text: Management has primary responsibility for risk management within our Company. The Company's Board of Directors, with the support of its committees, oversees risk management to ensure that the processes designed, implemented and maintained by our executives are functioning as intended and adapted when necessary to respond to changes in our Company's strategy as well as emerging risks. The Audit Committee of the Company's Board of Directors has responsibility for oversight of information and cybersecurity risks and assessment of cyber threats and defenses. The Audit Committee receives reports on these matters from our most senior executives in the digital organization, including our Chief Information Officer and CISO, and the Company's executive officers, at least twice a year. Topics historically covered in such reports, and for which our Board exercises oversight, include third-party evaluation of our technology infrastructure and information security against the NIST cybersecurity framework; management of emerging cyber threats such as merger and acquisition activity and the adoption and governance of artificial intelligence; risk mitigation through the Company's enterprise-wide cybersecurity training, including our Board of Directors, conducted at least annually; regular simulated phishing tests and third-party penetration testing; review of the Company's cyber incident insurance coverage and external cyber incident resources; review of the Company's Cybersecurity Incident Response Plan; review of readouts from cyber incident table top exercises; and consideration of applicable laws and regulations, including those related to privacy. The Company's Cybersecurity Incident Response Plan includes a section on Board escalation that specifies the process for notification of the Chair of the Audit Committee and the Chair of the Board of the Directors upon certain triggering events, and that group then determines the appropriate form and frequency of communication with the full Audit Committee or Board of Directors, depending on the unique characteristics of the incident.


text: Cybersecurity Program Our cybersecurity and related controls, policies and procedures ("Cybersecurity Program") are critical business functions protecting our enterprise information systems, data and business operations from external and internal threats. The Cybersecurity Program prioritizes detection, analysis, response and prevention to known, anticipated or unexpected cybersecurity threats, with regular internal and third-party assessments and enterprise risk management governance reviews. The Cybersecurity Program is informed by the National Institute of Standards and Technology's ("NIST") cybersecurity framework standard and is integrated into our overall enterprise risk management framework, along with our compliance requirements under federal and state cybersecurity and related regulations.

companyName: PennyMac Financial Services, Inc.

ticker: PFSI

secItem: Item 1C


text: We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition as of the end of fiscal year 2024. Our Risk Factors include further detail about our material cybersecurity risks.


text: Our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") each have over 25 years of information system experience and are primarily responsible for implementing the Cybersecurity Program and managing our information security personnel and consultants. The CIO has served in a variety of information technology leadership positions in the finance industry and holds a Bachelor of Science in Electrical Engineering. The CISO served in a variety of cybersecurity operations, cybersecurity architecture, and critical infrastructure cybersecurity enhancement programs in the finance industry, the utility industry and in government and holds a Bachelor of Science in Management Information Systems and Decision Sciences.


text: The Cybersecurity Program, which is integrated into our enterprise risk management framework, assesses, identifies and protects our enterprise information systems, data and business operations from various security threats and contains the following elements: Information Security Risk Assessment - Conducting internal and external risk and control assessment, quality control and assurance testing. Identity and Access Management - Managing enterprise identity and access control systems. Security Architecture - Managing security architecture, including secure code deployment standards, architecture security reviews, and cybersecurity advisory support.


text: Security Engineering - Designing, implementing and operating security technologies, including but not limited to malware protections, security event and incident management, data loss prevention, and phishing defenses.


text: Security Operations - Ensuring continuous operational coverage of security events and alerts, maintaining and executing processes for triage, containment, investigation and escalation/communication and threat intelligence.


text: Attack Surface Management - Managing vulnerability and patch management, network penetration testing, application security testing and exercises, including cybersecurity training, cyber-attack simulations and tabletop exercises with senior management to detect control gaps.


text: Third-Party Assessments - Coordinating, reviewing and analyzing third-party providers' assessments of the Cybersecurity Program. Internal Audit may also perform a periodic cybersecurity program audit that may be supported by external consulting firms. Third-Party Service Provider Reviews – Identifying and reviewing material risks from cybersecurity threats associated with certain third-party service providers.


text: Monitoring and Incident Reporting We continuously monitor our enterprise information systems and user activity to detect anomalous activity and identify potential security related incidents. Our cybersecurity monitoring and incident reporting program is informed by NIST guidelines and is internally and externally monitored. When a potential cybersecurity incident is detected, we gather the necessary information to classify the incident by type and severity and activate containment plans and response teams depending on the nature of the incident. Cybersecurity incidents that may impact enterprise business operations, compromise critical systems or result in unauthorized access to critical data will be escalated to the CISO and an internal incident response team comprised of senior IT, business operations and compliance personnel to coordinate any internal and external responses. The CISO and the internal incident team will also elevate any material cybersecurity incidents or unauthorized occurrences that jeopardize the confidentiality, integrity or availability of enterprise information to senior management and the board of directors.


text: Enterprise Risk Management Framework and Governance The Cybersecurity Program is integrated with our enterprise risk management framework and is primarily managed by the CIO, the CISO, and other information security personnel and consultants, and is overseen by risk management, internal audit, senior management and the board of directors to ensure the confidentiality, integrity and the availability of the Company's enterprise information systems, data and business operations. The Cybersecurity Program utilizes specialized third-party cybersecurity service providers to periodically perform penetration testing across certain internet-facing and business critical applications as well as external and internal network penetration tests.


text: Our Enterprise Risk Management unit separately provides independent oversight and monitoring of the Cybersecurity Program through periodic quality control testing and regulatory compliance verification of the Cybersecurity Program's controls. Our Internal Audit unit is an independent corporate function reporting to the board of directors' Audit Committee that also reviews the effectiveness of the Cybersecurity Program and whether it is effectively integrated into our overall enterprise risk management framework. Additionally, our Enterprise Risk Management and Internal Audit units may from time to time separately engage consulting services to perform independent cybersecurity controls audits and provide expert guidance.


text: Board of Directors Oversight The board of directors oversees our cybersecurity risks by periodically evaluating cybersecurity reports from senior management, including the CIO and CISO, as well as reports from the board committees and third-party consultants. The Risk Committee oversees our enterprise risk management framework including risks associated with data security, cybersecurity, IT infrastructure, and data privacy. The Audit Committee oversees the internal and external auditors' review of our cybersecurity risks.


text: Management Oversight Our CIO, CISO and other senior executives who oversee the Company's enterprise IT infrastructure periodically meet in management committees to ensure that our enterprise information systems are protected from internal and external cybersecurity threats by monitoring cybersecurity controls, risk assessments and information system reports. The CIO, CISO and our management committees periodically provide cybersecurity reports about our Cybersecurity Program to senior management, the board of directors and our board committees.


text: Processes for Assessing, Identifying, and Managing Cybersecurity Risks Our industry has become increasingly dependent on digital technologies to conduct certain processing activities. For example, we depend on digital technologies to perform many of our services, to process and record financial and operating data and to collect and store sensitive data, including our proprietary business information and personally identifiable information of our employees and others. We recognize the importance of assessing and managing material risks associated with cybersecurity threats. We seek to assess, identify and manage cybersecurity risks for our IT environment, leveraging the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), through the processes described below: Risk Assessment:

companyName: Select Water Solutions, Inc.

ticker: WTTR


text: We recognize that cybersecurity threats are constantly evolving, and we have implemented risk management procedures designed to protect our systems and data. We conduct vulnerability assessments, and periodic audits to identify and address potential cybersecurity vulnerabilities. We conduct periodic assessments to identify material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies, and education programs in response to those findings. As part of our efforts to safeguard our systems and data, we have sought to implement industry-standard security controls, including firewalls, encryption, and multi-factor authentication.


text: A monitoring and detection system has been implemented to help promptly identify cybersecurity incidents and recommend mitigating actions. Despite our best efforts, no security measure is entirely foolproof. In the event of a cybersecurity incident, we utilize a range of standard incident response practices to attempt to identify, analyze, contain, and recover the event with the goal of minimizing the impact and restoring normal operations. We require that our employees receive periodic cybersecurity trainings including phishing campaigns and general awareness campaigns.


text: Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. A multi-factor authentication process has been implemented for employees accessing company information.


text: We engage third-party vendors, assessors, consultants, auditors, and other third party service providers in connection with the above processes. We recognize that third-party service providers introduce cybersecurity risks. We have implemented processes to oversee and identify the risks from cybersecurity threats that impact select suppliers and third-party service providers with whom we share personal identifying and confidential information. The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management processes.


text: Impact of Risks from Cybersecurity Threats As of the date of this Report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. While we have implemented cybersecurity measures, it is important to note that the threat landscape is constantly evolving, and new risks may emerge. A successful attack on our information or operational technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information or operational technology systems.


text: Board of Directors' Oversight and Management's Role Our Board of Directors has delegated the responsibility for the oversight of risks from cybersecurity threats and our cybersecurity practices to the Audit Committee. Our Board of Directors and our Audit Committee receive regular updates on potential cybersecurity risks and mitigation strategies from the Company's Chief Technology Officer ("CTO").


text: Management is responsible for assessing and managing risks from cybersecurity threats and implementing the Company's cybersecurity strategies. Our CTO focuses on current and emerging cybersecurity matters and is responsible for establishing and maintaining the Company's cybersecurity-related policies and procedures. Our CTO has an Engineering degree from Rice University, a Master of Business Administration from Harvard Business School, more than 20 years' work experience, and a background in leading digital / software development organizations. Supporting our CTO is the Company's Vice President of Corporate Platform and Infrastructure and our team of cybersecurity experts (collectively with the CTO, the "Technology Team"). Our Vice President has an undergraduate degree from The University of Houston and has served in various Information Technology and Information Security roles for over 20 years across oil and gas, consulting, and power generation sectors. This team is collectively responsible for upward reporting on an as-needed basis of emerging cybersecurity incidents to senior management and, if appropriate, the Audit Committee of the Board of Directors. To facilitate effective oversight, our Technology Team holds regular discussions with our management team, the Audit Committee and the Board of Directors around cybersecurity risks, incident trends, and the effectiveness of our cybersecurity measures.


text: Risk Management and Strategy TripCo's corporate level IT and cybersecurity functions are provided by Liberty Media as part of the services agreement described in Item 1. Business. Through the services agreement, we participate in Liberty Media's processes for assessing, identifying, and managing risks from cybersecurity threats, as detailed below. Tripadvisor, as a separate publicly traded company from TripCo, operates its own cybersecurity function. While primary oversight for Tripadvisor rests with its board of directors and Audit Committee, we receive regular reporting from Tripadvisor management and collaborate with those tasked with oversight to ensure risks are appropriately addressed.

companyName: Liberty TripAdvisor Holdings, Inc.


text: The Company is committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, has implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats.


text: Cybersecurity risks are assessed as part of our enterprise risk assessment and risk management program and our cybersecurity risk management program is designed and assessed based on recognized frameworks, including the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF").


text: We rely on a multidisciplinary team, including our information security functions, legal departments, management, and third-party consultants, as described further below, at the corporate level and at Tripadvisor to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, using manual and automated tools, such as vulnerability scanning software, monitoring existing and emerging cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and assessments, and conducting threat and vulnerability assessments.


text: To manage and mitigate material risks from cybersecurity threats to our information systems and data, we implement and maintain various technical, physical and organizational measures, processes and policies. These measures include risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our IT, Security and other departments, encryption of data, network security controls, access controls, physical security, asset management, system monitoring, vendor risk management program, employee cybersecurity awareness and training, phishing tests, and penetration testing. Cybersecurity awareness training is also made available annually to our Board of Directors.


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place at the corporate level and at Tripadvisor. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary.


text: To operate our business, we utilize certain third-party service providers to perform a variety of operational functions. We have implemented a third-party risk management program to evaluate the cybersecurity practices of higher risk vendors and vendors that encounter our systems or data. We additionally engage and retain third party consultants, legal advisors and assessors to keep us apprised of emerging third-party risk, defense and mitigation strategies, and governance best practices.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations and financial condition.


text: For additional information on our cybersecurity risks, see "Risk Factors" under the section entitled "Risks Related to Information Security, Cybersecurity and Data Privacy" in Part I, Item 1A of this Annual Report on Form 10-K.


text: For additional information on Tripadvisor's cybersecurity program and risks refer to Item 1C. "Cybersecurity" in their 2024 Form 10-K filed on February 20, 2025.


text: Role of the Board of Directors Our Board of Directors has overall responsibility for risk oversight and has delegated to the Audit Committee primary enterprise risk oversight responsibility, including privacy and cybersecurity risk exposures, policies and practices, the steps management takes to detect, monitor and mitigate such risks and the potential impact of those exposures on our business, financial results, operations and reputation. The Audit Committee receives quarterly updates on the enterprise risk management program, including cybersecurity risks and the initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates, employee education initiatives, and internal audit observations, if applicable. In addition to the efforts undertaken by the audit committee, the full Board of Directors regularly reviews matters relating to cybersecurity risk and cybersecurity risk management. Any material cybersecurity events would be brought to the attention of the full Board of Directors once the event is deemed material. We additionally use our incident response framework as part of the process we employ to keep our management and Board of Directors informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Role of Management Through our services agreement with Liberty Media, we have established a cross functional Information Security Steering Committee ("ISSC") with executives from our Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at the corporate level. The ISSC receives regular reports and updates from Tripadvisor regarding their cybersecurity risk management activities and, if any, incidents that have occurred.


text: Tripadvisor also has executive oversight committees responsible for assessing and managing cybersecurity risk as part of their enterprise risk management and compliance programs. Tripadvisor has designated the Compliance Committee and Chief Compliance Officer ("CCO") with day-to-day management and oversight of corporate compliance initiatives, including cybersecurity. The Tripadvisor Compliance Committee consists of, among others, the Chief Financial Officer, Chief Legal Officer and CCO. The CCO has further established an Information Governance and Privacy Committee responsible for oversight of privacy and cybersecurity risks. The Information Governance and Privacy Committee consists of senior members of Tripadvisor's Information Security Team and CCO, as well as representatives from engineering, product development and data privacy. The Information Governance and Privacy Committee meets regularly to discuss and monitor information uses and governance and risks associated with Tripadvisor's information assets, including prevention, detection, mitigation and remediation of risks from cybersecurity threats.


text: Our management team's experience includes a diverse background in telecom and other industries, with decades of experience in various aspects of cybersecurity. Liberty Media's Head of Cybersecurity has more than 25 years of cybersecurity and information technology experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications and has worked at a variety of companies, including large publicly-traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, customer payment systems and telecommunications networks used by customers to transmit data. Tripadvisor maintains rigorous standards for its information security leadership positions, including requiring extensive experience in building and leading cybersecurity teams and implementing enterprise-wide cybersecurity programs.


text: Risk management and strategy Ball Corporation is committed to maintaining a strong cybersecurity posture. We have a dedicated, globally distributed information security team that is responsible for leading information security strategy, standards and processes, which are integrated into our comprehensive enterprise risk management process, including processes related to cybersecurity risks.

companyName: BALL Corp

ticker: BALL


text: The company employs a standards-based cybersecurity program aligned to the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), including ongoing assessment and continuous improvement to address the rapidly evolving threat landscape. Ball partners closely with a strong network of external partners, including conducting annual assessments of the cyber risk management program against the NIST CSF.


text: Our information security team has established and implemented formal processes and policies to assess, identify, and manage risks arising from cybersecurity threats, including those associated with our internal operations and the use of third-party service providers. We continually refine our approach to address evolving cybersecurity regulations, identify potential and emerging security risks, and implement strategies to manage these risks. Ball has developed an incident response plan that includes a cyber incident materiality assessment with appropriate leadership governance. In addition, we have aligned our incident response plan with our enterprise risk and global crisis management processes.


text: In response to the ever-evolving cyber threat landscape, Ball utilizes external experts to support continuous improvement across our cyber program, processes and operations. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on cyber enhancements. In addition, we also augment and extend our cyber team using a select few trusted third-party partners that are integrated as members of our global operations. This provides us with expanded global threat intel and enhances our ability to deliver continuous global cyber operations 24/7.


text: We are aware that there are potential cybersecurity risks associated with third-party service providers. Prior to engaging with third-party providers, Ball conducts thorough security assessments. We monitor for third-party cyber incidents and manage any third-party cyber incidents under our incident response plan and processes. Our oversight of third-party cyber risk aids our ability to lessen and mitigate impacts related to data breaches and other security incidents originating from third-parties.


text: Ball faces risks from cybersecurity threats that could have a material adverse effect on the company, including its business strategy, results of operations, financial condition and reputation. Refer to Item 1A, Risk Factors – Technological Risks, for additional details on cybersecurity risks that could potentially materially affect the company, including its business strategy, results of operations, financial condition and reputation. To date, we have not identified any cybersecurity incidents that have affected, or are reasonably likely to affect, our business, operations, or financial condition.


text: Ball's Chief Information Security Director (CISD) reports to the Senior Vice President and Chief Information Officer (CIO) and leads the company's cybersecurity team. The CISD is responsible for overseeing cybersecurity, including assessing and managing cybersecurity risk, and together with the CIO, providing comprehensive briefings to the executive leadership team with respect to the cybersecurity program and emerging or potential cybersecurity risks. The cybersecurity team has extensive experience selecting, deploying, and operating cybersecurity technologies, strategies and processes, and couples this knowledge with the use of external experts to protect the company from cyber threats. In the event of a cyber incident, our cross-functional response team will enact our incident response plan, and notify appropriate levels of management, including the executive leadership team, disclosure committee, and Board of Directors, as appropriate.


text: Our Board of Directors oversees our company's cybersecurity and information technology strategies. Annually, the CIO briefs the Board of Directors on the company's cybersecurity posture and the effectiveness of its risk management strategies.


text: The Company assesses cybersecurity risk and exposure on an ongoing basis and implements tools that are commensurate with the risks that the Company faces. In light of the Company's relatively small size and personnel, it relies heavily on reputable third-party vendors to mitigate key cybersecurity risks and exposures. While the nature of the Company's business and the data it processes inherently limit the Company's exposure to cybersecurity risk, the Company has implemented and maintains controls, policies, procedures and safeguards to maintain and protect confidential information as well as the integrity, continuous operation, redundancy and security of all information technology systems and data used in connection with the Company's business. The Company generally approaches cybersecurity threats through a comprehensive approach, with the specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: Farmland Partners Inc.

ticker: FPI


text: Risk Management and Strategy Consistent with overall risk management policies and practices, the Company's cybersecurity program focuses on the following areas:


text: Vigilance: The Company employs tools to identify, prevent and mitigate cybersecurity threats and respond to cybersecurity incidents in accordance with our internal cybersecurity policies and controls.


text: Systems Safeguards: The Company and its third party vendors deploy systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis.


text: Third-Party Risk Management: The Company ensures that all third party vendors that process or have access to sensitive information have appropriate cybersecurity risk controls in place.


text: Training: The Company communicates regularly with employees to increase awareness around phishing and spoofing attempts and other cybersecurity schemes. Employees are encouraged to report suspicious emails or incidents to the General Counsel or the President and Chief Executive Officer.


text: Incident Response Policies: The Company has established and maintains incident response policies that address the Company's response to a cybersecurity incident.


text: Communication, Coordination and Disclosure: The Company promotes awareness and surveillance over cybersecurity risk at all levels of the organization, including staff, senior management and our Board of Directors.


text: Our Board of Directors oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. Our Board of Directors receives presentations on cybersecurity issues and developments as needed. Our Board of Directors also will receive prompt and timely information regarding any cybersecurity incident that meets established reporting materiality thresholds, as well as ongoing updates regarding such incident until it has been addressed. The Company evaluates the materiality of a cybersecurity incident based on the overall impact of the event, which depends on a number of factors including, but not limited to, the financial impact of the incident and the type of information involved. At least once each year, our Board of Directors discusses the Company's approach to cybersecurity risk management with the Company's President and Chief Executive Officer and General Counsel.


text: The Company's President and Chief Executive Officer, Luca Fabbri, is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program and incident reporting, in partnership with other business leaders across the Company. In the event there is a material cybersecurity breach or incident, Mr. Fabbri works in coordination with the Company's General Counsel, Christine Garrison, to assess and respond, including by reporting the breach or incident to our Board of Directors and/or applicable regulatory authorities, as necessary or required. Mr. Fabbri has a high level of exposure to cybersecurity oversight through his current and previous work in the technology sector. Mr. Fabbri has served in various roles in information technology and information security for over 30 years, including serving as a consultant with Elk Creek Ventures Inc. from 2003 to 2012, through which he provided consulting services in technology, and serving as co-founder and vice president of engineering of Co3 Systems Inc., an enterprise software company in the cybersecurity space that is now part of IBM, from 2010 to 2011. Mr. Fabbri also co-founded a software company called HomeSphere, for which he served as senior vice president and chief financial officer from 2000 to 2002, and currently serves on the board of directors of Basil Systems Inc., a healthcare software company. Mr. Fabbri, Ms. Garrison and the Company's Chief Financial Officer each hold degrees in their respective fields, and each have over 15 years of experience with managing risks at the Company and in environments similar to the Company's, including risks arising from cybersecurity threats.


text: Mr. Fabbri, in coordination with our Board of Directors, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. Mr. Fabbri and Ms. Garrison monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to our Board of Directors and applicable regulatory authorities when appropriate.


text: The Company has in the past experienced cyberattacks on its computer networks and, although none to date have been material, the Company expects that additional cyberattacks will occur in the future. Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.


text: Risk Management and Strategy The Company has adopted processes designed to identify, assess and manage material risks from cybersecurity threats, and the Company's full Board and management is actively involved in overseeing the risk management process. These processes include response to, and an assessment of, internal and external threats to the security, confidentiality, integrity and availability of Company data and systems, along with other material risks to Company operations. We recognize the critical importance of maintaining the trust and confidence of our customers, business partners and employees.

companyName: COMFORT SYSTEMS USA INC

ticker: FIX


text: As part of our risk management process, the Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Company's cybersecurity program is focused on the following key areas: • Departmental Collaboration: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats and are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, potential acquisition targets and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: The Company provides regular training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. • Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by members of management and relevant management committees.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, because of the inherent nature of cybersecurity threats and the evolution of such threats over time, the Company's processes, oversight and risk management cannot provide absolute assurance that a cybersecurity threat will not have a material effect on the Company in the future.


text: The Company has established a risk committee (the " Risk Committee ") consisting of executive officers, including the Company's Chief Information Security Officer ("CISO"), that is directly responsible for the Company's risk management process. The Company's cybersecurity policies, standards, and practices are integrated into the Company's risk management process. The Board oversees information technology, data security, and cybersecurity risk management through regular reports and presentations from the CISO and other management members. The Risk Committee meets at least annually to define and improve the risk-mapping process and considers any updates at least quarterly. In addition, the Risk Committee presents comprehensive reports directly to the Board at least annually through the enterprise risk management matrix, which, as described below, is reviewed by the Audit Committee.


text: The Company's Audit Committee is briefed on cybersecurity risks at least once each calendar year and as necessary with respect to any material cybersecurity incidents. The Audit Committee also reviews the enterprise risk management matrix presented by the Risk Committee on an annual basis. The process of reviewing the matrix includes an overall assessment of the Company's compliance with cybersecurity policies, including topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.


text: The Board recognizes the critical importance of maintaining the trust and confidence of our tenants and business partners. The Board plays an active role in overseeing management of our risks, and cybersecurity represents an important component of the Company's overall approach to risk management and oversight. The Company's cybersecurity processes and practices are integrated into our risk management and oversight program. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We utilize a third-party managed IT service provider (the "MSP") to provide comprehensive cybersecurity services for the Company, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery, and cybersecurity education and awareness. The Company has adopted a written information security incident response plan, which, as discussed below, is overseen by the Audit Committee of the Board (the "Audit Committee").

companyName: CTO Realty Growth, Inc.

ticker: CTO


text: Governance: As discussed in more detail under "Item 1C. Cybersecurity—Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the Company's management team.


text: Collaborative Approach: CTO has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, the Audit Committee, and the Board in a timely manner.


text: Technical Safeguards: Together with the MSP, we deploy technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention systems, endpoint detection and response systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: Together with the MSP, we have established a written information security incident response plan that addresses the response to a cybersecurity incident, which is tested and evaluated on a regular basis.


text: Third-Party Risk Management: Together with the MSP, we maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: As directed by the Company, the MSP provides regular training for Company personnel regarding cybersecurity threats as a means to equip such personnel with effective tools to address cybersecurity threats, and to communicate evolving information security policies, standards, processes and practices.


text: Together with the MSP, we engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The MSP regularly assesses our cybersecurity measures, including information security maturity, and regularly reviews our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and we will adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Board, in coordination with the Audit Committee, oversees the Company's cybersecurity risk management process. The Audit Committee has adopted a charter that provides that the Audit Committee must review and discuss with the Company's management team the Company's privacy and cybersecurity risk exposures, including: the potential impact of those exposures on the Company's business, financial results, operations and reputation; the steps management has taken to monitor and mitigate such exposures;


text: the Company's information governance policies and programs; and major legislative and regulatory developments that could materially impact the Company's privacy and cybersecurity risk exposure.


text: The charter of the Audit Committee also provides that the Audit Committee may receive additional training in cybersecurity and data privacy matters to enable its oversight of such risks and that the Audit Committee will regularly report to the Board the substance of such reviews and discussions and, as necessary, recommend to the Board such actions as the Audit Committee deems appropriate.


text: Our Senior Vice President, Chief Financial Officer and Treasurer, Senior Vice President, General Counsel and Corporate Secretary, and Senior Vice President and Chief Accounting Officer work collaboratively with the MSP to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with a written information security incident response plan that we have adopted. These members of our management team, together with the MSP, monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and will report such threats and incidents to the Audit Committee when appropriate.


text: Our Senior Vice President, Chief Financial Officer and Treasurer, Senior Vice President, General Counsel and Corporate Secretary, and Senior Vice President and Chief Accounting Officer each hold degrees in their respective fields, and have approximately 20 years or more of experience managing risks at the Company and similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We execute a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity risk management program includes a cybersecurity incident response plan and dedicated cybersecurity incident response team ("CSIRT"). We do not have actual or contractual access to the systems or information maintained by our tenants, who maintain their own cybersecurity risk management programs to protect their operations from various risks from cybersecurity threats.

companyName: SIMON PROPERTY GROUP L P


text: We use the National Institute of Standards and Technology Cybersecurity Framework and CIS Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements.


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, public relations and financial risk areas.


text: Our cybersecurity risk management program includes the following key elements: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology (IT) environment;


text: a team comprised of IT security, infrastructure, and compliance personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents, supported by legal, human resources, corporate security and other internal resources;


text: the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes, which enable us to leverage specialized knowledge and insights, with the goal of ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices; cybersecurity awareness training of employees with access to our IT systems;


text: a cybersecurity incident response plan and Security Operations Center ("SOC") to respond to cybersecurity incidents; and a third-party risk management process for service providers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See further discussion in Item 1A. Risk Factors.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees and is regularly updated on management's design, implementation and enforcement of our cybersecurity risk management program. The Audit Committee is composed of board members with varied expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks.


text: Our Chief Financial Officer periodically provides reports to the Audit Committee, and, together with our Chief Technology Officer and Director of Cybersecurity, leads the Company's overall cybersecurity function. The Audit Committee receives regular reports on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents. Audit Committee members also receive periodic presentations on cybersecurity, IT and data protection topics.


text: Our Chief Financial Officer oversees our CSIRT, whose members have years of experience working in cybersecurity and certifications including CISSP (Certified Information Systems Security Professional), CCSP (Certified Cloud Security Professional), CGRC (Certification in Governance of Enterprise IT), GIAC (Global Information Assurance Certification) and GCED (GIAC Certified Enterprise Defender). Our CSIRT supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment.


text: The CSIRT is responsible for assessing and managing our material risks from cybersecurity threats. They have primary responsibility for leading our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our external cybersecurity service providers.


text: Cybersecurity risk management is an integral part of our overall enterprise risk management system. We have a cross-departmental approach to identifying, assessing, and managing cybersecurity risk, including input from employees and our Board of Directors (the "Board"). The Board and its Risk Committee and Audit Committee (respectively, the "Risk Committee" and the "Audit Committee"), as well as senior management in, among other areas, the information security, information technology, operations, and risk management (including enterprise and operational risk) areas, devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and to identify and respond to cybersecurity threats and incidents in a timely and effective manner. Our cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, identification, and remediation. Our information technology and information security areas review enterprise risk management-level cybersecurity risks continually, and key cybersecurity risks are incorporated into the Company's Enterprise Risk Management Framework that supports its Risk Appetite Statement. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information, and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management. On an annual basis, the Board approves the Company's Information Security Policy and Program which provides a layered approach to cybersecurity, and includes administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of customer information in accordance with applicable law.

companyName: SouthState Bank Corp

ticker: SSB


text: The Company's Chief Information Security Officer (" CISO ") is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Company's Chief Risk Officer ("CRO"), who oversees and supervises the risk function, including the information security, compliance, legal, operational (which includes business continuity, model risk, and third party risk functions) and enterprise risk areas. Our CISO has over 20 years of experience in information technology leadership, eight years of which is experience in leading information security oversight, and others on our information security team have various information security degrees and certifications within applicable disciplines. Our CISO receives reports from our information security team on a regular basis and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: Our information security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment. Further, we conduct periodic external and internal control validations to assess our processes and procedures and the threat landscape, and we maintain a vulnerability management program designed to identify vulnerabilities and coordinate remediation efforts for any identified vulnerabilities in the environment. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, and vendors. Results of these ongoing activities are reported quarterly to management through the Cyber and Information Technology Steering Committee. In addition, we periodically perform simulations and tabletop exercises at the management level and incorporate external resources and advisors as needed. All employees are required to complete information security training at least once every year, and we require employees in certain roles to complete additional role-based, specialized cybersecurity trainings.


text: We have continued to expand investments in information security and cybersecurity, including providing additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging third-party cybersecurity experts. For example, in 2023, the Bank engaged a third-party cybersecurity consultant to conduct a review of the Company's information security and cybersecurity program in relation to overall threat trends and specific factors affecting the Bank's cyber risk profile, and in 2024, a third-party cybersecurity consultant reviewed the Company's vulnerability management program These reviews assisted management in enhancing the Company's cyber-risk reduction efforts, including updating Bank's cybersecurity strategy and program. The Company also maintains cybersecurity insurance provided by carriers that can provide additional technical, legal, and consultation services in the event of a security event that requires additional staff or expertise, including attorneys, forensic accountants, and public relations professionals, among others. In addition to assessing our own cybersecurity preparedness, we also identify, evaluate and manage cybersecurity risks associated with use of third-party vendors and service providers. Our third-party risk function conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. Our information security area regularly reviews third-party vendors and service providers, including their System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor or service provider is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess its cybersecurity preparedness and assess our relationship on that basis. The frequency and granularity of our review of third-party vendors and service providers is based on an assigned risk rating for each third-party vendor and service provider. Our assessment of risks associated with use of third-party vendors and service providers is part of our overall cybersecurity risk management framework.


text: The Board has ultimate oversight responsibility for the Company's risk management and recognizes the importance of protecting the data provided by the Company's customers and employees and devotes considerable time and attention to overseeing the strategies the Company employs to protect our data and systems and to mitigate against cybersecurity risk. A cybersecurity expert chairs the Risk Committee and provides technology-related insight and guidance to the Company. As part of the Risk Committee's responsibility for monitoring key business and regulatory risks, the Risk Committee receives from both our Chief Information Officer and CISO quarterly reports and materials which include a review of cybersecurity and information technology key risk indicators, test results and related remediation, and any recent cybersecurity threats or incidents and how the Company is managing those threats or incidents. The Risk Committee also periodically reviews reports on the threat environment, vulnerability assessments, results of penetration testing, and potential cybersecurity and data privacy incidents, as well as information on ongoing employee training relating to data privacy and cybersecurity and how to protect data against cyber threats. Further, on a quarterly basis, our CRO presents to the Risk Committee updates from our Director of Enterprise and Operational Management on the Company's business continuity program, which covers, among other things, outages and incidences and disaster recovery and business continuity testing. The Risk Committee also approves the annual risk assessment required by the Gramm-Leach-Bliley Act. Moreover, the CISO follows a risk-based escalation process to notify the Risk Committee outside of the cycle of regular updates when management has identified an emerging risk or material issue related to cybersecurity. The Risk Committee also reports material cybersecurity risks to the full Board, based on our CISO's assessment of risk. In addition, the Audit Committee reviews reports of the Company's internal audit department's periodic audits of our information security area and various components thereof.


text: We face a number of cybersecurity risks in connection with our business and we have, from time to time, experienced threats to and incidents involving our data and systems. For more information about the cybersecurity risks we face, see the risk factors captioned "We are subject to complex and evolving laws, regulations, rules, standards and contractual obligations regarding data privacy and cybersecurity, which could increase the cost of doing business, compliance risks and potential liability " and " We face cybersecurity risks from cyber-attacks, information security breaches and other similar incidents that could result in the disclosure of confidential and other information (including personal information), adversely affect our business or reputation, and create significant legal and financial exposure. " In Item 1A- Risk Factors.


text: We have strategically integrated cybersecurity risk management into our broader enterprise risk management function to promote a company-wide culture of cybersecurity risk management. Our board of directors has general oversight responsibility for our enterprise risk management function, which includes specific areas of focus including competitive, economic, operational, financial (accounting, credit, liquidity and tax), legal, compliance, information technology security programs (including cybersecurity), ESG/corporate social responsibility, political and reputational risks. Our board of directors has delegated oversight of certain of these areas to the committees of our board of directors, including delegating the oversight of our information technology security programs (including cybersecurity) to the risk committee of our board of directors (the " Risk Committee "). We believe this division of risk management-related roles to the committees of our board of directors fosters an atmosphere of significant involvement in the oversight of risk at the board level and complements our risk management policies. The oversight responsibility of our board of directors is facilitated by a management report process that is designed to provide both visibility and transparency to our board of directors about the identification, assessment and management of critical risks and management's risk mitigation strategies.

companyName: Ryman Hospitality Properties, Inc.

ticker: RHP


text: Our risk management team, which includes members of senior management, including our Chief Financial Officer ("CFO"), Chief Information Officer ("CIO") and General Counsel, as well as external consultants, works closely with our information technology department ("IT Department") to continuously evaluate and address cybersecurity risks relevant to our business and operations. In addition, we have set company-wide policies and procedures that directly or indirectly relate to cybersecurity matters, such as policies related to encryption standards, antivirus protection, access removal, multifactor authentication, confidential information or use of the internet, social media, email and wireless devices. These policies go through an annual internal management review and approval process.


text: Our CIO and our Vice President of IT ("VP of IT") are primarily responsible for our overall information security, strategy, policy, security engineering, operations and cybersecurity threat detection and the management of cybersecurity risks. Our CIO and VP of IT, collectively, have over fifty years of experience working in the information technology and cybersecurity field and have extensive experience assessing and managing cybersecurity and information technology programs and cybersecurity risk. Our CIO and VP of IT hold degrees in the information technology and cybersecurity fields, as well as hold certain cybersecurity and other relevant technology certifications. The CIO meets with our Chief Executive Officer ("CEO"), on a weekly basis, and the CFO, on a monthly basis, to discuss all relevant business risks, including cybersecurity risks and threats. In addition to regular reports from our CIO and vice president of internal audit regarding our program for managing our information security risks, including data privacy and protection risks we face, the CIO and VP of IT also meet quarterly with the Risk Committee to inform them of current cybersecurity risks and threats, as well as cybersecurity enhancement projects. Our full board of directors receives an annual update regarding the current cybersecurity environment from our CIO, which may include presentations from external consultants. Our Enterprise Risk Management ("ERM") committee, which includes several members of senior management, including our CFO, our CIO, and a Certified Information Systems Auditor, also presents all of our top organizational and operational risks, including information security-related risks, focus areas and accomplishments throughout our various businesses, to the Risk Committee on a quarterly basis.


text: Our IT Department management team meets monthly to assess and review cybersecurity status, which includes dashboard reviews, operational risks and company compliance. Annually, our internal audit group and third-party consultants meet with our IT Department to perform risk assessment walkthrough meetings, discuss potential enhancements, materiality of risks and alignment with the Center for Internet Security Critical Security Controls framework. In addition, we engage third-party consultants to perform annual red team exercises and external penetration tests.


text: We promote a culture of cybersecurity compliance throughout our organization, including required monthly cybersecurity training for all employees with company accounts and annual training for service-related employees on cybersecurity related topics, including social engineering (e.g., phishing, vishing and smishing), ransomware, denial of service or information, and other security breach tactics. We conduct quarterly ERM discussions where top risk owners discuss how risks have changed and how such risks are being addressed with approaches designed to mitigate such risks. In addition to assessing our own cybersecurity preparedness and as part of our overall cybersecurity risk management framework, we also consider and evaluate cybersecurity risks associated with our use of third-party service providers. We perform a formal System and Organization Controls ("SOC") review process annually on our financially significant third-party service providers, which includes our internal assessment of complementary user entity controls. All other material third-party service providers undergo assessment as a contract is entered into or renewed to ensure cybersecurity alignment. Our internal audit group meets regularly with management team members of Marriott, our third-party hotel manager, to assess security applications compliance. We also regularly meet with management team members of Marriott to understand system upgrades, changes and associated risks with third-party managed applications. In addition, we generally require our third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations.


text: In assessing cybersecurity threats, our IT Department has established controls and procedures for responding to cybersecurity incidents, including a process to evaluate the significance of a cybersecurity incident. Members of senior management, including our General Counsel and CFO, are tasked with performing a materiality assessment in the event of a cybersecurity incident, which includes the consideration of relevant quantitative and qualitative factors, as well as SEC guidance. Based on the results of this evaluation, further escalation of the cybersecurity event may occur, which may include our CEO, our board of directors and/or law enforcement. In addition, members of senior management will determine, based on the assessment described above, whether the cybersecurity incident requires disclosure with the SEC.


text: We currently maintain a cybersecurity insurance policy that provides coverage for security incidents and periodically meet with our insurer to discuss emerging trends in cybersecurity. We do not believe that any risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, notwithstanding the programs, policies and procedures described above, there can be no assurance that we or businesses with which we interact will not experience a cybersecurity incident that materially affects us in the future. For more information about the cybersecurity risks we face, see the risk factor entitled "Cybersecurity incidents, including the failure to protect the integrity or availability of IT systems or the security of confidential information, or the introduction of malware or ransomware, could harm our business." in Item 1A. Risk Factors of Part I of this Annual Report on Form 10-K.


text: Cybersecurity Risk Management and Strategy Due to our structure as a REIT, the cybersecurity program, processes, and strategy described in this section are limited to the corporate systems, service providers, and information services belonging to or supporting the REIT. In order to maintain REIT status, the Company does not operate or manage its hotels. We lease each of our hotels to the TRS Lessee or one of its subsidiaries, which engages with third-party eligible management companies to operate and manage all aspects of the properties; and those third-party managers, in turn, rely on systems that they manage directly or indirectly (through their own service providers), including but not limited to reservation systems, billing, building and property management systems, point-of-sale systems, and financial transactions and records that store and process proprietary or personal information. In light of this structure, we do not have actual or contractual access to the systems or information maintained by the third-party managers, and we must instead rely on such managers' programs and processes to protect the properties in which we invest from risks associated with cybersecurity threats.

companyName: Sunstone Hotel Investors, Inc.

ticker: SHO


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident.


text: Our program is informed by the International Standards Organization ("ISO") 27000, ISO 27001, and National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the ISO 27000, ISO 27001 and NIST CSF as guides to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Key elements of our cybersecurity risk management program are integrated into our overall enterprise risk management program, and share common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems and information;


text: an information technology department principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls;


text: cybersecurity awareness training of our employees and senior management; and business continuity, contingency, and recovery plans, including a cybersecurity incident response plan with procedures for responding to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with, or effective in protecting our systems and information.


text: Cybersecurity Governance Our board of directors (the "board") considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee (the "committee") oversight of cybersecurity and other information technology risks. The committee oversees management's implementation of our cybersecurity risk management program.


text: The committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the committee, as necessary, regarding any significant cybersecurity incidents.


text: The committee reports to the board regarding its activities, including those related to cybersecurity. The board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from management as part of the board's continuing education on topics that impact public companies.


text: Our management team, including our chief financial officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel, our external information technology support, and our retained external cybersecurity consultants. Our information technology department has over 20 years of experience developing and implementing computer infrastructure, including cybersecurity and audit compliance. We seek to use the latest security technologies from leading vendors to help secure our network and to regularly monitor and assess alerts and threat levels. The information technology department possesses various industry certifications and continuously refreshes skills through relevant training.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from IT security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risks from cybersecurity threats or incidents (cybersecurity risks) are assessed, identified and managed by the Company in a manner that is consistent with leading cybersecurity frameworks, including the National Institute of Standards and Technology Cybersecurity Framework (NIST Framework). The Company's approach to cybersecurity risk management is generally based on the six core functions contained within the NIST Framework organizing structure: identify, protect, detect, respond, recover and govern.

companyName: RLI CORP

ticker: RLI


text: As of the date of this report, risks from cybersecurity threats or incidents have not materially affected, nor are they reasonably likely to materially affect, the Company's business strategy, results of operations or financial condition. However, in light of emerging and changing cybersecurity threats and vulnerabilities, the Company cannot guarantee that it will not be a victim of a cybersecurity attack in the future that could materially affect the Company. See Item 1A, Risk Factors for more information.


text: The IT security department is responsible for the day-to-day assessment and management of cybersecurity risks, including efforts to prevent and, if necessary, mitigate the effects of a cybersecurity incident. The Company's IT security department operates under general oversight of the Company's chief information officer (CIO), who also serves as the Company's chief information security officer (CISO). The Company's CIO has 27 years of technology and technology leadership experience, including 14 years serving as a CISO, in the insurance industry. The head of the Company's IT security department, who reports to the CIO, holds a Certified Information Systems Security Professional designation from the Information Security Certification Consortium, has 20 years of experience in the insurance industry and has served in IT security-related roles for 24 years.


text: Management oversight of cybersecurity risks is provided primarily through the Company's Technology Committee, which is chaired by the Company's CIO and comprised of members of senior management. The Technology Committee's responsibilities include general oversight of cybersecurity-related matters, maintenance of the cybersecurity and data privacy programs and oversight of the Company's cybersecurity incident response plan. Technology risk, including cybersecurity risk, is also integrated into the Company's enterprise risk management process. The Company's Risk Committee, chaired by the CEO and comprised of members of executive management, identifies the Company's material risks and reviews the strategies, processes and controls in place to facilitate the understanding, identification, prevention, measurement, reporting and mitigation of those risks. The Risk Committee meets quarterly and reviews the Technology Committee's current assessment of cybersecurity risks.


text: Through 2024, the RLI Corp. Board of Directors provided oversight for cybersecurity risks primarily through its Audit Committee. In February 2025, the charter of the Finance & Investments Committee was revised to include overall enterprise risk management oversight, including oversight of cybersecurity risk. The committee was renamed the Finance & Risk Committee (FRC). The Company's CIO, along with the head of the Company's IT security department, presents quarterly to the designated committee on cybersecurity risks and the Company's strategies to assess and manage those risks. Additionally, the board receives periodic updates on emerging cybersecurity issues and developments through director education provided by the Company and third-party experts, detailed reviews provided by the CIO and the Company's head of IT security on select cybersecurity topics, and periodic "table top" simulations of a cybersecurity event.


text: The Company maintains a Cybersecurity Incident Response Plan (CIRP) providing a framework for identifying, evaluating and escalating potential or actual cybersecurity events. The CIRP assigns responsibilities and provides a workflow between the Company's IT security department; the Company's Technology Committee; and the board of directors regarding the detection, assessment and response to a cybersecurity event.


text: The Company's internal audit department routinely engages third-party cybersecurity consultants to conduct network security audits. The Company also engages other third-party consultants in a number of areas to support the assessment, identification and management of cybersecurity risks, including risk assessments, log monitoring, threat intelligence, system penetration testing, training and incident response, among others. The Company performs cybersecurity due diligence and monitoring of third-party vendors, which may include the review of System and Organization Control (SOC) reports or the results of a security questionnaire, to identify the cybersecurity controls and protections maintained by a third party.


text: Our Board of Directors oversees our risk management process, including risks from cybersecurity threats. Our Board of Directors reviews strategic risk exposure, and members of our management are responsible for addressing the material risks we face on a day-to-day basis. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole as well as through our Audit Committee. Our Board and our Audit Committee receive updates annually and more frequently as deemed necessary from our management on cybersecurity.

companyName: GENCO SHIPPING & TRADING LTD

ticker: GNK


text: Our Chief Financial Officer, our Internal Audit Director and our external Information Technology department are primarily responsible to assess and manage material risks from cybersecurity threats and oversee key cybersecurity policies and processes. They are informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Chief Information Manager of our Information Technology department has 36 years of experience in the design, implementation, and support of information technology infrastructures with significant expertise in information technology forensics. He is assisted by two network engineers with 27 years of information technology experience with a focus on information technology forensics.


text: Network and information systems and other technologies play an important role in our business activities. We also obtain certain confidential, proprietary and personal information about our charterers, personnel, and vendors. To protect our data, we have employed cybersecurity protocols which are designed to work in tandem with internal controls to safeguard our information technology environment. Our information technology infrastructure is designed with commercial flexibility, data integrity, and safety in mind. We utilize a layered approach of systems and policies intended to provide a secure operating environment and promote business continuity. Our hardware and software systems are equipped with technology intended to offer access and intrusion protection, software and communications systems protections, and mitigate cybersecurity threats.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information maintained in them.


text: We conduct regular risk assessments to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. As part of our risk management process, we may engage third party experts to help identify and assess risks from cybersecurity threats. For example, an outside consulting firm conducts a National Institute of Standards and Technology and International Organization for Standardization based cybersecurity capability maturity assessment every two years, which is reviewed with our Chief Financial Officer. We also perform penetration tests, data recovery testing, security audits and risk assessments throughout the year. We hold quarterly online cybersecurity trainings for our employees. Our risk management process also encompasses cybersecurity risks associated with our use of third-party service providers. Following these risk assessments, we design, implement, and maintain safeguards intended to minimize the identified risks; address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards.


text: The Company also maintains a cyber liability insurance policy. See Item 1 – "Business – Insurance – Cyber Liability Insurance" in this report.


text: While we develop and maintain protocols, controls, and systems, that seek to prevent cybersecurity incidents from occurring, we must constantly monitor and update these protocols, controls, and systems in the face of sophisticated and rapidly evolving attempts to overcome them. The occurrence of cybersecurity incidents could cause a variety of material adverse impacts on our business, although no such incident has had any such impact to date. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this report, including the risk factor entitled "Security breaches and other disruptions to our information technology infrastructure could interfere with our operations and expose us to liability" and Item 1, "Business – Environmental and Other Regulations – Safety Management System Requirements" in this report.


text: In the ordinary course of our business, we collect, use, store, and transmit confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our IT systems is important to our operations and business strategy. We understand the growing challenges associated with cybersecurity threats and have established a strong cybersecurity program intended to continue to monitor and improve our cybersecurity posture.

companyName: Protagonist Therapeutics, Inc

ticker: PTGX


text: Risk Management Approach We have documented cybersecurity policies and standards, and we assess risks from cybersecurity threats and monitor information systems for potential cybersecurity issues. These processes are managed and monitored by a dedicated cybersecurity team, including third-party service providers, and led by our Head of IT, and include mechanisms, controls, technologies, systems, and other processes designed to help prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and help maintain a stable information technology environment. For example, we use processes, tools and external services to conduct regular vulnerability testing, penetration testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, CROs, and other contractors and suppliers.


text: We work to maintain a strong cybersecurity posture through a multi-layered approach. Our endpoint detection and response ("EDR") system helps monitor and analyze endpoint devices, and is designed to assist us in quickly identifying and responding to emerging threats. Complementing our EDR capabilities, our managed detection and response service assists with threat monitoring, proactive threat hunting, and rapid incident response. Furthermore, we employ data loss prevention tools to help enforce strict data security policies, prevent unauthorized access and protect the transmission of sensitive information. These integrated technologies help us to detect, mitigate, and respond to cyber threats, with the goal of minimizing potential disruptions to our business operations.


text: We have an incident response plan designed to help quickly detect, contain and remediate cybersecurity incidents. This plan outlines clear escalation procedures, roles and responsibilities to help us respond in a timely manner to potential threats. We also conduct regular employee training on matters such as phishing and email security best practices, among other topics. In addition, we consult with outside advisors and experts when appropriate to assist with assessing, identifying, and managing cybersecurity risks, including to help anticipate future threats and trends, and their impact on our risk environment.


text: Our current Head of IT reports directly to our Chief Financial Officer and has over twenty years of experience managing information technology and cybersecurity matters, holds a Master of Science degree in Telecommunications and Computer Networks and is Project Management Professional, Certified Scrum Master and IT Infrastructure Library certified. We have established a cybersecurity council, facilitated by the Head of IT, which includes senior leadership from various departments. The council meets quarterly to review cybersecurity strategies, assess emerging threats, and receive updates on regulatory and industry best practices.


text: Our Board as a whole has oversight for the most significant risks facing us and for our processes to help identify, prioritize, assess, manage, and mitigate those risks, including oversight of cybersecurity risks. Our Board receives at least two updates each year on cybersecurity and information technology matters and related risk exposures from our Head of IT as well as other members of our senior leadership team.


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have identified and mitigated certain known cybersecurity threats, which we determined are not reasonably likely to materially affect us and have strengthened our cybersecurity ecosystem. However, cybersecurity attack techniques change frequently, and with increased volume and sophistication of such attacks, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents that could materially affect us. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors - Significant disruptions of information technology systems or cybersecurity incidents could adversely affect our business."


text: Risk Management and Strategy Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems are necessary for the operation of our business. We use these systems, among others, to manage our tenant and vendor relationships, for internal communications, for accounting and record-keeping functions, and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: INNOVATIVE INDUSTRIAL PROPERTIES INC

ticker: IIPR


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including confidential information that is proprietary, strategic or competitive in nature, and tenant data ("Information Systems and Data").


text: We rely on a multidisciplinary team, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, using manual and automated tools, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, and conducting threat and vulnerability assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, systems monitoring, employee training, and penetration testing.


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, conducting security assessments, and conducting periodic reassessments during their engagement.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K, including "The occurrence of cyber incidents or cyberattacks could disrupt our operations, result in the loss of confidential information and/or damage our business relationships and reputation," for additional discussion about cybersecurity-related risks.


text: Our board of directors holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Directors and through its committees. The audit committee of the board of directors oversees the management of systemic risks, including cybersecurity, in accordance with its charter. The audit committee engages in regular discussions with management regarding our significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats.


text: Our management, represented by our Chief Operating Officer, Catherine Hastings, leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. Ms. Hastings is an experienced risk management professional, having previously served as our Chief Financial Officer and Treasurer from 2017 until March 2023, and as Vice President, internal audit of BioMed Realty Trust, Inc. (formerly NYSE: BMR) until December 2016, having joined BioMed Realty in 2009. Ms. Hastings currently oversees key functions for our development, asset management, human resources and information technology functions, including cybersecurity risk oversight and the development and enhancement of internal controls designed to prevent, detect, address, and mitigate the risk of cyber incidents. Since 2016, we have retained a third-party information technology specialist to develop and maintain our information technology infrastructure and network, who has extensive experience in the development of business processes, system infrastructure design and cybersecurity for large-scale, institutional real estate companies.


text: Management is responsible for helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Management is responsible for approving cybersecurity processes, reviewing cybersecurity assessments and other cybersecurity-related matters, and responding to cybersecurity incidents, including reporting to the audit committee for certain cybersecurity incidents. Our management team also evaluates the potential impact of cybersecurity incidents to determine materiality. This evaluation considers factors such as the nature and scope of the incident, and its effects on operations, assets, or reputation. The audit committee holds quarterly meetings and receives periodic reports from management, including our Chief Operating Officer and third-party information technology expert, concerning our significant cybersecurity threats and risks and the processes we have implemented to address them.