text: Overseeing our cybersecurity initiatives is our CIO and Director of Global Cybersecurity, who provide invaluable expertise in managing cybersecurity risks and leading our cybersecurity operations. Both the CIO and Director of Global Cybersecurity possess extensive expertise in information technology and program management, with a wealth of experience, including over 19 combined years of dedicated service within our corporate information security organization. Furthermore, the executive leadership team is active in security operations, overseeing implementation of policies, procedures, and policies related to cybersecurity, technology, and vendors. Both the Audit Committee of the Board as well as executive leadership team will be notified and updated in the event of an incident, with incident updates, mitigation efforts, and impact, as deemed appropriate.


text: We are dedicated to safeguarding our invaluable assets and ensuring the well-being of personnel, as demonstrated through the preparation of our cybersecurity program.

companyName: EnerSys

ticker: ENS

secItem: Item 1C


text: Cybersecurity Risk Management and Strategy Our cyber risk management program is designed to comprehensively address the spectrum of cybersecurity threats that confront our organization. Within this program, we integrate an analysis of the risks facing the organization to guide our preparedness against cybersecurity threats to ensure a holistic approach that encompasses cross-functional and geographical visibility under the oversight of executive leadership through regular risk management meetings.


text: To aid our cybersecurity risk management strategy, we contract with dedicated third-party firms and assessors to identify risks and threats to our organization. These assessments adhere to leading cybersecurity standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework aligning with industry best practices. Additionally, our organization adheres to compliance with the Cybersecurity Maturity Model Certification (CMMC) and is undergoing International Organization for Standardization (ISO) accreditation, further demonstrating our commitment to adhering to rigorous cybersecurity standards. To oversee incident response and mitigation we utilize our incident response plan and processes to standardize our processes for assessing, identifying, and managing cybersecurity incidents. This includes a comprehensive reporting structure and analysis processes to provide visibility and determine incident business impact. Were a cybersecurity incident to occur, we have also implemented a cross-functional business team to aid in the determination of incident impact, severity, and materiality, with the support of standing external counsel and third-party incident response advisors. Additional to our third-party incident response advisors and support contracts, we undergo regular penetration tests to bolster our readiness in the event of cybersecurity incidents. Furthermore, we have also obtained cybersecurity insurance coverage to enhance protection and minimize potential financial losses arising from cyber threats.


text: We prioritize cybersecurity within our supply chain, both nationally and globally, by assessing our third-party cybersecurity posture to provide secure visibility with our partnerships. As part of our due diligence processes, we conduct security questionnaires and service provider reviews, to align our cybersecurity standards on the onset of our partnerships. Additionally, we collaborate closely with a third-party vendor to enhance supply chain resilience. This collaboration involves leveraging their expertise to inform decision-making and enhance risk oversight processes, ensuring greater robustness, and adaptability in managing supply chain challenges.


text: While we maintain a strong cybersecurity posture, we continuously strive for improvement and vigilance to mitigate evolving threats within this dynamic environment and protect our stakeholders' interests. Our organization has not experienced any unauthorized access resulting from cybersecurity incidents with a materially adverse effect on our business, operations, or financial condition and we remain cognizant of the potential impact of insufficient cybersecurity measures on our operations. For further insights into additional organizational risks, please refer to the General Risk Factors section of Item 1(A) Risk Factors.


text: Cybersecurity Governance The Board delegated primary oversight authority to the Audit Committee who plays a pivotal role in ensuring the effectiveness of our cybersecurity strategy. Through regular updates provided by our leadership team, the committee actively evaluates the organization's cybersecurity posture and aids in prioritizing risk mitigation efforts aligned with our strategic objectives. These updates encompass detailed quarterly reports during audit committee meetings, covering key metrics, ongoing initiatives, and any cybersecurity incidents. Additionally, on an annual basis, the entire board receives updates on the progress of our cybersecurity program and strategy, including insights into emerging risks and industry trends. Moreover, the board benefits from supplementary educational briefings delivered by both internal and external experts, providing invaluable global threat visibility and enhancing the Board's understanding of cybersecurity challenges and opportunities.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, malicious attacks, improper employee or contractor access, harm to employees or customers and violation of data privacy, intellectual property or security laws. Although, as of the date of this Form 10-K, Huron has not experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Further details about the cybersecurity risks we face are described under Item 1A. "Risk Factors."

companyName: Huron Consulting Group Inc.

ticker: HURN


text: We have an enterprise-wide cybersecurity strategy that focuses on implementing risk-based controls, technologies, and other processes. We aim to incorporate industry best practices throughout our cybersecurity program, including the frameworks established by the National Institute of Standards and Technology ("NIST"), the Cybersecurity and Infrastructure Security Agency ("CISA"), and other applicable industry standards. To augment our in-house capabilities, we leverage expertise from professional services firms and/or outside counsel, as needed, to assess our cybersecurity controls, and collaborate on an ever-changing landscape. Our cybersecurity program is verified as conforming with ISO/IEC 27001:2013 and our most recent recertification was in 2023.


text: We use various mechanisms to preempt, detect and monitor cybersecurity threats, including monitoring unusual network activity, conducting annual security awareness training for employees, deploying phishing test campaigns, maintaining containment and incident response tools, and reviewing, updating and improving our Incident Response Plan annually. We also conduct tabletop exercises to simulate responses to cybersecurity incidents. During these exercises, our team of cybersecurity professionals collaborate with technical and business stakeholders across the organization to further analyze the risk to the company and form detection, mitigation, and remediation improvements.


text: Our risk management program also assesses risks associated with third-party service providers. Such providers are subject to an onboarding process and may be reevaluated periodically, such as upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, our service providers adhere to mutually agreed upon security requirements, controls and responsibilities.


text: Cybersecurity Governance Our cybersecurity program is overseen by the leaders of our Information Security functional team, which is led by our Chief Information Officer ("CIO") who has nearly 30 years of relevant work experience. Prior to joining Huron in 2018, our CIO served in various information security and information technology roles in the professional services industry for several large, public companies and executed large-scale, global implementations of business applications and infrastructure technologies in a way that mitigates cybersecurity risks. Our CIO reports on a quarterly basis to Huron's internal Information Security Management System ("ISMS") Committee, which has primary responsibility for assessing and managing material cybersecurity risks. The ISMS Committee, which includes members of our executive and senior leadership teams, our CIO and other functional team leaders, reviews, approves and establishes ISMS specific goals and objectives, reviews policy updates and approves the annual IT risk assessment, which identifies impacts, threats and controls related to IT assets utilized across the enterprise.


text: Our board of directors, in coordination with the board of director's Technology and Information Security ("T&IS") Committee, oversees the governance of the Company's technology-related risks, including information security, data protection, cybersecurity, vendor, fraud, and business continuity risks, and technology-related strategies. The T&IS Committee receives quarterly updates from the CIO, including existing and new cybersecurity risks, the management and/or mitigation of such risks, material cybersecurity incidents (if any), and status on key cybersecurity initiatives. Our board also actively participates in discussions with management on cybersecurity-related news events and discusses any updates to our cybersecurity risk management and strategy programs on a timely basis.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. Accordingly, the company takes a comprehensive approach to identifying and managing cybersecurity risks that involves the company's Information Security functional team, senior management, and our board of directors in coordination with the Technology and Information Security ("T&IS") Committee and the Audit Committee of our board of directors. Our cybersecurity risk management function is a component of our overall approach to risk management, including coordination with our Enterprise Risk Management Committee.


text: Our cybersecurity risks include, among other things: operational risks, malicious attacks, improper employee or contractor access, harm to employees or customers and violation of data privacy, intellectual property or security laws. Although, as of the date of this Form 10-K, Huron has not experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Further details about the cybersecurity risks we face are described under Item 1A. "Risk Factors."


text: We have a cybersecurity program that focuses on implementing risk-based controls, technologies, and other processes. We aim to incorporate industry best practices throughout our cybersecurity program, including the frameworks established by the National Institute of Standards and Technology ("NIST"), the Cybersecurity and Infrastructure Security Agency ("CISA"), and other applicable industry standards. To augment our in-house capabilities, we leverage expertise from professional services firms and/or outside counsel, as needed, to assess our cybersecurity controls, and collaborate on an ever-changing landscape. Our cybersecurity program conforms with ISO/IEC 27001:2022 and our most recent recertification was in 2024.


text: We use various mechanisms to detect and monitor cybersecurity threats, including monitoring unusual network activity, conducting annual security awareness training for employees, deploying phishing test campaigns, maintaining containment and incident response tools, and reviewing, updating and improving our Incident Response Plan annually. We also conduct tabletop exercises to simulate responses to cybersecurity incidents. During these exercises, our team of cybersecurity professionals collaborate with technical and business stakeholders across the organization to further analyze the risk to the company and form detection, mitigation, and remediation improvements. We also engage third parties, including assessors, consultants, and auditors to assess our cybersecurity control environment and to test the vulnerability of our cybersecurity infrastructure at least annually.


text: Our risk management program also assesses risks associated with third-party service providers. Such providers are subject to an onboarding process and may be reevaluated periodically. We use a variety of inputs in such risk assessments, including information supplied by the providers themselves and other third parties. In addition, our contracts with our service providers require them to adhere to mutually agreed upon security requirements, controls and responsibilities, as applicable.


text: Cybersecurity Governance Our cybersecurity program is overseen by the leaders of our Information Security functional team, which is led by our Chief Information Officer ("CIO") who has over 30 years of relevant work experience. Prior to joining Huron in 2018, our CIO served in various information security and information technology roles in the professional services industry for several large, public companies and executed large-scale, global implementations of business applications and infrastructure technologies in a manner designed to mitigate cybersecurity risks. Our CIO reports on a quarterly basis to Huron's internal Information Security Management System ("ISMS") Committee, which has the primary responsibility for assessing and managing material cybersecurity risks. The ISMS Committee, which includes members of our executive and senior leadership teams, our CIO and other functional team leaders, reviews, approves and establishes ISMS specific goals and objectives, reviews policy updates and approves the annual IT risk assessment, which identifies impacts, threats and controls related to IT assets utilized across the enterprise.


text: Our board of directors, in coordination with its T&IS Committee, oversees the governance of the Company's technology-related risks, including information security, data protection, cybersecurity, vendor, fraud, and business continuity risks, and technology-related strategies. The T&IS Committee receives quarterly updates from the CIO, including existing and new cybersecurity risks, the management and/or mitigation of such risks, material cybersecurity incidents (if any), and status on key cybersecurity initiatives. Our board also actively participates in discussions with management on cybersecurity-related news events and discusses any updates to our cybersecurity risk management and strategy programs.


text: Spok's enterprise risk management program includes our cybersecurity risk management program ("Cybersecurity Program"), which is designed to protect the confidentiality, integrity and availability of our critical systems and information. Our Cybersecurity Program is designed utilizing guidance from the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and includes security policies and procedures, security appliances and software, third-party vulnerability testing, business continuity plans, and other administrative, physical and technical measures. Executive management, including Chief Information Officer (CIO)/Chief Information Security Officer (CISO) and VP Technology Operations, has overall responsibility for assessing and managing key cybersecurity risks; implementation of the Cybersecurity Program is led by key information technology and security management members, including the CIO/CISO who have over a combined four decades of experience, specialized training, and various certifications in information technology and cybersecurity strategy, tools and governance. As part of the enterprise risk management program, our Cybersecurity Program shares similar methodologies, reporting channels and governance processes to other areas across the Company.

companyName: Spok Holdings, Inc

ticker: SPOK


text: The Cybersecurity Program includes, but is not limited to, the following processes that collectively help management to stay informed about and monitor the prevention, detection, mitigation and remediation of risks and incidents: • Risk assessment program to assess, track and address security risks. • Incident Response Plan to identify, evaluate, remediate and report incidents, as appropriate. • Security testing by external third-party providers to identify potential threats and vulnerabilities. • Reviews of critical third-party connections, including a security assessment and restrictions based on the third-party's risk profile. • Security training for employees and contractors, including alerts for new security developments, as warranted.


text: Cybersecurity is part of our Board of Directors' oversight function. Our Board of Directors has delegated oversight of cybersecurity and other information technology to its Audit Committee. Our Audit Committee receives regular reporting from executive management on our cybersecurity risks and, as necessary, updates on cybersecurity incidents. Our Audit Committee and executive management report to our Board of Directors regarding its activities, including the Cybersecurity Program. Our Board of Directors also receives continuing education on the cybersecurity risks that impact public companies.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors –Cyberattacks, data breaches or other compromises to our or our critical third parties' systems, data, products or services could have a material adverse effect on our business.


text: Spok's enterprise risk management program includes our cybersecurity risk management program ("Cybersecurity Program"), which is designed to protect the confidentiality, integrity and availability of our critical systems and information. Our Cybersecurity Program is designed utilizing guidance from the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and includes security policies and procedures, security appliances and software, third-party vulnerability testing, business continuity plans, and other administrative, physical and technical measures. Executive management, including our Chief Information Officer (CIO)/Chief Information Security Officer (CISO) and VP Technology Operations, has overall responsibility for assessing and managing key cybersecurity risks; implementation of the Cybersecurity Program is led by key information technology and security management members, including the CIO/CISO and VP Technology Operations, who have specialized training, and various certifications in information technology and cybersecurity strategy, tools and governance. The CIO/CISO has over two decades of experience directing security programs, controls, policies and operationalizing them specific to the healthcare industry. The VP Technology Operations has over a decade of experience managing the Cybersecurity Program, SOC2 audits and security controls and policies. As part of the enterprise risk management program, our Cybersecurity Program shares similar methodologies, reporting channels and governance processes to other areas across the Company.


text: The Cybersecurity Program includes, but is not limited to, the following processes that collectively help management to stay informed about and monitor the prevention, detection, mitigation and remediation of risks and incidents: • Risk assessment program to assess, track and address security risks. • Incident Response Plan to help identify, evaluate, remediate and report incidents, as appropriate. • Security testing by external third-party providers to identify potential threats and vulnerabilities. • Reviews of critical third-party connections, including a security assessment and restrictions based on the third-party's risk profile. • Security training for employees and contractors, including alerts for new security developments, as warranted.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors".


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: bluebird bio, Inc.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: We evaluate cybersecurity risk as part of our overall enterprise risk management program, using systematic methodologies, reporting channels and governance processes that apply across the broader enterprise risk management program.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management, including training on best practices for data privacy and security and safekeeping of patient information; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for information technology software service providers, suppliers, and vendors that have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our information technology systems, or those of our third-party collaborators, service providers, contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product candidates' development programs and activities related to our approved products and have a material adverse effect on our reputation, business, financial condition or results of operations."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Head of Information Technology, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Head of Information Technology and our Head of Information Security are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Head of Information Technology's experience includes 25 years in managing information technology departments, including four years specifically in cybersecurity and five years with the Company. Our Head of Information Security's experience includes 13 years in managing information technology departments, including 12 years specifically in cybersecurity and seven months with the Company.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Cybersecurity Risk Management and Strategy We recognize the importance of data privacy and security and are committed to safeguarding and protecting our own confidential information and other confidential information shared with us. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of all our critical systems and information, which is integrated into our overall risk management program. This cybersecurity risk management program involves the strategic planning, operation, implementation, and monitoring of cybersecurity practices within our organization. Our cybersecurity program also includes a comprehensive incident response plan ("IRP") to respond to security breaches and cyberattacks.

companyName: Prestige Consumer Healthcare Inc.

ticker: PBH


text: In addition, our cybersecurity IRP is part of our overall Information Security Program, which is led by the Company's Information Technology ("IT") Vice President ("VP") and Chief Information Security Officer ("CISO") and is overseen by the Company's Chief Financial Officer ("CFO").


text: The IRP is designed to protect and preserve the confidentiality, integrity and continued availability of all confidential information in the care of the Company and the information systems owned or used by the Company, as well as the Company's ability to operate. Our cybersecurity IRP includes controls and procedures for timely and accurate reporting of any cybersecurity incident. We design and assess our program based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.


text: Our cybersecurity risk management program includes the following: • An ongoing process of identifying, evaluating, and addressing our cybersecurity threats; • A security team responsible for managing our cybersecurity risk, assessment processes, security controls, and responses for security breaches and cyberattacks • The use of external service providers, where appropriate, to assess, perform tabletop exercises, or otherwise assist with aspects of our security controls designed to anticipate cyberattacks and respond to breaches. Procedures include annual internal vulnerability scans and external penetration tests; • Regular cybersecurity awareness training for all employees to provide a better understanding of the issues and risks related to cybersecurity and data privacy. We realize that cybersecurity is not just the job of the IT security team; the Company and all employees play a critical role in managing the risk; • Phishing and other exercises performed by our IT department periodically throughout the year to test our systems and reinforce the training provided to all personnel • A cybersecurity incident response plan managed by our VP of IT/CISO, which includes procedures for responding to cybersecurity incidents and is designed to protect and preserve the confidentiality, integrity and continued availability of information possessed by the Company • A third-party cybersecurity risk management process for service providers, suppliers, and vendors performed throughout the year.


text: We have not identified any risks from known cybersecurity threats, including any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For a detailed discussion on the Company's cybersecurity related risks, see "Risk Factors" relating to information technology contained in Part 1, Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk a part of its overall risk oversight function. The VP of IT/CISO reports to the CFO, who regularly reports to the Board of Directors and Audit Committee regarding cybersecurity risks and our risk management program.


text: The Audit Committee oversees management's implementation of our cybersecurity risk management program, including reviewing risk assessments and policies with respect to the Company's IT systems, privacy, information governance and cybersecurity management. The Audit Committee meets with management at least annually, and as necessary, to review the Company's IT security program, compliance and controls with the CFO and/or CISO, including the potential impact of data privacy risk exposures on the Company's business, financial results, operations and reputation, the steps management has taken to monitor and mitigate such exposures, and major legislative and regulatory developments that could materially impact the Company's data privacy risk exposure.


text: Our VP of IT/CISO and CFO are responsible for assessing and managing our material risks from cybersecurity threats. The cyber security risk management team is led by our VP of IT/CISO, who has significant experience across digital innovation and technology-enabled growth, information security, infrastructure, operations and compliance. The team has primary responsibility for our overall cybersecurity risk management program and oversees both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Members of our executive leadership team, including our CFO, Senior Vice President and General Counsel, as well as the other members as needed, supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management and Strategy We recognize the importance of data privacy and security and are committed to safeguarding and protecting our own confidential information and other confidential information shared with us. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of all our critical systems and information, which is integrated into our overall risk management program. This cybersecurity risk management program involves the strategic planning, operation, implementation and monitoring of cybersecurity practices within our organization. Our cybersecurity program also includes a comprehensive incident response plan ("IRP") to respond to security breaches and cyberattacks.


text: In addition, our cybersecurity IRP is part of our overall Information Security Program, which is led by the Company's Information Technology ("IT") Vice President ("VP") and Chief Information Security Officer ("CISO") and is overseen by the Company's Chief Financial Officer & Chief Operating Officer ("CFO & COO").


text: The IRP is designed to protect and preserve the confidentiality, integrity and continued availability of all confidential information in the care of the Company and the information systems owned or used by the Company, as well as the Company's ability to operate. Our cybersecurity IRP includes controls and procedures for timely and accurate reporting of any cybersecurity incident. In accordance with the plan, material cybersecurity incidents are escalated to the Audit Committee of the Board of Directors. We design and assess our program based on the NIST Cybersecurity Framework.


text: Our cybersecurity risk management program includes the following: • An ongoing process of identifying, evaluating and addressing our cybersecurity threats; • A security team responsible for managing our cybersecurity risk, assessment processes, security controls and responses for security breaches and cyberattacks • The use of external service providers, where appropriate, to assess, perform tabletop exercises, or otherwise assist with aspects of our security controls designed to anticipate cyberattacks and respond to breaches. Procedures include annual internal vulnerability scans and external penetration tests; • Regular cybersecurity awareness training for all employees to provide a better understanding of the issues and risks related to cybersecurity and data privacy. We realize that cybersecurity is not just the job of the IT security team; the Company and all employees play a critical role in managing the risk; • Phishing and other exercises performed by our IT department periodically throughout the year to test our systems and reinforce the training provided to all personnel • A cybersecurity incident response plan managed by our VP of IT/CISO, which includes procedures for responding to cybersecurity incidents and is designed to protect and preserve the confidentiality, integrity and continued availability of information possessed by the Company • A third-party cybersecurity risk management process for service providers, suppliers and vendors performed throughout the year.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk a part of its overall risk oversight function. The VP of IT/CISO reports to the CFO & COO, who regularly reports to the Board of Directors and Audit Committee regarding cybersecurity risks and our risk management program.


text: The Audit Committee oversees management's implementation of our cybersecurity risk management program, including reviewing risk assessments and policies with respect to the Company's IT systems, privacy, information governance and cybersecurity management. The Audit Committee meets with management at least annually, and as necessary, to review the Company's IT security program, compliance and controls with the CFO & COO and/or CISO, including the potential impact of data privacy risk exposures on the Company's business, financial results, operations and reputation, the steps management has taken to monitor and mitigate such exposures, and major legislative and regulatory developments that could materially impact the Company's data privacy risk exposure.


text: Our VP of IT/CISO and CFO & COO are responsible for assessing and managing our material risks from cybersecurity threats. The cyber security risk management team is led by our VP of IT/CISO, who has significant experience across digital innovation and technology-enabled growth, information security, infrastructure, operations and compliance. The team, which includes personnel with Certified Information Systems Security Professional ("CISSP") certification from the International Information System Security Certification Consortium, has primary responsibility for our overall cybersecurity risk management program and oversees both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Members of our executive leadership team, including our CFO & COO and our Senior Vice President and General Counsel, as well as the other members as needed, supervise efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Amphastar Pharmaceuticals, Inc.

ticker: AMPH


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Head of the Information Technology Systems, or ITS, department who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through training.


text: We engage consultants in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our business."


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Our business and operations have been impacted in the past, and may be impacted in the future, in the event of system breach or failure" and "Complying with laws in the U.S., Europe, and other jurisdictions that impose restrictive regulations addressing the collection, use, and other processing of personal information may be expensive, and failure to comply with such laws and regulations could cause substantial harm to our company.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function through the audit committee. The chairperson of our audit committee has received a certificate in Cybersecurity Oversight from Carnegie Mellon University.


text: Our head of the ITS Department, and our executive management are primarily responsible for assessing and managing our material risks from cybersecurity threats.


text: Our head of the ITS Department oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. We have set up processes by which our executive management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Our head of the ITS Department and our executive management provide quarterly briefings to the audit committee of the board regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports. In addition, our head of the ITS Department provides periodic briefings to the board of directors on cybersecurity risks and activities.


text: We engage consultants in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our business.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Our business and operations have been impacted in the past, and may be impacted in the future, in the event of system breach or failure" and "Complying with laws in the U.S., Europe, and other jurisdictions that impose restrictive regulations addressing the collection, use, and other processing of personal information may be expensive, and failure to comply with such laws and regulations could cause substantial harm to our company."


text: Our head of the ITS Department and our executive management are primarily responsible for assessing and managing our material risks from cybersecurity threats.


text: We maintain a comprehensive information and cybersecurity and data privacy program to safeguard the security, confidentiality, integrity, availability and protection of the Company's and our clients' information. We aim to continually strengthen our cybersecurity posture and protocols. We have invested in people, processes and technology intended to protect information throughout the business life cycle and to manage cybersecurity risk, and we intend to continue to do so as cybersecurity risks and methods for preventing against them evolve. We provide no assurance that the policies and procedures outlined below will be properly followed in every instance or that they will be effective in safeguarding against every possible cybersecurity threat.

companyName: ExlService Holdings, Inc.

ticker: EXLS


text: We describe how cybersecurity threats are likely to materially affect our business, results of operations, and financial conditions in Part I, Item 1A, "Risk Factors." We believe that these risks have not materially affected our business to date, but we can provide no assurance that they will not affect us in the future. Although we maintain cybersecurity insurance to manage potential liabilities resulting from specific cybersecurity incidents, there is no guarantee that our insurance coverage limits will protect against any future claims or that such insurance proceeds will be paid to us in a timely manner. See "Risks Related to Our Business-Unauthorized disclosure of sensitive or confidential client and employee data, whether through breach of our computer systems or otherwise, could cause us significant reputational damage, expose us to protracted and costly litigation, and cause us to lose clients."


text: Cybersecurity Strategy and Risk Management Our cybersecurity strategy is founded on policies, processes and practices that are integrated into our overall risk management system. These policies, processes and practices are aimed at building a cyber-resilient organization by implementing and operationalizing cybersecurity capabilities to identify, protect, detect, respond and recover from cybersecurity threats and incidents and are guided by relevant regulatory and governance bodies, including but not limited to the Cyber Security Framework of the National Institute of Standards and Technology. We have undertaken measures designed to comply with applicable privacy laws and regulations that are applicable to our services. These security capabilities are designed to mitigate material vulnerabilities and the impact of cyber incidents.


text: We regularly conduct cybersecurity and other risk assessments and compliance audits both internally and through third party auditors that we independently engage or that we engage in connection with our certification to certain international standards, such as the ISO 27001:2013 standard for information security management systems, the ISO 22301:2012 for business continuity management systems, the ISO 9001:2008 standard for quality management systems, among others. We also regularly assess and deploy technical safeguards and conduct vulnerability assessment and penetration testing of our technology environment independently and through third parties. We use the outcome of these assessments to align our cybersecurity program and technical safeguards with the evolving cybersecurity threat landscape and adjust and augment our security controls environment as required.


text: We have implemented a third-party risk management program to proactively identify and mitigate any potential risks that emerge from our supplier and partner ecosystem. There are processes in place to restrict and provide need-based access to sensitive or confidential data for third parties. We conduct periodic evaluations of key suppliers and partners for ongoing monitoring of the risk environment.


text: Incident Response and Recovery Planning While processes are in place to minimize the occurrence of a successful cyberattack, we have institutionalized detailed incident response procedures to address a cyber threat that may occur despite these safeguards. The response procedures are designed to identify, analyze, isolate and contain, remediate, and, if applicable, report any such material cyber incidents that occur. We have developed a materiality assessment approach for cyber and a cyber crisis communication methodology for structured and timely notification to internal and external stakeholders. Further, we have empaneled specialized cyber partners to provide advanced investigation capabilities and response management support in case of a real cyber incident.


text: Training and Awareness We maintain a comprehensive information and cybersecurity awareness and training program for all employees and contracted resources. This includes a mandatory annual information security training, periodic simulations such as red teaming and tabletops, regular communications on relevant topics and policies related to data privacy, phishing, email security best practices, among others. We provide specialized security training for certain roles with access to sensitive data, including human resources or employees who regularly handle personal or sensitive information. Governance (Management Oversight and Engagement with the Board of Directors)


text: Cybersecurity is governed by our cross-functional apex body, the Management Security, Continuity and Privacy Forum ("MSCPF"), comprised of management representatives across all of our business units and enterprise functions such as Legal, Human Resource, Growth and Strategy, Compliance, Technology and Information Security. The MSCPF periodically reviews the strategy, policy, program effectiveness, standards development, cybersecurity risks, incident, and response preparedness.


text: The Audit Committee of our board of directors provides primary oversight and strategic guidance on Cybersecurity. The Audit Committee receives reports from management, typically on a quarterly basis, regarding our security risk management, including cybersecurity-related risks, vulnerabilities, policies, practices, and strategic initiatives. Annually, our board of directors receives a report from management on our cybersecurity posture, our readiness and our capability to reduce the risk of, detect and respond to a cyberattack. In 2022 and 2023, our senior management and board of directors completed cyber tabletop exercises to further enhance our preparedness in the event of an actual incident.


text: We maintain a comprehensive cybersecurity and data privacy program to safeguard the security, confidentiality, integrity, availability and protection of the Company's and our clients' information. Cyber security is also an inherent consideration for our data and AI-led solutions. Specifically, there is a heightened focus on institutionalizing a Responsible AI framework to proactively identify and mitigate data protection and privacy risks. We aim to continually strengthen our cybersecurity posture and protocols by investing in people, processes and technology intended to protect information throughout the business life cycle and to manage cybersecurity risk, and we intend to continue to do so as cybersecurity risks and methods for preventing against them evolve. No assurance can be given that the policies and procedures outlined below will be properly followed in every instance or that they will be effective in safeguarding against every possible cybersecurity threat.


text: We describe how cybersecurity threats are likely to materially affect our business, results of operations, and financial conditions in Part I, Item 1A, "Risk Factors" under "Risks Related to Our Business–– Unauthorized disclosure of sensitive or confidential client and employee data, whether through breach of our computer systems or otherwise, could cause us significant reputational damage, expose us to protracted and costly litigation, and cause us to lose clients." We believe that these risks have not materially affected our business to date, but we can provide no assurance that they will not affect us in the future. Although we maintain cybersecurity insurance to mitigate potential liabilities resulting from specific cybersecurity incidents, there is no guarantee that our insurance coverage limits will comprehensively protect us against any future claims or that such insurance proceeds will be paid to us in a timely manner.


text: Cybersecurity Strategy and Risk Management Our cybersecurity strategy is founded on policies, processes and practices that are integrated into our overall risk management system. These policies, processes and practices are aimed at building a cyber-resilient organization by implementing and operationalizing cybersecurity capabilities to identify, protect, detect, respond and recover from cybersecurity threats and incidents and are guided by relevant regulatory and governance bodies, including but not limited to the Cyber Security Framework of the National Institute of Standards and Technology. We have undertaken measures designed to comply with applicable privacy laws and regulations that are applicable to our services. These security capabilities are designed to mitigate vulnerabilities and the impact of cyber incidents.


text: Cyber security is an inherent consideration for our data and AI-led digital solutions. There is heightened focus on institutionalizing a Responsible AI framework that includes periodic Secure AI assessments to proactively identify and mitigate data protection and privacy risks.


text: We regularly conduct cybersecurity and other risk assessments and compliance audits both internally and through third party auditors that we independently engage or that we engage in connection with our certification to certain international standards, such as the ISO 27001:2013 standard for information security management systems, PCI DSS for handling financial data, the ISO 22301:2012 for business continuity management systems, the ISO 9001:2008 standard for quality management systems, SOC 1 TYPE II and SOC 2 TYPE II, among others. We also regularly assess and deploy technical safeguards and conduct vulnerability assessment and penetration testing of our technology environment independently and through third parties. We use the outcome of these assessments to align our cybersecurity program and technical safeguards with the evolving cybersecurity threat landscape and adjust and augment our security controls environment as required.


text: We have implemented a third-party risk management program to proactively identify and mitigate any potential risks that emerge from our supplier and partner ecosystem. We have processes in place to restrict and provide need-based access to sensitive or confidential data for third parties. Additionally, we conduct periodic evaluations of key suppliers and partners for ongoing monitoring of the risk environment.


text: Incident Response and Recovery Planning While processes are in place to minimize the occurrence of a successful cyberattack, we have institutionalized detailed incident response procedures to address a cyber threat that may occur despite these safeguards. The response procedures are designed to identify, analyze, isolate and contain, remediate, and, if applicable, report any such material cyber incidents that occur. We have developed a materiality assessment approach for cyber and a cyber crisis communication methodology for structured and timely notification to internal and external stakeholders. Further, we have empaneled specialized cyber partners to provide advanced investigation capabilities and response management support in case of a real cyber incident. Periodic tabletop and crisis simulation exercises are conducted to reinforce our incident response controls on an ongoing basis.


text: The Audit Committee of our board of directors provides primary oversight and strategic guidance on Cybersecurity. The Audit Committee receives reports from management, typically on a quarterly basis, regarding our security risk management, including cybersecurity-related risks, vulnerabilities, policies, practices, and strategic initiatives. Annually, our board of directors receives a report from management on our cybersecurity posture, our readiness and our capability to reduce the risk of, detect and respond to a cyberattack. Our senior management and board of directors participate in periodic cyber tabletop exercises to further enhance our preparedness in the event of an actual incident.


text: The Cyber Security program including security operations, governance, risk and compliance, data privacy, and business continuity is led by our Chief Information Security Officer ("CISO") who has over 25 years of extensive experience in technology and data center architecture, client solutioning, complex program management and nearly a decade in cyber risk management, governance and incident handling. Our CISO is supported by a team of cyber experts, many of whom are certified professionals in areas of security architecture, threat hunting, incident response, application security, business resiliency and data privacy among others.


text: Risk Management and Strategy We recognize the importance of developing, implementing and maintaining robust measures to safeguard our electronic information systems and we have established processes, described below, to assess, identify, manage and mitigate risks from cybersecurity threats and cybersecurity incidents. We believe our processes are reasonable for real estate companies of our size and complexity.

companyName: CubeSmart

ticker: CUBE


text: We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Under the direction of our Senior Vice President, Information Technology and our Senior Director, Information Security & Infrastructure (together, the "Cybersecurity Leadership Team") our Information Technology department regularly monitors cybersecurity threats and leads the prevention, detection, mitigation and remediation of cybersecurity incidents, with regular reporting to senior management and to the Board on these topics.


text: The Critical Security Controls, a prescriptive, prioritized, and standardized set of globally recognized best practices, guide our information security strategy. The Critical Security Controls are developed and maintained by the Center for Internet Security, Inc., a nonprofit organization with over 20 years of experience in helping individuals, businesses and governments protect themselves against cyber threats. We also consider best practices from third-party vendors and payment processors and from the Cloud Security Alliance, a nonprofit organization that leverages global expertise to offer research and education programs related to cloud security.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we also retain a range of external experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our information security processes and systems. These engagements enable us to access specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our engagements with these third parties include regular audits, threat assessments and consultation on security enhancements. We also regularly conduct information security training to ensure that all employees, including those who may come into possession of confidential financial or personally identifiable information, are aware of information security risks and are equipped to take steps to mitigate such risks. The results of such tests, assessments, reviews and trainings are evaluated by senior management and our cybersecurity policies, processes and practices are refined as necessary based on the information provided.


text: We routinely conduct thorough security assessments of our third-party service providers that have access to our electronic information (including data centers operated by third parties and cloud computing platforms) and we maintain policies and procedures to oversee and identify cybersecurity risks associated with our use of third-party service providers. Our policies and procedures also include technical controls and processes, as well as contractual mechanisms to mitigate risk. Assessments are performed biannually by the Cybersecurity Leadership Team and on a regular basis by their staff.


text: Since January 1, 2021, we have not experienced any cybersecurity incidents that have resulted in material financial loss. We are not aware of any cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: Management Oversight Primary responsibility for the oversight of the assessment, identification and management of our cybersecurity risks rests with our Senior Vice President, Information Technology. Under her direction, these risk mitigation efforts are designed, tested, and implemented by our Senior Director, Information Security & Infrastructure. Collectively, the Cybersecurity Leadership Team has over 50 years of experience in the field of Information Technology, holding relevant academic degrees and industry certifications, including the Certified Cloud Security Professional and Certified Information Systems Security Professional designations. The Cybersecurity Leadership Team oversees our information technology governance programs, tests our compliance with standards, remediates known risks, and leads our employee cybersecurity training program.


text: The Cybersecurity Leadership Team continually assesses and discusses the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition enhances our processes that are used to identify, prevent, mitigate and remediate cybersecurity threats and cybersecurity incidents. The Cybersecurity Leadership Team's responsibilities include the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Cybersecurity Leadership Team is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact of the incident, reporting such events to senior management, and developing strategies for remediation and prevention of future incidents.


text: The Cybersecurity Leadership Team maintains an ongoing dialogue with senior management regarding emerging or potential cybersecurity risks. Together, they discuss updates on any significant developments in the cybersecurity domain, ensuring that management's oversight is proactive. In addition, a cross-organizational cyber task force, which includes the Cybersecurity Leadership Team and several members of senior management, meets regularly to consider and address cybersecurity risks, including risks related to our use of third-party service providers. This task force reports regularly to senior management, who actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. The involvement of senior management in our cybersecurity strategy ensures that cybersecurity considerations are collaborative and integrated into our broader strategic objectives.


text: The Cybersecurity Leadership Team regularly informs the cyber task force of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing us. Furthermore, as noted below, significant cybersecurity matters, and strategic risk management decisions are escalated to the Audit Committee and, as appropriate, the Board, ensuring that such bodies maintain comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Board of Trustees Oversight The Board acknowledges the importance of managing risks associated with cybersecurity threats and cybersecurity incidents and has established oversight mechanisms to manage such risks. The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of five independent Trustees, two of whom have considerable information technology experience.


text: The Audit Committee receives comprehensive briefings from the Cybersecurity Leadership Team on an annual basis. These briefings help identify areas for improvement and ensure the alignment of cybersecurity efforts with our overall risk management framework. The broad range of topics encompassed in these briefings includes: The current cybersecurity landscape and emerging threats; Our cybersecurity posture and the effectiveness of our risk management strategies; The status of ongoing cybersecurity initiatives and strategies; and Our compliance with regulatory requirements and industry standards.


text: Our internal controls also provide for the Audit Committee to receive prompt information regarding any cybersecurity incident that meets established reporting thresholds, as well as for updates regarding any such incident until it has been fully remediated. The Audit Committee provides updates to the Board regarding such matters, as appropriate.


text: Risk Management and Strategy We recognize the importance of developing, implementing and maintaining robust measures to safeguard our electronic information systems and we have established processes, described below, to assess, identify, manage and mitigate risks from cybersecurity threats and cybersecurity incidents. We believe our processes are reasonable for real estate companies of our size, complexity, and risk profile.


text: We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Under the direction of our Senior Vice President, Information Technology and our Senior Director, Information Security (together, the "Cybersecurity Leadership Team") our Information Technology department regularly monitors cybersecurity threats and leads the prevention, detection, mitigation and remediation of cybersecurity incidents, with regular reporting to senior management and to the Board on these topics.


text: Since January 1, 2022, we have not experienced any cybersecurity incidents that have resulted in material financial loss. We are not aware of any cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: Management Oversight Primary responsibility for the oversight of the assessment, identification and management of our cybersecurity risks rests with our Senior Vice President, Information Technology. Under her direction, these risk mitigation efforts are designed, tested, and implemented by our Senior Director, Information Security. Collectively, the Cybersecurity Leadership Team has over 50 years of experience in the field of Information Technology, holding relevant academic degrees and industry certifications, including the Certified Cloud Security Professional and Certified Information Systems Security Professional designations. The Cybersecurity Leadership Team oversees our information technology governance programs, tests our compliance with standards, remediates known risks, and leads our employee cybersecurity training program.


text: Our established system of internal controls also provides for the Audit Committee to receive prompt information regarding any cybersecurity incident that meets established reporting thresholds, as well as for updates regarding any such incident until it has been fully remediated. The Audit Committee provides updates to the Board regarding such matters, as appropriate.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: PACIFIC BIOSCIENCES OF CALIFORNIA, INC.

ticker: PACB


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Senior Director and Head of Information Technology who reports to our Chief Operating Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards, including through annual third-party vulnerability assessments. We train our employees on these safeguards, in collaboration with human resources, IT, and departmental management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: We require each third-party infrastructure and applications service provider that has access to our system to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: We have not previously experienced a cybersecurity incident that was determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Senior Director and Head of Information Technology and our management committee on cybersecurity, which includes Facilities, HR, IT, Legal, and Management, are primarily responsible to assess and manage our material risks from cybersecurity threats. Our cybersecurity team and IT management have years of cybersecurity experience and expertise including holding numerous applicable cybersecurity certifications, such as ISC2 Certified Information Systems Security Professional (CISSP).


text: Our Senior Director and Head of Information Technology and our management committee on cybersecurity oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Senior Director and Head of Information Technology is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents by leading the implantation of the cybersecurity risk management program and working directly with our security team. The Senior Director and Head of Information Technology also provides appropriate information and updates to our management committee on cybersecurity.


text: Our Senior Director and Head of Information Technology and representatives from our management committee on cybersecurity provide annual briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote resources and designate high-level personnel, including our Vice President and Head of Information Technology who reports to our Chief Operating Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards, including through annual third-party vulnerability assessments. We train our employees on these safeguards, in collaboration with human resources, IT, and departmental management. Personnel at all levels and departments are made aware of our cybersecurity policies through training.


text: We engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes. These service providers assist us in designing and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: We have established procedures to evaluate and respond to cybersecurity incidents, including cybersecurity incidents at third-party service providers which have a potential to impact our data and systems. Our cybersecurity risk management is intended to address such risks, as well as other risks related to third parties.


text: We have not previously experienced a cybersecurity incident that was determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, " Risk Factors," in this Annual Report on Form 10-K.


text: One of the key functions of our board of directors is to provide oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Vice President and Head of Information Technology and our cyber committee, which includes Facilities, HR, IT, Legal, and Management, are primarily responsible to assess and manage our material risks from cybersecurity threats. Our Vice President and Head of Information Technology has years of cybersecurity experience and expertise including holding numerous applicable cybersecurity certifications, such as ISC2 Certified Information Systems Security Professional (CISSP).


text: Our Vice President and Head of Information Technology and our management committee on cybersecurity oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Vice President and Head of Information Technology is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents by leading cybersecurity risk management and working directly with our IT team. Our Vice President and Head of Information Technology also provides appropriate information and updates to our management committee on cybersecurity.


text: Our Vice President and Head of Information Technology and representatives from our management committee on cybersecurity provide annual briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.


text: Risk Management and Strategy Our risk management processes and procedures include a cybersecurity risk management program as part of its multiple technical layers of defense. Through our cybersecurity risk management program, we have designed and implemented processes for identifying, assessing, preventing, and managing material risks from cybersecurity threats to our critical computer networks, third-party service providers, communication systems, hardware and software, and our critical data, including confidential company and customer information. As part of our cybersecurity risk management program, we evaluate our various technical layers of defense on an ongoing basis including performing incident response planning, frequent vulnerability testing, vendor risk management, intrusion monitoring, and maintaining a security awareness program. We invest in our people, processes and systems and maintain partnerships with appropriate government and law enforcement agencies to help monitor cybersecurity threats as well as prevent and respond to cybersecurity incidents.

companyName: Axos Financial, Inc.

ticker: AX


text: We may utilize various resources that we deem necessary based on actual or potential threats and vulnerabilities to Axos, including engaging independent third-party assessors, consultants and/or auditors to help evaluate the effectiveness of our cybersecurity risk management program, processes, and controls.


text: Our overall enterprise risk management includes a third-party risk management program, through which we identify, monitor, and manage cybersecurity risks inherent in or related to external service providers and other third parties. Through our business lines, we actively assess and oversee our third-party service providers against requirements set by our third-party risk management program and our cybersecurity risk management program.


text: We have not identified any cybersecurity incidents that have materially affected Axos or its business strategy, results of operations, or financial condition. However, we face ongoing cybersecurity risks which may materially affect the Company in the future. Refer to the Risk Factors section for additional information.


text: Our Board of Directors includes cybersecurity risk management as part of its general oversight function and oversees the cybersecurity risk management program and any identified cybersecurity risks and incidents. To facilitate its oversight, the Board of Directors receive regular updates from management on cybersecurity.


text: Our Chief Risk Officer has primary responsibility for our enterprise risk management program, including oversight of our cybersecurity risk management program. Our Chief Information Security Officer has primary responsibility for our cybersecurity risk management program and supervises the Company's cybersecurity personnel. Both individuals have extensive work experience in various roles involving risk and compliance, including cybersecurity and information security.


text: The individuals involved in our cybersecurity risk management program are informed about developments in cybersecurity risks and related matters through a variety of channels inside the Company, including but not limited to, briefings from internal teams and alerts and reports produced by various measures we may deploy, as well as information obtained from external sources in the government and private sector, including external third party consultants retained by Axos.


text: Our Chief Information Security Officer and Chief Risk Officer report information on cybersecurity risks to the Board of Directors on a regular basis.


text: Risk Management and Strategy Our risk management processes and procedures include a cybersecurity risk management program as part of its multiple technical layers of defense. Through our cybersecurity risk management program, we have designed and implemented processes for identifying, assessing, preventing, and managing material risks from cybersecurity threats to our critical computer networks, third-party service providers, communication systems, hardware and software, and our critical data, including confidential company and customer information. As part of our cybersecurity risk management program, we evaluate our various technical layers of defense on an ongoing basis including performing incident response planning, frequent vulnerability testing, vendor risk management, intrusion monitoring, and maintaining a security awareness program. We invest in our people, processes and systems and collaborate with appropriate government and law enforcement agencies to help monitor cybersecurity threats as well as prevent and respond to cybersecurity incidents.


text: Cybersecurity risk management is part of our Board of Directors' general oversight function, which includes oversight of the cybersecurity risk management program and any identified cybersecurity risks and incidents. To facilitate its oversight, the Board of Directors receives regular updates from management on cybersecurity.


text: Our Chief Risk Officer has primary responsibility for our enterprise risk management program. Our Chief Information Security Officer has primary responsibility for our cybersecurity risk management program and supervises the Company's cybersecurity personnel. Both individuals have extensive work experience in various roles involving risk and compliance, including cybersecurity and information security.


text: Risk Management and Strategy To mitigate cybersecurity risks we strive to continually assess and improve our processes and procedures. We engage with industry-leading managed security service providers to supplement our efforts in identifying, assessing, preventing, and responding to cybersecurity threats. We are working to align our information technology operations and information security processes to the National Institute of Standards and Technology's framework. We have adopted a cloud-first strategy which is a foundational element to our overall cybersecurity posture. For essential systems, we utilize SaaS-based software partners who annually conduct Statement on Standards for Attestation Engagements.

companyName: Comstock Holding Companies, Inc.

ticker: CHCI


text: We have adopted a cybersecurity risk management process that is designed to identify and mitigate potential cybersecurity risks and is currently being integrated into our overall enterprise risk management process. We regularly assess our cybersecurity vulnerability by utilizing credible, third-party cybersecurity experts to conduct annual internal penetration tests and monthly vulnerability scans. These threat intelligence and monitoring activities, tests, and scans help us identify potential cybersecurity risks.


text: We seek to mitigate cybersecurity risks we identify through a variety of methods; however, we acknowledge that even a robust, well-designed information technology control environment may not fully eliminate cybersecurity risk. It is possible that we will be unable to detect certain vulnerabilities in time to remediate them, or that our implemented controls may not operate as intended.


text: To date, we have not experienced any material cybersecurity incidents. We remain subject to the risks from cybersecurity threats that, if realized, are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.


text: Our Board of Directors considers cybersecurity as part of its risk oversight function. While management is responsible for the day-to-day management of risk, our Board of Directors maintains oversight of management's implementation of our cybersecurity risk management processes. Our Board of Directors receives briefings on material cybersecurity incidents, as necessary.


text: Our Vice President of Information Technology provides principal oversight and guidance of our cybersecurity risk management strategy, programs, and processes. The Vice President of Information Technology has over 30 years of experience in information technology, leading organizations through strategic technology and process improvement initiatives, including over 15 years of extensive experience in cybersecurity. He is supported by a team of technical experts who have received formal training and possess relevant experience in addition to managed cybersecurity service providers who specialize in preventing, identifying, and responding to cybersecurity threats.


text: As part of our annual enterprise risk assessment, technology cybersecurity risks are ranked and reviewed by management. In the event of a cybersecurity incident, the Vice President of Information Technology would prepare a comprehensive assessment for management that summarizes potential and actual impacts and includes any steps needed to remediate the identified issues. If the cybersecurity incident was deemed to be material by management, the Vice President of Information Technology would brief our Board of Directors on the matter, at which time determinations would be made by the Board of Directors on the need to report or disclose the cybersecurity incident to our customers or investors.


text: Risk Management and Strategy To mitigate cybersecurity risks, we continuously assess and enhance our security processes and procedures. We collaborate with industry-leading managed security service providers to strengthen our ability to identify, assess, prevent, and respond to cybersecurity threats. Our information technology operations and security processes are being aligned with the National Institute of Standards and Technology (NIST) framework to further standardize and improve our security posture.


text: As part of our commitment to a cloud-first strategy, we prioritize the use of SaaS-based solutions for critical business functions. These third-party providers conduct annual Statement on Standards for Attestation Engagements ("SSAE") audits, ensuring compliance with industry best practices.


text: We have adopted a cybersecurity risk management framework designed to identify and mitigate potential cybersecurity risks, which is being integrated into our overall enterprise risk management program. Our risk assessments are informed by third-party cybersecurity experts, who conduct annual internal penetration tests and monthly vulnerability scans to continuously evaluate and strengthen our security posture.


text: Cybersecurity risks are categorized using a Critical, High, Medium, and Low risk scoring methodology. These assessments are performed through a combination of automated tools, manual audits, and expert evaluations, allowing us to implement effective controls that enhance our security framework. In addition, we have introduced annual cybersecurity awareness training, phishing simulations, and ongoing communication initiatives to strengthen organizational awareness of cybersecurity risks and threat prevention. To date, we and our subsidiaries have not experienced any material cybersecurity incidents.


text: Cybersecurity is a key component of our enterprise risk oversight framework, with our Board of Directors actively engaged in overseeing cybersecurity risk management. While management is responsible for day-to-day cybersecurity operations, the Board ensures that our cybersecurity risk management strategies are effectively implemented. The Board is briefed on material cybersecurity incidents as necessary to maintain transparency and informed decision-making.


text: Our Vice President of Information Technology leads our cybersecurity strategy, programs, and risk management processes. With over 30 years of experience in IT, including 15+ years in cybersecurity, the Vice President provides strategic oversight and ensures alignment with industry best practices. This role is supported by a team of cybersecurity professionals with formal training and specialized expertise, as well as partnerships with managed security service providers focused on proactive threat detection, incident response, and risk mitigation.


text: As part of our annual enterprise risk assessment, cybersecurity risks are ranked and reviewed by executive management. In the event of a cybersecurity incident, the Vice President of Information Technology, in collaboration with our cybersecurity partners, would conduct a comprehensive impact assessment. This assessment would outline both potential and actual risks, along with necessary remediation steps. If an incident is deemed material, the Vice President would escalate the matter to the Board of Directors, who would determine whether disclosure to customers or investors is required.


text: We, together with our third-party vendors, employ information technology including networks, systems, and applications to support our business processes and decision-making across the Company. Our information technology is connected to support the flow of information across our business processes. As such, our information technology infrastructure is susceptible to cybersecurity threats.

companyName: LAS VEGAS SANDS CORP

ticker: LVS


text: We maintain detailed technology and cybersecurity programs to manage information security risk within the Company. We rely on both proprietary and commercially available systems, software, and tools to protect and monitor the processing, transmission, and storage of company data and both customer and team member information. The objectives of our programs are to: • protect the confidentiality, integrity, and availability of data, • protect against anticipated threats, • protect against unauthorized access to our information technology systems, • safeguard assets, and • maintain resiliency and recovery plans regarding Company informational technology.


text: To meet these objectives and oversee the programs, we employ a Chief Information Security Officer ("CISO"). The CISO has over 27 years of cybersecurity experience, 25 years of cybersecurity leadership experience, an MBA in Information Systems, a Master of Science degree in operational analysis, a bachelor's degree in operations research and holds a Cyber Risk Oversight Certificate from the National Association of Corporate Directors and is a Certified Information Systems Security Professional ("CISSP"). The CISO works closely with the head of information technology and the data privacy officer to collectively manage our global cybersecurity, information technology and data privacy programs.


text: Our cybersecurity programs are informed by or aligned to the ISO/IEC 27001 security framework, an internationally recognized standard. As part of our programs, we assess our third-party vendors for relevant risks which may impact the Company.


text: We also engage third-party providers to perform periodic risk-based assessments of our cybersecurity programs, and also leverage our internal audit department, supported by third-party technical experts, to conduct periodic risk-based audits of our cybersecurity programs.


text: Our Enterprise Risk Management ("ERM") process, which is governed by an ERM Committee, includes a review of our cybersecurity programs. The ERM Committee, which is led by our executive vice president and chief financial officer, meets regularly, and receives updates from the CISO on emerging risks, recent cyber risk events, and any priority risks relating to cybersecurity. We also have a Cyber & Privacy Steering ("CPS") Committee, which meets regularly and is comprised of senior management, serving as a multi-disciplinary group for coordinating and overseeing the management of the cybersecurity and privacy programs.


text: The Audit Committee of the Board of Directors has oversight responsibility for ERM, including the cybersecurity programs. The CISO provides regular updates on cyber security to the Audit Committee, including on the cybersecurity aspects noted by the ERM Committee and CPS Committee, and regularly meets with the Audit Committee in executive session. The presentations highlight the state of our cybersecurity and data security programs, as well as our progress on key initiatives in this area.


text: To date, the Company has not experienced a cybersecurity threat or incident that has materially affected or is reasonably likely to materially affect the Company. The Company, however, has experienced and expects to continue to experience cyber incidents of varying degrees. See "Item 1A. — Risk Factors — Failure to maintain the integrity of our information and information systems or comply with applicable privacy and cybersecurity requirements and regulations could harm our reputation and adversely affect our business." for more detailed information on cybersecurity risks and the potential impacts.


text: We maintain detailed technology and cybersecurity programs to manage information security risk within the Company. We rely on both proprietary and commercially available systems, software, and tools to protect and monitor the processing, transmission, and storage of Company data and both customer and team member information. The objectives of our programs are to: • protect the confidentiality, integrity, and availability of data, • protect against anticipated threats, • protect against unauthorized access to our information technology systems, • safeguard assets, and • maintain resiliency and recovery plans regarding Company informational technology.


text: To meet these objectives and oversee the programs, we employ a Chief Information Security Officer ("CISO"). The CISO has over 28 years of cybersecurity experience, 26 years of cybersecurity leadership experience, an MBA in Information Systems, a Master of Science degree in operational analysis, a bachelor's degree in operations research and holds a Cyber Risk Oversight Certificate from the National Association of Corporate Directors and is a Certified Information Systems Security Professional ("CISSP"). The CISO works closely with the head of information technology and the data privacy officer to collectively manage our global cybersecurity, information technology and data privacy programs.


text: Our Enterprise Risk Management ("ERM") process, which is governed by an ERM Committee, includes a review of our cybersecurity programs. The ERM Committee, which is led by our executive vice president and chief financial officer, meets quarterly, and receives updates from the CISO on emerging risks, recent cyber risk events, and any priority risks relating to cybersecurity. We also have a Cyber & Privacy Steering ("CPS") Committee, which meets regularly and is comprised of senior management, serving as a multi-disciplinary group for coordinating and overseeing the management of the cybersecurity and privacy programs.


text: To date, the Company has not experienced a cybersecurity threat or incident that has materially affected or is reasonably likely to materially affect the Company. The Company, however, has experienced and expects to continue to experience cyber incidents of varying degrees. See "Item 1A. — Risk Factors — Failure to maintain the integrity of our information and information systems or comply with applicable privacy and cybersecurity requirements and regulations could harm our reputation and adversely affect our business" for more detailed information on cybersecurity risks and the potential impacts.


text: Our risk management program includes focused efforts on identifying, assessing and managing cybersecurity risk, including the following: • A robust information security training program that requires all company employees with access to our networks to participate in regular and mandatory training on how to be aware of, and help defend against, cyber risks, combined with periodic testing to measure the efficacy of our training efforts. • Alignment of our program with the National Institute of Standards and Technology Cybersecurity Framework to prevent, detect and respond to cyberattacks. • Continuous and robust testing of our systems to assess our vulnerability to cyber risk, which includes targeted penetration testing, tabletop incident response exercises, periodic audits of our systems by outside industry experts and regular vulnerability scanning. • Engaging external cybersecurity experts in incident response development and management. • Business continuity plans and critical recovery backup systems.

companyName: BlueLinx Holdings Inc.

ticker: BXC