text: The Bank's information security program and strategy are regularly reviewed and updated to ensure that they are aligned with the Bank's business objectives and are designed to address evolving cybersecurity threats and satisfy regulatory requirements and industry standards.


text: Material Effects of Cybersecurity Threats While cybersecurity risks have the potential to materially affect the Bank's business, financial condition, and results of operations, the Bank does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Bank, including its business strategy, results of operations or financial condition. Accordingly, no matter how well designed or implemented the Bank's controls are, there is a risk that it may not be able to anticipate all zero-day cyber security exploits and vulnerabilities, and it may not be able to implement effective preventive measures against such exploits / vulnerabilities and potentially associated security breaches in a timely manner.

companyName: BCB BANCORP INC

ticker: BCBP

secItem: Item 1C


text: Board of Directors Oversight The Bank's Board of Directors is charged with overseeing the establishment and execution of the Bank's security management framework and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Consistent with this responsibility the Board has delegated primary oversight responsibility over the Bank's security management framework, including oversight of cybersecurity risk and cybersecurity risk management, to the Information Technology /Information Security Committee of the Board of Directors. The Information Technology /Information Security Committee receives regular updates on cybersecurity risks and incidents and the cybersecurity program through direct interaction with the Chief Information Technology Officer and provides periodic updates regarding cybersecurity risks and the cybersecurity program to the full Board of Directors. Additionally, awareness and training on cybersecurity topics is provided to the Board on an annual basis.


text: Management's Role The Information Technology department is responsible for implementing and maintaining the Bank's cybersecurity risk management program. The Information Technology department consists of cybersecurity and information risk professionals who assess, identify, and manage cybersecurity risks. Information Security is led by Chief Information Technology Officer, who reports directly to the Chief Operating Officer and dotted lined to the Board of Directors. The Bank's CITO has over 23 years of experience in technology and cybersecurity across the financial services industry. Prior to joining the Bank, the Bank's CITO served as Chief Information Officer and Information Security Officer at First Choice Bank and the Director of Technology and IT Governance at OceanFirst Bank. The Information Technology department is responsible for ensuring the protection of electronic and physical information through the identification and management of risk activities. Information security risk is reported by the Information Technology Department through quarterly management reporting to achieve an appropriate flow of information risk reporting to the Board. The committees and working groups that monitor information security risks include the Cybersecurity Incident Response Team, and the Information Technology / Information Security Committee of the Board of Directors. These committees and working groups establish and oversee policies, programs, and other guidance to provide specific expectations for managing the cybersecurity risk.


text: Cybersecurity Risk Management and Strategy Cybersecurity risks are continually evolving, becoming increasingly complex and pervasive across all industries. To mitigate these cybersecurity risks and protect nonpublic, personally identifiable customer data, financial transactions and our classified information systems, the Bank has implemented a comprehensive information security program, which is a component of its overarching enterprise risk management program. Key components of the information security program include: • A risk assessment process that identifies and prioritizes material cybersecurity risks; defines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the Board of Directors. • Annual security assessments that proactively identify potential vulnerabilities that are both externally facing and internal within the bank's infrastructure; reports the results for all assessments to executive management and the Board of Directors with tracking and resolution to potential areas of risk. • Vulnerability management program that patches known vulnerabilities across operating systems and software platforms. • Strong controls around user access including creation, changes and termination of access, ongoing user access reviews, multifactor authentication and password policies. • A technology team covering all critical cyber defense functions such as engineering, data protection, identity and access management, insider risk management, security operations, threat emulation and threat intelligence. • A training program that educates employees about cybersecurity risks and how to protect themselves from cyberattacks. • An awareness program that keeps employees informed about cybersecurity threats and how to stay safe online. • An incident response plan that outlines the steps the Bank will take to respond to a cybersecurity incident, which is tested on a periodic basis. • Adoption and implementation of a layered defense / defense in depth model n which security systems are linked or stacked so that the strengths of one security system compensate the weaknesses of the other system. • Additional controls that include but not limited to data encryption; change management; end of life management; asset management; malware and antivirus detection, response and mitigation; physical security; business continuity and disaster recovery management.


text: The Bank engages reputable third-party assessors to conduct various independent audits on a regular basis, including but not limited to maturity assessments and various testing. Following a defense-in-depth strategy, the Bank leverages both in-house resources and third-party service providers to implement and maintain processes and controls to manage the identified risks.


text: The Bank's Third-Party / Vendor Risk Management program is designed to ensure that our vendors meet our cybersecurity requirements. This includes conducting periodic risk assessments of vendors, requiring vendors to implement appropriate cybersecurity controls and monitoring vendor compliance with our cybersecurity requirements.


text: The Bank's information security program and strategy are designed to ensure the Bank's information and information systems are resilient and appropriately protected from a variety of threats, both natural and man-made. Periodic audits and risk assessments are performed to validate control requirements and ensure that the Bank's information is protected at a level commensurate with its sensitivity, value, and criticality. Preventative and detective security controls and policies are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission to ensure the confidentiality, integrity, and availability of Bank information. These controls and policies include, but are not limited to access control, data encryption, data loss prevention, incident response, security monitoring, third party risk management, and vulnerability management.


text: Management's Role We recognize the critical importance of developing, implementing, assessing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Senior Management, in collaboration with the Information Technology and Risk Departments, is responsible for the implementation and oversight of the Bank's Cybersecurity Risk Management Program.


text: Information security risk is systematically reported to our Board of Directors by the Information Technology and Risk Departments through quarterly management reports, ensuring a structured and effective flow of cybersecurity risk information to the Board of Directors. Various committees and working groups are dedicated to monitoring and managing information security risks, including the Cybersecurity Incident Response Team and the Information Technology/Information Security Committee of the Board of Directors. These committees play a pivotal role in establishing and overseeing policies, programs, and guidance that define clear expectations for managing cybersecurity risk.


text: Due to the evolving nature of cybersecurity threats, we actively engage with external experts to enhance our security expertise. These subject matter experts provide independent evaluations and testing of our cybersecurity risk management framework. Our collaboration with these entities includes regular audits, threat assessments, and consultations on security enhancements to reinforce our security posture.


text: As a trusted advisor to our clients and a regulated financial services firm, information and cybersecurity are critical to our operations and reputation. Our management team takes an active role in identifying, assessing, monitoring and managing material risks from information and cybersecurity threats. Management's assessment of information and cybersecurity threats is incorporated into our enterprise risk management processes, which include assessing inherent risks posed by the internal operating environment and external factors, assessing the adequacy and design of controls, testing controls, determining residual risk and comparing it to risk appetite thresholds, and taking steps to further mitigate risks as needed. Our board of directors is actively engaged in the oversight of cybersecurity and information technology risks, with primary oversight responsibility delegated to the audit committee of the board of directors. The audit committee is composed of board members with the appropriate expertise, including risk management, cybersecurity and finance, to oversee these risks as well as management's cybersecurity processes and protocols.

companyName: PIPER SANDLER COMPANIES

ticker: PIPR


text: Our chief information and operations officer is a member of our leadership team and has been in this role for 15 years. With more than 25 years of experience in information technology in the investment banking industry, he is responsible for overseeing more than 100 employees in our information security and technology departments who possess relevant educational and industry experience. The information security and technology departments are responsible for various functions of our information and cybersecurity program, including implementing and maintaining policies and procedures; developing, implementing and governing various service level agreements; ratifying security standards; reviewing project implementations; performing third-party vendor assessments; and operating programs such as threat intelligence, vulnerability management, security information event management, and information governance.


text: Our information and cybersecurity program utilizes the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and our security controls are mapped to the NIST Cybersecurity Framework to ensure alignment with recognized industry best practices. Annually, we engage a third-party consultant to conduct an assessment of the effectiveness of our information and cybersecurity program against the NIST Cybersecurity Framework. This assessment is reviewed with the audit committee, and opportunities for further maturation are incorporated into our information and cybersecurity roadmap.


text: Additionally, we regularly engage consultants and other third parties to evaluate specific priority areas of our information and cybersecurity program based on our assessment of the current cybersecurity threat landscape. Examples of our engagement with consultants include external penetration testing, application security assessment and cybersecurity incident response tabletop exercises.


text: Our third-party vendor management program has a tiered approach to assess vendors based on risk profile. We review each third-party vendor's architectures, security practices and data flows, and integrate stringent contractual terms encompassing breach notifications and other security requirements. The risk profiles associated with our service level agreements are monitored by senior employees in our information security and technology departments. Our vendor management program also includes an annual reassessment of the risk profile of each vendor and interim vendor reviews are completed if service alterations occur.


text: Senior information security and technology employees, including the chief information and operations officer, meet regularly to discuss potential information and cybersecurity threats that have been identified by our systems, employees or otherwise made known to us by our third-party service providers, vendors and other external users, and to formulate the appropriate response to any identified material information and cybersecurity threats. When high-priority information or cybersecurity risks are identified, certain employees in our information security, privacy, technology, legal and compliance departments meet or communicate to review potential threats in accordance with our internal cybersecurity incident response process.


text: Potential threats, our response to such threats, and our evaluation of any residual risk are communicated quarterly to the audit committee. As necessary, the chief information and operations officer provides interim updates to the audit committee and, as appropriate, the board of directors, concerning high-priority or material information or cybersecurity threats. Our chief information and operations officer also provides a quarterly update to the audit committee regarding our ongoing information and cybersecurity initiatives; the current cybersecurity landscape and emerging threats; and metrics on the effectiveness of certain aspects of our information and cybersecurity program.


text: Employees, including representatives of management, conduct an annual cybersecurity incident response tabletop exercise to review our processes and procedures in the event of a material information or cybersecurity incident, including the process for assessing the materiality of an incident and communication of an incident to the audit committee and, as appropriate, the board of directors. In addition, to promote a company-wide culture of cybersecurity risk management, we conduct regular phishing email simulations for employees to enhance awareness and responsiveness to possible threats and other kinds of preparedness training. We also require all employees to complete an annual cybersecurity and privacy awareness training.


text: We believe that we have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, as well as controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: We are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect our company, including our business strategy, results of operations or financial condition. However, we cannot provide assurance that a future cybersecurity incident would not materially affect our business strategy, results of operations or financial condition. Additional information regarding risks related to cybersecurity is included under "Risk Factors" in Part I, Item 1A of this Form 10-K.


text: Our chief information and operations officer is a member of our leadership team and has been in this role since 2008. With more than 25 years of experience in information technology in the investment banking industry, he is responsible for overseeing more than 100 employees in our information security and technology departments who possess relevant educational and industry experience. The information security and technology departments are responsible for various functions of our information and cybersecurity program, including implementing and maintaining policies and procedures; developing, implementing and governing various service level agreements; ratifying security standards; reviewing project implementations; performing third-party vendor assessments; and operating programs such as threat intelligence, vulnerability management, security information event management, and information governance.


text: Our information and cybersecurity program utilizes the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0, and our security controls are mapped to the NIST Cybersecurity Framework 2.0 to ensure alignment with recognized industry best practices. Annually, we engage a third-party consultant to conduct an assessment of the effectiveness of our information and cybersecurity program against the NIST Cybersecurity Framework 2.0. This assessment is reviewed with the audit committee, and opportunities for further maturation are incorporated into our information and cybersecurity roadmap.


text: Employees, including representatives of management, conduct an annual cybersecurity incident response tabletop exercise to review our processes and procedures in the event of a material information or cybersecurity incident, including the process for assessing the materiality of an incident and communication of an incident to the audit committee and, as appropriate, the board of directors. In 2024, our board of directors also participated in the cybersecurity incident response tabletop exercise. In addition, to promote a company-wide culture of cybersecurity risk management, we conduct regular phishing email simulations for employees to enhance awareness and responsiveness to possible threats and other kinds of preparedness training. We also require all employees to complete an annual cybersecurity and privacy awareness training.


text: Risk management and strategy We have implemented and maintain an information security program designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data including intellectual property, clinical trial participant and patient-related data, and confidential information that is proprietary, strategic or competitive in nature, or collectively, Information Systems and Data.

companyName: Jazz Pharmaceuticals plc

ticker: JAZZ


text: Our cybersecurity threat risk management processes include the following, among others: • Our information security department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example, manual methods and automated tools, conducting scans of the threat environment, conducting threat assessments, performing vulnerability assessments, use of external intelligence feeds, and through third-party-conducted red/blue team testing and tabletop incident response exercises. • Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: information security policies and standards governing access control, network and device security, encryption standards, incident response plans, disaster recovery plans, risk management, vulnerability detection and management and security awareness training requirements as well as security tools such as firewalls, malware protection tools, secure authentication tools, centralized logging and monitoring tools, threat intelligence tools, and data protection tools. • Our overall risk assessment and management processes address cybersecurity threats that may have a material impact on our business. Our information security department maintains a risk register of individual risks from cybersecurity threats. Our Chief Information Security Officer, or CISO, and Chief Information Officer, or CIO, periodically review the area of cybersecurity risk management within our overall enterprise risk management program and work with our executive director of internal audit and enterprise risk management to incorporate the aggregate risks from the cybersecurity threat risk register into the overall enterprise risk management program risk register. In addition, our CISO and CIO report significant increases to our threat profile to the Information Security Governance Committee (described below). • We use third parties, including professional services, incident response and managed security firms (including some that we have on a pre-paid retainer basis), to assist us from time to time to identify, assess, and manage cybersecurity risks, perform threat assessments relating to our Information Systems and Data by reviewing our business and industry vertical threat profiles and applying those to the overall threat landscape, perform penetration tests, conduct cybersecurity readiness exercises, assess program maturity, and to assist in the event of a cyber security incident. • We have third-party vendor management processes designed to help us identify, assess and manage risks from cybersecurity threats to our Information Systems and Data that may arise out of our use of third-party vendors across our business, including, among others, application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. Depending on the nature of the services and the service provider, our vendor management processes may include assessment of the cybersecurity practices of such vendors and contractually imposing obligations on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how those risks may affect us see "Significant disruptions of information technology systems or data security breaches could adversely affect our business" under Part I, Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: • Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors, or Audit Committee, helps oversee our cybersecurity risk management processes, including oversight of risks from cybersecurity threats. • The Information Governance Security Committee and the Audit Committee receive various reports from CISO and CIO. The CISO (or its designee) reports to the Audit Committee on cybersecurity risk on at least a quarterly basis. Written reports and presentation materials regarding cybersecurity risk provided to the Audit Committee are made available to the board of directors and they can discuss the materials and cybersecurity risk with the Audit Committee members. The Internal Audit team oversees internal controls implemented by us under our information security program. • Our information security program is implemented and maintained by certain of our management, including the CISO, CIO and other members of our Information Security Governance Committee (Chief Legal Officer, Chief Financial Officer, and Chief Privacy Officer). Our CISO has been at the company for over 7 years, and has served in various cybersecurity roles for over 20 years across multiple companies and industry verticals including banking, consulting, ecommerce, and pharmaceuticals. He is a Certified Information Systems Security Professional and has experience responding to major information security incidents at previous companies prior to joining the company. Our CIO has been at the company and had oversight of our cybersecurity for over 7 years. In addition, our CIO has served in various information technology roles in the U.S. and overseas for over 25 years across multiple companies and industry verticals including consulting, healthcare, and pharmaceuticals. • The Information Security Governance Committee helps assess and manage our cybersecurity risks and monitor the effectiveness of our information security program and risk management. Management, including those serving on our Information Security Governance Committee, is responsible for hiring appropriate cybersecurity personnel, helping to integrate cybersecurity considerations into our overall risk management strategy, providing appropriate resources for cybersecurity risk management, and communicating key priorities to relevant personnel. Our cybersecurity incident response plan includes processes designed to escalate certain cybersecurity incidents that caused a significant impact to us to members of the Information Security Governance Committee, and certain members of executive management depending on the circumstances. In addition, our incident response plan includes reporting to the Audit Committee for certain cybersecurity incidents, including those that have potentially had a material impact to us.


text: Our cybersecurity threat risk management processes include the following, among others: • Our information security department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example, manual methods and automated tools, conducting scans of the threat environment, conducting threat assessments, performing vulnerability assessments, use of external intelligence feeds, and through third-party-conducted red/blue team testing and tabletop incident response exercises. • Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: information security policies and standards governing access control, network and device security, encryption standards, incident response plans, disaster recovery plans, risk management, vulnerability detection and management and security awareness training requirements as well as security tools such as firewalls, malware protection tools, secure authentication tools, centralized logging and monitoring tools, threat intelligence tools, and data protection tools. • Our overall risk assessment and management processes address cybersecurity threats that may have a material impact on our business. Our information security department maintains a risk register of individual risks from cybersecurity threats. Our CISO and CIO periodically review the area of cybersecurity risk management within our overall enterprise risk management program and work with our executive director of internal audit and enterprise risk management to incorporate the aggregate risks from the cybersecurity threat risk register into the overall enterprise risk management program risk register. In addition, our CISO and CIO report significant increases to our threat profile to the Information Security Governance Committee (described below). • We use third parties, including professional services, incident response and managed security firms (including some that we have on a pre-paid retainer basis), to assist us from time to time to identify, assess, and manage cybersecurity risks, perform threat assessments relating to our Information Systems and Data by reviewing our business and industry vertical threat profiles and applying those to the overall threat landscape, perform penetration tests, conduct cybersecurity readiness exercises, assess program maturity, and to assist in the event of a cyber security incident. • We have third-party vendor management processes designed to help us identify, assess and manage risks from cybersecurity threats to our Information Systems and Data that may arise out of our use of third-party vendors across our business, including, among others, application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. Depending on the nature of the services and the service provider, our vendor management processes may include assessment of the cybersecurity practices of such vendors and contractually imposing obligations on the provider.


text: • Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee helps oversee our cybersecurity risk management processes, including oversight of risks from cybersecurity threats. • The Information Governance Security Committee and the Audit Committee receive various reports from CISO and CIO. The CISO (or its designee) reports to the Audit Committee on cybersecurity risk on at least a quarterly basis. Written reports and presentation materials regarding cybersecurity risk provided to the Audit Committee are made available to the board of directors and they can discuss the materials and cybersecurity risk with the Audit Committee members. The Internal Audit team oversees internal controls implemented by us under our information security program. • Our information security program is implemented and maintained by certain of our management, including the CISO, CIO and other members of our Information Security Governance Committee (Chief Legal Officer, Chief Financial Officer, and Chief Privacy Officer). • The Information Security Governance Committee helps assess and manage our cybersecurity risks and monitor the effectiveness of our information security program and risk management. Management, including those serving on our Information Security Governance Committee, is responsible for hiring appropriate cybersecurity personnel, helping to integrate cybersecurity considerations into our overall risk management strategy, providing appropriate resources for cybersecurity risk management, and communicating key priorities to relevant personnel. Our cybersecurity incident response plan includes processes designed to escalate certain cybersecurity incidents that caused a significant impact to us to members of the Information Security Governance Committee, and certain members of executive management depending on the circumstances. In addition, our incident response plan includes reporting to the Audit Committee for certain cybersecurity incidents, including those that have potentially had a material impact to us.


text: Risk Management and Strategy. The Company's information security program consists of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis. These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, sensitive data management, electronic communication, risk/security reporting, incident response planning and business continuation planning. The information technology department ("IT Department"), which includes the cybersecurity department ("IT Security Department"), is responsible for implementing such processes and coordinating with the Human Resources Department to align training and onboarding efforts with such processes. The IT Security Department carries out risk management primarily by outsourcing risks to those companies and agencies that specialize in handling such risks and that have the appropriate resources to do so. Additionally, the IT Department assesses and improves the Company's cybersecurity risk management processes on an annual basis by: (i) engaging its cyber insurance broker, AON, plc, to complete a benchmarking evaluation to compare the Company's cybersecurity posture against peers and (ii) engaging cyber risk readiness and response company, Netdiligence, to conduct vulnerability and penetration testing, which produces a report that specifies any possible risk area and devices. Such report is presented to the IT Department for analysis and for the purpose of developing subsequent action plans to remediate any vulnerabilities. As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial conditions, except as otherwise noted.

companyName: ASHFORD HOSPITALITY TRUST INC

ticker: AHT


text: Governance. Management is ultimately responsible for assessing and managing the Company's cybersecurity risk. The information security program is overseen by the Chief Financial Officer, Vice President of IT, and the Information Security Manager. The Information Security Manager provides a weekly report to the Vice President of IT, which contains an overview of the activity in the department, any United States Computer Emergency Readiness Team alerts processed and all findings from the preventative maintenance tools. The Vice President of IT provides such report to the Chief Financial Officer on a quarterly basis. The Audit Committee of the Board is then briefed each quarter on the occurrence of any cybersecurity incidents. The Board will also be provided an overview of the information security program on an annual basis, including updates on the IT team, IT training, implementation of IT controls, cybersecurity testing, the incident response process and the cybersecurity assets of the Company.


text: Risk Management and Strategy. The Company relies on Ashford Inc. and the Company's managers to protect the electronic assets of the Company. Their programs consist of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis. These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, electronic communication, risk/security reporting, incident response planning and business continuity planning. The information technology department of Remington Hospitality ("IT Department"), which includes a cybersecurity department ("IT Security Department"), is responsible for implementing processes and coordinating with the Human Resources Department to align training and onboarding efforts of Ashford Inc. and Remington Hospitality employees handling the Company's electronic assets.


text: Remington Hospitality's IT Security Department carries out risk management primarily by outsourcing risks to those companies and agencies that specialize in handling such risks and that have the appropriate resources to do so. Additionally, Remington Hospitality's IT Department assesses and improves the Company's cybersecurity risk management processes on an annual basis by: (i) engaging consultants to complete a benchmarking evaluation to compare its cybersecurity posture against peers; and (ii) engaging a cybersecurity risk readiness and response company to conduct vulnerability and penetration testing, which produces a report that specifies any possible risk area and devices. Such report is presented to the IT Department for analysis and for the purpose of developing subsequent action plans to remediate any vulnerabilities. As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial conditions, except as otherwise noted.


text: Governance. Management, provided by Ashford Inc., is ultimately responsible for assessing and managing the Company's cybersecurity risk. The information security program is overseen by the Chief Financial Officer of Ashford Inc. and the Chief Technology Officer for Remington Hospitality. A Cyber Incident Response Team comprised of Ashford Inc. and Remington Hospitality employees meets bi-weekly to review incidents that have occurred and/or impacted the Company's electronic assets. The Chief Technology Officer of Remington Hospitality reviews weekly reports that contain an overview of the activity in the department, any United States Computer Emergency Readiness Team alerts processed and all findings from the preventative maintenance tools. The Chief Technology Officer provides such report to the Chief Financial Officer on a quarterly basis. The Audit Committee of the board of directors is then briefed each quarter on the occurrence of any cybersecurity incidents. The board of directors will also be provided an overview of the information security program on an annual basis, including updates on Remington Hospitality's IT team, IT training, implementation, IT controls, cybersecurity testing, the incident response process and the cybersecurity assets of the Company.


text: Risk Management and Strategy We have implemented ongoing processes that are designed to continually identify, assess, manage and mitigate the dynamic and evolving material risks to us from cybersecurity threats. Our cybersecurity threat risks are identified, assessed, managed, and monitored by our Adviser's and Administrator's resource management and compliance departments, on our behalf, and work in conjunction with an independent third-party information technology service provider ("ISP") engaged by our Adviser to manage our information technology strategy. The ISP regularly performs cyber assessments and assists in maintaining our cyber and information security programs. The ISP proposes recommendations to our Adviser's resource management and compliance departments, which then are considered by other officers and employees of our Adviser and Administrator, working on our behalf, before improvements are implemented to our information technology strategy, cybersecurity, and incident response policies, processes and procedures.

companyName: GLADSTONE COMMERCIAL CORP

ticker: GOOD


text: In addition, regular ongoing cybersecurity threat risk assessments are performed throughout the year and reported to our officers and Board of Directors by our Chief Compliance Officer ("CCO") no less than quarterly. Cybersecurity risks are assessed in general as part of the overall enterprise risk management for us, but also specifically between the ISP and our Adviser and Administrator in monitoring and determining not only the risks but also in assessing corresponding processes and procedures to mitigate those risks appropriately. Additionally, third party business applications are also incorporated in these risk assessments.


text: As an international service provider, our ISP constantly monitors information technology risk and cybersecurity threats globally. When risks are detected, we, through our Adviser and Administrator, consults with the ISP to assess if the risk is a cybersecurity threat to our information technology systems or data. If a risk to our information systems or data is identified, we then, through our Adviser and Administrator, work in conjunction with the ISP to implement recommended processes, improvements, or safeguards to our systems or processes to address the risks as needed. Relevant examples of such efforts include but are not limited to: • implementation of industry leading Cloud solutions and business applications which possess integrated cybersecurity safeguards; • anti-malware, antivirus and threat detection software; • ransomware containment and isolation software; • enhanced password requirements and multifactor authentication requirements; • endpoint encryption; • intrusion detection and response system conduct file integrity monitoring; • email archiving, firewalls, and quarantine capabilities; • mobile device management of business applications; • frequent systems backups with recovery capabilities; and • regular vulnerability scans and penetration testing.


text: Contractually, we require the ISP to annually provide a third-party report on its systems and on the suitability of the design and operating effectiveness of its controls relevant to information and cyber security. In addition to the ongoing dialogue and technology interaction between our Adviser and Administrator, on our behalf, and our ISP, any significant findings in these reports are shared with us, including our Board of Directors and other officers, to enhance ongoing monitoring and assessment of our information technology and cybersecurity risk management.


text: While our ISP works to create a hardened information technology systems environment, our Adviser and Administrator also regularly trains employees working on our behalf on the evolving threats and educates them on cybersecurity risks. Whether it is communicating information about the latest cybersecurity threats, assessing employees' awareness through mock fraud exercises, social engineering and phishing campaigns, or providing access to a library of educational material about past and newly evolving cybersecurity attacks, our Adviser and Administrator work in concert with the ISP, on our behalf, to keep employees servicing us informed so as to provide an additional protection barrier through end-user knowledge.


text: Notwithstanding our risk management and strategy described above, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See "Risk Factors - Cybersecurity threats and cyber incidents may adversely affect our business by causing a disruption to our operations, or the operations of businesses in which we invest, a compromise or corruption of our confidential information and/or damage to our business relationships, all of which could negatively impact our business, financial condition and operating results." for a discussion of risks related to cybersecurity and cyber incidents.


text: Our Board of Directors is actively engaged in overseeing our cybersecurity and information security program. Our Board of Directors receives regular reports during board meetings from our CCO on our and our Adviser's and Administrator's efforts concerning information security and addressing information technology and cybersecurity risks, no less than quarterly. The reports are distributed to our Board of Directors, and our CCO engages in detailed discussions with the independent board members during the independent members' session. The reports cover all potentially material cybersecurity threats facing us, as well as key risks and mitigation efforts undertaken by us and our Adviser and Administrator. As significant threats or events are identified by management or the ISP between regular reporting periods, our CCO will inform our Board of Directors immediately and keep it informed as to the developments of assessing the risks, mitigating efforts, and potential disclosure. Appropriate members of management and third party providers will be involved as deemed necessary based on the potential impact.


text: Our management personnel most involved with assessing and managing the cybersecurity risks and program with our ISP include our Head of Resources Management, who is also a member of our Board of Directors, and our CCO. Our Head of Resources Management has more than 30 years of overall experience and more than 20 years directly assessing and managing our cyber information technology and human resources systems, and the associated security concerns. Our CCO has more than 30 years of overall experience as a CPA, with more than 15 years managing information technology systems and databases, and 15-plus years supporting our Adviser's and Administrator's resource management department. This includes identifying, assessing, mitigating, and monitoring cyber information security risks. These managers, as well as other management personnel, attend various professional continuing education programs, which include cybersecurity matters. Certain members of our Board of Directors have, or previously held, positions with other companies, including other public companies, that involved managing risks associated with their cyber and information technology systems. Our Board of Directors regularly receives updates from third parties on various business risks, which include cybersecurity matters.


text: Risk Management and Strategy We have implemented ongoing processes that are designed to continually identify, assess, manage and mitigate the dynamic and evolving material risks to us from cybersecurity threats. Our cybersecurity threat risks are identified, assessed, managed, and monitored by our Adviser's and Administrator's resource management, information technology ("IT"), and compliance departments, on our behalf, and work in conjunction with an independent third-party information technology service provider ("ISP") engaged by our Adviser to manage our information technology strategy. The ISP regularly performs cyber assessments and assists in maintaining our cyber and information security programs. The ISP proposes recommendations to our Adviser's Head of Resource Management, Director of IT, and Chief Compliance Office ("CCO"), which then are considered by other officers and employees of our Adviser and Administrator, working on our behalf, before improvements are implemented to our information technology strategy, cybersecurity, and incident response policies, processes and procedures.


text: In addition, regular ongoing cybersecurity threat risk assessments are performed throughout the year and reported to our officers and Board of Directors by our CCO no less than quarterly. Cybersecurity risks are assessed in general as part of the overall enterprise risk management for us, but also specifically between the ISP and our Adviser and Administrator in monitoring and determining not only the risks but also in assessing corresponding processes and procedures to mitigate those risks appropriately. Additionally, third party business applications are also incorporated in these risk assessments.


text: As an international service provider, our ISP constantly monitors information technology risk and cybersecurity threats globally. When risks are detected, our Head of Resource Management, Director of IT, and CCO consult with the ISP to assess if the risk is a cybersecurity threat to our information technology systems or data. If a risk to our information systems or data is identified, we then, through our Adviser and Administrator, work in conjunction with the ISP to implement recommended processes, improvements, or safeguards to our systems or processes to address the risks as needed. Relevant examples of such efforts include but are not limited to: • implementation of industry leading Cloud solutions and business applications which possess integrated cybersecurity safeguards; • restrict access to known devices only; • anti-malware, antivirus and threat detection software; • ransomware containment and isolation software; • enhanced password requirements and multifactor authentication requirements; • endpoint encryption; • intrusion detection and response system conduct file integrity monitoring; • email archiving, firewalls, and quarantine capabilities; • mobile device management of business applications; • frequent systems backups with recovery capabilities; and • regular vulnerability scans and penetration testing.


text: Contractually, we require the ISP to annually provide a third-party report on its systems and on the suitability of the design and operating effectiveness of its controls relevant to information and cyber security. In addition to the ongoing dialogue and technology interaction between our Director of IT and our ISP, any significant findings in these reports are shared with us, including our Board of Directors and other officers, to enhance ongoing monitoring and assessment of our information technology and cybersecurity risk management.


text: Our management personnel most involved with assessing and managing the cybersecurity risks and program with our ISP include our Head of Resources Management, who is also a member of our Board of Directors, Director of IT, and CCO. Our Head of Resources Management has more than 30 years of overall experience and more than 20 years directly assessing and managing our cyber information technology and human resources systems, and the associated security concerns. Our Director of IT has over 20 years of experience in IT, with a focus in the implementation of information security projects to enhance organizations' resilience against emerging threats, and has collaborated closely with security vendors/partners to contain and address cybersecurity incidents. Our CCO has more than 30 years of overall experience as a CPA, with more than 15 years managing information technology systems and databases, and 15-plus years supporting our Adviser's and Administrator's resource management department. This includes identifying, assessing, mitigating, and monitoring cyber information security risks. These managers, as well as other management personnel, attend various professional continuing education programs, which include cybersecurity matters. Certain members of our Board of Directors have, or previously held, positions with other companies, including other public companies, that involved managing risks associated with their cyber and information technology systems. Our Board of Directors regularly receives updates from third parties on various business risks, which include cybersecurity matters.


text: Risk Management and Strategy We are committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, have implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats.

companyName: QVC INC

ticker: QVCD


text: Cybersecurity risks are assessed as part of our enterprise risk assessment and risk management program and our cybersecurity risk management program is designed and assessed based on recognized frameworks, including the National Institute of Standards and Technology Cybersecurity Framework.


text: We rely on a multidisciplinary team, including our information security function, legal department, management, and third-party consultants, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, using manual and automated tools such as vulnerability scanning software, monitoring existing and emerging cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and assessments, and conducting threat and vulnerability assessments.


text: To manage and mitigate material risks from cybersecurity threats to our information systems and data, we implement and maintain various technical, physical and organizational measures, processes and policies. These measures include risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our information technology ("IT"), security and other departments, encryption of data, network security controls, access controls, physical security, asset management, system monitoring, vendor risk management program, employee cybersecurity awareness and training, phishing tests, and penetration testing. Cybersecurity awareness training is also made available annually to our board of directors.


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place at QVC. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary.


text: To operate our business, we utilize certain third-party service providers to perform a variety of operational functions. We have implemented a third-party risk management program to evaluate the cybersecurity practices of higher risk vendors and vendors that encounter our systems or data. We additionally engage and retain third-party consultants, legal advisors and assessors to keep us appraised of emerging third-party risk, defense and mitigation strategies, and governance best practices.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: For additional information on our cybersecurity risks, see "Our business is subject to cyber security risks, including cyber security threats and cybersecurity incidents, such as security breaches and identity theft" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Role of the Qurate Retail Board of Directors The Qurate Retail board of directors has overall responsibility for risk oversight and has delegated to its Audit Committee primary enterprise risk oversight responsibility, including privacy and cybersecurity risk exposures, policies and practices, the steps management takes to detect, monitor and mitigate such risks and the potential impact of those exposures on our business, financial results, operations and reputation. The Audit Committee receives quarterly updates on the enterprise risk management program, including cybersecurity risks and the initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates, employee education initiatives, and internal audit observations, if applicable. In addition to the efforts undertaken by the Audit Committee, Qurate Retail's board of directors regularly reviews matters relating to cybersecurity risk and cybersecurity risk management. Any material cybersecurity events are brought to the attention of Qurate Retail's board of directors once the event is deemed material. We additionally use our incident response framework as part of the process we employ to keep our management and board of directors informed and to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Role of Management Through a services agreement between Qurate Retail and Liberty Media Corporation ("LMC"), Qurate Retail has established a cross functional Information Security Steering Committee ("ISSC") with executives from the Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at Qurate Retail and at QVC.


text: At QVC, the VP Information Security is responsible for day-to-day management and oversight of cybersecurity, including assessing, monitoring and mitigating cybersecurity risk. The VP Information Security provides regular reporting to the ISSC and QVC executive management, including quarterly updates on security hot topics, threat intelligence, incidents (if any) and the status of the cybersecurity program to the Chief Executive Officer and the broader executive leadership team. In addition to real time notification to the ISSC of privacy and security incidents, the ISSC and QVC have a bi-monthly meeting to discuss incidents, incident trends, developments in laws and regulations, and other privacy and cybersecurity hot topics, as applicable.


text: The experience of the combined QVC and Qurate Retail management teams includes a diverse background in telecom, retail and other industries, with decades of experience in various aspects of technology and cybersecurity. LMC's Head of Cybersecurity, who sits on the ISSC, has more than 25 years of cybersecurity and IT experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications. QVC's VP Information Security has more than 30 years of IT experience and holds multiple certifications, including Certified Information Security System Professional and Certified Information Security Manager. Together this management team has worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, business applications, customer facing applications and customer payment systems.


text: Role of the QVC Group Board of Directors The QVC Group board of directors has overall responsibility for risk oversight and has delegated to its Audit Committee primary enterprise risk oversight responsibility, including privacy and cybersecurity risk exposures, policies and practices, the steps management takes to detect, monitor and mitigate such risks and the potential impact of those exposures on our business, financial results, operations and reputation. QVC Group's audit committee receives quarterly updates on the enterprise risk management program, including cybersecurity risks and the initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates, employee education initiatives, and internal audit observations, if applicable. In addition to the efforts undertaken by the audit committee, QVC Group's board of directors regularly reviews matters relating to cybersecurity risk and cybersecurity risk management. Any material cybersecurity events are brought to the attention of QVC Group's board of directors once the event is deemed material. We additionally use our incident response framework as part of the process we employ to keep our management and board of directors informed and to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Role of Management Through a services agreement between QVC Group and Liberty Media Corporation ("LMC"), QVC Group has established a cross functional Information Security Steering Committee ("ISSC") with executives from the Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at QVC Group and at QVC.


text: At QVC, the VP of Cybersecurity is responsible for day-to-day management and oversight of cybersecurity, including assessing, monitoring and mitigating cybersecurity risk. The VP of Cybersecurity provides regular reporting to the ISSC and QVC executive management, including quarterly updates on security hot topics, threat intelligence, incidents (if any) and the status of the cybersecurity program to the Chief Executive Officer and the broader executive leadership team. In addition to real time notification to the ISSC of privacy and security incidents, the ISSC and QVC have a bi-monthly meeting to discuss incidents, incident trends, developments in laws and regulations, and other privacy and cybersecurity hot topics, as applicable.


text: The experience of the combined QVC and QVC Group management teams includes a diverse background in telecom, retail and other industries, with decades of experience in various aspects of technology and cybersecurity. LMC's Head of Cybersecurity, who sits on the ISSC, has more than 25 years of cybersecurity and IT experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications. QVC's VP of Cybersecurity has more than 30 years of IT experience and holds multiple certifications, including Certified Information Security System Professional and Certified Information Security Manager. Together this management team has worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, business applications, customer facing applications and customer payment systems.


text: The Company's enterprise-wide cybersecurity program is embedded within and integrated with the enterprise risk management function. The Chief Security Officer is part of our senior leadership team and reports to the Chief Risk Officer. Our Chief Security Officer has over thirty years of cybersecurity, technology, and leadership experience both as a career active-duty military cyber operations officer and in the private sector. The cybersecurity team is organized into three departments: Protective Operations, Posture Management, and Governance, Risk, and Compliance. Each of the three departments identifies, assesses, and manages material cybersecurity threats through specific approaches as further described below.

companyName: NELNET INC

ticker: NNI


text: Protective Operations includes the Security Operations Center, cyber threat intelligence, offensive security, and application security teams. New cybersecurity threats surface daily, and existing cybersecurity threats evolve constantly. Our 24x7x365 in-house Security Operations Center is organized to not only monitor for signs of intrusion but also to provide contextual threat intelligence to system and platform owners across the enterprise, empowering them to take an active role in defending the enterprise. The Security Operations Center conducts daily briefings, identifies emerging cyber threats affecting the financial and education sectors, and reviews new tactics, techniques, and procedures utilized by cyber criminals and nation-state cyber actors. The Security Operations Center is also our incident response team, and ensures that the Company is prepared to detect, analyze, contain, eradicate, and recover from cyber incidents. While we have experienced cybersecurity incidents in the past, to date none have materially affected us, including our business strategy, results of operations, or financial condition. Our offensive security team conducts continuous threat-based and risk-based red team activities, and our application security team utilizes a combination of training, tools, code reviews, and awareness to ensure that our applications are developed with security at the forefront. We also engage with professional cybersecurity firms to conduct penetration tests on specific systems and applications annually. For more information about the cybersecurity risks we face, see the factors set forth under the caption "Risk Factors" in Part I, Item 1A of this report.


text: Posture Management includes the vulnerability management, log operations, and architecture and engineering teams. Our vulnerability management team conducts regular scans of our enterprise to look for potential weaknesses and configuration-related issues. Based on the results of these scans, this team routinely patches or works with system and platform owners to resolve identified vulnerabilities. Our log operations team works closely as a bridge between the system owners and our Security Operations Center by ensuring that activities on our systems and applications are logged and monitored. Our architecture and engineering team manages security appliances and provides security architecture advice and consulting to our information technology and delivery teams throughout the enterprise. When it comes to posture management, our goal is not just to reactively resolve potential vulnerabilities discovered through the vulnerability management process; we also look for ways to ensure that vulnerabilities don't materialize through minimizing system ports, protocols, and services to only that which is necessary.


text: Governance, Risk, and Compliance includes the risk management and compliance management teams. This team manages the security awareness program, compliance with cyber and privacy regulations, security policies, and prioritizes potential cyber risks that require ongoing monitoring or remediation. Identified risks are brought to the Cyber Risk Steering Committee for treatment. The Chief Security Officer chairs the committee, which consists of the Deputy Chief Security Officer, cybersecurity managers, various subject matter experts, and (as needed) members of management from operational areas of the business.


text: The Company's business segments and support teams also work closely with cybersecurity and enterprise risk management to monitor and manage third-party risks. Managing third-party risks includes maintaining a close and effective working relationship with the information technology procurement, accounting, and legal teams. In addition to identifying risks as part of the third-party selection process, we continuously monitor our third parties using products and services that provide us insight into their attack surface, threats that can impact us through them, and real-world security posture.


text: Audits are an important part of our layers of defense; they can help us to identify areas in which we have incomplete coverage or ineffective placement of controls. The Company has an independent internal audit team that conducts audits based on their own methodology and assessment and we utilize external cybersecurity auditors, where applicable. In addition, certain lines of business utilize other third-party cybersecurity auditors for PCI DSS assessments and PCI ASV scans; and we are routinely audited by our customers.


text: The Company's Board of Directors and Board Risk and Finance Committee oversee our integrated enterprise risk management and cybersecurity programs. The Board Risk and Finance Committee receive regular reports from the Chief Risk Officer and Chief Security Officer on key company risks and emerging threats. These reports also include cybersecurity monitoring and threat response metrics, industry trends and educational materials, risk mitigation strategies, regulatory requirements, corporate policies, third-party risk metrics, cybersecurity tools and resources, incident response plans, and other areas of importance.


text: Protective Operations includes the Security Operations Center, cyber threat intelligence, offensive security, and application security teams. New cybersecurity threats surface daily, and existing cybersecurity threats evolve constantly. Our 24x7x365 in-house Security Operations Center is organized to not only monitor for signs of intrusion but also to provide contextual threat intelligence to system and platform owners across the enterprise, empowering them to take an active role in defending the enterprise. The Security Operations Center conducts daily briefings, identifies emerging cyber threats affecting the financial and education sectors, and reviews new tactics, techniques, and procedures utilized by cyber criminals and nation-state cyber actors. The Security Operations Center is also our incident response team, focused on detecting, analyzing, containing, eradicating, and recovering from cyber incidents. While we have experienced cybersecurity incidents in the past, to date none have materially affected us, including our business strategy, results of operations, or financial condition. Our offensive security team conducts continuous threat-based and risk-based red team activities, and our application security team utilizes a combination of training, tools, code reviews, and awareness designed to ensure that our applications are developed with security at the forefront. We also engage with professional cybersecurity firms to conduct penetration tests on specific systems and applications annually. For more information about the cybersecurity risks we face, see the factors set forth under the caption "Risk Factors" in Part I, Item 1A of this report.


text: Posture Management includes the vulnerability management, log operations, and architecture and engineering teams. Our vulnerability management team conducts regular scans of our enterprise to look for potential weaknesses and configuration-related issues. Based on the results of these scans, this team routinely patches or works with system and platform owners to resolve identified vulnerabilities. Our log operations team works closely as a bridge between the system owners and our Security Operations Center by logging and monitoring activities on our systems and applications. Our architecture and engineering team manages security appliances and provides security architecture advice and consulting to our information technology and delivery teams throughout the enterprise. When it comes to posture management, our goal is not just to reactively resolve potential vulnerabilities discovered through the vulnerability management process; we also look for ways to prevent vulnerabilities through minimizing system ports, protocols, and services to only that which is necessary.


text: The Company's Board of Directors and Board Risk and Finance Committee oversee our integrated enterprise risk management and cybersecurity programs. The Board Risk and Finance Committee receives regular reports from the Chief Risk Officer and Chief Security Officer on key company risks and emerging threats. These reports also include cybersecurity monitoring and threat response metrics, industry trends and educational materials, risk mitigation strategies, regulatory requirements, corporate policies, third-party risk metrics, cybersecurity tools and resources, incident response plans, and other areas of importance.


text: We have established a risk-based cybersecurity and information security program ("program") designed to assess, identify, and manage material risks from cybersecurity threats. Our cybersecurity risk management process includes policies that specify the requirements for technical security controls, monitoring systems, tools and services from third-party providers, and employee training and awareness. Our cybersecurity risk management process also includes regular independent audits across our operating units. Management oversees our cybersecurity risk management process in order to assess and manage material risks from cybersecurity threats identified by both internal and external threat intelligence. Our program monitors and evaluates risks from cybersecurity threats, and we aim to adapt our program and related processes accordingly. As adopted by our businesses, which has been overseen by our corporate executive team, we have a cybersecurity incident response plan that outlines our policies and procedures for managing a cybersecurity incident. Our businesses are required to conduct regular exercises of their incident response plan as part of our program.

companyName: TransDigm Group INC

ticker: TDG


text: The multi-layered framework on which our cybersecurity and information security program is built incorporates cybersecurity standards and certain requirements of the National Institute of Standards and Technology ("NIST") Special Publication 800-171—Protecting Controlled Unclassified Information in Non-Federal Systems and Organizations—along with other legal and regulatory requirements. However, this does not mean that we meet any particular technical standards, specifications, or requirements, but rather that we use NIST and other cybersecurity standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity and information security program is led by the Company's Vice President of Cybersecurity ("VPoC") who reports to our Chief Financial Officer. Our VPoC has served as a technology leader of cybersecurity, information security, infrastructure, and operational functions for over 35 years. The VPoC is supported by the Incident Response Team ("IRT"), a management committee made up of the Co-Chief Operating Officers, Chief Financial Officer, and executives in legal, finance, IT, and audit. The IRT supports the VPoC in assessing and managing risks from cybersecurity threats and in the event of a cybersecurity incident, provides oversight and leadership with respect to incident response.


text: We have in place an incident response plan to identify, respond to, and recover from cybersecurity threats and cybersecurity incidents. In the event of a potentially material cybersecurity incident, as determined by the VPoC with support from legal, as needed, the IRT is notified through an established escalation protocol. The Chair of the Audit Committee is also notified and briefed, and meetings of the Audit Committee and/or full Board of Directors would be held as appropriate. We maintain a relationship with a third-party forensic vendor available for incident response and investigation. Additionally, we maintain cybersecurity insurance.


text: The Company's Board of Directors oversees our enterprise risk management ("ERM") program and has delegated the primary responsibility for its oversight, which includes oversight of cybersecurity risk, to the Audit Committee. The Audit Committee is informed of about material risks from cybersecurity threats through regular discussion with management regarding cybersecurity risk mitigation and cybersecurity incident management. Executive management, including our VPoC, regularly presents to the Audit Committee regarding cybersecurity matters, including program updates, key metrics, and developments.


text: The ERM program inventories and classifies key risk areas. We employ a methodology for scoring the risks based on the probability and impact of individual risks and discuss and implement countermeasures to address the risks.


text: Based on the information we have as of the date of this Annual Report on Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For further information about risks related to cybersecurity threats, refer to Item 1A. "Risk Factors."


text: We have established a risk-based cybersecurity and information security program ("program") designed to assess, identify, and manage material risks from cybersecurity threats. Our cybersecurity risk management process includes policies that specify the requirements for technical security controls, monitoring systems, tools and services from third-party providers, and employee training and awareness. Our cybersecurity risk management process also includes regular independent audits across our operating units. Management oversees our cybersecurity risk management process in order to assess and manage material risks from cybersecurity threats identified by both internal and external threat intelligence. Our program monitors and evaluates risks from cybersecurity threats, and we aim to adapt our program and related processes accordingly.


text: As adopted by our businesses, which has been overseen by our corporate executive team, we have a cybersecurity incident response plan that outlines our policies and procedures to identify, respond to, and recover from cybersecurity threats and cybersecurity incidents. Our businesses are required to conduct regular exercises of their incident response plan as part of our program.


text: In the event of a potentially material cybersecurity incident, as determined by the VPoC with support from legal, as needed, the IRT is notified through an established escalation protocol. The Chair of the Audit Committee is also notified and briefed, and meetings of the Audit Committee and/or full Board of Directors would be held as appropriate. We maintain a relationship with third-party forensic vendor(s) available for incident response and investigation. Additionally, we maintain cybersecurity insurance.


text: The Company's Board of Directors oversees our enterprise risk management ("ERM") program and has delegated the primary responsibility for its oversight, which includes oversight of cybersecurity risk, to the Audit Committee. The Audit Committee is informed of material risks from cybersecurity threats through regular discussion with management regarding cybersecurity risk mitigation and cybersecurity incident management. Executive management, including our VPoC, regularly presents to the Audit Committee regarding cybersecurity matters, including program updates, key metrics, and developments.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: DOCUSIGN, INC.

ticker: DOCU


text: Our cybersecurity risk management program is guided by industry standards developed by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO"), and other relevant organizations.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and utilizes common reporting channels and governance processes that apply across other risk areas. While everyone at our company plays a part in managing cybersecurity risks, as discussed in more detail under "Cybersecurity Governance" below, our board of directors, both directly and through delegation to our Audit Committee (the "Audit Committee"), and our senior management team are actively involved in the oversight of our cybersecurity risk management program. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Our cybersecurity risk management and strategy includes: • Our dedicated Security team, which performs periodic risk assessments to identify and assess cybersecurity threats, vulnerabilities, their severities, and potential mitigations. The team leverages both top-down and bottom-up risk processes and technologies to identify, manage and monitor cyber threats and vulnerabilities. The team also manages our response to cybersecurity incidents. • Incident Response Playbooks and Standard Operating Procedures ("SOP") outlining procedures for detecting, responding to, and mitigating cybersecurity incidents. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the board of directors. • The use of external service providers, where appropriate, to assess, test or otherwise assist with certain aspects of our security controls and processes, as well as maturity assessments of our cybersecurity program. • Implementation of new hire and annual data privacy and cybersecurity training of all employees, including senior management; annual role-based training of employees with specific access to systems, devices, or locations, and targeted cybersecurity simulation training held on a recurring basis. • A third-party risk management process that identifies and mitigates cybersecurity threats associated with our use of third-party service providers. Such service providers are subject to risk tiering, security risk assessments, continuous monitoring including investigation of security incidents that have impacted our third party service providers, as applicable.


text: We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. While we have experienced cybersecurity incidents in the past, we believe our current processes, systems and oversight with respect to the management of risks associated with cybersecurity threats are effective. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding the risks we face from cybersecurity threats see "Risk Factors."


text: Cybersecurity Governance Securing the information of our customers, employees, contractors, and third party service providers is important to us. We have adopted physical, technological, and administrative controls on data security, and have defined procedures for data incident detection, containment, response, and remediation. While everyone at our company plays a part in managing these risks, oversight responsibility is shared by our board of directors, our Audit Committee, and management. Accordingly, our management team provides regular cybersecurity updates to our board of directors and regular updates on cyber risk management to the Audit Committee. We also maintain information security risk insurance coverage.


text: We have recently also established a Security Governance Council ("Council") that provides strategic guidance for the protection of our information, technology, and physical assets, including the definition of security risks and the prioritization of the implementation of associated controls. The Council membership is led by the Chief Information Security Officer ("CISO") and includes relevant senior executives and has begun to meet at least quarterly, and will reconvene on an emergency basis when necessary to respond to potentially material cybersecurity incidents. The CISO reports to the Chief Information Officer ("CIO") and is responsible for management of cybersecurity risks and the protection and defense of our networks, systems and data. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Our CISO has over 20 years of experience in IT and Information Security across security architecture, incident response, and threat intelligence programs. Our CISO also holds a bachelor's degree in computer science and maintains Certified Information Systems Security Professional ("CISSP") certification.


text: Members of executive leadership are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described herein, including the operation of our incident response plan. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to members of executive leadership, and the Audit Committee. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: Our cybersecurity risk management program is guided by industry standards developed by the NIST, the International Organization for Standardization ("ISO"), and other relevant organizations.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and utilizes common reporting channels and governance processes that apply across other risk areas. While everyone at our company plays a part in managing cybersecurity risks, as discussed in more detail under "Cybersecurity Governance" below, our board of directors, both directly and through delegation to our Audit Committee (the "Audit Committee"), and our senior management team are actively involved in the oversight of our cybersecurity risk management program. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach by engaging teams across the business. We expect these teams to operate pursuant to our Standard Operating Procedures. Our approach is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur through shared processes.


text: Our cybersecurity risk management and strategy includes: • Our dedicated Security team, which performs periodic risk assessments to identify and assess cybersecurity threats, vulnerabilities, their severities, and potential mitigations. The team leverages both top-down and bottom-up risk processes and technologies to identify, manage and monitor cyber threats and vulnerabilities. The team also manages our response to cybersecurity incidents. • Incident Response Playbooks and Standard Operating Procedures ("SOP") outlining procedures for detecting, responding to, and mitigating cybersecurity incidents. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the board of directors. • The use of external service providers, where appropriate, to assess, test or otherwise assist with certain aspects of our security controls and processes, as well as maturity assessments of our cybersecurity program. • Implementation of new hire and annual data privacy and cybersecurity training of all employees, including senior management; annual role-based training of employees with specific access to systems, devices, or locations, and targeted cybersecurity simulation training held on a recurring basis. • A third-party risk management process that identifies and mitigates cybersecurity threats associated with our use of third-party service providers. Such service providers are subject to risk tiering, security risk assessments, continuous monitoring including investigation of security incidents that have impacted our third-party service providers, as applicable.


text: We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. While we have experienced cybersecurity incidents in the past, we believe our current processes, systems and oversight with respect to the management of risks associated with cybersecurity threats are effective. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding the risks we face from cybersecurity threats see "Risk Factors. "


text: Cybersecurity Governance Securing the information of our customers, employees, contractors, and third-party service providers is important to us. We have adopted physical, technological, and administrative controls on data security, and have defined procedures for data incident detection, containment, response, and remediation. While everyone at our company plays a part in managing these risks, oversight responsibility is shared by our board of directors, our Audit Committee, and management. To facilitate coordinated supervision of cybersecurity matters, our management team provides regular cybersecurity updates to our board of directors and regular updates on cyber risk management, which include development regarding our cybersecurity program, broader cybersecurity trends, evolving industry standards, the threat environment and other topics, to the Audit Committee. Together with management, our Audit Committee and board of directors consider this information in their review of our cybersecurity risks and response to data breaches. We also maintain information security risk insurance coverage.


text: We have recently also established a Security Governance Council ("Council") that provides strategic guidance for the protection of our information, technology, and physical assets, including the definition of security risks and the prioritization of the implementation of associated controls. The Council membership is led by the Chief Information Security Officer ("CISO") and includes relevant senior executives and has begun to meet at least quarterly, and will reconvene on an emergency basis when necessary to respond to potentially material cybersecurity incidents. The CISO reports to the Chief Information Officer ("CIO") and is responsible for management of cybersecurity risks and the protection and defense of our networks, systems and data. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Our CISO has over 20 years of experience in IT and Information Security across security architecture, incident response, and threat intelligence programs. Our CISO also holds a bachelor's degree in computer science and maintains Certified Information Systems Security Professional certification.


text: Our board of directors recognizes the importance of maintaining the trust and confidence of our customers, clients, business partners and employees. Our board of directors, through the Audit Committee, oversees our cybersecurity program as part of our enterprise-wide approach to risk management. Our cybersecurity policies, standards, processes and practices are fully integrated into our risk management approach and are based on recognized frameworks established by the National Institute of Standards and Technology. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: UNIVERSAL TECHNICAL INSTITUTE INC

ticker: UTI


text: Risk Management and Strategy As one of the critical elements of enterprise-wide approach to risk management, our cybersecurity program is focused on the following key areas:


text: Governance: As discussed in more detail under the heading "Governance" below, our cybersecurity program is overseen by our Chief Information Officer (CIO), who reports to our Chief Executive Officer (CEO), and is responsible for publishing cybersecurity policies and standards, conducting annual risk assessments and maintaining our compliance. Our CIO regularly reports to our Audit Committee on the status of the cybersecurity program.


text: Collaboration: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments, certifications, audits and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: We have established and maintained comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our board of directors and Audit Committee by CIO, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our board of directors, through the Audit Committee, oversees our enterprise-wide approach to risk management, including the risks arising from cybersecurity threats. Our Audit Committee regularly receives presentations and reports on cybersecurity risks, which address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to our third party partners. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, our Audit Committee discusses our approach to cybersecurity risk management with management.


text: Our Audit Committee, in connection with management led by CIO, works collaboratively across our Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our Information Security Team monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management when appropriate.


text: Our CIO holds an undergraduate degree in Business Administration and has served in various roles in Information Technology for over 15 years and has been overseeing the cybersecurity program for 5 years. Our VP information Security hold an undergraduate degree in Information Systems Security and has served in various roles in cybersecurity for over 15 years. Our Chief Executive Officer, interim Chief Financial Officer, and Chief Legal Officer each hold undergraduate and/or graduate degrees in their respective fields, and each has experience managing risks at our Company and at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity Threats To date, we are not aware of any cybersecurity threats, including as a result of previous cybersecurity incidents, that are reasonably likely to have a material effect on us, our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us.


text: Governance: As discussed in more detail under the heading "Governance" below, our cybersecurity program is overseen by our Chief Information Officer ("CIO"), who reports to our Chief Executive Officer ("CEO"), and is responsible for publishing cybersecurity policies and standards, conducting annual risk assessments and maintaining our compliance. Our CIO regularly reports to our Audit Committee on the status of the cybersecurity program.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our board of directors and Audit Committee by our CIO, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.