our processes for assessing, identifying and managing material risks from cybersecurity threats have been integrated into our overall Enterprise Risk Management ("ERM") program. We maintain a strong cybersecurity program to protect not only our business, but also our clients, vendors and employees. We have a dedicated Information Security function ("Infosec") that oversees the company's cyber risk management and strategy.

companyName: Thoughtworks Holding, Inc.


text: As a result of our global business, we must comply with domestic and international laws and regulations. Our privacy and cybersecurity policies encompass incident response procedures, information security and vendor management. In order to help develop these policies and procedures, we monitor the privacy and cybersecurity laws, regulations and guidance applicable to us in the regions where we do business. In order to comply with the variety of domestic and international legal requirements, Infosec aligns the company's program with common industry frameworks (such as the National Institute of Standards and Technology (NIST), the International Organization for Standardization (ISO), Cyber Essentials +, and the Trusted Information Security Assessment Exchange (TISAX)).


text: To assess and manage risk, we have a formal risk assessment methodology. Risk assessments of our key risk categories are conducted on a continuous basis. We perform regular internal audits and we use a third party vendor if we need an external audit. Infosec reviews these assessments and takes action as required to meet compliance requirements. The assessments, along with any mitigation efforts or remediation, are incorporated into our broader risk management process. Between the risk owner, the Infosec team and, in the case of the most severe risks, the Technology Risk Steering Subcommittee (described below), mitigations are decided, and remediation assigned to appropriate teams to implement which is, as needed, overseen by the ERM Steering Committee (described below).


text: On an on-going basis, our information technology systems are monitored for anomalies, vulnerabilities and misconfigurations. Furthermore, all employees are required to take an annual security awareness training, with additional role-specific training for employees involved in security and risk management. With respect to third party service providers, we obligate our vendors to adhere to privacy and cybersecurity measures, and we perform vendor assessments, including their ability to protect data from unauthorized access.


text: In order to drive continuous improvement, we have implemented an internal security and data protection maturity assessment for our client delivery teams. In addition, we commission an independent external assessment of our cybersecurity maturity annually. The results of these assessments are shared with the Board, key senior leadership, and the Infosec leadership team to develop and inform our strategy for the coming year. As described in Item 1A "Risk Factors," our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, employee or vendor misconduct, and other external hazards could expose our information systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business. While we have experienced cybersecurity events, to date, we are not aware that we have experienced a material cybersecurity incident.


text: The sophistication of cybersecurity threats, including through the use of artificial intelligence, continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency may further expose our computer systems to the risk of cybersecurity incidents.


text: Thoughtworks has a multilayer approach to governance of its cybersecurity program. Our Board of Directors encourages management to promote a culture that incorporates risk management into our corporate strategy and day-to-day business operations. Management discusses strategic, operational, financial and legal risks at regular management meetings and raises strategic issues and points of concern with the Board of Directors, or its standing subcommittees, through regularly scheduled or, if necessary, special meetings, as needed. Our Audit Committee, comprised of independent directors from our Board, oversees the Board's responsibilities relating to the operational risk affairs of the Company, including information technology risks, business continuity and data security. Our Audit Committee is informed of such risks through an annual board meeting.


text: Nitin Raina has been our Chief Information Security Officer ("CISO") since 2022. Prior to that, Mr. Raina was Vice President of Cyber and Information Security between 2020 and 2022. From 2015 to 2022, he was Global Director of Information Security. Mr. Raina has over 25 years of work experience in information technology and cybersecurity. Mr. Raina earned a Bachelor of Engineering, Electronic and Telecommunications from the COEP Technology University in Pune, India and a Post Graduate Diploma in Information Technology from the Symbiosis Centre for Distance Learning. Mr. Raina also holds the Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM) industry certifications and Board Qualified Technology Executive (QTE).


text: We also have management level committees, along with Infosec, who support our processes to assess and manage cybersecurity risk as follows: • The ERM Steering Committee, composed of members from senior leadership, including our CISO, regularly assesses and prioritizes enterprise risks and oversees appropriate mitigation plans. • The Technology Risk Steering Subcommittee, composed of members of senior leadership, which includes our Chief Talent and Operating Officer, Chief Information Officer, General Counsel and Chief Compliance Officer, Chief Technology Officer, and Chief Information Security Officer, discusses technology risks, cyber risks, data protection risks and opportunities to enable safe, effective, and efficient execution of business objectives.


text: The CISO, in coordination with management level committees, along with Infosec, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time.


text: At least once a year, the Board of Directors receives an update on the risk management process and enterprise risks, including those related to cybersecurity and data privacy. If there are any significant or critical cybersecurity threats or incidents, management will provide special reports to either the Audit Committee or the Board of Directors, depending on the severity of the threat or incident. Please see our 2023 Proxy Statement filed April 14, 2023 for more information regarding our ERM program.


text: Risk Management and Strategy We rely on information technology networks and systems and data processing to manage a variety of business processes and activities, including, without limitation, to process customer payments and conduct our marketing efforts. We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic, or competitive in nature, and customer data.

companyName: Dutch Bros Inc.

ticker: BROS


text: We utilize certain third-party service providers to perform a variety of functions, such as to outsource certain business critical functions, to augment staff for after-hours support, to help track chain of custody for physical PCI devices for our shops, application providers, hosting companies, distributors, supply chain resources, property management, cloud-based infrastructure, data center facilities, encryption and authentication technology, corporate productivity services, and other functions. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, for certain service providers, our vendor management process may include reviewing the cybersecurity practices of certain providers, contractually imposing obligations on certain providers related to the services they provide and/or the information they process, conducting security assessments, requiring providers to complete written questionnaires regarding their services and data handling practices, conducting periodic re-assessments during their engagement, using a third party vendor management security company to provide certain ongoing monitoring, or annually collect certain information security-related compliance documentation and reports.


text: Risks from cybersecurity threats are among those that we address in the Company's general risk management program. As part of our overall risk management processes, the Company maintains various policies related to information security, including an Incident Response Policy and a Cybersecurity Incident Reporting Policy. We identify cybersecurity threats as part of our risk management processes, including (depending on the environment or systems) through internal monitoring, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environments, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting threat assessments for internal and external threats, and conducting vulnerability assessments to identify vulnerabilities. Our information technology team is responsible for identifying, assessing, and managing the Company's cybersecurity threats and risks under the oversight of our Chief Technology Officer. This team works with third parties from time to time to help identify, assess, and manage cybersecurity risks, including professional services firms and other vendors.


text: Based on our assessment process, we implement and maintain various technical, physical, and organizational measures designed to manage and mitigate cybersecurity risks and potential material impacts. Depending on the environment or systems, we implement measures designed to prevent, detect, respond to, mitigate, and recover from identified and significant cybersecurity threats. The risk management and reduction measures we implement for certain of our environments or systems include: policies and procedures designed to address cybersecurity threats, including an incident response policy, acceptable use policy, and vulnerability management policy; internal and/or external audits of some environments to assess our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; encryption of certain data; network security controls in certain systems; physical and electronic access controls in certain environments; asset management, tracking and disposal; systems monitoring of certain systems; employee security training; penetration testing of certain environments; and maintaining cyber insurance; and a dedicated cybersecurity officer.


text: Our business, results of operations, or financial condition could be materially affected as a result of such risks, due to: the cost of and modification of business activities related to prevention or incident response; potential system failure, data loss, fraud or theft, or other material adverse consequences; disruptions, including in operations, due to potential delays in remediation of high risk or critical vulnerabilities; costs of notices and other disclosures that may be required by applicable data privacy and security obligations; or our inability to recover such costs under insurance policies or contractual rights. See "Risks Related to Our Business" in Item 1A, Risk Factors for more information.


text: The Audit and Risk Committee of the board of directors is responsible for oversight of the Company's processes and policies for enterprise risk identification, management, and assessment, including key risks around data privacy, technology, and information security. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Technology Officer (CTO), Leigh Gower, who has more than 20 years of experience in the information technology field, including work in cybersecurity risk management. Prior to serving the Company, our CTO gained cybersecurity experience serving as Vice President, Technology at Blue Nile, as Senior Director, Product & Technology at T-Mobile, and as Management Consultant at Slalom Consulting.


text: Our CTO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CTO and her team are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including reporting certain incidents to a cross-functional group responsible for making ongoing assessments of reported incidents, led by our Chief Legal Officer and Chief Technology Officer, and includes members of our standing Disclosure Committee. The Chief Legal Officer is responsible for informing the Audit and Risk Committee regarding the Company's significant cybersecurity threats and risk and meets with the Audit and Risk Committee at periodic or special meetings to review and discuss issues. Our Chief Legal Officer oversees an annual enterprise risk assessment that addresses certain applicable cybersecurity risks, the results of which are presented to the Audit and Risk Committee. We engage a third party consulting firm to assist with the annual enterprise risk assessment. Our Chief Legal Officer works with the Board, senior management, others at various levels of the organization, and our outside advisors to help identify, assess, and validate the Company's top risks, taking into account past risk mitigation activities and future plans. Under our Cybersecurity Incident Reporting Policy, the Chief Legal Officer is also responsible for communicating to the Audit and Risk Committee the activities of the Company related to the assessments and reporting of potentially significant cybersecurity incidents.


text: We utilize certain third-party service providers to perform a variety of functions, such as outsourcing certain business critical functions, augmenting staff for after-hours support, help tracking chain of custody for physical PCI devices for our shops, providing applications, hosting our systems, distributing our products, property management, providing cloud-based infrastructure, data center facilities, encryption and authentication technology, supporting corporate productivity services, and other functions. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, for certain service providers, our vendor management process includes reviewing the cybersecurity practices of certain providers, contractually imposing obligations on certain providers related to the services they provide and/or the information they process, conducting security vulnerability assessments, requiring providers to complete written questionnaires regarding their services and data handling practices, conducting periodic re-assessments during their engagement, using a third party vendor management security company to provide certain ongoing monitoring, or annually collecting certain information security-related compliance documentation and reports.


text: Risks from cybersecurity threats are among those that we address in the Company's general risk management program. As part of our overall risk management processes, the Company maintains various policies related to information security, including, for example, an Incident Response Policy and a Cybersecurity Incident Reporting Policy. We identify cybersecurity threats as part of our risk management processes, including (depending on the environment or systems) through internal monitoring, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environments, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting threat assessments for internal and external threats, and conducting security vulnerability assessments to identify vulnerabilities. Our information technology team is responsible for identifying, assessing, and managing the Company's cybersecurity threats and risks under the oversight of our Chief Technology and Information Officer. This team works with third parties from time to time to help identify, assess, and manage cybersecurity risks, including professional services firms and other vendors.


text: Based on our assessment process, we implement and maintain various technical, physical, and organizational measures designed to manage and mitigate cybersecurity risks and potential material impacts. Depending on the environment or systems, we implement measures designed to prevent, detect, respond to, mitigate, and recover from identified and significant cybersecurity threats. The risk management and reduction measures we implement for certain of our environments or systems include: policies and procedures designed to address cybersecurity threats, including an incident response policy, acceptable use policy, and vulnerability management policy; internal and/or external security audit assessments of select environments to assess our exposure to cybersecurity threats, compliance with risk mitigation procedures, and the effectiveness of relevant controls; documented risk assessments; encryption of certain data; network security controls in certain systems; physical and electronic access controls in certain environments; asset management, tracking and disposal; systems monitoring of certain systems; employee security training; penetration testing of certain environments; maintaining cyber insurance; and a dedicated cybersecurity leader.


text: Our business, results of operations, financial condition, or reputation could be materially affected as a result of certain risks from cybersecurity threats, including for example, due to: the cost of and modification of business activities and implementation of security measures; system failure, data loss, fraud or theft; disruptions, including in operations; delays in remediation of high risk or critical vulnerabilities; costs of notices and other disclosures that may be required by applicable data privacy and security obligations; or our inability to recover such costs under insurance policies or contractual rights. See "Risks Related to Our Business" in Item 1A, Risk Factors for more information and a description of the risks from cybersecurity threats that materially affect the Company.


text: The Audit and Risk Committee of the board of directors is responsible for oversight of the Company's processes and policies for enterprise risk identification, management, and assessment, including certain risks around data privacy, technology, and information security. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Technology and Information Officer, Venki Krishnababu, who has over 30 years of experience in the information technology field. Prior to serving the Company, Mr. Krishnababu served in various information technology roles, most recently as Chief Technology Officer, at lululemon athletica inc. (NASDAQ: LULU), and prior to that as Chief Technology Officer at Premera Blue Cross.


text: Our Chief Technology and Information Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Technology and Information Officer and his team are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including reporting certain incidents to a cross-functional group responsible for making ongoing assessments of reported incidents. This group is led by our Chief Legal Officer and Chief Technology and Information Officer, and includes members of our standing Disclosure Committee. The Chief Legal Officer is responsible for informing the Audit and Risk Committee regarding certain significant cybersecurity threats and risks, and meets with the Audit and Risk Committee periodically or at special meetings to review and discuss issues. Additionally, our Chief Legal Officer oversees an annual enterprise risk assessment that addresses certain applicable cybersecurity risks, the results of which are presented to the Audit and Risk Committee. We also engage a third party consulting firm to assist with our annual enterprise risk assessment. Our Chief Legal Officer works with the Board, senior management, others at various levels of the organization, and our outside advisors to help identify, assess, and validate the Company's top risks, taking into account past risk mitigation activities and future plans. Under our Cybersecurity Incident Reporting Policy, the Chief Legal Officer is also responsible for communicating to the Audit and Risk Committee the activities of the Company related to the assessments and reporting of potentially significant cybersecurity incidents.


text: We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: Consensus Cloud Solutions, Inc.

ticker: CCSI


text: Board of Directors Our Board, in coordination with the Audit Committee, oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives presentations at least quarterly from members of our team responsible for overseeing the Company's cybersecurity risk management, including the Chief Information Security Officer (CISO), Chief Technology Officer (CTO), Chief Legal Officer (CLO), and Head of Internal Audit, which address topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. Then, the Audit Committee and such members of our management team report to the Board on a quarterly basis, with an in-depth review at least annually, on data protection and cybersecurity matters. Additionally, the Company has protocols for cybersecurity incidents that meet established reporting thresholds for escalation within the Company including, where appropriate, reporting to the Board and Audit Committee, with required updates for ongoing matters until any such incident has been addressed and resolved.


text: The Company has implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. At the management level, our Cybersecurity and Governance Council, composed of the CISO, CTO, CLO, Chief Revenue Officer and EVP of Operations, and Head of Internal Audit has broad oversight of the Company's risk management processes. The Cybersecurity and Governance Council meets regularly to discuss the risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CISO invites team members from the product and technology groups to attend each Cybersecurity and Governance Council meeting to report on ongoing or relevant cybersecurity and compliance matters. The Cybersecurity and Governance Council reports any material developments to the Audit Committee on a quarterly basis.


text: Our CISO, who has extensive cybersecurity knowledge and skills gained from over 20 years of work experience at the Company and elsewhere, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business. The CISO receives reports on cybersecurity threats from industry threat reports, and the team members in Information Security who are responsible for various parts of the business on an ongoing basis and in conjunction with management regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CISO and the team work closely with Legal and Internal Audit to oversee compliance with legal, regulatory, and contractual security requirements.


text: Risk Management and Strategy The Company employs systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use.


text: Information Security Policy and Requirements The Company's Information Security Policy ("Policy") is based upon the ISO 27001, HITRUST CSF, SOC 2 Type 2, and PCI DSS frameworks and standards and provides specific and detailed direction and support for appropriately maintaining the overall security, confidentiality, integrity, and availability of information within the Company. The Policy covers all processes, equipment, hardware, and software owned or under the control of the Company as well as networks operated by third parties containing Company information or processes. It addresses the Company's procedures and controls for, including but not limited to, asset and data management, user access and authentication, personnel education/trainings, change management, risk management, system configurations, security monitoring and reporting, vulnerability management, and business continuity and disaster recovery. The Policy applies to all employees, consultants, contractors, and other such persons ("Personnel") with access to the aforementioned processes, equipment, hardware, and software. The Policy requires that Personnel agree to and are trained annually on all components of the Policy as a condition of employment, partnership, or temporary affiliation with the Company.


text: Employee Trainings All Company employees must complete trainings at least annually on various security threats and best practices including, but not limited to, trainings on the following topics: the Company's Information Security Policy; Information Security Incident Response Plan; HIPAA, PCI Compliance; GDPR and CCPA; Security Awareness and Incident Response Training covering Social Engineering Phishing (identification and common red flags), Social Media safety best practices, Internet Security best practices, and Incident response training for end-users; and Phishing. In addition, our developers must complete Secure Code / Secure Application Development Training based on OWASP top 10 standards.


text: Incident Response Our Company has adopted an Information Security Incident Response Plan that applies in the event of a cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process follows the NIST framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation.


text: The IRP requires an Information Security Incident Response Team ("IRT") which includes, at a minimum, the following representatives: CTO, CISO, CLO, Data Protection Officer, and department heads of Network Operations, Engineering, and Information Security to oversee all details of the incident response. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company.


text: Third Party Certifications and Audits In addition to our internal cybersecurity capabilities, we regularly engage with consultants, and other third parties to assist with assessing, identifying, and managing cybersecurity risks. Specifically, the Company is engaged with third party auditors for HITRUST, PCI, and SOC 2 Type 2 for annual certification. We are also engaged with a third party Data Protection Officer to oversee compliance with the General Data Protection Regulation (GDPR).


text: Material Cybersecurity Risks, Threats & Incidents While we have not experienced any risks from cybersecurity threats, including those resulting from previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. We also rely on information technology and third party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Form 10-K under the heading "Risks Related to our Business," which should be read in conjunction with the foregoing information.


text: Board of Directors Our Board of Directors, in coordination with the Audit Committee of the Board of Directors (the "Audit Committee"), oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. Our Board of Directors has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives presentations at least quarterly from members of our team responsible for overseeing the Company's cybersecurity risk management, including the Chief Information Security Officer ("CISO"), Chief Technology Officer ("CTO"), Chief Legal Officer ("CLO"), and Head of Internal Audit, which address topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. Then, the Audit Committee and such members of our management team report to the Board of Directors on a quarterly basis, with an in-depth review at least annually, on data protection and cybersecurity matters. Additionally, the Company has protocols for cybersecurity incidents that meet established reporting thresholds for escalation within the Company including, where appropriate, reporting to the Board of Directors and Audit Committee, with required updates for ongoing matters until any such incident has been addressed and resolved.


text: The Company has implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. At the management level, our Cybersecurity and Governance Council, composed of the CISO, CTO, CLO, Chief Revenue Officer and Executive Vice President of Operations, and Head of Internal Audit has broad oversight of the Company's risk management processes. The Cybersecurity and Governance Council meets regularly to discuss the risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CISO invites team members from the product and technology groups to attend each Cybersecurity and Governance Council meeting to report on ongoing or relevant cybersecurity and compliance matters. The Cybersecurity and Governance Council reports any material developments to the Audit Committee on a quarterly basis.


text: Information Security Policy and Requirements The Company's Information Security Policy ("Policy") is based upon the International Organization for Standardization ("ISO") 27001, Health Information Trust Alliance ("HITRUST") Common Security Framework ("CSF"), System and Organization Controls 2 Type 2 ("SOC 2 Type 2"), and Payment Card Industry Data Security Standard ("PCI DSS") frameworks and standards and provides specific and detailed direction and support for appropriately maintaining the overall security, confidentiality, integrity, and availability of information within the Company. The Policy covers all processes, equipment, hardware, and software owned or under the control of the Company as well as networks operated by third parties containing Company information or processes. It addresses the Company's procedures and controls for, including but not limited to, asset and data management, user access and authentication, personnel education/trainings, change management, risk management, system configurations, security monitoring and reporting, vulnerability management, and business continuity and disaster recovery. The Policy applies to all employees, consultants, contractors, and other such persons ("Personnel") with access to the aforementioned processes, equipment, hardware, and software. The Policy requires that Personnel agree to and are trained annually on all components of the Policy as a condition of employment, partnership, or temporary affiliation with the Company.


text: Employee Trainings All Company employees must complete trainings at least annually on various security threats and best practices including, but not limited to, trainings on the following topics: the Company's Information Security Policy; Information Security Incident Response Plan; HIPAA, PCI Compliance; General Data Protection Regulation ("GDPR") and CCPA; Security Awareness and Incident Response Training covering Social Engineering Phishing (identification and common red flags), Social Media safety best practices, Internet Security best practices, and Incident response training for end-users; and Phishing. In addition, our developers must complete Secure Code / Secure Application Development Training based on Open Web Application Security Project top 10 standards.


text: Incident Response Our Company has adopted an Information Security Incident Response Plan that applies in the event of a cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process follows the National Institute of Standards and Technology ("NIST") framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation.


text: Third-Party Certifications and Audits In addition to our internal cybersecurity capabilities, we regularly engage with consultants, and other third parties to assist with assessing, identifying, and managing cybersecurity risks. Specifically, the Company is engaged with third-party auditors for HITRUST, PCI, and SOC 2 Type 2 for annual certification. We are also engaged with a third-party Data Protection Officer to oversee compliance with the GDPR.


text: Material Cybersecurity Risks, Threats & Incidents While we have not experienced any risks from cybersecurity threats, including those resulting from previous cybersecurity incidents, that, to our knowledge, have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Form 10-K under the heading "Risks Related to our Business," which should be read in conjunction with the foregoing information.


text: Risk Management and Strategy In the normal course of business, we collect and store personal information and other sensitive information, including proprietary and confidential business information, intellectual property, information regarding patients, sensitive third-party information and employee information. To protect this information, we have implemented a framework that is designed to identify, assess, and mitigate cybersecurity threats.

companyName: Xeris Biopharma Holdings, Inc.

ticker: XERS


text: We use managed detection and response services to monitor our network infrastructure and associated endpoints for possible cybersecurity threats. In addition, we engage third parties to perform penetration testing and to assess the effectiveness of our cybersecurity practices. We conduct a cybersecurity risk assessment by identifying critical assets, recognizing potential threats and vulnerabilities, and implementing strategies to mitigate these cybersecurity risks and their possible impacts. We also actively engage with key vendors and industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: We have established a cybersecurity incident response plan and provide cybersecurity training to our employees and monitor their activity for adherence to our security protocols.


text: No risks from cybersecurity threats have occurred that have affected our business strategy, results of operations, or financial condition. See "Risk Factors - General Risk Factors" for additional information.


text: Our information security program is overseen by our Executive Director of Information Technology ("IT"). The Executive Director of IT reports to the Chief Financial Officer and oversees the team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, and processes. The Executive Director of IT possesses over twenty-five years of experience in information technology and approximately ten years in cybersecurity risk management.


text: Our Board of Directors ("Board") has responsibility for oversight of risk management and, pursuant to the Audit Committee Charter, has delegated to our Audit Committee oversight of our cybersecurity risk management program. The Executive Director of IT provides reports to the Audit Committee at least annually as well as the Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by internal and external security professionals with the results of those reviews reported to senior management and the Board.


text: As of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. See "Risk Factors - General Risk Factors" for additional information.


text: Our information security program is overseen by our VP of Information Technology ("IT"). The VP of IT reports to the Chief Financial Officer and oversees the team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, and processes. The VP of IT possesses over twenty-five years of experience in information technology and approximately ten years in cybersecurity risk management.


text: Our Board of Directors ("Board") has responsibility for oversight of risk management and, pursuant to the Audit Committee Charter, has delegated to our Audit Committee oversight of our cybersecurity risk management program. The VP of IT provides reports to the Audit Committee at least annually as well as the Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by internal and external security professionals with the results of those reviews reported to senior management and the Board.


text: Risk Management and Strategy Constellation has established programs and processes to manage material risks from cybersecurity threats including assessing and identifying existing cybersecurity risks, as well as continuously monitoring for developing risks. Our cybersecurity risk management strategy is established at the executive level and is implemented through our cybersecurity program which deploys risk-based security controls and services to protect our customers, personnel, information and cyber assets. The program aligns enterprise cyber and physical security controls with the National Institute of Standards & Technology (NIST) Cybersecurity Framework (CSF) and other industry standards such as the NERC and NRC cybersecurity standards. Cybersecurity risk is assessed and reported in our enterprise risk management program, which utilizes the Three Lines Model adapted from the Institute of Internal Auditors, for risk management to assign clear risk responsibilities across the enterprise. Through coordination with operational teams, we align on cybersecurity risk classification, categorization, likelihood, and potential impact to the company. At the highest level, our program includes multi-layered oversight by the Board of Directors and Board Committees.

companyName: CONSTELLATION ENERGY GENERATION LLC


text: Our cybersecurity and physical security controls are implemented through policies and procedures which form the comprehensive framework we utilize for planning, performing, managing, assessing, innovating, and improving our security controls. Our defense-in-depth strategy to protect our cyber assets and sensitive information reduces the potential severity and duration of a cybersecurity incident by leveraging security measures across various layers of the enterprise. Cross-functional executive steering committees and peer groups, with business unit and technical stakeholder participation, are maintained to support oversight, security controls development, change management, implementation, evaluation, continuous improvement, and sustainment.


text: Our cybersecurity program is aligned to the five functions of the NIST Cybersecurity Framework – identify, detect, protect, respond, and recover. To protect our information and cyber assets, we implement practices for training and screening of personnel, access management, network defense, asset configuration management, vulnerability assessment (including penetration testing), third-party security, and privacy and information protection.


text: In addition, to detect cybersecurity events, we deploy security logging and monitoring, malicious code detection, and data loss protection tools. If the company is the target of a cybersecurity attack, we have established processes for incident response and crisis management to detect and triage potential incidents and determine severity, contain, and eradicate a threat. These processes also include steps to recover our systems and information through established and exercised system recovery plans and business continuity plans. Our incident response process includes steps to notify regulatory and other governmental authorities of cybersecurity events as required by law, including providing notice to investors for material cybersecurity events.


text: As part of our process to continuously improve, we utilize internal functions such as our internal audit and risk functions to evaluate security controls and risk management practices. We also engage third-party subject matter experts to independently assess our programs, processes and technical controls, as needed. For our regulated cyber assets associated with critical infrastructure, such as those within the scope of NERC and the NRC, regulatory auditors and inspectors monitor our adherence to mandatory cybersecurity requirements on a regular frequency using a variety of compliance monitoring and enforcement mechanisms.


text: Board Governance and Management Our Board is actively engaged in monitoring the performance of the Company's cybersecurity program and maintains oversight of the Company's enterprise risk program, including with respect to commodity markets, market design, enterprise security (physical and cyber), operating risks, and financial performance. While the full Board retains ultimate responsibility and oversight of the Company's cybersecurity risk management practices, the Nuclear Oversight Committee and the Audit and Risk Committee also have cybersecurity risk management as part of their charters. The Nuclear Oversight Committee is tasked with overseeing compliance with policies and procedures to manage and mitigate cybersecurity risks associated with our nuclear assets. The Audit and Risk Committee oversees policies and processes established by management to identify, assess, monitor, manage and control technology and cyber risks, among other risks. Our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) provide regular reports to the Board, or one or both of its designated Committees, regarding the security of our operational and information technology programs, systems, and risks. We also report on the state of our cybersecurity program and provide key risk indicators to track performance. Emergent matters or events are reported to the Board between scheduled meetings on an ad hoc basis through our incident response and crisis management protocols.


text: At the executive and management level, the Chief Administration Officer, via delegations to the Cyber and Physical Security organizations, is authorized to govern and functionally oversee our security controls and services on behalf of the enterprise. Our cybersecurity organization, under the direction of the CISO who reports to the CIO, implements and provides governance and functional oversight for cybersecurity controls and services. Our CIO has over 20 years of experience with information systems, including management roles in operational security, technical design and engineering, and platform architecture cybersecurity, governance and compliance, and business continuity. Our CISO has over 20 years of experience in cybersecurity, governance and compliance, physical security and business continuity. In addition, cybersecurity risk is assessed and tracked through the Company's enterprise risk management program.


text: Although the risks from cyber threats have not materially affected our business strategy, results of operations, or financial condition to date, we continue to closely monitor cyber risk. Overall, our company has implemented tactical processes for assessing, identifying, and managing material risks from cybersecurity threats to the company including governance at the Board level and accountability in our executive management for the execution of our cyber risk management strategy and the controls designed to protect our operations. See ITEM 1A. RISK FACTORS for additional information regarding the Company's cybersecurity risks.


text: Risk Management and Strategy Constellation has established programs and processes to manage material risks from cybersecurity threats including assessing and identifying existing cybersecurity risks, as well as continuously monitoring for developing risks. Our cybersecurity risk management strategy is established at the executive level and is implemented through our cybersecurity program which deploys risk-based security controls and services to protect our customers, personnel, information and cyber assets. The program aligns enterprise cyber and physical security controls with the National Institute of Standards & Technology (NIST) Cybersecurity Framework (CSF) and other industry standards such as the NERC and NRC cybersecurity standards. Our cybersecurity program is aligned to the five functions of the NIST Cybersecurity Framework – identify, detect, protect, respond, and recover. Cybersecurity risk is assessed and reported in our enterprise risk management program, which utilizes the Three Lines Model adapted from the Institute of Internal Auditors, for risk management to assign clear risk responsibilities across the enterprise. Through coordination with operational teams, we align on cybersecurity risk classification, categorization, likelihood, and potential impact to the company. At the highest level, our program includes multi-layered oversight by the Board of Directors and Board Committees.


text: Our cybersecurity and physical security controls are implemented through policies and procedures we utilize for planning, performing, managing, assessing, innovating, and improving our security controls. To protect our information and cyber assets, we implement practices for training and screening of personnel, access management, network defense, asset configuration management, vulnerability assessment (including penetration testing), third-party security, and privacy and information protection. Our defense-in-depth strategy to protect our cyber assets and sensitive information reduces the potential severity and duration of a cybersecurity incident by leveraging security measures across various layers of the enterprise. Cross-functional executive steering committees and peer groups, with business unit and technical stakeholder participation, are maintained to support oversight, security controls development, change management, implementation, evaluation, continuous improvement, and sustainment.


text: To assist in detecting cybersecurity events, we deploy security logging and monitoring, malicious code detection, and data loss protection tools. If the company is the target of a cybersecurity attack, we have established processes for incident response and crisis management to triage potential incidents, determine severity, contain, and eradicate a threat. These processes require notifications to regulatory and other governmental authorities of cybersecurity events as required by law, including providing notice to investors for material cybersecurity events. To recover our systems and information, we utilize established system recovery plans and business continuity plans.


text: As part of our process to continuously improve, we utilize our internal audit, risk, and legal functions to evaluate security controls and risk management practices. We also engage third-party subject matter experts to independently assess our programs, processes and technical controls, as needed. For our regulated cyber assets associated with critical infrastructure, such as those within the scope of NERC and the NRC, regulatory auditors and inspectors monitor our adherence to mandatory cybersecurity requirements on a regular frequency using a variety of compliance monitoring and enforcement mechanisms.


text: At the executive and management level, the Chief Administration Officer, via delegations to the Cyber Security organization, is authorized to govern and functionally oversee our security controls and services on behalf of the enterprise. Our cybersecurity organization, under the direction of the CISO who reports to the CIO, implements and provides governance and functional oversight for cybersecurity controls and services, including coordination with our Corporate Security function. Our CIO has over 20 years of experience with information systems, including management roles in operational security, technical design and engineering, and platform architecture cybersecurity, governance and compliance, and business continuity. Our CISO has over 20 years of experience in cybersecurity, governance and compliance, physical security and business continuity. In addition, cybersecurity risk is assessed and tracked through the Company's enterprise risk management program.


text: Information technology supports all aspects of our business, including operations, marketing, sales, order processing, production and distribution networks, retail and professional hairstylist customer experience, consumer experience, finance, business intelligence, and product development. We continue to maintain and enhance our information technology systems, cybersecurity infrastructure and customer and consumer experiences in alignment with our long-term strategy. An increasing portion of our global information technology infrastructure is cloud-based and in partnership with industry-leading service providers. We believe this approach enables a high-performance platform to support current and future requirements and enhances our scale and flexibility to respond to the demands of the business by leveraging advanced and leading-edge technologies. We recognize that technology presents opportunities to build a competitive advantage, and we continue to invest in new capabilities across various aspects of our business. Such efforts, however, subject us to increased cyber risk, as these investments are subject to cyberattacks, business disruptions and other risks described in "Risk Factors – Risks Related to Information Technology and Cybersecurity."

companyName: OLAPLEX HOLDINGS, INC.

ticker: OLPX


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. As part of our company-wide enterprise risk management process, we conduct a comprehensive annual enterprise risk assessment that includes evaluation of cybersecurity risks and development of risk mitigation response plans. Company management reviews our enterprise risk assessment with our Audit Committee and our Board of Directors and provides periodic updates with respect to our risk mitigation response plans to our Audit Committee and our Board of Directors. We have established internal policies and procedures for cybersecurity risk management and incident response management that are based on industry standard cybersecurity frameworks, and we provide regular training to our employees regarding evolving cybersecurity threats and risk management.


text: Our cybersecurity team is primarily responsible for identifying, evaluating and responding to risks from cybersecurity threats. Our cybersecurity team is led by our Senior Vice President, Information Technology, who has an undergraduate degree in electronic and communications engineering and over 20 years of experience in information technology, including cybersecurity risk management. Our cybersecurity team reviews and assesses our cybersecurity profile against internal and external cybersecurity frameworks that are aligned with industry standards on an ongoing basis and conducts ongoing security management internally and through the engagement of third-party vendors and consultants. In addition, our cybersecurity team periodically engages independent third parties to conduct security assessments and internal and external penetration tests. Our cybersecurity team seeks to detect potential cybersecurity incidents through technical safeguards such as automatic detection systems, as well as through our policies and procedures that require internal and external notification of cybersecurity incidents. When a cybersecurity incident occurs, our cybersecurity team implements our incident management procedures and convenes an incident response team consisting of members of our IT team and other company representatives as appropriate based on the nature of the incident. The incident response team determines appropriate containment, eradication and recovery procedures based on the type of incident and recommends any corrective actions to the cybersecurity team following the resolution of the cybersecurity incident. Cybersecurity incidents are reported to our Board of Directors, our Audit Committee or its Information Security Subcommittee as appropriate based on the nature of the incident.


text: We rely on the information systems of third-party vendors, including our cloud vendors, for various functions of our business, including manufacturing, sourcing, distribution, sales and marketing. We engage a third-party risk management software to oversee and identify the risks from cybersecurity threats associated with relevant vendors, based on the services such vendors provide and the information to which they have access. In addition, as part of our new vendor onboarding procedures, we review proposed new vendors' cybersecurity and data protection practices and collaborate with such vendors to align their cybersecurity platforms with our expectations.


text: Our Audit Committee assists the Board of Directors in its oversight of our policies, procedures and practices with respect to risk management and mitigation, including risks related to information security, cybersecurity, and data privacy and protection. The Audit Committee has delegated oversight of risks related to information security, cybersecurity, and data privacy and protection to its Information Security Subcommittee, which meets at least twice a year with our Senior Vice President, Information Technology and other members of our IT department to discuss our cybersecurity profile and related risks, as well as to discuss updates on relevant developments in the cybersecurity threat environment. The Information Security Subcommittee reports to the Audit Committee following each subcommittee meeting, and the Audit Committee reports to our Board of Directors.


text: Although we have experienced cybersecurity incidents in the past, as of the date of this report, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. Despite our continuing efforts, our cybersecurity platform may not prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm or damage to our brand, lost sales, reduced demand, loss of intellectual property rights, significant costs or the Company being subject to government investigations, litigation, fines or damages. For more information, see "Risk Factors – Risks Related to Information Technology and Cybersecurity."


text: Risk Management and Strategy Information technology supports all aspects of our business, including operations, marketing, sales, order processing, production and distribution networks, retail and Pro customer experience, consumer experience, finance, business intelligence, and product development. We continue to maintain and enhance our information technology systems, cybersecurity infrastructure and customer and consumer experiences in alignment with our long-term business strategy. An increasing portion of our global information technology infrastructure is cloud-based and is built and maintained in partnership with industry-leading service providers. We believe this approach enables a high-performance platform to support current and future requirements and enhances our scale and flexibility to respond to the demands of the business by leveraging advanced and leading-edge technologies. We recognize that technology presents opportunities to build a competitive advantage, and we continue to invest in new capabilities across various aspects of our business. Such efforts, however, subject us to increased cyber risk, as technology investments are subject to cyberattacks, business disruptions and other risks described in "Risk Factors – Risks Related to Information Technology and Cybersecurity" included in Part I. Item 1A of this Annual Report.


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. As part of the Company's enterprise risk management process, we conduct a comprehensive annual enterprise risk assessment that includes consideration of cybersecurity risks in conjunction with other Company risks. Our cybersecurity team further evaluates cybersecurity risks and develops risk mitigation response plans. We have established internal policies and procedures for cybersecurity risk management and incident response management that are based on industry standard cybersecurity frameworks, and we provide regular training to our employees regarding evolving cybersecurity threats and risk management. We also maintain cybersecurity insurance coverage that is intended to address certain costs that we may incur in the event that we experience a cybersecurity incident.


text: Our cybersecurity team is primarily responsible for identifying, evaluating and responding to risks from cybersecurity threats. Our cybersecurity team reviews and assesses our cybersecurity profile against internal and external cybersecurity frameworks that are aligned with industry standards on an ongoing basis and conducts ongoing security management internally and through the engagement of third-party vendors and consultants. In addition, our cybersecurity team periodically engages independent third parties to conduct security assessments and internal and external penetration tests. Our cybersecurity team seeks to detect potential cybersecurity incidents through technical safeguards such as automatic detection systems, as well as through our policies and procedures that require internal and external notification of cybersecurity incidents. When a cybersecurity incident occurs, our cybersecurity team implements our incident management procedures and convenes an incident response team consisting of members of our IT team and other company representatives as appropriate based on the nature of the incident. The incident response team determines appropriate containment, eradication and recovery procedures based on the type of incident and recommends any corrective actions to the cybersecurity team following the resolution of the cybersecurity incident. Our cybersecurity incident management procedures also include a framework to assess whether a cybersecurity incident is material and subject to SEC reporting requirements. Such procedures include the involvement of senior members of our cybersecurity team and other senior leaders across various functions.


text: We rely on the information systems of third-party vendors, including our cloud vendors, for various functions of our business, including manufacturing, sourcing, distribution, sales and marketing. We engage a third-party risk management software to oversee and identify the risks from cybersecurity threats associated with relevant vendors, based on the services such vendors provide and the information to which they have access. In addition, as part of our new vendor onboarding procedures, we review proposed new vendors' cybersecurity and data protection practices and certifications and collaborate with such vendors to align their cybersecurity platforms with our expectations.


text: Although we have experienced cybersecurity incidents in the past, as of the date of this report, we have not identified cybersecurity threats that have materially affected or are reasonably likely to materially affect our operations, business strategy, results of operations or financial condition. Despite our continuing efforts, we may face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect our operations, business strategy, results of operations, or financial condition. For more information, see "Risk Factors – Risks Related to Information Technology and Cybersecurity" included in Part I, Item 1A of this Annual Report.


text: Our Audit Committee assists the Board of Directors in its oversight of our policies, procedures and practices with respect to risk management and mitigation, including risks related to information security, cybersecurity, and data privacy and protection. Company management reviews our enterprise risk assessment with our Audit Committee and our Board of Directors and provides periodic updates with respect to our risk mitigation response plans to our Audit Committee and our Board of Directors. The Audit Committee has delegated oversight of risks related to information security, cybersecurity, and data privacy and protection to its Information Security Subcommittee, which meets at least twice a year with senior members of our cybersecurity team to discuss our cybersecurity profile and related risks, as well as to discuss updates on relevant developments in the cybersecurity threat environment. The Information Security Subcommittee reports to the Audit Committee following each subcommittee meeting, and the Audit Committee reports to our Board of Directors. Pursuant to our incident management procedures, cybersecurity incidents are reported to our Board of Directors, our Audit Committee or its Information Security Subcommittee as appropriate based on the nature of the incident.


text: At the management level, our cybersecurity team is led by the head of our information technology team, who is responsible for assessing and managing material risks from cybersecurity threats, including the prevention, mitigation, detection, and remediation of cybersecurity incidents, and is a member of our incident response team. Our cybersecurity team has relevant academic degrees, multiple certifications, and real-world experience managing cybersecurity incidents and risks. The head of our information technology team has over 20 years of experience in information technology and cybersecurity, including previous employment as the chief information officer of multiple entities. Our broader cybersecurity team includes specialists that collectively have over 50 years of experience in information technology and/or cybersecurity and is supported by independent contractors. Our cybersecurity team works collaboratively to identify, assess and manage cybersecurity incidents and risks and implements and maintains centralized cybersecurity practices in coordination with senior leadership and cross functionally with other teams across the Company.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and as described further below, have integrated these processes into our overall risk management systems and processes. Our board of directors performs meaningful oversight of these cybersecurity risk management processes, and our management team is responsible for the day-to-day management of the material risks we face. Management roles in cybersecurity risk management.

companyName: Informatica Inc.

ticker: INFA


text: We have several committees and individual management positions responsible for assessing, identifying, and managing the material cybersecurity risks that we face. Enterprise Risk Management Committee.


text: Our Enterprise Risk Management Committee performs a central function in the assessment and management of our important business risks overall. Our Enterprise Risk Management Committee is comprised of members of our executive leadership. The committee meets periodically to review risk-related topics, including updates on cybersecurity risks and incidents, cybersecurity policy changes, and certain cybersecurity investment recommendations. The diverse skills and experience relevant to cybersecurity risk management possessed by the senior management and executive positions on this committee contribute to our effective management of such risks. The Enterprise Risk Management Committee is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through its Cybersecurity Steering Subcommittee and the Global Security Organization.


text: The Cybersecurity Steering Subcommittee oversees teams of subject matter experts and working groups assigned to focus on specific cybersecurity risk management issues, and receives periodic status updates from those teams.


text: The Enterprise Risk Management Committee provides reports to the audit committee of our board of directors on a quarterly basis to support its oversight of our cybersecurity risk management. Chief Information Security Officer.


text: Our Chief Information Security Officer ("CISO") leads our Global Security Organization. Our CISO supports our compliance with standards and contractual obligations relevant to cybersecurity and good risk governance. Our CISO has over ten years of experience focused on cybersecurity. Our CISO has degrees in computer science and management information systems, each with an emphasis on information security, and has certificates from the Global Information Assurance Certification program as an Information Security Professional and for Strategic Planning, Policy and Leadership. Our CISO has held senior positions focused on the management and operation of our cybersecurity risk management processes for over five years. In addition to its oversight, monitoring and other responsibilities, the Global Security Organization conducts an annual risk assessment process concerning our enterprise and product families. This process supports our prioritization, planning and execution of security program improvements. We also maintain a risk management process throughout the year designed to compile and manage risks through a variety of technical and administrative controls. Third-party cybersecurity risk management.


text: Our cybersecurity processes are designed to identify and address cybersecurity risks associated with our use of third-party technologies and service providers.


text: Our processes call for the evaluation of third parties for security and compliance risks before onboarding them for potential use within our own systems and services. For applicable vendors, we require audit reports and regular responses to our detailed security questionnaires particularly for vendors associated with critical assets. In addition, our procurement processes call for specific contractual obligations from relevant vendors regarding their maintenance of appropriate cybersecurity controls and relevant certifications. Our internal Software Development Lifecycle is designed to build our products in part relying upon industry-standard practices and third-party tools and services to test our code and bundled third-party libraries for known security misconfigurations and errors. Our people are a crucial pillar of our cybersecurity.


text: We operate processes to maintain an internal culture that expressly values cybersecurity. This includes broad-based processes for cybersecurity training, internal communications, reporting concerns, and escalations. Our security awareness and skills training processes guide behaviors across our workforce to be security conscious. Consultants provide valuable services within our cybersecurity risk management.


text: Our cybersecurity risk management processes and technical safeguards are supported by consultants and other service providers including for security assessments of our suppliers, independent risk assessments and forensic analyses. We have also retained third-party providers to monitor and assess our cybersecurity posture by a variety of security indicators, cybersecurity threat intelligence signals and other sources and methods. Incident response processes are an integral part of our cybersecurity posture.


text: If indications are reported of an actual or threatened incident affecting our information systems or networks, or affecting a third party provider relevant to our security, we commence our incident response processes led by the Global Security Organization. This comprehensive incident response process is designed to address possible and confirmed cybersecurity incidents and enable escalations and notifications to appropriate management and members of the audit committee.


text: After an incident has been contained our processes shift emphasis to the continuity of business operations, and if necessary, restoration of services and the recovery of any affected business systems and data. Board oversight of cybersecurity risk management.


text: On a quarterly basis either the audit committee or the full board of directors receive information regarding our cybersecurity risk management from our Global Security Organization and from a representative of our Chief Product Officer's organization. The chair of the audit committee also updates the full board of directors on specific topics that are presented or discussed at the regular meeting of the audit committee.


text: The audit committee also receives an annual review from the CISO regarding our cybersecurity strategies, including how changes in the threat landscape and changes to our risk posture and business and compliance requirements may affect our risk management strategies.


text: As a result of the significance of the cybersecurity threats to our business, we expend material efforts on our cybersecurity risk management processes, although we have not identified any specific threat or incident that has materially affected or is reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For additional information regarding our risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled: "A security breach or incident may compromise the integrity of our products, create service outages for our hosted products, or allow unauthorized access to our network or our customers' data, harm our reputation, create additional liability and adversely impact our financial results."


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, which includes risks that arise from our use of AI, and as described further below, have integrated these processes into our overall risk management systems and processes. Our board of directors performs meaningful oversight of these cybersecurity risk management processes, and our management team is responsible for the day-to-day management of the material risks we face. Management roles in cybersecurity risk management.


text: The Cybersecurity Steering Subcommittee oversees teams of subject matter experts and working groups assigned to focus on specific cybersecurity risk management issues, and receives periodic status updates from those teams. This subcommittee also receives information from several specific risk-focused working groups such as an AI risk review team and a product AI and privacy working group.


text: If indications are reported of an actual or threatened incident affecting our information systems or networks, or affecting a third party provider relevant to our security, we commence our incident response processes supported by the Global Security Organization. This comprehensive incident response process is designed to address possible and confirmed cybersecurity incidents and enable escalations and notifications to appropriate management and members of the audit committee.


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of GC Advisors and other third-party service providers. GC Advisors manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: GOLUB CAPITAL DIRECT LENDING CORP