text: Risk Management Personnel Our Director, Information Technology (our " IT Director "), who has a career of 23 years in IT, has in-depth working knowledge on IT systems and data security, and his experience is instrumental in developing and executing our cybersecurity strategies. Our IT Director along with the IT team, oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee cybersecurity risk training program. However, the primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Risk Management Team. The diverse background and experience of our Risk Management Team members are instrumental in developing and executing our cybersecurity strategies and supplement the expertise of our IT Director with their understanding of the needs of our business.


text: Monitor Cybersecurity Incidents Our IT Director and the IT team are continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. Our IT Director and the IT team implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, our IT Director is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Energy Recovery, Inc.

ticker: ERII

secItem: Item 1C


text: Reporting to Board of Directors Our IT Director, in his capacity, regularly informs the other Risk Management Team members of all aspects related to cybersecurity risks and incidents. This ensures that various levels management are kept abreast of the cybersecurity posture and potential risks facing Energy Recovery, Inc. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Audit Committee, ensuring that the Audit Committee has comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company- wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our Risk Management Team (see " Management's Role Managing Risk " below for details regarding the team members and scope) works closely with our Information Technology (" IT ") team (our " IT team ") to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity consultants in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes an initial assessment by our Sr. Director, Information Technology (our " Sr. Director of IT ") and IT team, and on an ongoing basis of a few key high-risk third-party systems by our security engineers. We also rely upon certain third-party system providers, including cloud and non-cloud programs provided by software developers such as Microsoft Corporation, Blackline Systems, Inc., Workiva, Inc., and others, to review and notify their customers of any data breach. This approach, both internal and reliance on external review notification, is designed to mitigate risks related to data breaches or other security incidents originating from third-parties.


text: Risks from Cybersecurity Threats While we have a cybersecurity program designed to protect and preserve the integrity of our information systems, we also maintain cybersecurity insurance to manage potential liabilities resulting from specific cyber-attacks. However, it's important to note that although we maintain cybersecurity insurance, there can be no guarantee that our insurance coverage limits will protect against any future claims or that such insurance proceeds will be paid to us in a timely manner. As of December 31, 2024, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition.


text: The Board is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.


text: Board of Directors Oversight The Audit Committee of the Board (the " Audit Committee ") is central to the Board 's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of independent board members with diverse expertise and experience which allows them to oversee cybersecurity risks effectively.


text: Management's Role Managing Risk We have an internal management team comprising of our Chief Financial Officer ("CFO"), Chief Legal Officer ("CLO"), VP, Corporate Controller, Sr. Director, SEC Reporting, and Sr. Director of IT (the " Risk Management Team "), that plays a pivotal role in informing the Audit Committee on cybersecurity risks. The Sr. Director of IT and IT team monitor cybersecurity risks and perform continual risk exercises and assessments. The Risk Management Team meets quarterly to discuss current security breaches and threats, if any, and discuss new controls and results of the cybersecurity risk monitoring, exercises, and assessments. The Risk Management Team provides comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee and the Risk Management Team maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, the Board receives updates on any significant developments in the cybersecurity domain, ensuring the Board 's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives.


text: Risk Management Personnel Our Sr. Director of IT, who has a career of 24 years in IT, has in-depth working knowledge on IT systems and data security, and his experience is instrumental in developing and executing our cybersecurity strategies. Our Sr. Director of IT along with the IT team, oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee cybersecurity risk training program. However, the primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Risk Management Team. The diverse background and experience of o ur Risk Management Team members are instrumental in developing and executing our cybersecurity strategies and supplement the expertise of our Sr. Director of IT with their understanding of the needs of our business.


text: Monitor Cybersecurity Incidents Our Sr. Director of IT and the IT team are continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Sr. Director of IT and the IT team implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, our Sr. Director of IT is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Board of Directors Our Sr. Director of IT, in his capacity, regularly informs the other Risk Management Team members of all aspects related to cybersecurity risks and incidents. This ensures that various levels of management are kept abreast of the cybersecurity posture and potential risks to the company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Audit Committee, ensuring that the Audit Committee has comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: We recognize the importance of maintaining the trust and confidence of our publishers, buyers, partners, customers, and employees. The Audit Committee of our Board ("Audit Committee") is responsible for oversight of the Company's cybersecurity function and efforts, and receives quarterly updates from management regarding the Company's cybersecurity policies, standards, processes, and practices. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our cybersecurity risk management program is overseen by our Senior Vice President, Infrastructure and Security ("SVP Security"), our executive management team, and our Board through the Audit Committee.

companyName: PubMatic, Inc.

ticker: PUBM


text: Risk Management and Strategy We maintain a cross-functional cybersecurity program to identify, prevent, and mitigate cybersecurity threats and incidents. The program also includes implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Policies and Framework Our cybersecurity efforts are governed by a set of policies to address data protection and security incident management, and overseen by our Security Incident Management Team ("SIMT"). Our policies are closely based on recognized frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO") and other applicable industry standards, and we expect to review them at least annually. Our information technology standards and infrastructure safeguards include information security standards prescribed for use by NIST, security measures aligned with the ISO/IEC 27000 series of standards, the Sarbanes-Oxley Act and SSAE 18/ISAE 3402, privacy regulations compliance, and other generally recognized industry standards, in each case, designed to safeguard the confidentiality, integrity and availability of our infrastructure and data and the resiliency of our operations.


text: In connection with these policies, we deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: We also maintain a risk-based approach to identify and oversee cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Incident Response and Recovery Planning We have established and maintain incident response and recovery plans and procedures that address our response to a known or potential cybersecurity incident, including in our systems and those that occur on third-party systems that we use. These plans and procedures include the notification and escalation processes, the investigation and containment process, the evaluation, review, and remediation process for a known or potential cybersecurity incident, and a process to assess the materiality of an incident.


text: Our incident response and recovery planning are overseen by the SIMT and Company personnel who become aware of an incident or potential incident are required to notify the SIMT. The SIMT is comprised of senior members of management and subject matter experts and is responsible for overseeing our cybersecurity program and our response to any cybersecurity incidents.


text: Periodic Review, Testing and Training In accordance with our policies, we perform periodic assessments and tests of the application of our policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a range of activities, including internal audits, assessments, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We engage third parties to perform assessments on our cybersecurity measures as a component of our SOX compliance program.


text: We also provide regular, mandatory training for employees and contractors regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, including the detection and prevention of "phishing" and other attacks using social engineering, and to communicate our evolving information security policies, standards, processes, and practices.


text: The Board, in coordination with the Audit Committee, oversees our overall enterprise risk management ("ERM") process, including the management of risks arising from cybersecurity threats and information security. The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends, and information security considerations arising with respect to our peers and third parties. Beginning in 2024, the Audit Committee will be provided updates on our process, procedures, policies and any cybersecurity incidents at least quarterly. In the event of a material incident, or incident that may be determined to be material, the Audit Committee is informed as soon as reasonably practical and provided regular updates by the SIMT. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee will have the opportunity to discuss our approach to cybersecurity risk management with the SIMT.


text: Our SIMT is responsible for preventing, detecting and responding to cybersecurity threats and incidents to the Company, and includes our Chief Executive Officer ("CEO"), SVP Security, Chief Financial Officer ("CFO"), Chief Marketing Officer, Chief Technology Officer ("CTO"), General Counsel, and other subject matter experts. The SIMT works collaboratively across the Company to implement a program designed to protect our information systems and offerings from cybersecurity threats and to promptly identify and respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the SVP, Security and the SIMT monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents, and report such threats and incidents to our Board and Audit Committee when appropriate.


text: The SIMT, together with other internal and external advisors, has developed a Security Incident Management Policy ("Security Policy") and Cybersecurity Incident Management Process ("CIM Process") to help guide our response to any potential cybersecurity incidents or threats. These documents are reviewed on a periodic basis by the SIMT, and the Audit Committee will be apprised of the SIMT's actions and potential improvements to the Security Policy and CIM process.


text: Our SVP Security has a strong background in engineering with over 30 years' of industry experience in technology and security, and previously operated one of the world's largest retail websites instituting and undergoing PCI and HIPPA certifications.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. Cybersecurity threats, and their evolving nature, may pose a risk to us and our strategy, results of operations, and financial condition in the future.


text: We recognize the importance of maintaining the trust and confidence of our publishers, buyers, partners, customers, and employees. The Audit Committee of our Board ("Audit Committee") is responsible for oversight of the Company's cybersecurity function and efforts, and receives quarterly updates from management regarding the Company's cybersecurity policies, standards, processes, and practices. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our cybersecurity risk management program is overseen by our Senior Vice President, Infrastructure and Security ("SVP Security"), who also serves as our Information Security Officer, our executive management team, and our Board through the Audit Committee.


text: The Board, in coordination with the Audit Committee, oversees our overall enterprise risk management ("ERM") process, including the management of risks arising from cybersecurity threats and information security. The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends, and information security considerations arising with respect to our peers and third parties. Beginning in 2024, the Audit Committee was provided updates on our process, procedures, policies and any cybersecurity incidents at least quarterly. In the event of a material incident, or incident that may be determined to be material, the Audit Committee is informed as soon as reasonably practical and provided regular updates by the SIMT. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee have the opportunity to discuss our approach to cybersecurity risk management with the SIMT.


text: The SIMT, together with other internal and external advisors, has developed a Security Incident Management Policy ("Security Policy") and Cybersecurity Incident Management Process ("CIM Process") to help guide our response to any potential cybersecurity incidents or threats. These documents are reviewed on a periodic basis by the SIMT, and the Audit Committee is apprised of the SIMT's actions and potential improvements to the Security Policy and CIM process.


text: The Company's information technology systems, as well as those of the Company's third-party service providers, are subject to cybersecurity threats. Significant cybersecurity threats, including intrusions into, compromises of, or disruptions in the information technology systems of the Company or its third-party service providers could adversely affect the Company's financial condition and results of operations. The Company maintains and updates its information technology systems to mitigate the risk of cybersecurity threats.

companyName: Quanex Building Products CORP

ticker: NX


text: The Board of Directors have oversight responsibility for the Company's cybersecurity risks. While the Company's employees play a key role in cybersecurity, the Company's Chief Information Officer, General Counsel and other members of management have shared responsibility for assessing and managing the Company's cybersecurity risks. The Company's management has sufficient knowledge, experience and expertise for assessing and managing the Company's cybersecurity risks. The Board of Directors and Audit Committee receive updates from management regarding cybersecurity risks, cybersecurity threats that could impact the Company and cybersecurity initiatives to enhance the Company's cybersecurity practices. The Audit Committee also receives updates on the results of assessments and audits of the Company's information technology systems and controls.


text: The Company has information technology security practices to protect its information technology systems and data and to monitor for potential cybersecurity threats. These practices are integrated into the Company's risk management framework and include: • cybersecurity controls embedded in the Company's information technology systems; • implementation of changes to address potential threats and vulnerabilities of the Company's information technology systems; • incident response programs, including proactive simulations, to identify and manage cybersecurity threats, risks or incidents; • participation in industry forums and collaboration with peers; • security awareness and data protection training for applicable employees; and • engaging third party services and tools to periodically assess and/or monitor cybersecurity threat environment and the company's cybersecurity posture.


text: Additionally, the Company assesses and manages cybersecurity threats associated with its third-party service providers' information technology systems that could compromise the Company's information security or data. Identified cybersecurity threats are communicated to management for review, response, and mitigation as appropriate.


text: The Company assesses cybersecurity risks and changes in the cyber environment and adjusts its practices as deemed appropriate. To date, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk Factors" included elsewhere in this Annual Report on Form 10-K for additional information on risks related to the Company's business, including cybersecurity risks.


text: Risk Management and Strategy We maintain an active cybersecurity risk management and strategy program to address the risks of cybersecurity threats to our business. Our cybersecurity program aligns with the NIST Cybersecurity Framework, and we conduct reviews of its effectiveness on a regular basis through annual testing, periodic third-party evaluations of our processes and controls, and ongoing surveillance. This program involves the use of cybersecurity tools to identify, protect, detect, respond, and recover from cybersecurity threats. Additionally, we engage with third-party cybersecurity consultants and other professional advisors to gain insight and knowledge into emerging threats, industry trends and emerging practices. Annually, we review cybersecurity risk in the context of our overall enterprise risk management assessment. As a component of these processes, our management team, including our Senior Vice President and Chief Technology Officer, identifies and assesses the likelihood and magnitude of risks, on both inherent and residual basis. These evaluations inform our overall cybersecurity strategy.

companyName: AGNC Investment Corp.

ticker: AGNC


text: Our business operations depend significantly on third party service providers. We have processes in place to evaluate the operational and cybersecurity risks posed to us by third parties on whom we are reliant for these services at the inception of our engagement, and we annually review third-party firms that pose the greatest risks to our business and operations from cybersecurity threats. Nonetheless, we rely on the third parties we use to implement security programs commensurate with their own risk, and we cannot ensure that their efforts will be successful.


text: Our primary business involves investments in mortgages and mortgage instruments, but we do not perform mortgage servicing, maintain customer accounts, or provide any direct mortgage lending. Nor do we receive personal information on individual mortgage borrowers as part of our regular operations. However, our business is highly dependent on the availability of information systems, and a cybersecurity incident, if one were to occur, could have the potential to disrupt our operations. Please refer to Risks Related to Our Business Operations in Item 1A. Risk Factors of this Form 10-K for a further discussion of the risks posed by cybersecurity threats.


text: Governance and Oversight The Audit Committee of the Board of Directors has responsibility to oversee management's strategy to address risks from cybersecurity threats. The Audit Committee periodically reviews with management the Company's policies, controls, and procedures used to identify, mitigate, and manage cybersecurity risks. To accomplish this objective, we have established processes for reporting cybersecurity risks to the Audit Committee of the Board of Directors on a quarterly basis. This report, which is prepared by our Senior Vice President and Chief Technology Officer, includes performance as against key performance indicators (KPIs) and service level objectives specifically defined to measure the effectiveness of our cybersecurity controls and risk management efforts, current threat landscape, and strategy. In addition, on an annual basis the Company's Senior Vice President and Chief Technology Officer presents to the Audit Committee on cybersecurity matters, including material changes to the Company's information systems, policies and controls, the results of penetration and other testing and findings from any third-party reviews. Our Audit Committee is committed to maintaining a well-informed and cybersecurity-aware posture, regularly engaging by receiving scheduled and requested updates on our strategy to address risks from cybersecurity threats and the evolving threat landscape. The Board of Directors also is appraised of cybersecurity risks as part of its review of management's annual enterprise risk management assessment.


text: Management plays a pivotal role in identifying, assessing, and managing material risks from cybersecurity threats. This involves continuous monitoring, analyzing emerging threats, and the development and implementation of risk mitigation strategies. Led by our Senior Vice President and Chief Technology Officer with over 20 years of cyber and risk management experience, the Company actively implements and enforces cybersecurity policies, procedures, and strategies, including employee training programs, security assessments, and updates to ensure alignment with our evolving threat landscape.


text: Our business operations depend significantly on third party service providers. We have processes in place to evaluate the operational and cybersecurity risks posed to us by third parties on whom we are reliant for these services at the inception of our engagement, and we continuously monitor third-party firms that pose the greatest risks to our business and operations from cybersecurity threats. Nonetheless, we rely on the third parties we use to implement security programs commensurate with their own risk, and we cannot ensure that their efforts will be successful.


text: Our primary business involves investments in mortgages and mortgage instruments, but we do not perform mortgage servicing, maintain customer accounts, or provide any direct mortgage lending. Nor do we receive personal information on individual mortgage borrowers as part of our regular operations. However, our business is highly dependent on the availability of information systems, and a cybersecurity incident, if one were to occur, could have the potential to disrupt our operations. To date, the Company has not identified any cybersecurity incidents which have materially affected, or are reasonably likely to materially affect, our operations, business strategy, or financial condition. As discussed more fully under Risks Related to Our Business Operations in Item 1A. Risk Factors of this Form 10-K, given the evolving nature and increasing sophistication of cyber threats, there is no guarantee that future incidents will not have a material impact. While we continuously assess, identify, and mitigate cybersecurity risks through policies, procedures, and industry-standard security measures, cyber threats remain dynamic and could potentially disrupt our operations, expose us to legal or regulatory liabilities, or cause reputational harm.


text: Governance and Oversight The Audit Committee of the Board has responsibility to oversee management's strategy to address risks from cybersecurity threats. The Audit Committee periodically reviews with management the Company's policies, controls, and procedures used to identify, mitigate, and manage cybersecurity risks. To accomplish this objective, we have established processes for reporting cybersecurity risks to the Audit Committee of the Board on a quarterly basis. This report, which is prepared by our Senior Vice President and Chief Technology Officer, includes performance as against key performance indicators (KPIs) and service level objectives specifically defined to measure the effectiveness of our cybersecurity controls and risk management efforts, current threat landscape, and strategy. In addition, on at least an annual basis the Company's Senior Vice President and Chief Technology Officer presents to the Audit Committee on cybersecurity matters, including material changes to the Company's information systems, policies and controls, the results of penetration and other testing and findings from any third-party reviews. Our Audit Committee is committed to maintaining a well-informed and cybersecurity-aware posture, regularly engaging by receiving scheduled and requested updates on our strategy to address risks from cybersecurity threats and the evolving threat landscape. The Board also is apprised of cybersecurity risks as part of its review of management's annual enterprise risk management assessment.


text: Management plays a pivotal role in identifying, assessing, and managing material risks from cybersecurity threats. This involves continuous monitoring, analyzing emerging threats, and developing and implementing risk mitigation strategies. The Company, led by our Senior Vice President and Chief Technology Officer—who holds the Certified Information Systems Security Professional (CISSP) designation and has over 20 years of cyber and risk management experience—actively implements and enforces cybersecurity policies, procedures, and strategies, including employee training programs, security assessments, and updates to ensure alignment with our evolving threat landscape.


text: Cybersecurity Risk Management and Strategy Our approach to risk management is designed to identify, assess, prioritize, and manage material risk exposures that could impact our ability to execute our corporate strategy and fulfill our business objectives. Cybersecurity is a critical component of our enterprise risk management approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our Board of Directors and the Audit Committee of the Board of Directors (Audit Committee). To identify, assess, prioritize, and manage potential cybersecurity threats, we have integrated the following cybersecurity safety measures and processes into our overall risk management system: • Product Security: We integrate cybersecurity into our systems, applications, and processes so that security is a key aspect of the design process. Our major products undergo a formal review process that includes threat modeling, code and dependency scanning and manual code review to identify and remediate vulnerabilities prior to their final release. In addition, we have introduced robust access management controls to enhance the security of our offerings. • Threat Intelligence and Incident Prevention, Detection, and Response: In the fiscal year ended January 31, 2024, Zuora procured FS-ISAC membership for threat intelligence and proactive cybersecurity incident prevention. We maintain a cybersecurity detection and response program aligned with the National Institute of Standards and Technology's Cybersecurity Framework to enable rapid cybersecurity threat detection and response. Additionally, Zuora established a Governance, Risk, and Compliance Committee (GRC Committee), which includes our Chief Financial Officer (CFO), Chief Legal Officer (CLO), Chief Information Officer (CIO), Chief Information Security Officer (CISO), and an Internal Audit representative, and others as needed, in the fiscal year ended January 31, 2024. We also deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including role-based user and network access controls, vulnerability scanning, security configuration monitoring, intrusion prevention and detection systems, and anti-malware prevention, which we evaluate and seek to improve through vulnerability assessments and cybersecurity threat intelligence. • Incident Management Procedures: To date, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our Company. We have a well-defined incident response plan that includes procedures and guidelines in the event of a potential Company crisis, including a potential cybersecurity incident that has the potential to materially and adversely impact our customers or business operations. Our guidelines define what is meant by a cybersecurity crisis, identify a core Crisis Management Team that includes our CFO, CLO, CIO, CISO, and engineering and human resource management, establish a basic escalation framework, and create a practical communications protocol. The escalation framework requires that our CEO and Audit Committee (and ultimately, the full Board of Directors) receive prompt notification if there is a reasonable risk of a material cybersecurity incident. Following notification, the Crisis Management Team (along with outside experts as needed) must provide the CEO and the Board of Directors with ongoing updates regarding the cybersecurity incident until it has been remediated.

companyName: ZUORA INC


text: • Training: We have a cybersecurity training program in place for employees. Additionally, our engineers regularly undergo secure code training. • Third-Party Risk Management: Our security experts and our legal team work together to assess third-party vendors to confirm that each vendor contract requires adequate technical and organizational measures to protect the systems and data that such vendor operates or processes on behalf of Zuora. Additionally, we maintain a Supplier Code of Conduct that sets forth our vendor expectations and a Vendor Data Access Policy that establishes the limits on what information our vendors may see, access, modify, and control. • Assessments and Testing: We engage in the periodic assessment and testing of our cybersecurity policies, processes, and practices. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, penetration testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures. We also engage third parties (including auditors and cybersecurity consulting firms) to perform assessments of our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. We adjust our cybersecurity policies, processes, and practices based on the information provided by these assessments and testing activities. • Cybersecurity and Privacy Certifications: Zuora has maintained various security certifications, including ISO 27001, ISO 27002, ISO 27018, ISO 27701, PCI, and SOC 2 Type II.


text: Cybersecurity Governance As part of its broader risk oversight activities, the Board of Directors regularly oversees business, strategic, operational, and financial risks facing Zuora, including cybersecurity risks and mitigation plans, primarily through delegation to the Audit Committee. As reflected in the Audit Committee Charter, the Audit Committee periodically reviews with management our cybersecurity and other information technology risks, controls, and procedures, including Zuora's plans to mitigate cybersecurity risks and respond to potential data breaches. To ensure the Audit Committee may carry out these responsibilities, our management team provides regular information technology and cybersecurity updates, including metrics regarding cyber threat response preparedness, program maturity milestones, risk mitigation status, and the current and emerging threat landscape. In addition, the Audit Committee periodically reviews and provides input regarding the level of information security risk insurance coverage we maintain. The full Board of Directors receives regular updates on the activities of the Audit Committee, including with regard to cybersecurity oversight. One of our directors who serves on the Audit Committee recently underwent formal cybersecurity training and earned a National Association of Corporate Directors CERT Certificate in Cybersecurity Oversight.


text: In the fiscal year ended January 31, 2024, Zuora also hired a new CISO principally responsible for overseeing our cybersecurity risk management program, in partnership with other members of management. Our CISO has served in various roles in cybersecurity and information technology for over 25 years and has experience building security programs and leading global teams at large enterprises and fast-growing technology companies.


text: Moreover, our GRC Committee meets bimonthly to evaluate, among other things, cybersecurity incident response readiness and results of our quarterly cybersecurity tests and annual risk assessment. The GRC Committee also reviews corporate progress regarding artificial intelligence governance, audits, and various other security and privacy exercises and addresses any identified gaps in Zuora policies to prevent, detect, mitigate, and/or remediate any potential cybersecurity incidents.


text: Finally, as disclosed above, our incident management procedures are designed to notify and actively involve our Audit Committee and Board of Directors whenever there is a reasonable risk of a material cybersecurity incident.


text: Cybersecurity Risk Management and Strategy As a financial institution, the Company's business depends on the continuous operation of its information and data processing systems and the security of information received from customers, employees and others. The Company has developed and implemented a cybersecurity program intended to protect the reliability of its critical systems and the confidentiality of nonpublic information.

companyName: PCB BANCORP

ticker: PCB


text: The Company has designed and assess its cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and the guidance of banking and other regulatory agencies. The Company's information security team has primary responsibility for overall cybersecurity risk management program. The Company's cybersecurity professionals are led by the Information Security Officer, who has over 23 years of experience in the information technology field, including over 3 years of experience focusing solely on the cybersecurity space. The Information Security Officer has Security+ and Network+ certifications and is currently working on obtaining CISSP. The Company's cybersecurity risk management is integrated as part of its overall risk management program, and the Company's Chief Risk Officer, Information Security Officer in conjunction with Chief Information Officer work together to develop and maintain the cybersecurity program. In addition to its own employees, the Company engages third party service providers to provide security products and services as needed, using their expertise to evaluate and enhance its cybersecurity program and to inform employees regarding evolving threats, risks and defensive measures. Generally, these third party service providers are managed by the Information Security Officer and Chief Information Officer.


text: Features of the cybersecurity risk management program include: • Technology solutions designed to prevent, detect and mitigate cybersecurity incidents. • Review, testing and assessments of the Company's cybersecurity systems, both internal and using third party service providers with cybersecurity expertise. • Required cybersecurity training for employees to learn about data security, how to identify and mitigate potential cybersecurity risks and how to protect our resources and information. • Specialized security training for members of the risk management, cybersecurity and technology teams that includes information about evolving cybersecurity threats and new risk mitigation and detection technologies. • Processes to assess, identify and manage the material risks from cybersecurity threats include the risks arising from threats associated with third-party service providers, including technology providers and cloud-based platforms. • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and facilitates coordination and communication across multiple parts of the Company. • On-going assessment of the adequacy of the cybersecurity program.


text: Like many financial institutions, the Company has experienced cyber-based attacks and other attempts to compromise its information systems and expects that it will continue to experience these attacks and attempts in the future. In 2021, the Bank was the target of a ransomware attack in which an external actor illegally accessed and/or acquired certain data on its network. As a result, the Bank was sued in a purported class action lawsuit. The lawsuit is currently in process of settlement, subject to final court approval. See "Item 3. Legal Proceedings," above. While the Company has not identified other known risks from previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, like all financial institutions, the Company faces ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect its business, results of operations, or financial condition. See Item 1A – Risk Factors – "Risk Related to our Business -- System failure or breaches of our network security could subject us to increased operating costs as well as litigation and other liabilities.," above.


text: Cybersecurity Governance The Company's Board of Directors and its Risk and Compliance Committee are responsible for overseeing the Company's cybersecurity program and polices. The Company's management, led by the Chief Risk Officer and Information Security Officer in conjunction with Chief Information Officer, is responsible for designing and implementing the program. The Chief Risk Officer and Information Security Officer regularly report to the Risk and Compliance Committee regarding management's implementation of the cybersecurity program, cybersecurity risks and threat, assessments of the Company's cybersecurity systems and the planning and status project to strength the Company's information security. The Company's cybersecurity incident response plan requires that management promptly advise of the Risk and Compliance Committee of any material cybersecurity incident. The Chair of the Risk and Compliance Committee regularly reports to the Board on cybersecurity risks and other matters reviewed by the Committee. Board members may attend Risk and Compliance Committee meetings where cybersecurity issues are discussed and have access to the materials for each Risk and Compliance Committee meeting.


text: The Company has designed and assess its cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and the guidance of banking and other regulatory agencies. The Company's information security team has primary responsibility for overall cybersecurity risk management program. The Company's cybersecurity professionals are led by the Information Security Officer, who has over 23 years of experience in the information technology field, including over 3 years of experience focusing solely on the cybersecurity space. The Information Security Officer has Security+ and Network+ certifications and is currently working on obtaining CISSP. The Company's cybersecurity risk management is integrated as part of its overall risk management program, and the Company's Chief Risk Officer and Information Security Officer, in conjunction with Chief Information Officer, work together to develop and maintain the cybersecurity program. In addition to its own employees, the Company engages third party service providers to provide security products and services as needed, using their expertise to evaluate and enhance its cybersecurity program and to inform employees regarding evolving threats, risks and defensive measures. Generally, these third party service providers are managed by the Information Security Officer and Chief Information Officer.


text: Like all financial institutions, the Company faces ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect its business, results of operations, or financial condition. See Item 1A – Risk Factors – "Risk Related to our Business – System failure or breaches of our network security could subject us to increased operating costs as well as litigation and other liabilities.," above.


text: Cybersecurity Governance The Company's Board of Directors and its Risk and Compliance Committee are responsible for overseeing the Company's cybersecurity program and polices. The Company's management, led by the Chief Risk Officer and Information Security Officer in conjunction with Chief Information Officer, is responsible for designing and implementing the program. The Chief Risk Officer and Information Security Officer regularly report to the Risk and Compliance Committee regarding management's implementation of the cybersecurity program, cybersecurity risks and threat, assessments of the Company's cybersecurity systems and the planning and status of projects to strength the Company's information security. The Company's cybersecurity incident response plan requires that management promptly advise of the Risk and Compliance Committee of any material cybersecurity incident. The Chair of the Risk and Compliance Committee regularly reports to the Board on cybersecurity risks and other matters reviewed by the Committee. Board members may attend Risk and Compliance Committee meetings where cybersecurity issues are discussed and have access to the materials for each Risk and Compliance Committee meeting.


text: Our cybersecurity program is designed to promote actions that protect our computer systems and networks, delivering safe, secure, and reliable operations. Our digital technology group is led by a dedicated Chief Information Security Officer ("CISO"). Our CISO has 15 years of experience as a chief information security officer, over four decades of experience in the energy industry, a degree in computer science, and manages a team at WES that is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, governance, and risk management. The CISO also leads WES's Cybersecurity Council, which is a cross-functional internal team including members of WES senior management, that meets regularly to review current information-technology and cybersecurity issues and initiatives and to collaborate on key decisions. Additionally, the CISO provides quarterly reports to the Audit Committee of the Board of Directors. These reports include updates on WES's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our cybersecurity program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Audit Committee. In addition, in our continuing commitment to cybersecurity education and preparedness, we also engage with industry peers, vendors, intelligence organizations, and law enforcement communities to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: Western Midstream Operating, LP


text: Our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Risk Factors under Part I, Item 1A of this Form 10-K.


text: Our cybersecurity program is designed to promote actions that protect our computer systems and networks, delivering safe, secure, and reliable operations. Our digital technology group is led by a dedicated Chief Information Security Officer ("CISO"). Our CISO has 16 years of experience as a chief information security officer, over four decades of experience in the energy industry, a degree in computer science, and manages a team at WES that is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, governance, and risk management. The CISO also leads WES's Cybersecurity Council, which is a cross-functional internal team including members of WES senior management, that meets regularly to review current information-technology and cybersecurity issues and initiatives and to collaborate on key decisions. Additionally, the CISO provides quarterly reports to the Audit Committee of the Board of Directors. These reports include updates on WES's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our cybersecurity program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Audit Committee. In addition, in our continuing commitment to cybersecurity education and preparedness, we also engage with industry peers, vendors, intelligence organizations, and law enforcement communities to evaluate and enhance the effectiveness of our information security policies and procedures.


text: We developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across other legal, strategic, operational, and financial risk areas.

companyName: FOX FACTORY HOLDING CORP

ticker: FOXF


text: Risk Management and Strategy Our cybersecurity risk management program includes: • policies, process, and tools designed to identify, assess, and mitigate cyber risks across all aspects of our operations; • a cybersecurity team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, monitor, or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees and contractors; and • a Cybersecurity Incident Response Plan that includes procedures for responding to cybersecurity incidents.


text: Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program while our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly, as well as through the Audit Committee of the Board of Directors, and receives regular updates on relevant information regarding cybersecurity.


text: The Audit Committee receives regular reports from management on our company's cybersecurity risks and activities, including but not limited to any recent cybersecurity incidents and related responses, and any cybersecurity systems testing. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser potential impact.


text: Our Chief Information Officer, who oversees our cybersecurity team, is responsible for assessing and managing our material risks from cybersecurity threats. The Chief Information Officer and our cybersecurity team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal personnel dedicated to cybersecurity as well as our engaged and retained external cybersecurity consultants. Our cybersecurity team is supported by the information technology department as well as our engaged third parties and our retained service providers and, in addition, is informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Chief Information Officer has over 20 years of experience in managing large-scale information technology infrastructure and associated technologies and other members of our cybersecurity team have experience and certifications relevant to cybersecurity. In addition, all personnel involved in cybersecurity engage in regular training on cybersecurity matters.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For more information on our cybersecurity related risks, see Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: Risk Management and Strategy Our cybersecurity risk management program includes: • policies, process, and tools designed to identify, assess, and mitigate cyber risks across all aspects of our operations; • a cybersecurity team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents (as such term is used and defined in Item 106(a) of Regulation S-K, as amended and supplemented, of the Securities Act ("Regulation S-K")); • the use of external service providers, where appropriate, to assess, test, monitor, or otherwise assist with aspects of our cybersecurity controls; • cybersecurity awareness training for our employees and contractors; and • a Cybersecurity Incident Response Plan that includes procedures for responding to cybersecurity incidents.


text: The Audit Committee receives regular reports from management on our Company's cybersecurity risks and activities, including but not limited to any recent cybersecurity incidents and related responses, and any cybersecurity systems testing. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser potential impact.


text: Our Chief Information Officer, who oversees our cybersecurity team, is responsible for assessing and managing our material risks from cybersecurity threats (as such term is used and defined in Item 106(a) of Regulation S-K). The Chief Information Officer and our cybersecurity team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal personnel dedicated to cybersecurity as well as our engaged and retained external cybersecurity consultants. Our cybersecurity team is supported by the information technology department as well as our engaged third parties and our retained service providers and, in addition, is informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Chief Information Officer has over 20 years of experience in managing large-scale information technology infrastructure and associated technologies and other members of our cybersecurity team have experience and certifications relevant to cybersecurity. In addition, all personnel involved in cybersecurity engage in regular training on cybersecurity matters.


text: We utilize an internal cross-departmental approach to addressing cybersecurity risk, including input from employees, Senior Management, and our Board of Directors. A cross functional Senior Management Cybersecurity Steering Committee devotes resources to cybersecurity and risk management to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program is based on the National Institute of Standards and Technology ("NIST") framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond, and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection, and mitigation. Our information technology ("IT") team reviews enterprise risk management-level cybersecurity risks annually, and risks are incorporated into the Enterprise Risk Management Committee framework. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include several IT Security policies as well as other policies that directly or indirectly relate to cybersecurity, which address topics related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email, and networked devices. These policies go through an internal review process and are approved by appropriate members of management.

companyName: Workhorse Group Inc.

ticker: WKHS


text: The Company's Director of Cybersecurity in cooperation with the Chief Information Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Company's internal Cybersecurity Steering Committee. Our Director of Cybersecurity has over 20 years of experience leading cybersecurity oversight and holds cybersecurity certifications such as the CISSP ("Certified Information Systems Security Professional").


text: We periodically perform simulations to test employees and provide any necessary remedial training. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity training online. We may also require employees in certain roles to complete additional role-based, specialized cybersecurity training. We continue to expand investments in IT security, taking a multi-layered security approach, which includes additional end-user training, improving security defenses, network segmentation, identifying and protecting critical assets, strengthening monitoring, and alerting, and leveraging industry experts where available.


text: We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team monitors alerts and meets to discuss threat levels, trends, and remediation. Our IT team also regularly collects data on cybersecurity threats and risk areas and conducts a periodic risk assessment. Further, we conduct external penetration tests and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. In collaboration with our Internal Audit team, the internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls ("SOC") 1 or SOC 2 report.


text: The Audit Committee and the Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. The Audit Committee's semi-annual cybersecurity review also includes review of recent enhancements to the Company's defenses and management's progress on its cybersecurity strategic roadmap. In addition, the Cybersecurity Steering Committee receives quarterly cybersecurity reports, which include a review of key performance indicators, test results and related remediation, and may discuss recent threats and how the Company is managing those threats.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to our data and systems, including malware, phishing, and other types of cyber-attacks. For more information about the cybersecurity risks we face, see the risk factors described in Part I, Item 1A, Risk Factors in this Annual Report on Form 10-K.


text: Our Director of Cybersecurity in cooperation with the Chief Information Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to our internal Cybersecurity Steering Committee. Our Director of Cybersecurity has over 20 years of experience leading cybersecurity oversight and holds cybersecurity certifications such as the CISSP ("Certified Information Systems Security Professional").


text: We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team monitors alerts and meets to discuss threat levels, trends, and remediation. Our IT team also regularly collects data on cybersecurity threats and risk areas and conducts a periodic risk assessment. Further, we conduct external penetration tests and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Our internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls ("SOC") 1 or SOC 2 report.


text: The Partnership has implemented processes to assess, identify and manage material risks resulting from cybersecurity incidents. Our Cybersecurity program and processes are based upon the International Standards Organization ("ISO") guidance on information security. The Partnership's processes used to identify, assess, and mitigate cybersecurity risks are integrated into the Partnership's broader risk management system and processes, including through the risk management activities of the Board and its Audit Committee, our Enterprise Risk Management Committee ("ERM Committee"), and our internal audit and information technology functions.

companyName: CVR PARTNERS, LP

ticker: UAN


text: Board Oversight of Cybersecurity Matters The board of directors of the Partnership's general partner (the "Board") considers oversight of CVR Partners' risks and risk management activities, including those related to cybersecurity risk, to be a responsibility of the entire Board. The Board also delegates certain risk oversight responsibilities to certain of its committees, and oversight of the Partnership's cybersecurity risk is delegated by the Board to its Audit Committee. The Audit Committee receives regular reports, typically on a quarterly basis, from management regarding information technology, cybersecurity risk, and efforts to prevent and mitigate such risks. The Chairperson of the Audit Committee subsequently reports on the Partnership's cybersecurity risk, monitoring, and mitigation activities to the full Board, which equips the Board and its committees to fulfill their risk oversight role.


text: The Board and Audit Committee are supported in their oversight capacity by the Partnership's ERM Committee, and internal audit and information technology functions. On a quarterly basis, the ERM Committee evaluates past, existing, and future risks to the Partnership; the likelihood, severity, and velocity of such risks; and the controls and mitigation tools implemented to address such risk. Several members of the ERM Committee have functional responsibility for the Partnership's information technology and cybersecurity risk monitoring activities and provide expertise to the ERM Committee in those areas.


text: Likewise, the Partnership's internal audit function periodically performs audit engagements focused on information technology processes and cybersecurity risks. These audits have provided the Partnership with assessments of the effectiveness and efficiency of our information technology and cyber threat management processes with the goal of safeguarding Partnership assets and information.


text: Management of Cybersecurity Matters At the management level, the Partnership's cybersecurity risk management activities are integrated into the day-to-day activities of the Partnership's information technology function led by our Chief Information Officer, who operates under the supervision of our Chief Financial Officer. The Partnership's information technology function has a dedicated cybersecurity team comprised of employees with, on average, nearly 20 years of experience and expertise in cybersecurity, and includes individuals with degrees in Computer Studies and cybersecurity-related certifications including Certified Information Systems Security Specialist (CISSP), Certified in Risk and Information Systems Controls (CRISC), and Certified Information Security Manager (CISM).


text: Management utilizes certain tools and controls to detect, monitor, prevent, mitigate, and remediate cybersecurity threats to our systems, networks, applications, and data. Management also conducts annual cybersecurity training and periodic phishing tests, which provide contemporaneous feedback and instruction to our employees and strengthen the Partnership's defenses against cyber threats. Lastly, management maintains information security incident response processes to guide response and mitigate impact in the event of a cybersecurity incident. A third-party cybersecurity service provider is on retainer to assist the Partnership should a cybersecurity incident occur.


text: Engagement of Third Parties The ERM Committee, internal audit function, information technology function and various other groups each occasionally engage third-party service providers to assist in their management of cybersecurity risk, including but not limited to cybersecurity vendors, assessors, consultants, auditors, and other third parties. The information technology function maintains processes to oversee and identify cyber risks associated with the Partnership's use of third-party service providers who may have access to sensitive Partnership data and systems.


text: Material Impact on Partnership During 2023, the Partnership did not experience any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Partnership, including its business strategy, results of operations, or financial condition.


text: The Partnership has implemented processes to assess, identify and manage material risks resulting from cybersecurity incidents. Our Cybersecurity program and processes are based upon the International Standards Organization ("ISO") guidance on information security. The Partnership's processes used to identify, assess, and mitigate cybersecurity risks are integrated into the Partnership's broader risk management system and processes, including through the risk management activities of the Board and its Audit Committee, our Enterprise Risk Management Committee ("ERM Committee"), and our internal audit and information technology functions. Refer to Part I, Item 1A, "Risk Factors—We are subject to cybersecurity risks and may experience cyber incidents resulting in disruption or harm to our businesses" of this Report for further discussion of our processes for managing cybersecurity risks.


text: Board Oversight of Cybersecurity Matters The Board considers oversight of CVR Partners' risks and risk management activities, including those related to cybersecurity risk, to be a responsibility of the entire Board. The Board also delegates certain risk oversight responsibilities to certain of its committees, and oversight of the Partnership's cybersecurity risk is delegated by the Board to its Audit Committee. The Audit Committee receives regular reports, typically on a quarterly basis, from management regarding information technology, cybersecurity risk, AI use and governance, and efforts to prevent and mitigate such risks. The Audit Committee subsequently reports on these activities to the full Board, which equips the Board and its committees to fulfill their risk oversight role.


text: Similarly, the Partnership's internal audit function periodically performs audit engagements focused on information technology processes and cybersecurity risks. These audits have provided the Partnership and its Board with assessments of the effectiveness and efficiency of our information technology and cyber threat management processes with the goal of safeguarding Partnership assets and information.


text: Management of Cybersecurity Matters At the management level, the Partnership's cybersecurity risk management activities are led by our Chief Executive Officer and his executive team and is integrated into the day-to-day activities of the Partnership's information technology function and Chief Information Officer, who operates under the supervision of our Chief Financial Officer, and reports regularly to the Audit Committee on cybersecurity risks, typically on a quarterly basis. The Partnership's information technology function has a dedicated cybersecurity team comprised of employees with, on average, nearly 20 years of experience and expertise in cybersecurity, and includes individuals with degrees in Computer Studies and cybersecurity-related certifications including Certified Information Systems Security Specialist (CISSP), Certified in Risk and Information Systems Controls (CRISC), and Certified Information Security Manager (CISM).


text: Management utilizes certain tools and controls to detect, monitor, prevent, mitigate, and remediate cybersecurity threats to our systems, networks, applications, and data. Management also conducts annual cybersecurity training and periodic phishing tests, which provide contemporaneous feedback and instruction to our employees and seek to strengthen the Partnership's defenses against cyber threats. Management also monitors AI usage and has implemented a framework that tracks use and is governed by CVR Energy's Artificial Intelligence Policy and includes a review and approval process for adopting use of AI tools. Such governance activities are designed to mitigate the risks presented by AI. Lastly, management maintains information security incident response processes to guide response and mitigate impact in the event of a cybersecurity incident. A third-party cybersecurity service provider is on retainer to assist the Partnership should a cybersecurity incident occur.


text: Material Impact on Partnership During 2024, 2023, and 2022, the Partnership did not experience any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Partnership, including its business strategy, results of operations, or financial condition.


text: To combat the ever-present cyber risks, the Company maintains a comprehensive cybersecurity program, which includes ongoing employee training, annual risk assessments and a comprehensive cybersecurity environment meant to detect, prevent, and limit unauthorized or harmful actions across our information technology environment. We operate in the medical device sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems and partner with a third-party hosted provider. Our cybersecurity program is aligned with industry standards, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We also monitor and evaluate our cybersecurity performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. We require third-party service providers with access to personal, confidential, or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards.

companyName: ORTHOPEDIATRICS CORP

ticker: KIDS


text: Our VP of Information Technology has expertise in the following areas which assist in assessing and managing applicable cybersecurity risk: 36 years of IT experience including endpoint detection, security, incident management and response, vulnerability management and response, event management and response, and network security segmentation. The VP of Information Technology provides regular reports on ongoing risk and mitigation practices to our COO and CFO, who then reports to the Board. Our incident response policy, which is updated from time to time, provides that management reports to the Board in the event of any detected material incident and regularly updates them on the mitigation and remediation steps being taken in connection with the Company's response.


text: The Board considers cybersecurity risks in business strategy by getting updates on cybersecurity risk assessment. It assesses the experience of management personnel responsible for preventing, mitigating, detecting, and remediating any cyber incidents, including the VP of Information Technology as well as third-party providers. The Company has not experienced any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, including its business strategy, results of operations or financial condition.


text: In 2023, we upgraded our enterprise resource planning system to enhance operating efficiencies and provide more effective management of our business operations. The upgrade was substantially completed in the third quarter of 2023. The upgrade included training of personnel, migration of data, and maintaining effective internal controls.


text: Our VP of Information Technology has expertise in the following areas which assist in assessing and managing applicable cybersecurity risk: extensive IT experience including endpoint detection, security, incident management and response, vulnerability management and response, event management and response, and network security segmentation. The VP of Information Technology provides regular reports on ongoing risk and mitigation practices to our COO and CFO, who then reports to the Board. Our incident response policy, which is updated from time to time, provides that management reports to the Board in the event of any detected material incident and regularly updates them on the mitigation and remediation steps being taken in connection with the Company's response.


text: Cybersecurity risk is the risk of compromising the confidentiality, integrity, or availability of our technology platforms, data, and other systems, which could have an adverse impact on us, our members, Clients, and Network Partners. We take a strategic, risk-based approach to our cybersecurity program, which emphasizes continual improvement in an effort to protect and enable our business operations. Our enterprise cybersecurity program is designed to assess, identify, and manage cybersecurity threats through continuous monitoring of our information systems for potential vulnerabilities and through various controls and security tools designed to prevent, detect, escalate, investigate, resolve, and recover from identified and reasonably anticipated vulnerabilities, including any cybersecurity incidents, in a timely manner.

companyName: HEALTHEQUITY, INC.

ticker: HQY


text: In the event a security risk is detected, or a breach occurs, we are prepared with response protocols based on National Institute of Standards & Technology ("NIST") guidelines. Our Security Incident Response Plan defines roles and responsibilities, incident severity levels, key contacts, post-incident steps, and guidelines for testing. Our procedures cover response steps for phishing attacks, ransomware, data breaches, and major vulnerabilities. In addition, we have an organic threat model that evaluates our security controls to help protect against attacker tactics, techniques, and procedures. See "Risk Factors" in Part I, Item 1A of this Form 10-K for further information about cybersecurity risk.


text: Risk management and strategy We have implemented the Three Lines of Defense Model as the foundation of our risk management approach. Our information security team serves as a First Line, working with our Enterprise Risk Management & Compliance functions as a Second Line, and our Internal Audit function as the Third Line.


text: Cybersecurity is integrated into our operations, including through team member engagement, technology infrastructure, data fabric, and product development. Due to the sensitive nature of our customers' data that we hold, we have a heightened focus on data security and protection. We maintain administrative, technical, and physical safeguards designed to protect confidential data. Our security team seeks to identify security risks by working with state and federal law enforcement, security information-sharing organizations, and 24/7 system surveillance through internal and external detection and response teams. Additionally, to help ensure our approach to customer privacy and security is effective and in line with industry standards, we publish Service and SOC 2 attestation reports on our risk management standards established by the Statement on Standards for Attestation Engagements 18 (SSAE-18).


text: We regularly engage external and internal assessors and auditors to evaluate and audit our cybersecurity policies, procedures, standards, and practices. Results from these assessments are shared with management for remediation and with the Cybersecurity and Technology Committee of our board of directors on a regular basis. We have obtained, or are working toward obtaining, industry certifications and attestations and have aligned our cybersecurity program with the NIST Cybersecurity Framework and related controls.


text: As part of our Partner Security Risk Management program, we perform initial risk assessments prior to engaging third-party service providers and ongoing risk assessments annually thereafter, which follow an established process designed to identify, assess, and periodically review our exposure to risk through our partners.


text: During the fiscal year ended January 31, 2024, no known cybersecurity threats materially affected, or we believe are reasonably likely to materially affect, our business, our business strategy, financial reporting, or results of operations.


text: The Cybersecurity and Technology Committee of our board of directors provides oversight of the Company's cybersecurity threat landscape, risks and data security programs, and the Company's management and mitigation of cybersecurity risks and potential breach incidents. The Audit and Risk Committee of our board of directors provides an additional layer of cybersecurity oversight, as it provides oversight of the Company's enterprise risk management program, which includes management of cybersecurity risks and the potential fraud and privacy risks that could arise from a cybersecurity incident.


text: The Chief Security Officer (CSO) and his delegates meet with the Cybersecurity and Technology Committee at least quarterly to, among other items, review any cybersecurity incidents, review key risks and metrics on the Company's cybersecurity program and related risk management programs, and discuss the Company's cybersecurity programs and goals. The Cybersecurity and Technology Committee also participates in cybersecurity tabletop exercises with management and receives training on cybersecurity trends and developments. The Cybersecurity and Technology Committee updates the full board of directors at each quarterly board meeting, or more frequently if needed.


text: Our enterprise cybersecurity program is led by the CSO who oversees both information technology and information security functions. Our CSO brings more than 20 years of cybersecurity experience in various leadership positions, both in technology and finance industries. He holds a doctorate degree from the University of Michigan and holds over 100 US and global security-related patents. In order to assess and manage our material risks from cybersecurity threats, our CSO works with cross-functional teams, which are staffed with subject matter experts and leaders from each of the following areas: • Cybersecurity: We follow a defense-in-depth security model with a Joint Security Operations Center (JSOC), Attack Surface Management, and Data Protection team working with security architects and engineers deploying controls designed to prevent or limit the success of an attack. • Privacy and Governance: Our Data Privacy and Governance team helps our technology teams build a lasting roadmap to creating our products, services, and standards with privacy by design, and transparency at the forefront. • People Safety and Crisis Management: Led by federal law enforcement veterans, our People and Partner Safety team is responsible for ensuring the security of our team members across the US. We also conduct regular tabletop exercises to ensure we are ready to respond to crises, including cybersecurity incidents. • Fraud Prevention: Our Fraud Strategy and Prevention team leverages industry best practices of fraud prevention, identity and access management, and cybersecurity monitoring to protect the transactions of our members and Clients.


text: Cybersecurity risk is the risk of compromising the confidentiality, integrity, or availability of our technology platforms, data, and other systems, which could have an adverse impact on us, our members, Clients, and Network Partners, and our relationships with them. As further described below, we take various steps designed to help ensure that our platforms, data, and other systems remain available, resilient, and secure in the face of risks presented both by inadvertent actions (e.g., software that fails to operate properly) and by malicious activities (e.g., threat actors deliberately seeking to steal data or otherwise cause disruption). In particular, our industry continues to be a target for increasingly sophisticated cyber threats, including those driven by the rapid advancement of AI, adoption of public cloud environments, and reliance on third parties. We take a security-by-design and risk-based approach to our cybersecurity program, which emphasizes continual improvement to safeguard non-public information and enable our business operations.


text: Our cybersecurity program is structured to identify, assess, and mitigate risks through continuous monitoring, proactive threat intelligence, and a multi-layered defense strategy. We implement security controls, tools, and incident response procedures to prevent, detect, escalate, investigate, resolve, and recover from identified and reasonably anticipated vulnerabilities, including cybersecurity incidents. We emphasize fraud prevention, data protection, and securing our core platforms, while also prioritizing zero trust architecture, third-party risk management, immutable backups, training our staff and others who may have access to our data and systems, and improvement of our security personnel.


text: In the event of a security risk or breach, we are prepared with response protocols aligned with National Institute of Standards & Technology ("NIST") guidelines. Our Security Incident Response Plan defines roles and responsibilities, incident severity levels, key contacts, post-incident steps, and testing guidelines. Our procedures cover response steps for phishing attacks, ransomware, data breaches, and major vulnerabilities. In addition, we have an organic threat model to evaluate our security controls against attacker tactics, techniques, and procedures.


text: This adaptive approach strengthens our ability to anticipate and counter emerging threats. See "Risk Factors" in Part I, Item 1A of this Form 10-K for further information about cybersecurity risk.


text: Cybersecurity is integrated into our operations, including through team member engagement, technology infrastructure, data fabric, and product development. Due to the sensitive nature of our customers' data that we hold, we have a heightened focus on data security and protection. We maintain administrative, technical, and physical safeguards designed to protect confidential data. Our security team seeks to identify security risks by working with state and federal law enforcement, security information-sharing organizations, and 24/7 system surveillance through internal and external detection and response teams. Additionally, to help ensure our approach to customer privacy and security is effective and in line with industry standards, we publish Service and SOC 2 attestation reports on our risk management standards established by the Statement on Standards for Attestation Engagements 18.


text: As part of our Third Party Risk Management program, we perform initial risk assessments prior to engaging third-party service providers and ongoing risk assessments annually thereafter, which follow an established process designed to identify, assess, and periodically review our exposure to risk through our partners.


text: During the fiscal year ended January 31, 2025, no known cybersecurity threats materially affected, or we believe are reasonably likely to materially affect, our business, our business strategy, financial reporting, or results of operations.


text: The Chief Security Officer ("CSO") and his delegates meet with the Cybersecurity and Technology Committee at least quarterly to, among other items, review any cybersecurity incidents, review key risks and metrics on the Company's cybersecurity program and related risk management programs, and discuss the Company's cybersecurity programs and goals. The Cybersecurity and Technology Committee also participates in cybersecurity tabletop exercises with management and receives training on cybersecurity trends and developments. The Cybersecurity and Technology Committee updates the full board of directors at each quarterly board meeting, or more frequently if needed.


text: Our enterprise cybersecurity program is led by the CSO, who brings more than two decades of cybersecurity leadership experience and oversees both information technology and information security functions. In order to assess and manage our material risks from cybersecurity threats, our CSO works with cross-functional teams, which are staffed with subject matter experts and leaders from each of the following areas: • Threat & Vulnerability Management: We follow a defense-in-depth security model with a Joint Security Operations Center, Attack Surface Management, and Data Protection team working with security architects and engineers deploying controls designed to prevent or limit the success of an attack. • Governance, Risk, and Compliance: Our Security Governance, Risk, and Compliance team helps drive trust, compliance, and data protection by managing risks, including supply chain risks, to strengthen customer confidence, support innovation, and protect our reputation. • Fraud Prevention: Our Fraud Strategy and Prevention team seeks to employ industry best practices of fraud prevention, identity and access management ("IAM"), and cybersecurity monitoring to protect the transactions of our members and Clients. We continue to invest in people, processes, and technology solutions to enhance our fraud prevention program. • Security Engineering & Architecture: Our Security Engineering & Architecture team designs and implements resilient security solutions, embedding security into cloud and on-premise environments while automating controls and integrating security into development lifecycles. • Identity & Access Management: Our IAM team enforces zero trust principles, least privilege access, and adaptive authentication, managing multi-factor authentication, privileged access management, and just-in-time access to protect critical systems while ensuring seamless and compliant user access.


text: Cybersecurity Risk Management and Strategy Our enterprise-wide approach to risk management is designed to support the achievement of our organizational and strategic objectives and improve long-term organizational performance. Cybersecurity is a critical component of our enterprise risk management approach, and cybersecurity risks are among the enterprise risks that are subject to oversight by our Board and the Audit Committee of our Board (the "Audit Committee").

companyName: ROKU, INC

ticker: ROKU


text: Our cybersecurity program is designed to assess, identify, and manage cybersecurity risks and threats. Key components of our cybersecurity program include: • managing cybersecurity threats by deploying technical safeguards that are designed to protect our information systems from cybersecurity threats, which we evaluate and seek to improve, including through vulnerability assessments and cybersecurity threat intelligence; • maintaining cybersecurity incident management procedures to address incident reporting, classification, escalation, response, and recovery, and facilitate efficient and consistent management of cybersecurity incidents involving our information systems; • assessing and testing our cybersecurity policies and practices via internal efforts (such as assessments, vulnerability testing, threat modeling, tabletop exercises, and other exercises focused on evaluating the effectiveness of our cybersecurity measures) and by engaging third parties (including cybersecurity consulting firms) to perform assessments of our cybersecurity measures; • a third-party cybersecurity risk management process, including, among other things, a security assessment and contracting process for vendor applications and implementing contractual security measures with third-party vendors; and • cybersecurity awareness training for all employees and enhanced training for certain employees.


text: Cybersecurity Governance As part of its broader risk oversight activities, the Board oversees risks from cybersecurity threats, primarily through delegation to the Audit Committee. As reflected in its charter, the Audit Committee assists the Board in reviewing our significant cybersecurity matters and concerns. The Audit Committee engages on cybersecurity matters with our management team, including our Vice President of Trust Engineering, who regularly provides presentations to the Audit Committee on our cybersecurity program and cybersecurity risks. These presentations address a range of topics including, for example, the threat landscape and cybersecurity events, vulnerability assessments, incident preparedness assessments, disaster recovery plans, and cybersecurity awareness training. Two additional members of our Board, who have cybersecurity experience but are not members of the Audit Committee, are invited to attend Audit Committee meetings when review of our cybersecurity program is on the agenda. In addition, the full Board receives regular updates on the activities of the Audit Committee, including with regard to cybersecurity oversight.


text: Our Vice President of Trust Engineering is principally responsible for overseeing our cybersecurity risk management program, in partnership with other members of management. Our Vice President of Trust Engineering has served in various roles in cybersecurity and information technology for over 30 years, including as Vice President and Chief Security Architect of Intertrust Technologies Corporation and Java Security Architect at Sun Microsystems, Inc.


text: In addition, our Executive Incident Management Team ("EIMT") is a cross-functional management committee focused on providing executive guidance on the cybersecurity incident response process to facilitate an appropriate and timely response, make decisions related to cybersecurity incidents, and notify appropriate parties with relevant cross-functional expertise in the event of a cybersecurity incident.


text: Our Trust Engineering team is responsible for the day-to-day identification, assessment, and management of information security risks and provides regular updates to our Vice President of Trust Engineering regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Cybersecurity incidents are escalated to our Vice President of Trust Engineering, the EIMT, and the Chair of our Audit Committee in accordance with our cybersecurity incident management procedures, so that decisions can be made regarding incident reporting and disclosure in a timely manner.


text: Notwithstanding our cybersecurity risk management and governance, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information regarding the cybersecurity risks we face, see Item 1A, Risk Factors, elsewhere in this Annual Report, under the caption "Significant disruptions of our information technology systems or data security incidents could harm our reputation, cause us to modify our business practices, and otherwise adversely affect our business and subject us to liability."