text: The cybersecurity program is also supported by Uber's Chief Privacy Officer and Associate General Counsel, Privacy & Cybersecurity ("CPO"), who has served in that role since August 2018. The CPO has over three decades of experience as a legal advisor to multinational corporations, including serving as Chief Privacy & Security Counsel for a Fortune 100 technology company prior to her role at Uber.


text: The cybersecurity program is supported by other members of Uber's senior management team as well, including the Chief Legal Officer, Chief Architect Officer, and Global Data Protection Officer. Uber's Board of Directors oversees the cybersecurity program through regular updates.

companyName: Uber Technologies, Inc

ticker: UBER

secItem: Item 1C


text: This cybersecurity program is a critical component of Uber's enterprise risk management program, through which Uber reviews business, cybersecurity, information technology, privacy, legal, and geopolitical risks, among others. The cybersecurity program is designed to assess, identify, and manage risks from cybersecurity threats.


text: Key elements of this program include: • Oversight and Governance. Uber's Board oversees the cybersecurity program, and Uber's risk profile with respect to cybersecurity matters, through regular reports and reviews. These include presentations by the CISO to the Board and Audit Committee on an alternating quarterly basis, quarterly reports of certain cybersecurity incidents to the Board, and annual reports by the CPO to the Board.


text: The CISO also provides quarterly updates to Uber's senior management regarding cybersecurity risks, as well as interim updates during regular meetings with Uber's engineering, product and internal audit leadership. The CISO and CPO also jointly chair Uber's Privacy and Cybersecurity Council, which provides a venue for cross-functional insight and input into the cybersecurity program and our privacy program as they relate to Uber's business operations.


text: • Internally conducted environment and vulnerability assessments. These include regular assessments performed by Uber's security engineering teams. The findings from these assessments are reported to Uber's senior management, including the CISO, and the Board or Audit Committee. In addition, our internal audit function periodically conducts additional reviews and assessments, which are reported to the Audit Committee. We also conduct table-top exercises to simulate the response to cybersecurity incidents; participants may include, among others, the CISO, the CPO, and representatives from communications, investor relations, finance and legal. • Independent third-party audits and assessments by industry-leading firms. As a global organization, Uber undergoes annual audits to maintain its certification as a Payment Card Industry Data Security Standard (PCI DSS 4.0) Level 1 Merchant and Service provider. Uber also undergoes annual audits to maintain its ISO 27001 certification for its core mobility, delivery, and enterprise businesses, and SOC 2 attestations that vary depending on the Uber product. • Cyber incident management. This includes efforts by Uber's security engineering team, at the direction of the CISO, to review potential incidents identified by Uber's internal teams, Uber's third-party service providers or external researchers through Uber's Bug Bounty program; identify those which represent potential or actual threats to Uber's systems, data or users; investigate and mitigate the cause and impact of such incidents; and implement safeguards to help prevent recurrence. Uber's CPO and legal team support such efforts, including in connection with legal or disclosure obligations triggered in connection with any such incidents. • Third Party Risk Management. Uber performs due diligence regarding its third-party suppliers, service providers and business partners. This includes requiring submission of evidence demonstrating third parties' ability to meet Uber's cybersecurity and data handling requirements. In addition, Uber's third-party suppliers and service providers who process Uber personal data are contractually obligated to notify Uber if they experience certain incidents impacting Uber personal data.


text: For a discussion regarding risks from cybersecurity threats, see our risk factors, including the risk factors titled "— We have experienced, and may experience security or privacy breaches or other unauthorized or improper access to, use of, disclosure of, alteration of or destruction of our proprietary or confidential data, employee data, or platform user data, which could cause loss of revenue, harm to our brand, business disruption, and significant liabilities", "—Cyberattacks, including computer malware, ransomware, viruses, denial of service attacks, spamming, phishing and social engineering attacks could harm our reputation, business, and operating results", "—We currently are subject to a number of inquiries, investigations, and requests for information from the DOJ, other federal, state and local government agencies and other foreign government agencies, the adverse outcomes of which could harm our business" and "—We face risks related to our collection, use, transfer, disclosure, and other processing of data, which could result in investigations, inquiries, litigation, fines, legislative and regulatory action, and negative press about our privacy and data protection practices" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Risk Management, Strategy and Procedures We, our Investment Adviser and its affiliates regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, standards, processes, and practices, which are integrated into our overall risk management system. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, protect against, detect, respond to, and recover from security incidents. These efforts are implemented by Carlyle's Global Technology & Solutions ("GTS") team in partnership with our business, legal, and compliance teams, and are essential for us to conduct investment activities, manage internal administration activities, and connect our global enterprise. Our systems, data, network, and infrastructure are monitored and administered by formal controls and risk management processes that log events and help protect the our data. In addition, our business continuity plans are designed to allow critical business functions to continue in an orderly manner in the event of an emergency. The GTS team works closely with Carlyle's business segment teams, including our Investment Adviser, to maintain operational resilience through business continuity planning and annual information technology disaster recovery and incident response plan testing, which collectively support the goal of mitigating risk were an emergency to occur. The GTS team has procedures in place to report cybersecurity threats or incidents on a periodic basis. These efforts are underpinned by the implementation of security best practices, where possible, such as: • Multi-factor authentication for remote access, privileged access management for system administrators, application whitelisting, laptop encryption, and advanced malware defenses on endpoints; • Incident preparedness and response planning and risk mitigation; • Independent and continuous security testing, assessment and vulnerability management; • Regular security awareness training, including phishing simulations, for Carlyle authorized users; • Restrictions on access to personal email accounts, cloud storage, social media, risk-based categories of websites and USB storage devices; • Device and system access management policies and procedures that restrict access upon employee or contractor separation from the company; and • Compliance attestations by Carlyle personnel on firm policies, such as Carlyle's acceptable use policy, upon hire and annually.

companyName: Carlyle Secured Lending, Inc.

ticker: CGBD


text: In addition, Carlyle partners with third parties to assess the effectiveness of its cybersecurity program, which includes the Company. Third party assessments will include audits and assessments performed under the direction of Carlyle's internal audit team, which co-sources with third-party cybersecurity experts in conducting its reviews. GTS also administers Carlyle's cyber third-party risk management program, which assesses external service providers before onboarding and provides ongoing monitoring in accordance with certain risk-based cybersecurity criteria.


text: To our knowledge cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. The sophistication of cyber threats continues to increase and there can be no assurance that the various procedures and controls we utilize to mitigate these threats will be sufficient to prevent disruptions to our systems. Consequently, given that the magnitude of cybersecurity incidents or threats are difficult to predict, we are unable to determine at this time whether risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For an additional description of cybersecurity risk and potential related impacts on us, see Part I, Item 1A of this Form 10-K "Risk Factors—Risks Related to Our Business and Structure—Cybersecurity risks and cyber incidents may adversely affect our business or those of our portfolio companies by causing a disruption to our operations, a compromise or corruption of confidential information and/or damage to business relationships, or those of our portfolio companies, all of which could negatively impact our business, results of operations or financial condition."


text: Risk Management Oversight and Governance Our Board of Directors oversees our enterprise risk management strategy, including our strategy on cybersecurity risks, directly and through its committees. In this respect, the Audit Committee of the Board of Directors (the "Audit Committee") oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports from Carlyle on our enterprise risk profile on an annual basis. In addition, Carlyle's Chief Information Security Officer ("CISO") leads our cybersecurity program, chairs Carlyle's Information Security Steering Committee ("ISSC"), and provides cybersecurity status reporting to our Audit Committee at least annually. The ISSC meets quarterly and ensures that cybersecurity initiatives are in alignment with Carlyle's strategic priorities.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies, standards, processes, and practices throughout our operations that are designed to address cybersecurity threats, events, and incidents. In particular, our cybersecurity program supports security governance, security awareness and training, security engineering and architecture, security risk management, vulnerability management, security monitoring, and incident response capabilities. In addition, our incident response plan contains escalation and reporting protocols, including reporting to our disclosure committee to consider materiality of cybersecurity incidents. Policies and procedures are in place to assist the disclosure committee with these materiality assessments and any resulting reporting requirements.


text: Carlyle's CISO, in coordination with our Chief Financial Officer, Chief Compliance Officer, and Principal Accounting Officer, among certain other senior executives of our Investment Adviser, is responsible for leading the assessment and management of cybersecurity risks. The current Carlyle CISO has over 30 years of experience in information security and is a Certified Information Systems Security Professional. As described above, Carlyle's CISO leads our cybersecurity program, chairs Carlyle's ISSC that is comprised of senior management and other sector representatives, and provides cybersecurity status reporting to our Audit Committee as necessary and at least annually.


text: Risk Management, Strategy and Procedures We, our Investment Adviser and its affiliates regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, standards, processes, and practices, which are integrated into our overall risk management system. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, protect against, detect, respond to, and recover from security incidents. These efforts are implemented by Carlyle's Global Technology & Solutions ("GTS") team in partnership with our business, legal, and compliance teams, and are essential for us to conduct investment activities, manage internal administration activities, and connect our global enterprise. Our systems, data, network, and infrastructure are monitored and administered by formal controls and risk management processes that log events and help protect the our data. In addition, our business continuity plans are designed to allow critical business functions to continue in an orderly manner in the event of an emergency. The GTS team works closely with Carlyle's business segment teams, including our Investment Adviser, to maintain operational resilience through business continuity planning and annual information technology disaster recovery and incident response plan testing, which collectively support the goal of mitigating risk were an emergency to occur. The GTS team has procedures in place to report cybersecurity threats or incidents on a periodic basis. These efforts are underpinned by the implementation of security best practices, where possible, such as: • Multi-factor authentication for remote access, privileged access management for system administrators, application whitelisting, laptop encryption, mobile device management software, and advanced malware defenses on endpoints; • Incident preparedness and response planning and risk mitigation; • Independent and continuous security testing, assessment and third-party risk and vulnerability management; • Regular security awareness training, including phishing simulations, for Carlyle authorized users; • Restrictions on access to personal email accounts, cloud storage, social media, risk-based categories of websites, and USB storage devices; • Device and system access management policies and procedures that restrict access upon employee or contractor separation from the company; and • Compliance attestations by Carlyle personnel on firm policies, such as Carlyle's acceptable use policy, upon hire and annually.


text: To our knowledge cybersecurity threats, including as a result of any previous detected or undetected cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition, however, we may learn new facts about these detected or undetected incidents and these facts may lead us to change this materiality assessment. The sophistication of cyber threats continues to increase and there can be no assurance that the various procedures and controls we utilize to mitigate these threats will be sufficient to prevent disruptions to our systems. Consequently, given that the magnitude of cybersecurity incidents or threats are difficult to predict, we are unable to determine at this time whether risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For an additional description of cybersecurity risk and potential related impacts on us, see Part I, Item 1A of this Form 10-K "Risk Factors—Risks Related to Our Business and Structure—Cybersecurity risks and cyber incidents may adversely affect our business or those of our portfolio companies by causing a disruption to our operations, a compromise or corruption of confidential information and/or damage to business relationships, or those of our portfolio companies, all of which could negatively impact our business, results of operations or financial condition."


text: Carlyle's CISO, in coordination with our Chief Financial Officer, Chief Compliance Officer, and Principal Accounting Officer, among certain other senior executives of our Investment Adviser, is responsible for leading the assessment and management of cybersecurity risks. The current Carlyle CISO has over 22 years of experience in information security and that includes key roles managing cybersecurity risk in both government and the private sector. As described above, Carlyle's CISO leads our cybersecurity program, chairs Carlyle's ISSC that is comprised of senior management and other sector representatives, and provides cybersecurity status reporting to our Audit Committee as necessary and at least annually.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our customers and employees (Information Systems and Data).

companyName: Freshworks Inc.

ticker: FRSH


text: Our Chief Information Security Officer (CISO), our information security team, and third-party service providers help identify, assess, and manage our cybersecurity threats and risks, including through the use of our cybersecurity risk assessment program. Our CISO along with this team, as applicable, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods, including automated and manual tools, third-party threat feeds, internal audits, access control assessments, and evaluating threats reported to us by various third party enterprise threat reporting services.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: dedicated cybersecurity staff, including a 24X7 security operations center monitoring for and responding to threat activity, incident response plans and processes, vulnerability management, secure software development, static and dynamic code scanning for vulnerabilities, open-source software scanning, internal and third-party penetration testing, a bug bounty program, internal audit and assurance of security controls, disaster recovery/business continuity plans, attainment and maintenance of industry-standard security certifications, identity and access management, asset management, tracking and disposal, encryption, access controls, third-party risk management, phish testing and reporting, employee security awareness training, and maintaining cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risks are considered a part of our overall business strategy, financial planning, and capital allocation.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats. Our information security leadership inventories and prioritizes information security risks and evaluates material risks from cybersecurity threats, and reports those quarterly to the audit committee of our board of directors (Audit Committee), which evaluates our overall enterprise risk.


text: We use third-party service providers to perform a variety of security functions throughout our business, such as SaaS security providers, cloud-native application protection platforms, dark web monitoring, and software code scanning. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes risk assessments and imposition of contractual obligations. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, which may impose contractual obligations related to cybersecurity on the provider. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology, systems, or those of third parties upon which we rely or our data are or were to be compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our CISO and our information security team. Our CISO has served in various roles in information technology and information security for more than 20 years, including serving as the Chief Information Security Officer at a publicly traded SaaS company and large e-commerce company. Our CISO works with our broader Information Technology team on IT security issues and also works with our product organization, finance, legal and internal controls teams.


text: Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our CISO is responsible for overseeing our Information Security budget, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response process is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances including our CISO, our Chief Financial Officer and our Chief Legal Officer. Upon consultation with our Chief Financial Officer and our Chief Legal Officer, our CISO works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response process includes reporting to the Audit Committee for certain cybersecurity incidents.


text: The Audit Committee receives reports as part of its quarterly meetings from our CISO concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. Our board also receives periodic reports (at least annually) from our CISO regarding the our overall cybersecurity landscape, including material related to cybersecurity threats, risk, and mitigation.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: dedicated cybersecurity staff, including a 24/7 security operations center monitoring for and responding to threat activity, incident response plans and processes, vulnerability management, secure software development, static and dynamic code scanning for vulnerabilities, open-source software scanning, internal and third-party penetration testing, a bug bounty program, internal audit and assurance of security controls, disaster recovery/business continuity plans, attainment and maintenance of industry-standard security certifications, identity and access management, asset management, tracking and disposal, encryption, access controls, third-party risk management, phish testing and reporting, employee security awareness training, and maintaining cybersecurity insurance.


text: The Audit Committee receives reports as part of its quarterly meetings from our CISO concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. Our board also receives periodic reports (at least annually) from our CISO regarding the overall cybersecurity landscape, including material related to cybersecurity threats, risk, and mitigation.


text: The cybersecurity threat environment is volatile and dynamic, requiring a robust and dynamic framework to reduce and mitigate cybersecurity risk. Cybersecurity risk includes exposure to failures or interruptions of service or security breaches resulting from malicious technological attacks that impact the confidentiality, integrity, or availability of our or third parties' operations, systems, or data. We seek to mitigate cybersecurity risk and associated reputational and compliance risk by, among other things maintaining privacy policies, management oversight, accountability structures, and technology design processes to protect private and personal data;

companyName: Village Bank & Trust Financial Corp.


text: actively monitoring and mitigating cybersecurity threats and risks with a three lines of defense structure to provide oversight, governance, challenge and testing; using a third-party cybersecurity oversight program;


text: maintaining oversight of our information security program by senior management, our board-level Risk Committee, and our Board of Directors; and We had no material cybersecurity incidents in 2023.


text: Risk Management and Strategy Our cybersecurity risk management strategy is integrated into our enterprise risk management framework and is embedded in each of our three lines of defense. We use a combination of management expertise and Board oversight, as discussed below, as well as outside partners to assist us in overseeing our cybersecurity risk management program. We deploy safeguards designed to protect customer information and our own corporate information and technology. We have programs and processes in place designed to mitigate known attacks, and we use both internal and external resources to scan for vulnerabilities in our applications, systems, and platforms. We implement backup and recovery systems and require the same of our third-party service providers.


text: W e use independent third-party service providers to perform penetration testing of our infrastructure to help us better understand the effectiveness of our controls, improve our defenses, and conduct assessments of our program for compliance with regulatory requirements and industry guidelines. We also engage with outside risk experts and industry groups, including other peer institutions, as needed, to help us evaluate potential future threats and trends, particularly with respect to emerging information security and fraud risks. We generally have agreements in place with our service providers that include requirements related to cybersecurity and data privacy. We cannot guarantee, however, that such agreements will prevent a cyber incident from impacting our systems or information. Additionally, we may not be able to obtain adequate or any reimbursement from our service providers in the event we should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber incidents attributed to our service providers in relation to any data that we share with them.


text: While to date, we have not experienced a significant compromise, attack, or loss of data related to cybersecurity attacks, due to the nature of our business, we are under constant threat of an attack and could experience a significant cybersecurity event in the future. Potential risks we could face from a cybersecurity event are discussed in "Risk Factors" above.


text: Through established governance structures, including our incident response plan, we have processes and procedures to help facilitate appropriate and effective oversight of cybersecurity risk. These processes and procedures enable our three lines of defense and management to review and manage cybersecurity risks, monitor threats, and provide for further escalation to executive management, our board-level Risk Committee, or to the full Board, as appropriate.


text: Role of the Board of Directors Our Board of Directors plays a critical role in the oversight of risk, including risks from cybersecurity threats, and has established a risk oversight structure that seeks to ensure that cybersecurity risks are identified, monitored, assessed, and mitigated appropriately. In that regard, our Board is actively engaged in the oversight of our cyber risk profile, which includes risks from cybersecurity threats, enterprise cyber strategy, and key cyber initiatives. Our Board regularly receives reports on such matters from our Information Security Officer, and other relevant personnel. Our Board also meets with our internal and external auditors, and federal and state regulators to review and discuss reports on risk, examination, and regulatory compliance matters.


text: Our Board Risk Committee is responsible for assisting the Board in its oversight of risk, including cybersecurity threats, and for overseeing our enterprise risk management framework. The Board Risk Committee actively engages with our Chief Risk Officer and other members of management to discuss major risk exposures, establish risk management principles, and determine our risk appetite, and regularly reports on its activities, and makes recommendations to, the full Board. The Board Risk Committee receives a quarterly summary analysis of cybersecurity risks, threats, and incidents. In addition, the Board Risk Committee is engaged, as needed, in accordance with our Incident Response Plan.


text: Role of Management Our cybersecurity risk management program is built on three lines of defense, which collectively are designed to assess, identify, assess, and manage our material risks from cybersecurity threats. Our Chief Risk Officer is responsible for implementing our enterprise risk management framework and reports directly to our Chief Executive Officer.


text: Our first line of defense is our employees. Employees receive training, at least annually, on information security. In addition, our Information Security Officer provides ongoing information security education and awareness for teammates, such as online training classes, mock phishing attacks and information security awareness materials.


text: The second line of defense independently evaluates, monitors, and challenges our risk mitigation efforts to proactively identify cybersecurity risks, including early-stage engagement and risk management with emerging threats. Second line teammates provide effective challenge to the cybersecurity risk management efforts of the first line through ongoing engagement in problem incidents, regular reviews of cybersecurity risk reporting, and inquiries into the sufficiency of risk management activities. Our second line of defense leads our Management Risk and Compliance Committee, which governs our technology and operational risk tolerances, including cybersecurity and third- and fourth party provider risks. This committee includes the Information Security Officer, the SVP of IT and the Chief Risk Officer. The Committee is responsible for escalating key risks to our Executive Leadership Team.


text: Internal Audit serves as the third line of defense and provides independent assurance on how effectively we are mitigating, managing, and challenging our cybersecurity risks.


text: Cybersecurity, and in particular cybersecurity risk management, is an important part of operations and a focus area for the Company. Cybersecurity risks are evaluated on an ongoing basis by the Company's Technology department, both internally and with the assistance of external firms.

companyName: Alexander & Baldwin, Inc.

ticker: ALEX


text: The Company engages a national security firm in an effort to improve its cybersecurity posture and keep current with evolving cybersecurity risks. The Company's cybersecurity program is examined on a regular basis, and new procedures and tools are adopted on an ongoing basis to address the changing cybersecurity landscape. The Company's technology team tests the effectiveness of its tools with periodic exercises, such as an extensive, simulated attack exercise.


text: The Company's Board of Directors oversees the overall risk management process, including cybersecurity risks, which it administers in part through its Audit Committee. One of the Audit Committee's responsibilities involves reviewing the Company's policies regarding risk assessment and risk management, including with respect to cybersecurity risks. Risk oversight plays a role in all major decisions of the Company's Board of Directors, and the evaluation of risk is a key part of its decision-making process.


text: Cybersecurity risks are considered as part of the risk management process across all levels of the organization but are also facilitated through a formal process in which the Company identifies significant risks through regular discussions with management and also develops responses and mitigating actions to address such risks. In conjunction with the Company's Internal Audit department, management compiles a report of significant, enterprise risks that is shared with the Company's Board of Directors and its Audit Committee annually or as needed. In addition, cybersecurity and information security risks are among the matters presented by the Chief Technology Officer ("CTO") for discussion with the Company's Board of Directors annually and its Audit Committee quarterly or as needed. The CTO, who reports to the Chief Financial Officer, is responsible for leading the assessment and management of cybersecurity risks. The Company's current CTO has more than twenty years of experience managing technology initiatives in diverse industries, and he designed and led the approach for the modernization of the Company's technology platforms and security posture since 2017.


text: As many security threats involve social engineering, the Company has a multifaceted security training program for its employees. Mandatory cybersecurity training classes are administered semi-annually. Tests of employees' ability to thwart attacks are run successively throughout the year, and remedial refresher courses are required when employees fail the tests. In addition, security awareness assessment is required as part of the annual employee review process.


text: The Company does not believe that any risks from cybersecurity threats to date, including as a result of any previous cybersecurity incidents of which the Company is aware, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial conditions. Refer to the risk factor captioned, "Security breaches through cyber attacks or intrusions, or other significant disruptions of the Company's information technology ("IT") networks, communications, and related systems could impair our ability to operate, adversely affect our financial condition, and damage our reputation," in Part I, Item IA. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: The Company engages a national security firm to improve its cybersecurity posture and keep current with evolving cybersecurity risks. The Company's cybersecurity program is examined on a regular basis, and new procedures and tools are adopted on an ongoing basis to address the changing cybersecurity landscape. The Company's technology team gauges the effectiveness of its tools with periodic testing and evaluations.


text: Cybersecurity risks are considered as part of the risk management process across all levels of the organization but are also facilitated through a formal process in which the Company identifies significant risks through regular discussions with management and also develops responses and mitigating actions to address such risks. In conjunction with the Company's Internal Audit department, management compiles a report of significant, enterprise risks that is shared with the Company's Board of Directors and its Audit Committee annually or as needed. In addition, cybersecurity and information security risks are among the matters presented by the Chief Technology Officer ("CTO") for discussion with the Company's Board of Directors annually and its Audit Committee quarterly or as needed. The CTO, who reports to the Chief Financial Officer, is responsible for leading the assessment and management of cybersecurity risks. The Company's current CTO has more than twenty-five years of experience in IT across diverse industries, and he has designed and led the approach for the modernization of the Company's technology platforms and security posture since 2017.


text: As many security threats involve social engineering, the Company has a multifaceted security training program for its employees. Mandatory cybersecurity training classes are administered semi-annually, and a security awareness assessment is given annually. Tests of employees' ability to thwart attacks are run successively throughout the year, and remedial refresher courses are required when employees fail the tests. Compliance reporting on these programs is included in the annual review process.


text: The Company does not believe that any risks from cybersecurity threats to date, including as a result of any previous cybersecurity incidents of which the Company is aware, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial conditions. Refer to the risk factor captioned, "Security breaches through cyber attacks or intrusions, or other significant disruptions of the Company's IT networks, communications, and related systems could impair our ability to operate, adversely affect our financial condition, and damage our reputation," in Part I, Item IA. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: Risk Management and Strategy Cybersecurity risk was identified as a significant enterprise risk based on the results of our most recent enterprise risk assessment. As a significant enterprise risk, management has worked to identify the underlying drivers of cybersecurity risk, identify the activities in place to manage it, and assess its residual risk level. We have developed and implemented comprehensive strategies and processes to assess, identify, manage and mitigate cybersecurity risks, aligning with the National Institute of Standards and Technology Cybersecurity Framework ("NIST-CSF"). These processes include: • implementing security event monitoring, incident response processes, access management controls, vulnerability identification and remediation, third-party risk monitoring, and user awareness and training; • providing regular security training and awareness content for all associates, with mandatory training for new hires; • maintaining cybersecurity risk insurance to mitigate potential breach-related costs; • engaging consultants to perform periodic external assessments using industry-recognized frameworks like NIST-CSF; and • monitoring program maturity through periodic reviews against the Capability Maturity Model Integration framework.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: Risk Assessments We identify and categorize existing third-party service providers based on criticality to our operations and prioritize those that pose the highest risks. We leverage a third-party risk management solution to facilitate our risk assessment process for new third parties which includes interviews and questionnaires with internal business contacts and contacts from the third party to perform an inherent risk assessment. We determine applicable security controls based on the inherent risk level to drive the residual risk score to an acceptable level where possible. The goal of the assessment process is to evaluate the risks associated with each third party, including operational, financial, legal, and reputational risks.


text: Ongoing Monitoring Based on the residual risk score of a third party, we conduct assessments on a periodic basis to help ensure that we maintain current, up-to-date information on our vendors. We leverage an external third-party monitoring service to conduct continuous monitoring of our critical vendors to provide additional visibility and response efforts and work directly with vendors to remediate identified vulnerabilities. Finally, we review contracts that outline risk management responsibilities, compliance requirements, data protection, and incident management protocols.


text: Incident Management We have developed an incident response plan that includes a process for addressing issues arising from third-party relationships which includes communication channels for reporting and managing incidents involving third parties.


text: Documentation and Reporting We maintain detailed records of our third-party assessments and any evidence or documentation that is provided during the assessment process. We regularly review and report on third-party risk management activities and any significant issues to senior management and/or our Audit Committee or Board of Directors.


text: External Resources; Associate Training and Awareness We have developed a comprehensive information security protocol that relies on support from third-party experts and an internal training and awareness program aligned with industry standards and best practices.


text: Given the complex and evolving nature of cybersecurity threats, we engage third-party advisors and consultants to assist us in developing and maintaining effective cybersecurity risk management processes. Partnering with these third parties allows us to leverage specialized knowledge and insights, better ensuring our cybersecurity strategies and processes are well-designed and effective. For example, we work with third parties to regularly conduct simulated attack exercises to identify additional needs for training and overall program refinement.


text: Internally, our training and awareness program creates multi-layered defenses by empowering associates with knowledge and tools to recognize and respond to security risks. Through role-specific and comprehensive training, we seek to maintain a workforce that actively contributes to our cybersecurity goals. Key components of our training program include: • Onboarding Training — All new associates participate in an initial cybersecurity training module at onboarding. This training covers the Company's security policies, data protection standards and foundational security practices helping to ensure that new hires are equipped to meet the Company's expectations pertaining to its security protocols. • Articles — We publish articles on our intranet site for all associates to easily access. These articles highlight emerging threats, industry trends, and actionable tips to help associates enhance their personal and professional security posture. We target critical topics such as ransomware, social engineering, data management, and the latest threats and best practices. • Phishing Simulations — Our phishing awareness program includes continuous phishing simulations conducted on a routine basis. This program helps associates develop the skills to effectively identify and mitigate phishing attempts. Associates who fail a threshold number of simulations during a calendar year are required to undergo additional training. • Cybersecurity Awareness Month Activities — We have implemented interactive, virtual and on-site awareness activities during Cybersecurity Awareness Month in October. These activities include phishing simulations, articles, lunch and learns, and gamification to serve as refreshers on critical security concepts and reinforce our commitment to maintaining a security-conscious culture.


text: Our Board of Directors has overall oversight responsibility for our risk management and has delegated oversight of cybersecurity risks to our Audit Committee, including overseeing the actions management has taken to identify, monitor, and control such exposure. Our Audit Committee reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks on a quarterly basis. As part of our continued investment in developing our overall enterprise risk management program, our Audit Committee receives reports and presentations from management which address a range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, and technological trends. Our Audit Committee reports to our Board of Directors at least annually on cybersecurity matters.


text: At the management level, our Chief Information Security Officer ("CISO") leads the team responsible for implementing, monitoring, and maintaining information security, including data protection practices across our business. Our CISO receives reports on cybersecurity threats from both our internal personnel and external partners on a regular basis. Our Chief Operating Officer and Chief Administrative Officer receive regular reports from our CISO on the cyber program and measures implemented by the Company to identify and mitigate cybersecurity risks. Our CISO works closely with our Company's legal team to ensure compliance with legal and regulatory cybersecurity requirements. Our CISO has over a decade of cybersecurity and risk management experience and holds CISA, CISM, and CISSP certifications as well as a bachelor's degree in Business Information Systems.


text: Cybersecurity Threats and Incidents To date, risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. During fiscal 2024, fiscal 2023 and fiscal 2022, the Company did not experience any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company or its business strategy, results of operations and/or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced undetected cybersecurity incidents. For additional details regarding the risks the Company faces from cybersecurity threats, see "ITEM 1A. RISK FACTORS — Risks Related to Our Business — Our operations, financial condition or reputation may be impaired if our information or operational technology systems fail to perform adequately or if we are the subject of a data breach or cyber-attack" in this Form 10-K.


text: Risk Management and Strategy We maintain a risk-based, defense-in-depth approach to cybersecurity and data protection. We assess industry best practices and standards and endeavor to leverage them in our efforts to manage cybersecurity risk. We dedicate resources and apply security controls where we believe they would be most effective to predict, prevent, detect and respond to potential security threats to our highest value information assets, which we consider to be point-of-sale systems, financial systems and confidential, personal and private customer and employee information. We use multiple safeguards to protect our internal networks and systems, including, among others, firewalls, email protection and web filtering, endpoint detection and response software, controlled access to our data and systems, segmenting our card data environment, vulnerability management and patching, and performing regular penetration testing. A risk assessment, based on the National Institute of Standards and Technology Framework, is conducted and maintained throughout the system development lifecycle and is reviewed at least annually.

companyName: Bloomin' Brands, Inc.

ticker: BLMN


text: We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities, and we investigate security incidents that have impacted our third-party providers, as appropriate.


text: As part of our information security training program, employees and contractors participate in various cybersecurity awareness activities, including formal training exercises and simulated phishing events. We also contract with third-party cybersecurity firms to conduct simulated cyberattacks and perform regular penetration testing to assess the effectiveness of our security measures. We have also engaged with external subject matter experts to assess access management, information technology asset management and our cybersecurity policies.


text: We have company-wide business continuity and disaster recovery plans used to prepare for multiple events, including a potential disruption in the technology on which we rely. We maintain incident response plans and playbooks to prepare for various contingencies and types of incidents. The cybersecurity incident response plan ("IRP") includes immediate actions to mitigate and contain the short-term impact of an incident, and long-term strategies for remediation and prevention of future incidents. The IRP also includes policies that dictate escalation procedures and remediation plans based on the severity level of an incident. As part of our IRP, we consider engaging third-party cybersecurity firms to assist in the event of a significant incident. We also conduct tabletop exercises to enhance incident response preparedness.


text: We, like others in our industry, experience cybersecurity incidents and attempts to access our systems. In the event we experience an incident, we classify it based on its significance and track remediation actions and outcomes. Although we do not believe we have been materially affected by cybersecurity incidents or threats in the past, we cannot provide any assurance that we will not experience a material incident in the future. As described above, we utilize a risk-based approach to manage cybersecurity risk and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. See Item 1A. Risk Factors for additional discussion of our cybersecurity risks.


text: Our Board of Directors (our "Board") has charged the Audit Committee with oversight of the Company's identification, assessment and management of cybersecurity and data privacy risks. As part of its oversight of our enterprise risk management program, the Audit Committee periodically reviews and prioritizes key risks facing our Company, including cybersecurity risk. The Audit Committee receives quarterly updates from our head of information security and our Chief Technology Officer ("CTO") regarding our cybersecurity program and actions taken to manage cybersecurity risk, which include risk identification and management strategies, consumer data protection, security programs, ongoing risk mitigation activities and results of third-party assessments and testing.


text: We maintain a dedicated cybersecurity department, which consists exclusively of Company employees, within our broader information technology department. Functions within this department range from new information technology solution design and implementation, vulnerability management, phishing awareness, threat detection, Payment Card Industry compliance and incident response. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the head of information security, who has over 25 years of experience in the field of cybersecurity, including prior service in the military in cybersecurity roles, and relevant industry certifications commensurate with his role. Our head of information security reports directly to the CTO who has over 20 years of restaurant technology experience. BLOOMIN' BRANDS, INC.


text: Our CTO receives status reports from our cybersecurity department regularly and reports to our Chief Executive Officer, who receives updates on incidents, trends, projects and other relevant information regularly. In addition, as part of our incident response planning, we maintain cross-functional response teams to be prepared to respond to an incident.


text: We, like others in our industry, experience cybersecurity incidents and attempts to access our systems. In the event we experience an incident, we classify it based on its significance and track remediation actions and outcomes. Although we do not believe we have been materially affected by cybersecurity incidents or threats in the past, or that past incidents are reasonably likely to materially affect us, we cannot provide any assurance that we will not experience a material incident in the future. As described above, we utilize a risk-based approach to manage cybersecurity risk and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. See Item 1A. Risk Factors for additional discussion of our cybersecurity risks.


text: Our Board of Directors (our "Board") has charged the Audit Committee with oversight of the Company's identification, assessment and management of cybersecurity and data privacy risks. The Audit Committee receives quarterly updates from our Chief Information Security Officer ("CISO") and our Chief Information Officer ("CIO") regarding our cybersecurity program and actions taken to manage cybersecurity risk, which include risk identification and management strategies, consumer data protection, security programs, ongoing risk mitigation activities and results of third-party assessments and testing.


text: We maintain a dedicated cybersecurity department, which consists exclusively of Company employees, within our broader information technology department. Functions within this department range from new information technology solution design and implementation, vulnerability management, phishing awareness, threat detection, BLOOMIN' BRANDS, INC.


text: Payment Card Industry compliance and incident response. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO, who has over 25 years of experience in the field of cybersecurity, including prior service in the military in cybersecurity roles, and relevant industry certifications commensurate with his role. Our CISO reports directly to the CIO who has over 20 years of technology leadership experience in various industries.


text: Our CIO receives status reports from our cybersecurity department regularly and reports to our Chief Executive Officer, who receives updates on incidents, trends, projects and other relevant information regularly. In addition, as part of our incident response planning, we maintain cross-functional response teams to be prepared to respond to an incident.


text: We integrate technology into many aspects of our business. We use technology to engage with our customers and employees, and to deliver our products and services. The business information and data managed and stored in our technology systems is used in many of our daily functions, including accounting processes, financial forecasting, pricing, underwriting, sales, compliance, and communications, among others. We are mindful of the risk in the operation of our business presented by cybersecurity threats and remain aware of the potential risk to our IT systems and data.

companyName: NMI Holdings, Inc.

ticker: NMIH


text: In anticipation and in response to such risks, we have a comprehensive information security/cybersecurity program, including controls and procedures designed to safeguard and maintain the integrity of our IT systems, and prevent and detect unauthorized access to our IT systems by threats or bad actors, both internally and externally. Due to the ever-changing nature of cyber threats, we seek to proactively mitigate risks through prevention and preparation. We take a risk-based approach and identify new and continuing threats to our information systems that could potentially compromise their secure and efficient operation. Our cybersecurity program is fully integrated into our overall risk management framework and is regularly evaluated by internal and external experts.


text: Our information security program is managed by a dedicated Chief Information Security Officer (CISO), who has over 25 years of relevant experience. Our CISO is charged with the maintenance and execution of our security program and reports to our Chief Information Officer, who leads the management of our information systems. The CISO manages a team that assesses, evaluates, and responds to cybersecurity threats. Our CISO, and other senior leaders in our IT, law, and internal audit departments, provide periodic reports to our Chief Executive Officer and other members of our senior management team and the Board, as appropriate, on cybersecurity risks and program updates.


text: Our Board oversees cybersecurity risks through the Board's audit and risk committees. The Board's Audit Committee has primary oversight of cybersecurity risk. In performing its oversight function, the Audit Committee considers information from the senior leaders in various departments (including the IT, internal audit and law departments) who provide periodic reports on cybersecurity, including updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.


text: Our cybersecurity program is aligned with industry standards, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, and we periodically engage third parties as part of our continuing efforts to evaluate, enhance and test the adequacy and effectiveness of our security measures and controls. We require our third-party service providers to implement and maintain comprehensive cybersecurity practices commensurate with the services they perform for us, and consistent with applicable legal standards and practices. In addition, we maintain and test a business continuity plan that is designed to allow us to continue to operate in the midst of certain disruptive events, including disruptions to our IT systems, and we have an incident response plan that is designed to address information security incidents, including any breaches of our IT systems.


text: We believe all of these functions serve the process of prevention, detection, mitigation, and remediation of cybersecurity incidents. While we have not experienced any material cybersecurity events, we believe that disruptions to and breaches of our IT systems are possible and may negatively impact our business in the future. Despite robust controls and safeguards in place, no system can guarantee complete security from internal and external threats. See Item 1A, "Risk Factors - We may not be able to prevent the unauthorized disclosure or misuse of confidential, personal or proprietary information."


text: We are not currently engaged in any substantive business activity except the search for potential assets, property or businesses to acquire, and we have no current plans to engage in any other activity in the foreseeable future unless and until we complete any such acquisition. In our present form, we are deemed to be a "shell company"

companyName: ATLANTICA INC

ticker: ALDA


text: seeking to acquire or merge with a business or company. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents.


text: If and when we commence any operations, our board of directors will consider what they deem as a reasonable cybersecurity risk management program or formal processes for assessing cybersecurity risk.


text: Risk Management and Strategy Our cybersecurity policies, standards, processes and practices are based on applicable laws and regulations and informed by industry standards and industry-recognized practices. Our strategy to assess, identify, and manage material cybersecurity risks is focused on preserving the confidentiality, security, and availability of our information systems and data. We implement security measures and processes to identify, prevent, and mitigate cybersecurity threats and to effectively respond to cybersecurity incidents when they occur. Our cyber risk management includes: (1)

companyName: Nu-Med Plus, Inc.

ticker: NUMD


text: enterprise risk management to identify top cybersecurity risks; (2) vulnerability management to identify software vulnerabilities and risks related to compute infrastructure; (3) vendor risk management to identify risks related to third parties and business partners; (4) privacy risk management to identify privacy risks in our product and platforms and ensure regulatory compliance; and (5) security incident response to investigate, respond to, and mitigate cyber threats. As needed, we will engage third parties to identify risks in our underlying software and infrastructure, to provide threat intelligence, and to assist in triaging, identifying, and responding to cyber threats.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: Our Board of Directors maintains oversight of risks from cybersecurity threats. Our Chief Financial Officer is assigned oversight of cybersecurity risks. Our Chief Financial Officer is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.


text: Strategy, Governance and Risk Management Reflect Scientific maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, including the assessment of cybersecurity risks related to third-party vendors and suppliers. This program is integrated within the Company's enterprise risk management process and the results of the risk assessment, which occurs at least annually, along with mitigation strategies, are discussed with the senior management.

companyName: REFLECT SCIENTIFIC, INC.

ticker: RSCF


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization Standardization ("ISO") 27001 Information Security.


text: As a Company with a single-officer operation and no formal cybersecurity policies in place, we recognize the importance of safeguarding our digital assets and protecting sensitive information. While we strive to maintain the security of our systems and data, our resources and infrastructure are limited. We rely on basic security measures, such as password protection and firewalls to mitigate potential risks.

companyName: FLEXPOINT SENSOR SYSTEMS INC

ticker: FLXT


text: Given the nature of our operations and size, we may be more susceptible to cybersecurity threats. We acknowledge the possibility of breaches or unauthorized access to our systems, which could result in the loss or compromise of sensitive information. Any such incident could have a material adverse effect on our business, financial condition, and reputation.


text: We are committed to continuously evaluating and enhancing our cybersecurity measures as our business evolves. However, investors should be aware that our current capabilities may not fully address all cybersecurity risks. We encourage investors to consider the inherent risks associated with our limited resources and lack of formal cybersecurity policies when evaluating our Company.


text: Risk Management and Strategy Our cybersecurity policies, standards, processes and practices are based on applicable laws and regulations and informed by industry standards and industry-recognized practices. Our strategy to assess, identify, and manage material cybersecurity risks is focused on preserving the confidentiality, security, and availability of our information systems and data. We implement security measures and processes to identify, prevent, and mitigate cybersecurity threats and to effectively respond to cybersecurity incidents when they occur. Our cyber risk management includes: (1) enterprise risk management to identify top cybersecurity risks; (2) vulnerability management to identify software vulnerabilities and risks related to compute infrastructure; (3) vendor risk management to identify risks related to third parties and business partners; (4) privacy risk management to identify privacy risks in our product and platforms and ensure regulatory compliance; and (5) security incident response to investigate, respond to, and mitigate cyberthreats. As needed, we will engage third parties to identify risks in our underlying software and infrastructure, to provide threat intelligence, and to assist in triaging, identifying, and responding to cyber threats.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents.


text: Risk Management and Strategy We recognize the importance of assessing, identifying and managing risks from cyber security threats, and our processes to manage risks from cybersecurity threats have been integrated into our overall risk management framework.

companyName: Shutterstock, Inc.

ticker: SSTK


text: As a foundation of this approach, we have implemented a layered governance structure, and our privacy and cybersecurity risk management systems encompass policies, practices, and procedures for incident responses, information security and vendor management. In order to help develop these policies and procedures, we monitor the privacy and cybersecurity laws, regulations and guidance applicable to us in the regions where we do business including European Union General Data Protection Regulation (GDPR), UK Data Protection Law, the Brazilian General Data Protection Law (LGPD), the California Privacy Rights Act (CPRA) and other US state privacy laws, as well as proposed privacy and cybersecurity laws, regulations, guidance and emerging risks.


text: We annually undergo a Payment Card Industry (PCI) compliance certification process and obtain an attestation through a Qualified Security Assessor (QSA). We have an established bug bounty program and conduct penetration testing as needed to identify vulnerabilities for remediation. With respect to third party service providers, we obligate vendors to adhere to privacy and cybersecurity measures, perform risk assessments of vendors including their ability to protect data from unauthorized access. As described in Item 1A "Risk Factors," our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks, as we provide content licensing to customers in more than 150 countries and license content from contributors located in over 100 countries. Computer viruses, hackers, employee or vendor misconduct, and other external hazards could expose our information systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business including brand reputation, customer sales, legal impacts, and financial costs. While we have experienced cybersecurity incidents, to date, we have not experienced any material cybersecurity incidents.


text: The sophistication of cybersecurity threats, including through the use of artificial intelligence, continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency such as artificial intelligence, cloud computing, and machine learning may further expose our computer systems to the risk of cybersecurity incidents.


text: As part of our overall risk management approach, we prioritize the identification and management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Audit Committee, comprised of independent directors from our Board, oversees the Board's responsibilities relating to the operational (including information technology (IT) risks, business continuity and data security) risk affairs of the Company. Our Audit Committee is informed of such risks through quarterly reports from our group Chief Information Security Officer (CISO).


text: Our CISO, who has over 20 years of experience in cyber security and technology, oversees the implementation and compliance of our information security standards and mitigation of information security related risks. We also have management level committees and a cybersecurity incident team that support our processes to assess and manage cybersecurity risk as follows: • Privacy is co-chaired by the CISO and Assistant General Counsel. They bring IT, cybersecurity, legal, compliance and other function cross-functional members together as needed throughout the year to consider emerging technologies, such as artificial intelligence and emerging cybersecurity and privacy risks; review cybersecurity and privacy regulations; approve, review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise. • Our Technology Leadership Team, which includes our group Chief Technology Officer, CISO, Technology Vice Presidents, and members of executive leadership, oversees IT initiatives while considering cybersecurity risk mitigation with respect to these initiatives on a monthly cadence. • Our Senior Leadership Team including IT, operations, risk, legal and compliance leaders across business segments, meet quarterly to manage risks from matters related to business continuity including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, these leaders review the Company's programs and processes related to information security, third party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery. • The Crisis Incident Management Team, which includes senior executives across the Company, is alerted as appropriate to cybersecurity incidents, natural disasters and business outages. Annually, this team assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss the event and response options.


text: Each of these committees provides summary reports on their activities, which the CISO communicates as appropriate to the Audit Committee.


text: At the employee level, we maintain an experienced information technology team who are tasked with implementing our privacy and cybersecurity program and support the CISO in carrying out reporting, security and mitigation functions. We also hold annual employee trainings on privacy and cybersecurity, records and information management, and generally seek to promote awareness of cybersecurity risk through communication and education of our employee population.


text: We recognize the importance of maintaining the trust and confidence of our patients, our collaborators, our business partners, our investors, and our employees and understand how key it is to maintain their confidence in our ability to properly protect and manage our information technology systems, infrastructure and data as part of that trust and confidence. In order to achieve this, our management team and our Board of Directors are actively involved in the oversight of our cybersecurity program as part of our approach to risk management.

companyName: Nurix Therapeutics, Inc.

ticker: NRIX


text: Risk Management and Strategy We maintain processes for assessing, identifying, and managing cybersecurity risks. These processes are designed to protect our information assets and operations from both internal and external cyber threats, including protecting employee and patient information from unauthorized access or attack, and to secure our networks and systems. Our cybersecurity and data privacy programs are aligned to, among others, the U.S. National Institute of Standards and Technology (NIST) Cybersecurity Framework to assess, identify and manage material risks from cybersecurity threats. We employ a combination of physical, procedural, and technical safeguards, regular system tests, incident simulations, and routine policy and procedure reviews to identify risks and enhance our practices.


text: We have a cybersecurity incident response plan (CIRP) that we review on at least an annual basis and update as business needs and the security landscapes change and as required. In the event of a cybersecurity incident, our incident response team refers to our CIRP and existing management internal controls and disclosure processes. Pursuant to this process, designated personnel are responsible for assessing the severity of the incident and any associated threats, containing and resolving the incident as quickly as possible, managing any damage to our systems and networks, minimizing the impact on our stakeholders, analyzing and executing upon internal reporting obligations, escalating information about the incident to senior management and the Board of Directors, as appropriate, and performing post-incident analysis and program enhancements, as needed. We perform tabletop exercises on at least an annual basis to test our incident response procedures, identify gaps and improvement opportunities and exercise team preparedness.


text: We provide our employees and consultants with privacy, data protection, cybersecurity incident response, and prevention education and awareness training, which includes annual and supplemental training covering relevant topics, such as social engineering, phishing, password protection, confidential data protection, asset use, and mobile security, and educates employees on the importance of reporting all incidents immediately. In addition, we perform phishing test campaigns on at least a quarterly basis to reinforce identification and reporting training.


text: We engage third parties to conduct risk assessments on our systems and other vulnerability analyses on a recurring basis and assist with containment and remediation efforts. In addition, third-party technology and analytics and penetration testing are utilized to identify potential vulnerabilities. To manage risks related to cybersecurity incidents that could impact our CROs, third-party vendors and other contractors and consultants, we maintain a third-party risk management program, which is designed to assess the security controls of our third parties. The assessment methodology is based on risk and relies on the data, access, connectivity, and criticality of the services that the third-party offers.


text: Cybersecurity Governance Our cybersecurity and data privacy programs are implemented and overseen by our Chief Information Security Officer ( CISO), our Senior Vice President (SVP) of Information Technology, and members of our executive management team.


text: Our SVP of Information Technology has over 20 years of information technology experience, with over 15 years of experience leading technology and cybersecurity programs in biopharmaceutical companies. Since joining Nurix in 2021, our SVP of Information Technology has led all information technology strategy and operations, including our cybersecurity program. Previously, he served as Chief Technology Advisor focused on cybersecurity incident response and strategic security consulting, and held senior IT leadership roles at multiple clinical-stage biotechnology companies. He holds industry cybersecurity certifications and is undertaking advanced studies in IT Management and Cybersecurity.


text: Our CISO has over 20 years of experience in information security, including more than 15 years of experience leading large-scale cybersecurity and privacy programs across various industries. He currently leads all aspects of our enterprise cybersecurity strategy, risk governance, and privacy effort. He holds industry-recognized certifications, including CISSP. He earned his MBA with a focus on Finance and Strategy and a B.E. in Electronics and Communication.


text: Our SVP of Information Technology and our CISO regularly provide cyber threat intelligence briefings to management on the status of the Company's security measures and our efforts to identify and mitigate risks from cybersecurity threats. Our SVP of Information Technology and CISO also work closely with our Chief Financial Officer and Chief Legal Officer to further enhance incident response procedures and to assess and manage risks from cybersecurity threats.


text: The Audit Committee of our Board of Directors (Audit Committee) oversees the Company's overall enterprise risk assessment and risk management policies and guidelines, including risks related to cybersecurity matters. The Audit Committee provides periodic reports to the Board of Directors regarding its oversight of cybersecurity, information technology, data protection and related matters. Members of the Board of Directors also participate in table-top exercises involving simulated data security incidents and the Company's responses to those incidents.


text: The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, planned improvements to our cybersecurity program, and the status of information security initiatives. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds.


text: Risk and Issues Disclosure As of November 30, 2024, and through the date of this filing, we are not aware of any material cybersecurity incidents that have impacted the Company, nor do we believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. However, we previously have been the target of cyber-attacks and expect them to continue as cybersecurity threats have been rapidly evolving in sophistication and becoming more prevalent in our industry. We face risks of incidents, whether through cyber-attacks or cyber intrusions through the Cloud, the Internet, phishing attempts, ransomware, and other forms of malware, computer viruses, email attachments, extortion, and other scams. Although we make efforts to maintain the security and integrity of our information technology systems, these systems and the proprietary, confidential, and personal information that resides on or is transmitted through them are subject to the risk of a cybersecurity incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third-party vendors, will prevent breakdowns or incidents to our or our third-party vendors' systems that could adversely affect our business. For additional information on cybersecurity risks we face, see Part I, Item 1A. Risk Factors of this Annual Report on Form 10-K under the heading "Risks Related to Employees, Managing our Growth and Other Legal Matters—We depend on our information technology systems, and any failure of these systems, or those of our CROs, third-party vendors, collaborators or other contractors or consultants we may utilize, could harm our business. Security breaches, cyber-attacks, loss of data and other disruptions could compromise sensitive information related to our business or other personal information, prevent us from accessing critical information and expose us to liability, which could adversely affect our business, reputation, results of operations, financial condition and prospects."


text: Board Oversight of Cybersecurity Matters The Audit Committee is tasked with overseeing the Partnership's cybersecurity matters. Pursuant to the Audit Committee's charter, one of the Audit Committee's responsibilities is to discuss the Partnership's major risk exposures with management, including those related to cybersecurity, and the steps taken by management to monitor and control such exposures, including the Partnership's risk assessment and risk management guidelines, policies and practices.

companyName: Summit Midstream Partners, LP


text: The Audit Committee reports to the entire Board of Directors periodically regarding its oversight of cybersecurity matters. In developing such updates to the Board of Directors, the Audit Committee relies in large part on periodic updates from Partnership management. Management of Cybersecurity Matters The Partnership's management assumes executive responsibility for assessing, identifying, and managing cybersecurity risks and incidents.


text: In particular, the Senior Vice President, Engineering and Operations (SVP, E&O) reports directly to the President, Chief Executive Officer, and Chairman of the Board and holds the highest level of executive responsibility for assessing and managing all cybersecurity threats, incidents, and risks at the Partnership, as well as developing and implementing all cybersecurity risk management, strategy, and governance recommendations.


text: The SVP, E&O holds key skills, experience, and competencies related to the management of cybersecurity matters. In particular, our current SVP, E&O has over 30 years of experience leading IT and OT physical security and cybersecurity.


text: The SVP, E&O is supported by critical internal positions within the Partnership, including but not limited to the Director of Information Technology, Vice President of Operational Technology and dedicated IT and OT resources with cybersecurity responsibilities. The SVP, E&O is further supported by various external parties, including but not limited to cybersecurity service providers, consultants, and other third parties engaged on an as-needed basis.


text: The Partnership's management has processes in place by which it is informed of and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks. These processes include, but are not limited to: • Maintaining an updated inventory and management of digital assets; • Ensuring familiarity and compliance with cybersecurity frameworks, including the National Institute of Standards and Technology's Cybersecurity Framework and ISO 27001; • Updating and maintaining an internal incident response plan; • Conducting risk assessments of the Partnership's cybersecurity policies, practices, and tools; • Employing appropriate antivirus, anti-malware, firewall, endpoint detection and response, backup and recovery software, multifactor authentication, virtual private network, account change monitoring, patch management, web content filter, spam filter and reporting, and vulnerability management software; • Conducting regular vulnerability scans of the Partnership's digital and operational infrastructure; • Requiring employees to complete a Cybersecurity Awareness Program, which includes computer-based training; and • Reviewing and evaluating developments in the threat landscape.


text: The Partnership's management also has processes in place to oversee and identify material risks from cybersecurity threats associated with its use of third-party service providers. These processes include, but are not limited to: • Maintaining an inventory of all third-party vendors engaged by the Partnership and assessing each vendor's level of access to the Partnership's IT and OT systems and information; and • Implementing access controls that restrict vendor access to only specific Partnership systems and information necessary to perform their service.


text: The SVP, E&O provides updates to the Audit Committee at its quarterly meetings regarding management of the Partnership's cybersecurity matters, including any new cybersecurity threats, incidents, risks, risk management solutions, trainings or education, infrastructure upgrades, or governance changes.


text: As of March 15, 2024, the Partnership's business strategy, operations, or financial condition have not been materially affected by and are not likely to be materially affected by, any cybersecurity threats or incidents.


text: We are committed to maintaining robust oversight and governance of potential cybersecurity risks and to implementing processes and controls that help us identify, assess, manage, and mitigate such risks. To date, we have not experienced a cybersecurity threat or incident that has resulted in a material adverse impact to our business or operations. However, we cannot guarantee that we will not experience such a threat or incident in the future, given the increasing sophistication of those responsible for cybersecurity incidents. While we seek to detect and investigate unauthorized attempts and attacks against our network and to prevent their occurrence where practicable through our internal processes and tools, we remain potentially vulnerable to known or unknown threats. In some instances, we can be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See "Item 1A. Risk Factors" for more information on our cybersecurity risks.

companyName: Performant Healthcare Inc

ticker: PHLT


text: We aim to incorporate and align with industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies and other processes to identify, assess, manage, and mitigate material cybersecurity risks. These include, among other things, having mechanisms in place to detect and monitor unusual network activity, utilizing vulnerability assessment scans and tools, and conducting external and internal penetration tests and security assessments. We engage a third party expert to assist with numerous aspects of our cybersecurity program, including vulnerability assessment scans, penetration tests and security assessments. Additionally, from time to time, our internal audit function reviews and assesses various aspects of our cybersecurity program. We also engage in threat intelligence monitoring, including monitoring the dark web and zero-day vulnerability and attack information, and have processes in place to assess the potential cybersecurity impact or risk of any identified threats on our company, including potential impacts on our business partners and other parties with whom we share information. We actively engage with industry groups for peer benchmarking purposes and to stay current on best practices. We rely heavily on vendors and other third-party service providers in the conduct of our business operations, and a cybersecurity incident at a vendor or other third-party service provider could have a material and adverse impact on our business, results of operations and financial condition. We have further processes in place to assess the cybersecurity risks associated with our vendors and other third-party service providers, and we require such providers to take appropriate precautions to protect our data and to notify us promptly in the event of any known or suspected data breach or cyber incident.


text: Our cybersecurity program is integrated into our broader approach to risk management, and ultimate oversight for the program sits with our Board of Directors. The Board of Directors is aided by its Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board of Directors. Review of cybersecurity risks and internal audits regarding information security are conducted by the Audit Committee on a quarterly basis, or more frequently as determined to be necessary or advisable.


text: Our VP Information Security Officer (VPISO) runs our cybersecurity program. Our VPISO, who holds numerous cybersecurity and related certifications, including Certified Information Systems Security Professional, reports to our Chief Financial Officer (CFO). Our VPISO and CFO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. They regularly report directly to the Audit Committee or the Board of Directors on our cybersecurity program and our efforts to identify, assess, manage, and mitigate cybersecurity incidents. In addition, we have an escalation process in place to inform senior management and the Board of Directors of any material issues as they arise.


text: We rely on complex information technology systems and various software applications to operate our business. We have developed a comprehensive cybersecurity program designed to protect our systems and the confidentiality, integrity and availability of our data.

companyName: AbbVie Inc.

ticker: ABBV


text: We have implemented processes that are intended to assess, identify, manage and reduce cybersecurity risks. We maintain a global incident response plan and disaster recovery management plan, each designed to protect against, identify, evaluate, respond to and recover from an incident. These plans anticipate an array of potential scenarios and provide for the assembly of a cybersecurity incident response team in the event of a cyber incident. The incident response team is a cross-functional group that may be composed of both company personnel and external service providers, and which is tailored to a particular incident so that individuals with appropriate experience and expertise are available. We regularly conduct exercises to help ensure the plans' effectiveness and our overall preparedness.


text: We also have invested in tools and technologies to protect our and our patients', customers' and business partners' data and information technology, and we regularly monitor our information technology systems and infrastructure to identify and assess cybersecurity risks. We have designed a Threat Intelligence function that actively looks for risks that target the pharmaceutical industry generally or AbbVie specifically. We rely in part on third parties (including assessors, consultants, advisors and others) in connection with our processes for assessing, identifying, managing and reducing cyber risks.


text: In addition, we have implemented a cybersecurity awareness program designed to educate and train our entire employee network on how to identify and report cybersecurity threats. Training programs are conducted on a periodic basis and are focused on giving employees tools to manage and defend against the most relevant and prevalent cybersecurity risks to AbbVie. We also provide specialized training for employees in specialized information technology roles. We conduct regular drills, such as tabletop exercises, to help with our overall preparedness.


text: We take measures to regularly update and improve our cybersecurity program, including conducting independent program assessments, penetration testing and scanning of our systems for vulnerabilities. We follow the National Institute of Standards and Technology (NIST) Cybersecurity Framework and undergo a third-party assessment every two years to measure the maturity of our cybersecurity program against the NIST Cybersecurity Framework. In addition, we periodically engage third-party advisors to assess the effectiveness and capabilities of our cybersecurity program, strengthen our cybersecurity policies and practices and identify potential vulnerabilities of our systems.


text: With respect to third-party service providers, our information security program includes conducting due diligence of relevant service providers' information security programs prior to onboarding. We also contractually require third-party service providers with access to our information technology systems, sensitive business data or personally identifiable information to implement and maintain appropriate security controls and contractually restrict their ability to use our data, including personally identifiable information, for purposes other than to provide services to us, except as required by law. To oversee the risks associated with these service providers, we work with them to help ensure that their cybersecurity protocols are appropriate to the risk presented by their access to or use of our systems and/or data, including notification and coordination concerning incidents occurring on third-party systems that may affect us. These relevant service providers are contractually required to notify us promptly of information security incidents that may affect our systems or data, including personally identifiable information. While we conduct due diligence on the security and business controls of our third-party service providers and take steps to monitor their compliance with our security requirements, we may not have the ability in all cases to effectively monitor or oversee the implementation of these control measures.


text: As of December 31, 2023, cybersecurity risks have not materially affected our business, strategy, results of operations, or financial condition. Although we have invested in the protection of our data and information technology and monitor our systems on an ongoing basis, there can be no assurance that such efforts will in the future prevent material compromises to our information technology systems that could have a material adverse effect on our business. We maintain cybersecurity insurance coverage to mitigate our financial exposure to certain incidents. For additional information about our cybersecurity risks, see Item 1A, "Risk Factors - AbbVie depends on information technology and a failure of, or significant disruption to, those systems could have a material adverse effect on AbbVie's business."


text: Our board of directors has risk oversight responsibility for AbbVie and administers this responsibility both directly and with assistance from its committees. Each of the committees periodically reports to the board of directors on its risk oversight activities. Cybersecurity is a critical component of our enterprise risk management program, which is designed to be business aligned, risk-focused and multi-faceted to protect our and our patients', customers' and business partners' data. Our board of directors is actively involved in reviewing our information security and technology risks and opportunities (including cybersecurity) and discusses these topics on a regular basis.


text: The Audit Committee, comprised solely of independent directors, oversees our enterprise risk management program and assists the board of directors in fulfilling its oversight responsibility with respect to our information security and technology risks (including cybersecurity), which are fully integrated into our enterprise risk management program. The Audit Committee reviews and discusses our information security and technology risks (such as cybersecurity), including our information security and risk management programs.


text: Our cybersecurity program is led by our Chief Information Security Officer, who is responsible for assessing and managing our information security and technology risks (including cybersecurity). He has more than 25 years of experience in information security and information technology risk management, holding chief information security officer positions with Fortune 500 companies in the retail, healthcare and life sciences industries. He has also served on the Health-ISAC board of directors and is a Certified Information System Security Professional (CISSP).