text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "Corporate Governance and Oversight," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with and receives reports from the Company's ERM function, the Vice President of IT and Digital, the Company's Chief Information Security Officer ("CISO"), and other members of management. • Collaborative Approach: The Company has integrated cybersecurity risk management into its broader risk management framework to promote a Company-wide culture of cybersecurity risk management. To that end, the Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response: The Company has established and maintains a comprehensive incident response plan that fully address the Company's response to a cybersecurity incident, and this plan is tested and evaluated on a regular basis. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. The Company conducts security assessments of all of its electronic information-related third-party service providers before the Company engages them, and the Company maintains policies and procedures to oversee and identify cybersecurity risks associated with its use of third-party service providers. • Education and Awareness: The Company provides regular, mandatory training for the Company's personnel regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, threat modeling, penetration and vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties, including consultants and outside monitoring agencies, to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee during management's annual update to the Audit Committee and the Board, and the Company updates and adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Vishay Precision Group, Inc.

ticker: VPG

secItem: Item 1C


text: Management's Role in Managing Risk The Vice President of IT and Digital, along with the CISO, have developed a strategy and multi-year plan for cybersecurity and regularly update it based on evolving technology trends. The Audit Committee reviews the Company's information security program, including cybersecurity controls, annually (and/or if and when a significant event occurs as defined by its Incident Management policy). The Audit Committee updates the Board annually and upon request of the Board as detailed under the Corporate Governance and Oversight Section.


text: Our Vice President of IT and Digital, holds a Bachelor of Science in Computer Science and brings a wealth of experience from managing IT organizations in large, publicly traded companies, in addition to a distinguished background of service in the Israeli army, where she was responsible for managing classified information. Our CISO has an impressive 20-plus years in the field of cybersecurity, underpinned by a Bachelor's degree specializing in Knowledge and Information Management. Our CISO's extensive experience includes a period of 12 years during which he was employed by the Government of Israel, where he managed classified information systems and teams, a role that demands the highest levels of diligence and expertise in information security.


text: Through third-party service providers and attendance at seminars, the Vice President of IT and Digital and CISO are regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition enhances our processes to identify, prevent, mitigate and remediate of cybersecurity threats and cybersecurity incidents.


text: Together, our Vice President of IT and Digital and CISO lead a dynamic, cross-functional team that includes relevant stakeholders from all Company divisions. This team plays a pivotal role in raising cybersecurity awareness throughout the Company, ensuring that every employee is informed and cautious about potential cyber threats. They are committed to keeping our Company's management and Board regularly informed on cybersecurity matters, ensuring transparency and proactive management of digital risks. Additionally, they actively collaborate with division managers, participating in divisional management meetings to identify and protect sensitive information. Their involvement at this level ensures that cybersecurity is integrated into every aspect of our operations, aligning with our broader strategic objectives.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and, to the best of our knowledge, are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.


text: Corporate Governance and Oversight The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of directors who have diverse qualifications and experiences.


text: Significant cybersecurity matters, and strategic risk management decisions are escalated to the Audit Committee and, as appropriate, the Board, ensuring that such bodies maintain comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: The Audit Committee regularly reports to the Board regarding the Audit Committee's oversight of cybersecurity matters, such as the periodic assessment and testing of the Company's policies, standards, processes and practices and the risks identified in such assessment and testing.


text: Information Technology and Cybersecurity Risk Management As is the case for all large companies, we are regularly subject to cyberattacks and other cyber incidents and, therefore, cybersecurity occupies a pivotal role within our risk management process. We adhere to a risk-based, multi-layered "defense in depth" approach that is dedicated to the identification, protection, detection, response, and recovery from cyber threats and incidents. We understand that a single technology, process, or business control cannot wholly prevent or mitigate all potential risks. Therefore, we employ a multitude of technologies, processes, and controls, each functioning independently but collectively forming a cohesive strategy aimed at minimizing risk. This strategy is evaluated through various means, such as frequent research and industry security briefings among our information technology group, internal and external audits, independent program assessments, control attestation reports, penetration testing, and other exercises that gauge its effectiveness. Threats and incidents connected with third party service providers are considered and managed under this process as well.

companyName: Ameresco, Inc.

ticker: AMRC


text: We engage external parties, including consultants, independent privacy assessors, computer security firms and risk management and governance experts, to enhance our cybersecurity oversight. For example, we have engaged an outside consulting firm with expertise in the field to help us assess our systems, monitor risk and implement best practices and to support the internal audit of our cyber security programs and we regularly consults with industry groups on emerging industry trends. In addition, as part of our overall risk mitigation strategy, we also maintain cyber insurance coverage. Our cybersecurity policies, standards and procedures include cyber and data breach response plans, which are periodically assessed against the National Institute of Standards and Technology Cybersecurity Framework.


text: We do not believe that there are currently any risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: Cybersecurity Governance and Oversight The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk. The Audit Committee receives and provides feedback on periodic updates from management regarding cybersecurity. Agendas for quarterly updates are developed and adjusted throughout the year to adapt to any emerging risks or key topics and include, a wide range of information, including the prevailing cybersecurity threat landscape, investments in infrastructure, trainings programs and opportunities for bolstering the security of our company's systems and the protection of our products and operations. The full Board of Directors receives regular reports from the Audit Committee and our management on our cyber security program and the emerging threat landscape.


text: We have a Senior Vice President of Information Technology whose team is responsible for leading company-wide cybersecurity strategy, policy, standards and processes and works across relevant units of Ameresco. Our Senior Vice President of Information Technology has more than thirty years of experience in cybersecurity and information technology and based on his long career with Ameresco he has a deep understanding of our information technology and business needs and the cyber security opportunities and risks we face.


text: In actioning our cyber security strategy, our management together with our Senior Vice President of Information Technology evaluate the materiality of any cybersecurity threats and incidents utilizing both qualitative and quantitative considerations. Our internal audit team also provides independent testing on aspects of the operations of our cybersecurity program and the supporting control framework.


text: Our cybersecurity program is designed to ensure the confidentiality, integrity, and availability of data and systems as well as to ensure timely identification of and response to any incidents. This design is geared toward supporting our business objectives and the needs of our valued customers, employees, and other stakeholders. We firmly believe that cybersecurity is a collective responsibility that extends to every employee, and we prioritize it as an ongoing objective. To increase our employees' awareness of cyber threats, we provide education and share best practices through a security awareness training program. This includes receiving regular exercises, cyber-event simulations, training programs and an annual attestation to our Technology Acceptable Use Policy.


text: See "A failure of our information technology ("IT") and data security infrastructure or cyber or other security incidents, vulnerabilities or other deficiencies, could adversely impact our business, reputation or results of operation or could cause us to default under our contractual obligations." in Item 1A, Risk Factors.


text: We engage external parties, including consultants, independent privacy assessors, computer security firms and risk management and governance experts, to enhance our cybersecurity oversight. For example, we have engaged an outside consulting firm with expertise in the field to help us assess our systems, monitor risk and implement best practices and to support the internal audit of our cyber security programs and we regularly consult with industry groups on emerging industry trends. In addition, as part of our overall risk mitigation strategy, we also maintain cyber insurance coverage. Our cybersecurity policies, standards and procedures include cyber and data breach response plans, which are periodically assessed against the National Institute of Standards and Technology Cybersecurity Framework.


text: Our Senior Vice President of Information Technology is responsible for leading our company-wide cybersecurity strategy, policy, standards and processes and together with our whole information technology team works across relevant units of Ameresco. Our Senior Vice President of Information Technology has more than thirty years of experience in cybersecurity and information technology and based on his long career with Ameresco he has a deep understanding of our information technology and business needs and the cyber security opportunities and risks we face.


text: Cybersecurity Risk Management and Strategy, Governance and Incident Disclosure Cybersecurity risk is a significant operational risk facing our business. Cybersecurity risks result from intentional malicious attacks or unintentional acts that result in an impact to the confidentiality, integrity or availability of our or our clients' or third parties' operations, systems or data. Cybersecurity risk management is an integral element of Customers' overall risk management strategy.

companyName: Customers Bancorp, Inc.

ticker: CUBI


text: The Cybersecurity Risk Management and Strategy, Governance, and Incident Disclosure Program (the "Program") of Customers consists of six key areas focused on technology governance and compliance, standards management and architecture, physical security, application security, cybersecurity operations, and workforce training and preparedness. The Corporate Security Group manages Customers' documented security and cybersecurity incident ("Incident") response and business continuity functions and utilizes annual table-top exercises to test Customers' preparedness for any Incidents ranging from pandemics to cybersecurity events. Incidents are classified with a priority Level 1 (low) to a priority Level 5 (high) rating. Priority Levels 4 and 5 Incidents that may cause material or significant disruption to Customers are immediately reported to Customers' Directors Risk Committee for appropriate disclosure in a Current Report on Form 8-K as required by SEC rules requiring public companies to promptly disclose material cybersecurity Incidents. Our Incident Management Process is illustrated below.


text: Third-Party Risks Our Program is designed to decrease the likelihood of an impact to Customers' operations, reputation, or revenue due to a third-party or fourth-party vendor, supplier, service provider or partner of Customers ("Third-Party") issue, vulnerability, or compromise. The Program achieves this mission through a mix of monitoring, information gathering, and analysis of Third-Party quality and security at the contracting, pre-production and post-implementation stages.


text: Third-Party technology risks that exceed Customers' tolerance level are escalated monthly within the Cybersecurity Risk Indicators Report. Customers' Directors' Risk Committee approves the CISO's mitigant decisioning, including prioritization and resource allocation. Customers has a formal budgeting process. Corporate Security expenses, solutions and staffing needs are subject to zero-based budgeting and additional needs are forecasted based on the previous year's metrics.


text: Customers' Board of Directors periodically reviews and determines Customers' cyber risk tolerance level. The Statement of Cyber Risk Appetite is maintained for record by Customer's Enterprise Risk Management team. Customers' IT Risk Assessment and FFIEC Cybersecurity Assessment are presented annually to Customers' Directors' Risk Committee and Board of Directors, identifying Customers' cybersecurity risk posture, with recommendations for reduction as the Customers' Directors' Risk Committee and Board of Directors deems appropriate.


text: Cybersecurity Governance While often viewed as a technical discipline, we approach cybersecurity as a corporate governance responsibility that involves risk management, reporting controls, testing, and training, and executive accountability. Our motto is that every member of our organization is a member of our security team, a mantra that is driven as part of Customers' overall culture.


text: The cybersecurity group for Customers reports to the Chief Information Officer and is overseen by Customers' Directors' Risk Committee. Our Program is led by the CISO. The Program has been designed to conform with the National Institute of Standards & Technology's ("NIST") Cybersecurity Framework, International Organization for Standardization ("ISO") 27001, as well as the FFIEC guidelines for cybersecurity. We use these frameworks to assist our organization as it seeks to ensure the confidentiality, integrity, and availability of technology and services for its customers, employees, and partners. Our Program is ISO 27001 certified and is audited annually by an external accredited ISO 27001 certification body.


text: Our Program takes a holistic approach to organizational security focusing on both the protection of our core technologies and the protection of the operations and areas of business it supports. The Program manages 86 distinct metrics and operates 24x7x365 to meet the growing needs of Customers as it seeks to ensure the continued protection of its customers.


text: Customers' Directors' Risk Committee receives a monthly Cybersecurity Risk Indicators report from the CISO which provides information on cyber risk, vulnerabilities, disaster recovery testing, employee security awareness training, and Third-Party cybersecurity risk. An annual report named "The State of Security" is compiled and shared with Customers' Directors' Risk Committee summarizing the previous year's activities along with a comprehensive view of trends and the risks they pose. Customers' security policies are reviewed and ratified on an annual basis by the Board of Directors who provide oversight of executive-level enforcement and compliance. Customers also utilizes several global external advisors to ensure the appropriateness of its security posture, adherence to established controls, proper assessment of risk, and efficient operation of its cybersecurity discipline. Customers' Board of Directors includes a vetted board member who possesses expertise in Information Security across various domains.


text: Cybersecurity Risk Management and Strategy, Governance and Incident Disclosure Cybersecurity risk is a significant operational risk facing businesses today. It results from intentional malicious attacks or unintentional acts that impact the confidentiality, integrity, or availability of our, our clients' or third parties' operations, systems, or data. Cybersecurity risk management is an integral element of Customers' overall risk management strategies.


text: The Cybersecurity Risk Management and Strategy, Governance, and Incident Disclosure Program (the "Program") at Customers encompasses six key areas that focus on technology governance and compliance, standards management and architecture, physical security, application security, cybersecurity operations, and workforce training and preparedness. This training includes monthly phishing exercises and annual cybersecurity training required by all employees. The Corporate Security Group oversees Customers' documented security and cybersecurity incident ("Incident") response and business continuity functions employing annual table-top exercises to test Customers' preparedness for any Incidents, ranging from pandemics to cybersecurity events. Incidents are classified by priority levels from Level 1 (low) to Level 5 (high). Incidents classified as Levels 4 and 5, which could lead to material or significant disruptions to Customers, are immediately reported to the Customers' Directors' Risk Committee for appropriate disclosure in a C urrent Report on Form 8-K as required by SEC rules requiring public companies to promptly disclose material cybersecurity Incidents.


text: Third-Party Risks Our Program is designed to reduce the likelihood of impacts on Customers' operations, reputation, or revenue due to issues, vulnerabilities, or compromises related to a third-party or fourth-party vendor, supplier, service provider, or partner of Customers ("Third-Party"). The Program accomplishes this goal through a combination of monitoring, information gathering, and analysis of Third-Party quality and security at the due diligence, contracting, ongoing monitoring and termination stages.


text: Cybersecurity Governance Although often seen as a technical discipline, we view cybersecurity as a responsibility of corporate governance that encompasses risk management, reporting controls, testing, training, and executive accountability. Our motto is that every member of our organization is a part of our security team, a mantra that is embedded in our overall culture of service to our customers.


text: The cybersecurity group for Customers reports to the Chief Information Officer and is overseen by the Customers' Directors' Risk Committee. Our Program is led by the CISO. The Program has been designed to conform to the ISO 27001 standard, as well as the FFIEC guidelines for cybersecurity. We use these frameworks to help our organization ensure the confidentiality, integrity, and availability of technology and services for customers, team members, and partners. Our Program is ISO 27001 certified and is audited annually by an external accredited ISO 27001 certification body. Customers has recently achieved SOC2 Type 2 attestation.


text: Our Program takes a holistic approach to organizational security, focusing on protecting our core technologies and the operations and areas of business it supports. The Program manages numerous metrics and operates on a 24x7x365 basis to meet the growing needs of Customers and ensure the continued protection of its customers.


text: The Customers' Board of Directors periodically reviews and determines Customers' cyber risk tolerance level. The Statement of Cyber Risk Appetite is kept on record by Customer's Enterprise Risk Management team. The Customers' IT Risk Assessment and FFIEC Cybersecurity Assessment are presented annually to the Customers' Directors' Risk Committee and Board of Directors, identifying Customers' cybersecurity risk posture, with recommendations for reduction as deemed appropriate by the Customers' Directors' Risk Committee and Board of Directors. The FFIEC Cybersecurity Assessment will be phased out on August 31, 2025, with Customers introducing an annual NIST CSF 2.0 assessment in its place.


text: The Customers' Directors' Risk Committee receives a quarterly Cybersecurity Risk Indicators report from the CISO, which provides information on cyber risk, vulnerabilities, disaster recovery testing, employee security awareness training, and Third-Party cybersecurity risk. An annual report titled, "The State of Security" is compiled and shared with the Customers' Directors' Risk Committee summarizing the previous year's activities and offering a comprehensive view of trends and the risks they pose. Customers' security policies are reviewed and ratified annually by the Board of Directors, who oversee executive-level enforcement and compliance. Customers also engages several global external advisors to ensure the appropriate security posture, adherence to established controls, proper risk assessment, and efficient operation of its cybersecurity discipline. The Customers' Board of Directors includes a vetted board member with expertise in information security across various domains.


text: Thermon's cybersecurity risk management system is a comprehensive framework that helps the Company identify, assess, and mitigate known cybersecurity risks. The system is designed to protect the confidentiality, integrity, and availability of the Company's information assets.

companyName: Thermon Group Holdings, Inc.

ticker: THR


text: The system includes a risk assessment process that identifies and assesses the Company's cybersecurity risks. The risk assessment process is based on the security principles set forth in the National Institutes of Standards and Technology Common Industry Format Cybersecurity Framework and includes the following steps: • Identification of assets • Identification of threats • Identification of vulnerabilities • Assessment of risk The system is primarily implemented by the Company's cybersecurity team. This team is responsible for: • Developing and implementing the risk assessment process • Developing and implementing the risk mitigation strategy • Developing and implementing the risk monitoring and reporting process • Training the Company's employees on cybersecurity risk management The Company's cybersecurity risk management system is reviewed and updated on an annual basis. This includes a comprehensive incident response plan. The review process is designed to ensure that the system remains effective and efficient as the cybersecurity threat landscape evolves.


text: The Company currently uses a third-party system for training our people on cybersecurity risks as well as strategies to mitigate those risks through interactive learning and tests. The Company tracks the compliance and performance of the relevant people who participate in the training.


text: Monitoring is another key component of the cybersecurity risk management system. We employ 24/7 monitoring and regular testing to mitigate threats and possible weaknesses. Additionally, we maintain insurance coverage for cybersecurity attacks.


text: The Company's Chief Executive Officer ("CEO"), through the appropriate reporting channels, is responsible for the cybersecurity risk management program. The Company's information technology department is responsible for developing and implementing the Company's cybersecurity policies, procedures, and strategies; overseeing the Company's cybersecurity risk assessment process; and monitoring the Company's cybersecurity risk profile.


text: The Company's cybersecurity risk management program is subject to periodic review and updates. The Company's Board of Directors is responsible for overseeing the Company's cybersecurity risk management program through the Audit Committee. The Board receives quarterly reports on the Company's cybersecurity risk profile and the effectiveness of the Company's cybersecurity risk management program.


text: During the past year, there have been no material risks from cybersecurity threats or prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition. Despite our cybersecurity risk management program and the associated controls, and those of our third-party providers, we may be vulnerable to cyber-attacks, computer viruses, security breaches, ransomware attacks, inadvertent or malicious employee actions, program failures, and other risks that could materially impact our financial condition, results of operations and cash flows. For risks regarding cybersecurity and our information systems, please refer to Item 1A. "Risk Factors" in this annual report.


text: The system includes a risk assessment process that identifies and assesses the Company's cybersecurity risks. The risk assessment process is based on the security principles set forth in the National Institutes of Standards and Technology ("NIST") Cybersecurity Framework and includes the following steps: • Identification of assets • Identification of threats • Identification of vulnerabilities • Assessment of risk The system is primarily implemented by the Company's cybersecurity team. This team is responsible for: • Developing and implementing the risk assessment process • Developing and implementing the risk mitigation strategy • Developing and implementing the risk monitoring and reporting process • Training the Company's employees on cybersecurity risk management The Company's cybersecurity risk management system is reviewed and updated on an annual basis. This includes a comprehensive incident response plan. The review process is designed to ensure that the system remains effective and efficient as the cybersecurity threat landscape evolves.


text: The Company's Chief Executive Officer ("CEO"), through the appropriate reporting channels, is responsible for the cybersecurity risk management program. The Company's information technology department is responsible for developing and implementing the Company's cybersecurity policies, procedures, and strategies; overseeing the Company's cybersecurity risk assessment process; and monitoring the Company's cybersecurity risk profile. Our VP, Information Technology, who leads the information technology department, has over 15 years of experience with information security and information technology matters.


text: During the past year, there have been no material risks from cybersecurity threats or prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition. Despite our cybersecurity risk management program and the associated controls, and those of our third-party providers, we may be vulnerable to cyber-attacks, computer viruses, security breaches, ransomware attacks, inadvertent or malicious employee actions, program failures, and other risks that could materially impact our financial condition, results of operations and/or cash flows. For risks regarding cybersecurity and our information systems, please refer to Item 1A. "Risk Factors" in this annual report.


text: We recognize sophisticated global cybersecurity threats and targeted computer crimes pose a continuously evolving risk to the confidentiality, availability, and integrity of our data, operations and infrastructure. We have implemented comprehensive practices to minimize these risks. Our cybersecurity program is certified to the International Organization for Standardization ISO 27001, a standard for information security management, which covers key areas of management, technical and physical controls, legal, compliance and business continuity management.

companyName: LyondellBasell Industries N.V.

ticker: LYB


text: Our management utilizes a systematic approach to evaluating and determining risk tolerance and prioritizes the safeguarding of our digital assets. The Vice President of Cybersecurity leads our cybersecurity program and reports to the Executive Vice President and Chief Innovation Officer, who serves on the Executive Committee and reports to the CEO. The Vice President of Cybersecurity has a Master of Science degree in Cybersecurity Operations, is certified as an information security professional with the International Information System Security Certification Consortium (ISC2) and International Association of Privacy Professionals, and has over thirty years of leadership experience in technology, systems architecture, and cybersecurity.


text: Cybersecurity events are continuously monitored by global security operations centers staffed in the United States, European Union, and Asia Pacific regions with events and incidents being managed based upon the MITRE ATT&CK framework, a system for classifying and describing cyber attacks and intrusions. Management provides guidance and is informed of cybersecurity events through a committee with cross-functional representation of executive leadership. The committee meets at least quarterly for activities such as determining policy, reviewing active risks, assessing impact of emerging threats or regulatory changes, and monitoring active incidents. This committee also receives escalated alerts within 24-hours of confirmed cybersecurity events, and will determine the severity of the incident, engage with crisis management as necessary, and disseminate that information internally as appropriate and warranted.


text: Third-party service providers must meet baseline security requirements before they connect to our systems or manage sensitive information. They are evaluated based on risk, which is based on financial, operational, legal/regulatory, capacity, cybersecurity posture, and reputational impact. Additionally, high risk third-party service providers are continuously monitored for security health and active threats.


text: We recognize the risk posed by global cybersecurity threats, and our Board is regularly updated on emerging risks and maintains oversight of our cybersecurity program implemented to address them. In 2023, the Board conducted its annual comprehensive review of specific cybersecurity and process control topics at its September meeting. Cybersecurity risk evaluation is integrated into our enterprise risk management processes and is presented to management and the board as a part of that process.


text: While management is responsible for assessing and managing our day-to-day risks and control systems, the Audit Committee of the Board oversees our information technology and cybersecurity risks. The Committee conducts a comprehensive review of cybersecurity topics and reviews our programs and practices with management at least annually, and receives management's report on our cybersecurity dashboard, which summarizes key security metrics and activities, at each quarterly Committee meeting.


text: To further advance cybersecurity awareness, we are developing solutions to mitigate the impact of third-party fraudulent cyber activity, including public facing portals for potential and current partners with capability to report suspected phishing.


text: Our cybersecurity program includes, but is not limited to: • annual cybersecurity education for all company computer users on relevant policies and standards, best practices at work and at home; • communication processes including how to identify, respond, and report threats or potential vulnerabilities; • protective software installed and configured on Company systems and mobile devices, updated and patched on a regular basis, to provide the highest level of protection against malicious threats; • an established program based on the MITRE ATT&CK framework for dealing with ransomware and other cybersecurity incidents; • regular technical risk assessments of our network, applications and manufacturing facilities, using a combination of trusted suppliers and a dedicated, objective team; • penetration, discovery and vulnerability assessments conducted daily; • mobile threat protection mechanisms and policies; • business continuity plans that are well documented and tested regularly; disaster recovery plans that are also well documented and tested at least annually; and • coverage for non-damage business interruption or liability for data breaches as a part of the Company's combined insurance programs. In addition, in 2023, management conducted ransomware simulation exercises and engaged outside consultants to perform external perimeter penetration testing.


text: While we attempt to mitigate cybersecurity risks by employing a number of measures, as described above, our employees, systems, networks, products, facilities and services remain potentially vulnerable to ransomware or sophisticated espionage. Depending on their nature and scope, such threats could potentially lead to the compromise of confidential information, improper use of our systems and networks, manipulation and destruction of data, defective products, production downtimes and operational disruptions, which in turn could adversely affect our reputation, competitiveness and results of operations or financial condition. No risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition.


text: Our management utilizes a systematic approach to evaluating and determining risk tolerance and prioritizes the safeguarding of our digital assets. The Chief Information Security Officer ("CISO") is the Vice President of Cybersecurity leading our cybersecurity program and reports to the Executive Vice President and Chief Innovation Officer, who serves on the Executive Committee and reports to the CEO. The CISO has a Master of Science degree in Cybersecurity Operations, is certified as an information security professional with the International Information System Security Certification Consortium (ISC2) and International Association of Privacy Professionals, and has over thirty years of leadership experience in technology, systems architecture, and cybersecurity.


text: Cybersecurity events are continuously monitored by global security operations centers staffed in the United States, European Union, and Asia Pacific regions with events and incidents being managed based upon the MITRE ATT&CK framework, a system for classifying and describing cyberattacks and intrusions. Management provides guidance and is informed of cybersecurity events through a committee with cross-functional representation of executive leadership. The committee meets at least quarterly for activities such as determining policy, reviewing active risks, assessing impact of emerging threats or regulatory changes, and monitoring active incidents. This committee also receives escalated alerts within 24-hours of confirmed cybersecurity events, and will determine the severity of the incident, engage with crisis management as necessary, and disseminate that information internally as appropriate and warranted. The Company's generative artificial intelligence strategy is to "Generate Responsibly," actively providing education and awareness, encouraging the safe exploration of generative AI tools and resources, consistent with Company data protection policies and standards.


text: We recognize the risk posed by global cybersecurity threats, and our Board is regularly updated on emerging risks and maintains oversight of our cybersecurity program implemented to address them. In 2024, management provided a detailed cybersecurity update to the Board and led discussions on specific cybersecurity and process control topics at its May meeting. The Board also attended a training session led by outside counsel on the challenges public companies face with respect to cybersecurity and ransomware attacks in November.


text: Our cybersecurity program includes, but is not limited to: • annual cybersecurity education for all company computer users on relevant policies and standards, best practices at work and at home; • communication processes including how to identify, respond, and report threats or potential vulnerabilities; • protective software installed and configured on Company systems and mobile devices, updated and patched on a regular basis, to provide the highest level of protection against malicious threats; • an established program based on the MITRE ATT&CK framework for dealing with ransomware and other cybersecurity incidents; • regular technical risk assessments of our network, applications and manufacturing facilities, using a combination of trusted suppliers and a dedicated, objective team; • penetration, discovery and vulnerability assessments conducted daily; • mobile threat protection mechanisms and policies; • business continuity plans that are well documented and tested regularly; disaster recovery plans that are also well documented and tested at least annually; certain key financial applications that are tested at least semi-annually; and • coverage for non-damage business interruption or liability for data breaches as a part of the Company's combined insurance programs. In addition, in 2024, management conducted ransomware simulation exercises and engaged outside consultants to perform external perimeter penetration testing.


text: While we attempt to mitigate cybersecurity risks by employing a number of measures, as described above, our employees, systems, networks, products, facilities and services remain potentially vulnerable to ransomware or sophisticated espionage. Depending on their nature and scope, such threats could potentially lead to the compromise of confidential information, improper use of our systems and networks, manipulation and destruction of data, defective products, production downtimes and operational disruptions, which in turn could adversely affect our reputation, competitiveness and results of operations or financial condition. As of February 27, 2025, we do not believe that any cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. See Item 1A. Risk Factors - General Risk Factors for additional information.


text: We face significant and persistent cybersecurity risks due to the widespread use of our websites and mobile applications; the attractiveness of our websites and mobile applications to threat actors, including state-sponsored actors; the fact that we operate globally and must defend against cybersecurity attacks in thirteen countries; the substantial level of harm that could occur to our business, our customers, or our merchants if were we to suffer a material cybersecurity incident; and our use of third-party products and services. Protecting our systems, networks, data and confidential information is a priority at Groupon. We are committed to maintaining robust governance and oversight of these risks and implementing mechanisms, controls, technologies and processes designed to help us identify, assess and manage these risks.

companyName: Groupon, Inc.

ticker: GRPN


text: As of the date of this Form 10-K, we have not experienced a material cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, but there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in significant costs related to, for example: rebuilding our internal systems, implementing additional threat protection measures, providing modifications to our websites and mobile applications, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing merchants and customers with incentives to maintain a business relationship with us, taking other remedial steps with respect to third parties or incurring significant reputational harm. In addition, these threats are constantly evolving, which increases the difficulty of successfully defending against them or implementing adequate preventative measures. We have seen an increase in the volume, frequency and sophistication of cyberattacks. We seek to detect and investigate unauthorized attempts and attacks against our network, cloud infrastructure, websites, and mobile applications and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and our websites and mobile applications; however, we remain potentially vulnerable to known or unknown threats. It is also possible that we, our merchants, our customers or our vendors will be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See Item 1A. - Risk Factors for more information on our cybersecurity risks.


text: The Audit Committee of our Board ("Audit Committee") oversees risks pertaining to cybersecurity. A member of our IT and Information Security teams regularly reports to the Audit Committee, and directly to the Board, as appropriate, on the state of our cybersecurity program and provides updates on cybersecurity matters. In addition, our Vice President of Software Engineering typically conducts an annual cybersecurity review with our Board. We employ security practices to protect and maintain the systems located at our cloud hosting providers, invest in intrusion and anomaly detection tools and engage third-party security firms to test the security of our websites and systems. Specifically, we leverage industry best practices to identify and mitigate data security risks, including but not limited to, utilizing processes and tools to monitor and address email security, the security of our workstations and servers, cloud security, password management, secure file transfers and ransomware protection. In addition, we utilize a firewall, a virtual private network, multi-factor authentication and single sign-on and conduct regular phishing testing. We also regularly evaluate and assess our systems and the controls, processes and practices to protect those systems, including recently completing the migration of our public-facing websites and applications and our back-end business intelligence systems to the cloud. We also retain personnel that have in-depth experience in penetration testing and conduct penetration testing against our own systems. Further, we utilize third party partners to help us monitor issues that are internally discovered or externally reported that may affect our websites and mobile applications, and we have processes to assess the potential cybersecurity impact or risk of these issues. We also have a process in place to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including maintaining an effective security management program abiding by information handling and asset management requirements and notifying us in the event of any known or suspected cyber incident.


text: The day to day operations of our cybersecurity risk management program are overseen by our IT and Information Security teams. Our cybersecurity program is run by our Vice President of Engineering for InfoSec, Darren Redmond, who reports to our Chief Technology Officer ("CTO"), Vojtech Rysanek. Our CTO has served in that position since November 2022, and, prior to Groupon, he was previously the CTO at Aukro, the largest online marketplace in the Czech Republic. Mr. Redmond has served in this position for the last year and has worked at Groupon for over 7 years, and, prior to Groupon, his experience includes serving as the CTO of Knowledge Point, a learning materials management service provider. Our Information Security Officer reports to Mr. Redmond and monitors prevention, detection, mitigation and remediation efforts through regular communication and reporting from professionals in the Information Security team, many of whom hold cybersecurity certifications such as a Certified Information Systems, Security Professional or Certified Information Security Manager, and through the use of technological tools, software and results from third party audits. Our Information Security Officer joined Groupon in November 2023, and, prior to Groupon, was previously in VMware Carbon Black, and prior to that held roles in Skyscanner. Our Security Manager and Security Operation Center Manager also have extensive experience assessing and managing cybersecurity programs and cybersecurity risk.


text: Our VP of InfoSec and CTO regularly report directly to the Audit Committee on our cybersecurity program and efforts to prevent, detect, mitigate and remediate issues. In addition, we have an escalation process in place to inform senior management and the Board of material issues.


text: We face significant and persistent cybersecurity risks due to the widespread use of our websites and mobile applications; the attractiveness of our websites and mobile applications to threat actors, including state-sponsored actors; the fact that we operate globally and must defend against cybersecurity attacks in thirteen countries; the substantial level of harm that could occur to our business, our customers, or our merchants if we were to suffer a material cybersecurity incident; and our use of third-party products and services. Protecting our systems, networks, data and confidential information is a priority at Groupon. We are committed to maintaining robust governance and oversight of these risks and implementing mechanisms, controls, technologies and processes designed to help us identify, assess and manage these risks.


text: As of the date of this Form 10-K, we have not experienced a material cybersecurity threat or incident that resulted in a material adverse impact to our business strategy, results of operations or financial condition, but there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in significant costs related to, for example: rebuilding our internal systems, implementing additional threat protection measures, providing modifications to our websites and mobile applications, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing merchants and customers with incentives to maintain a business relationship with us, taking other remedial steps with respect to third parties or incurring significant reputational harm. In addition, these threats are constantly evolving, which increases the difficulty of successfully defending against them or implementing adequate preventative measures. We have seen an increase in the volume, frequency and sophistication of cyberattacks. We seek to detect and investigate unauthorized attempts and attacks against our network, cloud infrastructure, websites, and mobile applications and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and our websites and mobile applications; however, we remain potentially vulnerable to known or unknown threats. It is also possible that we, our merchants, our customers or our vendors will be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See Item 1A. - Risk Factors for more information on our cybersecurity risks.


text: The Audit Committee oversees risks pertaining to cybersecurity. A member of our IT and Information Security teams regularly reports to the Audit Committee, and directly to the Board, as appropriate, on the state of our cybersecurity program and provides updates on cybersecurity matters. In addition, our Vice President of Software Engineering typically conducts an annual cybersecurity review with our Board. We employ security practices to protect and maintain the systems located at our cloud hosting providers, invest in intrusion and anomaly detection tools and engage third-party security firms to test the security of our websites and systems. Specifically, we leverage industry best practices to identify and mitigate data security risks, including but not limited to, utilizing processes and tools to monitor and address email security, the security of our workstations and servers, cloud security, password management, secure file transfers and ransomware protection. In addition, we utilize a firewall, a virtual private network, multi-factor authentication and single sign-on and conduct regular phishing testing. We also regularly evaluate and assess our systems and the controls, processes and practices to protect those systems, including recently completing the migration of our public-facing websites and applications and our back-end business intelligence systems to the cloud. We also retain personnel that have in-depth experience in penetration testing and conduct penetration testing against our own systems. Further, we utilize third party partners to help us monitor issues that are internally discovered or externally reported that may affect our websites and mobile applications, and we have processes to assess the potential cybersecurity impact or risk of these issues. We also have a process in place to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including maintaining an effective security management program abiding by information handling and asset management requirements and notifying us in the event of any known or suspected cyber incident.


text: The day to day operations of our cybersecurity risk management program are overseen by our IT and Information Security teams. Our cybersecurity program is run by our Vice President of Engineering for InfoSec, Darren Redmond, who reports to our COO, Filip Popovic. Our COO has served in that position since June 2024. Mr. Redmond has served in this position for the last 2 years and has worked at Groupon for over 8 years, and, prior to Groupon, his experience includes serving as the CTO of Knowledge Point, a learning materials management service provider. Our Information Security Officer reports to Mr. Redmond and monitors prevention, detection, mitigation and remediation efforts through regular communication and reporting from professionals in the Information Security team, many of whom hold cybersecurity certifications such as a Certified Information Systems, Security Professional or Certified Information Security Manager, and through the use of technological tools, software and results from third party audits. Our Information Security Officer joined Groupon in November 2023, and, prior to Groupon, was previously in Vodafone, based in Hungary. Our Security Manager and Security Operation Center Manager also have extensive experience assessing and managing cybersecurity programs and cybersecurity risk.


text: Our VP of InfoSec regularly reports directly to the Audit Committee on our cybersecurity program and efforts to prevent, detect, mitigate and remediate issues. In addition, we have an escalation process in place to inform senior management and the Board of material issues.


text: Risk Management and Strategy Information security and privacy are an important part of our culture and foundational to our goal of delivering safe, secure and quality products and services. This philosophy is emphasized throughout the Bank by its Board of Directors, senior leaders, officers, managers and other employees to promote a Bank-wide culture of cybersecurity risk management.

companyName: Capitol Federal Financial, Inc.

ticker: CFFN


text: As a financial institution we collect, store, and transmit sensitive, confidential, and proprietary data and other information, including intellectual property, business information, funds-transfer instructions, payment card data, and personally identifiable information of our customers and employees. This information can be of significant value to criminal actors, and, as described in Item 1A. Risk Factors, cybersecurity incidents and other security breaches involving this information at the Bank, at our service providers or counterparties, may negatively impact our business or performance.


text: We have implemented a strategy to address threats to Bank assets and confidential information. Our information security program, under the responsibility of the Chief Information Officer and the Chief Compliance & Risk Management Officer, balances security risks with business goals and provides appropriate protections for the confidentiality, integrity and availability of Bank and customer information. We annually benchmark our information security program to assess its strength as measured against recommended industry security best practices.


text: Due to our heavy reliance on the strength and capability of our technology systems, which we use both to interface with our customers and to manage our internal financial reporting and other systems, we utilize a layered cybersecurity model designed to protect our systems and sensitive data. This model is composed of a variety of different components including administrative controls, technical controls and other safeguards. These various components are centrally managed and monitored, creating a multi-layered and interlocking cybersecurity defense system. Unauthorized access to our customers' confidential or proprietary information as a result of a cybersecurity incident or otherwise could expose us to reputational harm and litigation and adversely affect our ability to attract and retain customers.


text: We maintain a variety of programs and policies to support the management of cybersecurity risk with a focus on prevention, detection and recovery processes. These programs and policies leverage frameworks and controls from the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, Federal Financial Institutions Examination Council ("FFIEC") cybersecurity guidance, Center for Internet Security ("CIS") Benchmarks, as well as various other regulatory requirements and industry-specific standards. The Bank also participates in the federally recognized Financial Services Information Sharing and Analysis Center and requires its employees and contractors to complete various education and training programs related to information security.


text: The Bank's Information Technology ("IT") and Compliance and Risk Management ("C&RM") teams have the primary responsibility for establishing appropriate policies and procedures that are responsive to cybersecurity threats and other information security risks. Members of these teams have a wide variety of relevant certifications, such as Certified Information Systems Security Professional, Certified Information Security Manager, Certification in Risk Management Assurance and Certified in Risk and Information Systems Control. Our C&RM team provides risk management oversight to the IT team. The Bank's Internal Audit function, using internal and outside expertise, independently oversees, reviews and validates the IT and C&RM activities and reports to the Board of Directors' Audit Committee on the effectiveness of governance, risk management and internal controls.


text: We have established an Enterprise Risk Management program. As part of this program, the C&RM team reviews our IT risk management practices, which are designed to identify, assess, manage, monitor, and report cybersecurity risks. The IT team is responsible for implementing risk management practices set forth in the IT risk management program.


text: As one of the critical elements of the Bank's overall risk management approach, our cybersecurity risk management program and strategy is focused on the following key areas: • Incident Response and Recovery Planning: The Bank has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Bank deploys technical safeguards that are designed to protect the sensitive information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and multifactor authentication and other access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Outside Experts: The Bank routinely works with outside experts, consultants, auditors and other third parties in connection with managing its cybersecurity risks and for advice regarding best practices and technical expertise. • Education and Awareness: The Bank provides regular, mandatory training for personnel regarding cybersecurity threats on matters such as phishing and email security best practices to equip our personnel with effective tools to address cybersecurity threats, and to communicate the Bank's evolving information security policies, standards, processes and practices.


text: While processes are in place to minimize the chance of a successful cyberattack, the Bank has established incident response procedures to address a cyberattack that may occur despite these safeguards. The response procedures are designed to identify, analyze, contain and remediate any such cyber incident that occurs.


text: The Bank engages in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, penetration tests and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are analyzed by the cybersecurity team and the Information Technology Oversight Committee ("ITOC") and provided to the Bank's Board of Directors. We adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: We have implemented a third-party risk program to oversee and manage information security and privacy risks associated with third-party relationships. The program includes the assessment of third parties that provide key services or will access, store, process, or transmit sensitive information during initial onboarding and throughout the lifecycle of the relationship, and management of applicable contractual requirements relating to confidentiality, integrity, availability and privacy obligations, including timely notification of incidents. Third-party services related to advice, assessments, auditing, testing and support related to cybersecurity and information technology processes and services, where appropriate, are also subject to the third-party risk program.


text: Like other financial institutions, the Bank experiences malicious cyber activity on an ongoing basis directed at its websites, computer systems, software, networks and users. This malicious activity includes attempts at unauthorized access and implantation of computer viruses or malware. The Bank also experiences large volumes of phishing and other forms of social engineering attempted for the purpose of perpetuating fraud. Notwithstanding the breadth of our information security and privacy program, it may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse impact. Unauthorized access to our computer systems or stored data could result in theft, including cyber theft, or improper disclosure of confidential information, and the deletion or modification of records could cause interruptions in our operations. The impact of a material information technology event could have a materially adverse effect on our competitive position, reputation, results of operations, financial condition or cash flows.


text: Board Governance The members of the Boards of Directors of the Company and the Bank are identical. The Bank's Board of Directors oversees cybersecurity risk management and strategy for both entities through management updates regarding the policies, practices and security results related to the Gramm-Leach-Bliley Act, IT risk management, IT security metrics, penetration testing, tabletop exercises, IT risk assessments, disaster recovery testing, and security awareness testing and training. Management is responsible for designing and implementing policies, processes and procedures, and deploying physical and virtual technology and safeguards to measure, monitor, and control cybersecurity risk. The Bank's Chief Information Officer provides an annual comprehensive update to the Board of Directors on the status of IT, and the plans for the future as well as quarterly updates which include any cyber incidents. The Bank's Chief Technology Officer provides annual training on cyber security topics and reports to the Board of Directors on the Bank's cyber incidents, if any. Cyber incidents with (i) the potential of materiality; (ii) anticipated publicity; or (iii) anticipated written notices to a significant number of customers; have been promptly reported to the Board with ongoing updates during regular Board meetings. The Bank's Chief Information Officer presents updates on new security measures, programs and services to ITOC. The minutes and materials from the ITOC meetings are available to the Board of Directors on the Directors' Board Portal. The Bank's Information Security Officer provides the Board of Directors an annual report on all aspects of Information Security, including steps taken to minimize the risk of cyber incidents through training and testing employees on phishing, social engineering, etc. This annual report also includes an independent third-party assessment of the Bank's information security systems together with information on steps taken to address any identified weaknesses. The Board of Directors also participates in an annual evaluation of risk and is presented with management's assessment of the top risks, which generally includes several cybersecurity components.


text: Material Cybersecurity Incidents As of September 30, 2024, we were not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Bank, including its business strategies, results of operations or financial condition. For more information on our cybersecurity-related risks, see "Item 1A. Risk Factors – Risks Related to Cybersecurity, Third Parties, and Technology".


text: Risk Management and Strategy Information security and privacy are an important part of our culture and are foundational to our goal of delivering safe, secure and quality products and services. This philosophy is emphasized throughout the Bank by its Board of Directors, senior leaders, officers, managers and other employees to promote a Bank-wide culture of cybersecurity risk management.


text: As a financial institution we collect, store, and transmit sensitive, confidential, and proprietary data and other information, including intellectual property, business information, funds-transfer instructions, payment card data, and personally identifiable information of our customers and employees. This information can be of significant value to criminal actors, and, as described in "Item 1A. Risk Factors - Risks Related to Cybersecurity, Third Parties, and Technology", cybersecurity incidents and other security breaches involving this information at the Bank, at our service providers or counterparties, may negatively impact our business or performance. Unauthorized access to our customers' confidential or proprietary information as a result of a cybersecurity incident or otherwise could expose us to reputational harm and litigation and adversely affect our ability to attract and retain customers.


text: Due to our heavy reliance on the strength and capability of our technology systems, which we use both to interface with our customers and to manage our internal financial reporting and other systems, we utilize a layered cybersecurity model designed to protect our systems and sensitive data. This model is composed of a variety of different components including administrative controls, technical controls and other safeguards. These components are centrally managed and monitored, creating a multi-layered and interlocking cybersecurity defense system.


text: We maintain programs and policies to support the management of cybersecurity risk with a focus on prevention, detection and recovery processes. These programs and policies leverage frameworks and controls from the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, Federal Financial Institutions Examination Council ("FFIEC") cybersecurity guidance, Center for Internet Security ("CIS") Benchmarks, Cyber Risk Institute Profile, as well as various other regulatory requirements and industry-specific standards. The Bank also participates in the federally recognized Financial Services Information Sharing and Analysis Center and requires its employees and contractors to complete various education and training programs related to information security.


text: Like other financial institutions, the Bank is targeted with malicious cyber activity on an ongoing basis directed at its websites, computer systems, software, networks and users. This malicious activity includes attempts at unauthorized access and implantation of computer viruses or malware. The Bank is also targeted with large volumes of phishing and other forms of social engineering attempted for the purpose of perpetuating fraud. Notwithstanding the breadth of our information security and privacy program, it may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse impact. Unauthorized access to our computer systems or stored data could result in theft, including cyber theft, or improper disclosure of confidential information, and the deletion or modification of records could cause interruptions in our operations. The impact of a material information technology event could have a materially adverse effect on our competitive position, reputation, results of operations, financial condition or cash flows.


text: Board Governance The members of the Boards of Directors of the Company and the Bank are identical. The Bank's Board of Directors oversees cybersecurity risk management and strategy for both entities through management updates regarding the policies, practices and security results related to the Gramm-Leach-Bliley Act, IT risk management, IT security metrics, penetration testing, tabletop exercises, IT risk assessments, disaster recovery testing, and security awareness testing and training. Management is responsible for designing and implementing policies, processes and procedures, and deploying physical and virtual technology and safeguards to measure, monitor, and control cybersecurity risk. The Bank's Chief Information Officer provides an annual comprehensive update to the Board of Directors on the status of IT, and the plans for the future as well as quarterly updates which include any cyber incidents. The Bank's Chief Information Officer or delegate provides annual training on cyber security topics and reports to the Board of Directors on the Bank's cyber incidents, if any. Cyber incidents with (i) the potential of materiality, pursuant to SEC cybersecurity disclosure rules; (ii) anticipated publicity; or (iii) anticipated written notices to a significant number of customers; have been promptly reported to the Board with ongoing updates during regular Board meetings. The Bank's Chief Information Officer presents updates on new security measures, programs and services to ITOC. The minutes and materials from the ITOC meetings are available to the Board of Directors on the Directors' Board Portal. The Bank's Information Security Officer provides the Board of Directors with an annual report on all aspects of Information Security, including steps taken to minimize the risk of cyber incidents through training and testing employees on phishing, social engineering, etc. This annual report also includes an independent third-party assessment of the Bank's information security systems together with information on steps taken to address any identified weaknesses. The Board of Directors also participates in an annual evaluation of enterprise risk and is presented with management's assessment of the top risks, which generally include several cybersecurity components.


text: Material Cybersecurity Incidents As of September 30, 2025, we were not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Bank, including its business strategies, results of operations or financial condition. For more information on our cybersecurity-related risks, see "Item 1A. Risk Factors – Risks Related to Cybersecurity, Third Parties, and Technology".


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including consultants, computer security firms and risk management advisors, peer companies, industry groups and governance experts, to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect our company from any related vulnerabilities. As part of our overall risk mitigation strategy, we also maintain cybersecurity insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.

companyName: Schrodinger, Inc.

ticker: SDGR


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect our company or our business strategy, results of operations or financial condition.


text: The audit committee of our board of directors provides direct oversight over cybersecurity risk and provides regular updates to the board of directors regarding such oversight. The audit committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our vice president of information security leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare our company and our employees to address cybersecurity risks, including phishing attacks, ransomware, data breaches, and insider threats. Our vice president of information security has over 15 years of information security experience, including in developing, overseeing and managing information technology and information security teams. He has been with our company since 2017 and has served as our vice president of information security since April 2023. He previously served as our executive director of information security from January 2022 through April 2023, senior director of information security from February 2019 through January 2022 and director of information security from June 2017 through February 2019. Prior to joining our company, our vice president of information security worked at several technology companies and served in roles of increasing responsibility with respect to information security during his tenure.


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary employees, with a cybersecurity awareness program, which covers timely and relevant topics, including social engineering and phishing, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks throughout our information security systems. These tools are integrated into our comprehensive security framework, used to bolster our employee-based cybersecurity programs and are regularly updated to respond to evolving threats.


text: Risk Management Strategy While no organization can eliminate cybersecurity risk entirely, we devote significant resources to our cybersecurity strategy that we believe is reasonably designed to mitigate our cybersecurity and information technology risk. These efforts are designed to protect against, and mitigate the effects of, among other things, cybersecurity incidents where unauthorized parties attempt to access confidential, sensitive, or personal information; potentially hold such information for ransom; destroy data; disrupt or delay our operations or systems; or otherwise cause harm to the Company, our customers, employees, or other key stakeholders.

companyName: Knight-Swift Transportation Holdings Inc.

ticker: KNX


text: Process — We use a multi-layered defensive cybersecurity strategy based on best practices to identify risks, protect technology assets, detect anomalies, respond to, and recover from cybersecurity incidents. Our processes to identify, assess, and manage material risks from cybersecurity threats includes the following: • Identify - We identify risks from cybersecurity threats by first developing and maintaining an understanding of assets and systems essential to our operation and reputation, as well as assets and systems that could provide value to threat actors. Any attempt by a threat actor is considered a potential risk if a threat actor can use it to reduce the value of an asset, reduce our ability to utilize or otherwise access the value of an asset, or surreptitiously gain or increase their access to an asset or system which would result in decreased information security or a disruption in our operations. • Assess - We assess risks from cybersecurity threats by evaluating exposure of our assets to identified cyber risks, as well as potential impacts to our operations or reputation from our inability to access or utilize an asset or system, or a threat actor's ability to gain access to an asset or system. We further evaluate the potential materiality of these risks based on the potential impact to our operations or reputation. • Manage - We mitigate risks from cybersecurity threats by applying multiple layers of defense to maximize our continued ability to access or utilize an asset or system and minimize threat actors' ability to gain or increase their access to an asset or system. We prioritize defensive mechanisms, including administrative, physical, and technical controls, according to their relative cost and reduction in risk.


text: We further monitor, test, assess, and update these processes, including working with technology partners, government agencies, regulators, law enforcement, industry groups, and peers to implement practices to guard against an evolving cyber threat environment and to ensure we remain compliant with relevant regulatory requirements. We offer cybersecurity training for staff at key sites, focusing on reducing human risk through anti-phishing and social engineering exercises. We also carry cybersecurity insurance that provides protection against potential losses arising from certain cybersecurity incidents as part of our cybersecurity risk mitigation strategy.


text: Integration into our Risk Management Program — Our processes to assess, identify, and manage cybersecurity risks are expressly incorporated into our risk management program, which includes technology as one of the five primary risk categories addressed by our risk program, with cybersecurity risks being one of the three subcategories within the technology risk category. As a result, our risk management leadership team works with the Chief Information Officer ("CIO") and Vice President of Information Technology Security ("VPIT"), which we refer to collectively as "Cybersecurity Leadership," to define the top areas of risk in both the technology and cybersecurity areas, with such risks incorporated into our risk management program. Our risk management leadership team also meets on a quarterly basis with our cross-functional technology risk working group, comprised of leaders across the information technology, operations, internal audit, information security and legal departments, to monitor developments on an ongoing basis in the threat landscape in order to identify and prioritize key cybersecurity threats that may impact the Company.


text: Incident Response The Company has a dedicated cybersecurity incident response team, overseen by Cybersecurity Leadership, which is responsible for managing and coordinating the Company's cybersecurity incident response plans and efforts. This team also collaborates closely with other teams in identifying, protecting from, detecting, responding to, and recovering from cybersecurity incidents. Cybersecurity incidents that meet certain thresholds are escalated to Cybersecurity Leadership and cross-functional teams on an as-needed basis for support and guidance. Additionally, this team tracks potentially material cybersecurity incidents to help identify and analyze them. The Company's cybersecurity incident response team partners with the Company's internal cybersecurity teams as well as with external legal advisors, communication specialists, government agencies, regulators, law enforcement, and other key stakeholders as appropriate to respond to cybersecurity incidents. The Company maintains a cybersecurity incident response plan to prepare for and respond to cybersecurity incidents. The incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management and the Board as appropriate. Additionally, the Company conducts at least one cybersecurity tabletop exercise on an annual basis, where members of a cross-functional team engage in a simulated cybersecurity incident scenario. This preparedness exercise is intended to provide training for the participants and to help the Company assess its processes and capabilities in addressing major cybersecurity incidents.


text: Use of Third Parties The Company engages cybersecurity consultants, auditors, and other third parties to assess and enhance its cybersecurity practices. These third parties conduct assessments, penetration testing, and risk assessments to identify weaknesses and recommend improvements. Additionally, the Company leverages a number of third-party tools and technologies as part of its efforts to enhance cybersecurity functions. This includes a managed security service provider to augment the Company's dedicated security operations team, an endpoint detection and response system for continuous monitoring, detection, and response capabilities, and a security information and event management solution to automate real-time threat detection, investigation, and prioritization.


text: We also rely on third-party service providers to support our business and operations, which may include processing of confidential and other sensitive data. We are committed to continuing to develop and enhance our onboarding and monitoring processes for third-party vendors to ensure alignment with best practices. Despite our efforts, it's important to note our service providers are ultimately responsible to establish and uphold their respective cybersecurity programs. We have limited ability to monitor the cybersecurity practices of our service providers and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information systems, software, networks, or other assets owned or controlled by our service providers. Notwithstanding our efforts to mitigate any such risk, there can be no assurance that the compromise or failure of supplier information systems, technology assets, or cybersecurity programs would not have an adverse effect on the security of our information systems.


text: Risks from Material Cybersecurity Threats As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company has experienced cyberattacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place by the Company. Further, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. For a detailed discussion of the Company's cybersecurity related risks, refer to "Operational Risk" within Part I, Item 1A. Risk Factors of this Annual Report.


text: The Board is responsible for overseeing management's assessments of major risks facing the Company and for reviewing options to mitigate such risks. The Board's oversight of major risks, including cybersecurity risks, occurs at both the full Board level and at the Board committee level through the Nominating and Corporate Governance Committee.


text: The Board — The Chief Executive Officer, the Chief Financial Officer, the CIO, members of senior management, and other personnel and advisors, as requested by the Board, report on the risks to the Company, including cybersecurity risks, at regularly scheduled meetings of the Board and its committees. Based on these reports, the Board requests follow-up data and presentations to address any specific concerns and recommendations. Additionally, the Board committees have opportunities to report regularly to the entire Board and review with the Board any major issues that arise at the committee level, which may include cybersecurity risks. KNIGHT-SWIFT TRANSPORTATION HOLDINGS INC.


text: Nominating and Corporate Governance Committee — The Nominating and Corporate Governance Committee, which is comprised entirely of independent directors, reviews with management the Company's technology and cybersecurity frameworks, policies, programs, opportunities, and risk profile both at its regularly scheduled meetings and, if appropriate, in real time. Cybersecurity Leadership, members of the cybersecurity team, or other advisors, as requested by the Nominating and Corporate Governance Committee, report at least quarterly on the Company's technology, data privacy, and cybersecurity strategies and risks. Cybersecurity topics are presented to the Nominating and Corporate Governance Committee on a quarterly basis and generally highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks and related mitigation activities, and any other relevant cybersecurity topics. Reporting to the Nominating and Corporate Governance Committee is multi-format and includes both live presentations and memoranda. The Board believes that this regular cadence of reporting helps to provide the Nominating and Corporate Governance Committee with an informed understanding of the Company's dynamic cybersecurity program and threat landscape. The Nominating and Corporate Governance Committee further reviews with management the Company's business continuity and disaster recovery plans and capabilities, including our cybersecurity and business interruption insurance coverages, and the effectiveness of the Company's escalation procedures. Based on these management reports, the Nominating and Corporate Governance Committee may request follow-up data and presentations to address any specific concerns and recommendations. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated by management on as needed basis to the Nominating and Corporate Governance Committee. The Nominating and Corporate Governance Committee may also escalate such issues to the full Board at any time.


text: Management's Role The Company has a dedicated cybersecurity organization within its technology department that focuses on current and emerging cybersecurity matters. The Company's cybersecurity function is led by Cybersecurity Leadership who are actively involved in assessing and managing cybersecurity risks. They are responsible for implementing cybersecurity policies, programs, procedures, and strategies. The responsibilities and relevant experience of each of the Cybersecurity Leaders are listed below: • The CIO provides leadership for the Company's technology department, including responsibility for leading organization-wide cybersecurity strategy, policy, and processes. Our CIO has served in this role since the 2017 Merger, has been at Swift since 2003, and has over 25 years of cybersecurity experience, including technology positions at AlliedSignal, Sara Lee, and J-Del. • The VPIT, reporting to the CIO, is responsible for the assessment, oversight, and management of our enterprise-wide cybersecurity strategy and governance. Our VPIT has served in this role since 2020 and has significant relevant experience and professional certifications, including 18 years of cybersecurity and infrastructure experience. The VPIT, along with our cybersecurity team, has guided the organization through building a multi-layer cybersecurity program.


text: The Company's cybersecurity department is comprised of teams that engage in a range of cybersecurity activities such as threat intelligence, security architecture, and incident response. These teams, in coordination with third parties, conduct vulnerability management and penetration testing to identify, classify, prioritize, remediate, and mitigate vulnerabilities. The results of these tests are reviewed with the Nominating and Corporate Governance Committee. Leaders from each team regularly meet with Cybersecurity Leadership to provide visibility into major issues and seek alignment with strategy. As noted above under "Incident Response," the Company's cybersecurity incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management and the Board, as appropriate. Cybersecurity incidents that meet certain thresholds are escalated to Cybersecurity Leadership and cross-functional teams on an as-needed basis for support and guidance. The Company's incident response team also coordinates with external legal advisors, communication specialists, government agencies, regulators, law enforcement, and other key stakeholders. KNIGHT-SWIFT TRANSPORTATION HOLDINGS INC.


text: Risk Management Strategy While no organization can eliminate cybersecurity risk entirely, we devote significant resources to our cybersecurity strategy that we believe is reasonably designed to mitigate our cybersecurity and information technology risk. These efforts are designed to protect against, and mitigate the effects of, among other things, cybersecurity incidents where unauthorized parties attempt to access confidential, sensitive, or personal information; potentially hold such information for ransom; destroy data; disrupt or delay our operations or systems; or otherwise cause harm to the Company, our customers, employees, vendors, or other key stakeholders.


text: Process — We use a multi-layered defensive cybersecurity strategy based on best practices to identify risks, protect technology assets, detect anomalies, respond to, and recover from cybersecurity incidents. Our processes to identify, assess, and manage material risks from cybersecurity threats includes the following: • Identify - We identify risks from cybersecurity threats by first developing and maintaining an understanding of assets and systems essential to our operations and reputation, as well as assets and systems that could provide value to threat actors. Any attempt by a threat actor is considered a potential risk if a threat actor can use it to reduce the value of an asset, reduce our ability to utilize or otherwise access the value of an asset, or surreptitiously gain or increase their access to an asset or system which would result in decreased information security or a disruption in our operations. • Assess - We assess risks from cybersecurity threats by evaluating exposure of our assets to identified cyber risks, as well as potential impacts to our operations or reputation from our inability to access or utilize an asset or system, or a threat actor's ability to gain access to an asset or system. We further evaluate the potential materiality of these risks based on the potential impact to our operations or reputation. • Manage - We mitigate risks from cybersecurity threats by applying multiple layers of defense to maximize our continued ability to access or utilize an asset or system and minimize threat actors' ability to gain or increase their access to an asset or system. We prioritize defensive mechanisms, including administrative, physical, and technical controls, according to their relative cost and reduction in risk.


text: We further monitor, test, assess, and update these processes, including working with technology partners, government agencies, regulators, law enforcement, industry groups, and peers to implement practices to guard against an evolving cyber threat environment and to ensure we remain compliant with relevant regulatory requirements. We offer cybersecurity training for corporate employees at headquarters and terminal locations, focusing on reducing human risk through anti-phishing and social engineering exercises. We also carry cybersecurity insurance that provides protection against potential losses arising from certain cybersecurity incidents as part of our cybersecurity risk mitigation strategy.


text: Incident Response The Company has a dedicated cybersecurity incident response team, overseen by Cybersecurity Leadership, which is responsible for managing and coordinating the Company's cybersecurity incident response plans and efforts. This team also collaborates closely with other teams in identifying, protecting from, detecting, responding to, and recovering from cybersecurity incidents. Cybersecurity incidents that meet certain thresholds are escalated to Cybersecurity Leadership and cross-functional teams on an as-needed basis for support and guidance. Additionally, this team tracks potentially material cybersecurity incidents to help identify and analyze them. The Company's cybersecurity incident response team partners with the Company's internal cybersecurity teams as well as with external legal advisors, communication specialists, government agencies, regulators, law enforcement, vendors, and other key stakeholders as appropriate to respond to cybersecurity incidents. The Company maintains a cybersecurity incident response plan to prepare for and respond to cybersecurity incidents. The incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management and the Board as appropriate. Additionally, the Company conducts at least one cybersecurity tabletop exercise on an annual basis, where members of a cross-functional team engage in a simulated cybersecurity incident scenario. This preparedness exercise is intended to provide training for the participants and to help the Company assess its processes and capabilities in addressing major cybersecurity incidents.


text: Risks from Material Cybersecurity Threats As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the Company. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company has experienced cyberattacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place by the Company. Further, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. Our business and operations could be materially and adversely impacted by cybersecurity incidents. For a detailed discussion of the Company's cybersecurity related risks, refer to "Operational Risk" within Part I, Item 1A. Risk Factors of this Annual Report.