text: We have adopted a cloud-first strategy which is a foundational element to our overall cybersecurity posture. For essential systems, we utilize SaaS-based software partners who annually conduct Statement on Standards for Attestation Engagements SOC 1 or SOC 2 assessments, as appropriate, based on functional use within our company. Based on the nature of services provided by our technology partners, our third-party risk management process may include: Reviewing cybersecurity practices of such provider. Contractually obligating the provider to share detailed results of cybersecurity assessments on an annual basis. Contractually obligating the provider to make us aware of significant cybersecurity related incidents. Coordinating independent security assessments with the provider utilizing our own resources.


text: Cybersecurity Risk Management We have adopted a cybersecurity risk management process that is designed to identify and mitigate potential cybersecurity risks. On an annual basis, we work with credible, third-party cybersecurity experts to assess our ability to prevent, identify, and respond to cybersecurity threats through internal and external penetration tests and monthly vulnerability scans. We also test our organizational cybersecurity capabilities through facilitated tabletop exercises which simulate real life scenarios. Together with the findings of the SOC 1 and 2 assessments, and our threat intelligence and monitoring activities, these exercises, tests and scans help us identify potential cybersecurity risks. When practical and necessary, we patch vulnerabilities that are identified. We deploy endpoint detection and monitoring technologies to identify potential cybersecurity incidents.

companyName: JBG SMITH Properties

ticker: JBGS

secItem: Item 1C


text: We back up our systems and data to mitigate the impact of a cybersecurity event that would impact our ability to operate or result in the loss of data. We partner with strategic managed cybersecurity service providers to supplement the capabilities of our internal team. We update and refine our CIRP in response to identified risks.


text: To manage the third-party cybersecurity risk introduced by our cloud-first strategy, we have implemented a due diligence process for new software partners as well as an annual review process for essential SaaS system partners.


text: We conduct cybersecurity awareness training annually and simulated phishing campaigns no less than quarterly to test and educate our employees.


text: Notwithstanding the steps we take to address cybersecurity, we may not be successful in preventing or mitigating all cybersecurity incidents or threats. See Item 1A. Risk Factors - Risks Related to Our Business and Operations – The occurrence of cyber incidents, or a deficiency in our cybersecurity, or the cybersecurity of our service providers, could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information, regulatory enforcement and other legal proceedings, and/or damage to our business relationships, all of which could negatively impact our financial results – for a discussion of cybersecurity risks. To date, we have not experienced any material cybersecurity incidents.


text: Our Chief Information & Technology Officer along with our Vice President of Cybersecurity & Cloud Infrastructure provide principal oversight and guidance of our cybersecurity risk management strategy, programs and processes. The Chief Information & Technology Officer has over 20 years of experience in information technology in the real estate sector, leading organizations through strategic technology and process improvement initiatives. The Vice President of Cybersecurity & Cloud Infrastructure has over 15 years of extensive experience in cybersecurity and information technology. They are supported in their efforts by a team of technical experts who have had formal training and possess relevant industry related experience in addition to managed cybersecurity service providers who specialize in preventing, identifying, and responding to cybersecurity threats.


text: The Audit Committee of our Board of Trustees provides board-level governance and oversight regarding cybersecurity matters. Management meets with the Audit Committee periodically to discuss cybersecurity strategy, risk, trends, and internal personnel and qualifications. As part of our annual enterprise risk assessment, technology and cyber risks are standing risk factors which are ranked and reviewed by management.


text: In the event of a cyberattack, we engage our CIRP, which provides a framework of processes and procedures related to identifying, categorizing, responding, containing, analyzing, and eradicating cybersecurity threats to mitigate downtime and promptly restore systems and services. Management has responsibility for reporting cybersecurity incidents to the Audit Committee as they occur, if consistent with our CIRP. The CIRP also addresses management's responsibility, with Audit Committee oversight, with respect to any reporting or disclosure determinations related to a given cybersecurity incident and provides for Audit Committee and Board of Trustee briefings as appropriate.


text: Our Cybersecurity program is managed by our Chief Information Security Officer (CISO). The CISO is responsible for developing and managing the overall strategy, leading the response to cybersecurity incidents and reporting to the Board. The Audit Committee of the Board monitors our information security programs, including our cybersecurity risk management program, and receives updates quarterly, or more frequently as determined appropriate, from management on our cybersecurity program and systems protection.

companyName: ACCENDRA HEALTH INC/VA/

ticker: ACH


text: Our CISO has over twenty-five years of experience in cybersecurity and holds active Certified Information Systems Security Professional and Certified Information Security Manager certifications. Our policies require teammates, contractors, service providers and suppliers who become aware of a cybersecurity incident or the individual's supervisor must immediately report the cybersecurity incident to the appropriate reporting channels, which include the CISO. In the event of a cybersecurity incident, in addition to the standing members, teammates would be selected to serve on the Cybersecurity Incident Response Team (CIRT) based on the facts and circumstances of the particular cybersecurity incident. Additionally, our outside legal counsel is held on retainer to assist with our response to cybersecurity incidents.


text: We model our cybersecurity program to align with practices and standards referenced within the National Institute of Standards and Technology cybersecurity framework. Our information security program is integrated within our larger enterprise risk management program and includes, but is not limited to: Following the methodology of Identify, Protect, Detect, Respond, and Recover; Mandatory annual cybersecurity awareness training for all teammates accessing our network; Monthly Company-wide phishing prevention and awareness exercises;


text: Identification and remediation of information security risks and vulnerabilities in our information technology systems, including regular scanning of both internal and externally facing systems and annual third-party penetration testing; Implementation of security technologies intended to identify and assist in containing and remediating malware risks; Active monitoring of logs and events for our network perimeter and internal systems; Due diligence of information security maintained by third-party vendors that handle our data;


text: Partnering with the Cybersecurity and Infrastructure Security Agency (CISA), DHS, and the Federal Bureau of Investigation, to leverage their provided sensitive or confidential threat intel and with CISA for weekly vulnerability scans of our key public-facing servers;


text: Maintaining a cyber insurance policy that provides coverage for security breach recovery and response; and Engagement of third party consultants to assess the health of our cybersecurity program.


text: We maintain a Cybersecurity Incident Response Plan (CIRP) to assist in promptly responding to, resolving, and recovering from cybersecurity incidents. The CIRP includes guidelines for assessing, identifying, managing, reporting, including disclosure of material breaches with the SEC, and remediating cybersecurity incidents. Following a cybersecurity incident, external subject matter experts, including legal counsel are consulted to reduce the risk of further compromise to our information and to ensure proper reporting and documentation. The Audit Committee would be informed promptly of material cybersecurity incidents in the event that they arise. If a material cybersecurity incident were to occur, it could have a material effect on our business strategy, results of operations and financial condition. For more information see Item 1A. "Risk Factors" for the Risk Factor entitled "Our operations depend on the proper functioning of information systems, and our business or results of operations could be adversely affected if we experience a cyberattack or other systems breach or failure."


text: Cybersecurity Program Our cybersecurity and related controls, policies and procedures ("Cybersecurity Program") are critical business functions protecting our enterprise information systems, data and business operations from external and internal threats. The Cybersecurity Program prioritizes detection, analysis, response and prevention to known, anticipated or unexpected cybersecurity threats, with regular internal and third-party assessments and enterprise risk management governance reviews. The Cybersecurity Program is informed by the National Institute of Standards and Technology's ("NIST") cybersecurity framework standard and is integrated into our overall enterprise risk management framework, along with our compliance requirements under federal and state cybersecurity and related regulations.

companyName: PennyMac Financial Services, Inc.

ticker: PFSI


text: We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. Our Risk Factors include further detail about our material cybersecurity risks.


text: Our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") each have over 24 years of information system experience and are primarily responsible for implementing the Cybersecurity Program and managing our information security personnel and consultants. The CIO has served in a variety of information technology leadership positions in the finance industry and holds a B.S. in Electrical Engineering. The CISO served in a variety of cybersecurity operations, cybersecurity architecture, and critical infrastructure cybersecurity enhancement programs in the finance industry, the utility industry and in government and holds a B.S.in Management Information Systems and Decision Sciences.


text: The Cybersecurity Program, which is integrated into our enterprise risk management framework, assesses, identifies and protects our enterprise information systems, data and business operations from various security threats and contains the following elements: Information Security Risk Assessment - Conducting internal and external risk and control assessment, quality control and assurance testing. Identity and Access Management - Managing enterprise identity and access control systems. Security Architecture - Managing security architecture, including secure code deployment standards, architecture security reviews, and cybersecurity advisory support.


text: Security Engineering - Designing, implementing and operating security technologies, including but not limited to malware protections, security event and incident management, data loss prevention, and phishing defenses.


text: Security Operations - Ensuring continuous operational coverage of security events and alerts, maintaining and executing processes for triage, containment, investigation and escalation/communication and threat intelligence.


text: Attack Surface Management - Managing vulnerability and patch management, network penetration testing, application security testing and exercises, including cyber-attack simulations and tabletop exercises with senior management to detect control gaps.


text: Third-Party Assessments - Coordinating, reviewing and analyzing third-party providers' assessments of the Cybersecurity Program. Internal Audit may also perform a periodic cybersecurity program audit that may be supported by external consulting firms. Third-Party Service Provider Reviews – Identifying and reviewing material risks from cybersecurity threats associated with certain third-party service providers.


text: Cybersecurity Monitoring and Incident Reporting We continuously monitor our enterprise information systems and user activity to detect anomalous activity and identify potential security related incidents. Our cybersecurity monitoring and incident reporting program is informed by NIST guidelines and is internally and externally monitored. When a potential cybersecurity incident is detected, we gather the necessary information to classify the incident by type and severity and activate containment plans and response teams depending on the nature of the incident. Cybersecurity incidents that may impact enterprise business operations, compromise critical systems or result in unauthorized access to critical data will be escalated to the CISO and an internal incident response team comprised of senior IT, business operations and compliance personnel to coordinate any internal and external responses. The CISO and the internal incident team will also elevate any material cybersecurity incidents or unauthorized occurrences that jeopardize the confidentiality, integrity or availability of enterprise information to senior management and the board of directors.


text: Enterprise Risk Management Framework and Governance The Cybersecurity Program is integrated with our enterprise risk management framework and is primarily managed by the CIO, the CISO, and other information security personnel and consultants, and is overseen by risk management, internal audit, senior management and the board of directors to ensure the confidentiality, integrity and availability of the Company's enterprise information systems, data and business operations. The Cybersecurity Program utilizes specialized third-party cybersecurity service providers to periodically perform penetration testing across certain internet-facing and business critical applications as well as external and internal network penetration tests.


text: Our Enterprise Risk Management unit separately provides independent oversight and monitoring of the Cybersecurity Program through periodic quality control testing and regulatory compliance verification of the Cybersecurity Program's controls. Our Internal Audit unit is an independent corporate function reporting to the board of directors' Audit Committee that also reviews the effectiveness of the Cybersecurity Program and whether it is effectively integrated into our overall enterprise risk management framework. Additionally, our Enterprise Risk Management and Internal Audit units may from time to time separately engage consulting services to perform independent cybersecurity controls audits and provide expert guidance.


text: Board of Directors Oversight The board of directors oversees our cybersecurity risks by periodically evaluating cybersecurity reports from senior management, including the CIO and CISO, as well as reports from the board committees and third-party consultants. The Risk Committee oversees our enterprise risk management framework including risks associated with data security, cybersecurity, IT infrastructure, and data privacy. The Audit Committee oversees the internal and external auditors' review of our cybersecurity risks.


text: Management Oversight Senior management's Technology Committee, includes the CIO, the CISO and other senior executives who oversee the Company's enterprise IT infrastructure and ensures that our enterprise information systems are protected from internal and external cybersecurity threats by monitoring cybersecurity controls, risk assessments and information system reports. The Technology Committee, the CIO and the CISO periodically provide cybersecurity reports about our Cybersecurity Program to senior management's Executive Committee and the board of directors and its Risk Committee.


text: Processes for Assessing, Identifying, and Managing Cybersecurity Risks Our industry has become increasingly dependent on digital technologies to conduct certain processing activities. For example, we depend on digital technologies to perform many of our services and to process and record financial and operating data. We recognize the importance of assessing and managing material risks associated with cybersecurity threats. We seek to assess, identify and manage cybersecurity risks for our IT environment, leveraging the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), through the processes described below: Risk Assessment:

companyName: Select Water Solutions, Inc.

ticker: WTTR


text: We recognize that cybersecurity threats are constantly evolving, and we have implemented risk management procedures designed to protect our systems and data. We conduct vulnerability assessments, and periodic audits to identify and address potential cybersecurity vulnerabilities. We conduct periodic assessments to identify material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies, and education programs in response to those findings. As part of our efforts to safeguard our systems and data, we have sought to implement industry-standard security controls, including firewalls, encryption, and multi-factor authentication.


text: A monitoring and detection system has been implemented to help promptly identify cybersecurity incidents and recommend mitigating actions. Despite our best efforts, no security measure is entirely foolproof. In the event of a cybersecurity incident, we utilize a range of standard incident response practices that identify, analyze, contain, and recover the event with the goal of minimizing the impact and restoring normal operations. In the event of a cybersecurity incident, we have standard incident response practices that contain, analyze, and recover with the goal of minimizing the impact and restoring normal operations after each event. Employees receive periodic cybersecurity trainings including phishing campaigns and general awareness campaigns.


text: Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. A multi-factor authentication process has been implemented for employees accessing company information.


text: We engage third-party vendors, assessors, consultants, auditors, and other third party service providers in connection with the above processes. We recognize that third-party service providers introduce cybersecurity risks. We aim to assess the risks from cybersecurity threats that impact select suppliers and third-party service providers with whom we share personal identifying and confidential information. The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management processes.


text: Impact of Risks from Cybersecurity Threats As of the date of this Report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. While we have implemented cybersecurity measures, it is important to note that the threat landscape is constantly evolving, and new risks may emerge. A successful attack on our information or operational technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information or operational technology systems.


text: Board of Directors' Oversight and Management's Role Our Board of Directors and our Audit Committee oversee risks from cybersecurity threats and our cybersecurity practices. Accordingly, our Board of Directors and our Audit Committee receive regular updates on potential cybersecurity risks and mitigation strategies from the Chief Technology Officer.


text: Management is responsible for assessing and managing risks from cybersecurity threats and implementing the Company's cybersecurity strategies. The Company has a Chief Technology Officer ("CTO") that focuses on current and emerging cybersecurity matters and is responsible for establishing and maintaining the Company's cybersecurity-related policies and procedures. Our CTO has an Engineering degree from Rice University, a Master of Business Administration from Harvard Business School, more than 20 years' work experience, and a background in leading digital / software development organizations. Supporting our CTO is the Company's Vice President of Corporate Platform and Infrastructure and our team of cybersecurity experts. Our Vice President has an undergraduate degree from The University of Houston and has served in various Information Technology and Information Security roles for over 20 years across Oil & Gas, Consulting, and Power Generation sectors. This team is collectively responsible for upward reporting on an as-needed basis of emerging cybersecurity incidents to senior management and, if appropriate, the Audit Committee of the Board of Directors. To facilitate effective oversight, our Technology Team holds regular discussions with our management team and the Board of Directors around cybersecurity risks, incident trends, and the effectiveness of our cybersecurity measures.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: WATTS WATER TECHNOLOGIES INC

ticker: WTS


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements. We use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes the following: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls;


text: risk review of certain third-party service providers, including software vendors, third-party cloud services, and third-party hosting services, with ongoing risk monitoring for critical vendors through an external cybersecurity intelligence service;


text: cybersecurity awareness training of our employees, incident response personnel, and senior management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have not experienced any material cybersecurity incidents. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For a full discussion of cybersecurity risks, please see our Risk Factors in Item 1A.


text: Management Oversight of Cybersecurity Our Chief Information Officer ("CIO") and the Vice President ("VP") of Information Security have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO's and VP of Information Security's collectively have over 25 years of experience in leading information technology and security functions across strategy, architecture, engineering, and operations.


text: The CIO and VP of Information Security supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include but are not limited to risk assessments, including with the support of external advisors, briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Our Cybersecurity Council, comprised of cross-functional senior leaders from operations, finance, internal audit, product management, and information technology teams, also reviews and assesses security risks and issues from a business and technology perspective across all organizations within Watts on a quarterly basis, with the guidance and input of the CIO and VP of Information Security. Our executive management team is primarily responsible for assessing and managing our material or reasonably likely to be material risks from cybersecurity threats with the advice and input of the CIO and VP of Information Security, including based on the above and from external advisors as necessary.


text: Board Oversight of Cybersecurity Our Board considers cybersecurity risks as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks.


text: The Audit Committee oversees management's implementation of our cybersecurity risk management program and receives updates on the cybersecurity risk management program from the CIO and the VP of Information Security at least twice yearly. In addition, management updates the Audit Committee regarding any material or significant cybersecurity incidents, as well as incidents with lesser impact potential as necessary.


text: The Audit Committee reports to the full Board annually regarding cybersecurity. The full Board also receives annual briefings from the CIO and the VP of Information Security on cybersecurity, or from external experts on cybersecurity as part of the Board's continuing education on topics that impact public companies.


text: The global data protection landscape is rapidly evolving, and we may be impacted by or subject to new, amended, or existing laws and regulations in the future, including as our operations continue to expand or if we begin to operate in foreign jurisdictions. The risk of a security breach or disruption or data loss, particularly through social engineering attacks, cyber-attacks, or cyber intrusion, including by computer hackers, foreign governments, and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased.

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: We collect and maintain data and information necessary to conduct our business, and we are increasingly dependent on information technology systems and infrastructure to operate our business, including systems infrastructure operated and maintained by third-party service providers. In the ordinary course of business, we collect, store, and transmit confidential information, including intellectual property, proprietary business information and personal information. It is critical that we do so in a secure manner to maintain the privacy, security, confidentiality, and integrity of such confidential information.


text: We have established physical, electronic, and organizational measures to safeguard and secure our systems and facilities to prevent an information compromise. We rely on commercially available systems, software, tools and monitoring to provide security for our information technology systems and the processing, transmission, and storage of digital information. We have also outsourced elements of our information technology infrastructure, and as a result, a number of third-party vendors may or could have access to our confidential information.


text: The cost to mitigate, investigate and respond to potential security incidents, breaches, disruptions, network security problems, bugs, viruses, worms, malicious software programs and security vulnerabilities could be significant, and while we have implemented security measures to protect our data and information technology systems, our efforts to address these potential risks may not be successful, and could result in unexpected interruptions, delays, cessation of service and other harm to our business and competitive position.


text: If such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our product development programs. For example, the loss of clinical trial data from completed or ongoing or planned clinical trials could delay our regulatory approval efforts and significantly increase our costs as a result of efforts to recover or reproduce the lost data. Moreover, if a real or perceived security breach affects our systems (or those of our third-party service providers), or result in the loss of or accidental, unlawful, or unauthorized access to, use of, release of or other processing of personally identifiable information or clinical trial data, our reputation could be materially damaged.


text: In addition, a breach may require notification to governmental agencies, the media, or individuals pursuant to applicable data privacy and security laws. We would also be exposed to a risk of loss, negative publicity, harm to our reputation, governmental investigation and/or enforcement actions, claims or litigation and potential liability, which could materially adversely affect our business, results of operations and financial condition.


text: Cyber Risk Governance The Audit Committee is a sub-committee of our Board of Directors and is delegated to the role of cyber risk oversight for the Company.


text: Our management team, including the CIO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The CIO reports the progress of cyber risk reduction initiatives to the Audit Committee on a periodic basis. The CIO has extensive information technology experience in the corporate environment.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: In February 2024, we chartered the Information Systems, Data and Cybersecurity Governance Committee (the "Cybersecurity Committee"), which is comprised of the Company's business unit leaders and is responsible for the management of our cyber risk exposure and monitoring the effectiveness of the cybersecurity program. The Cybersecurity Committee will report the progress of cyber risk reduction initiatives to our senior leadership and the Audit Committee on a periodic basis.


text: Cyber Risk Management Strategy We have a cyber risk management policy and asset-based cyber risk management methodology for the continuous identification, assessment, and management of our cyber risk exposure. Our cyber risk managers have been trained in our cyber risk management policy and methodology. The methodology is as follows: Maintaining an up-to-date and accurate inventory of all assets (e.g., data, systems, hardware, software, and vendors).


text: Categorization of all assets based on the criticality of the data processed and the assets criticality to the continuity of business operations.


text: A profile is maintained of the most likely threats, their intent, and the impact the threat may have on the confidentiality, integrity, and availability of Company assets. Evaluation of relevant risk-based scenarios or vulnerability of an asset and how a threat may exploit the asset. Implemented security controls or "mitigating factors" are considered for each scenario.


text: Considering the asset, threat, risk-based scenario or vulnerability, and the mitigating factors, a likelihood and impact determination is made to calculate the final risk level. Risk reduction plans are determined and used to prioritize security program initiatives. Risk mitigations are tracked and monitored in a risk register.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: Cyber Risk Exposure Our top cyber risks have been grouped into genericized categories to avoid disclosure of sensitive information but include sufficient detail for a reasonable investor to understand our cyber risks and maintain confidence we act in good faith to reduce our cyber risk exposure. In the fourth quarter of 2023, we performed a risk analysis of all critical assets, determining the following are our current top cyber risks, none of which are material: Compromise to the confidentiality of intellectual property. Compromise to the confidentiality and integrity of financial records. Compromise to the confidentiality of employee records. Compromise to the confidentiality, integrity, and availability of core business systems. Compromise to the confidentiality, integrity, and availability of critical third-party vendors supporting the continuity of business operations.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We depend on our information technology systems, and any failure of these systems could harm our business. Any real or perceived security breach, loss of data, and other disruptions or incidents could compromise the privacy, security, integrity or confidentiality of sensitive information related to our business or prevent us from accessing critical information and expose us to liability and reputational harm, which could adversely affect our business, results of operations and financial condition."


text: Third Party Risk Management We leverage multiple third parties to support our business operations. Throughout the lifecycle of the vendor relationship, security is integrated as part of each process. We maintain a vendor inventory, categorized based in risk tiers, and perform due diligence of the vendor's security practices commensurate with the risk tier. Vendor contracts and security practices are monitored to ensure an accurate assessment of risk is maintained.


text: Third Party Support of the Cyber Risk Management Program We employ third parties to support our cyber risk management program in the following ways: Use of internal and external auditors to maintain compliance with regulatory requirements.


text: Use of cybersecurity consultants and managed security services providers to supplement the security program practices and evaluate the program's effectiveness, specifically: Governance, risk, and compliance services. Penetration testing and vulnerability management. Continuous security event monitoring. Data loss prevention.


text: Incident Management We make continuous efforts to maintain the ability to respond quickly and effectively to security incidents to minimize their impact. We implement an incident response policy, incident response plan, and deploy comprehensive continuous security monitoring solutions to monitor events occurring across its assets. Additionally, a material risk determination model enables our cyber incident response team and senior leadership to determine materiality.


text: Risk Management and Strategy We maintain a cybersecurity program designed to assess, identify, and mitigate risks from cybersecurity threats. This program is informed by the five elements of the National Institute of Standards and Technology framework: identify, protect, detect, respond, and recover. We utilize various methods to achieve these objectives including but not limited to company-wide policies and operating procedures, periodic testing, systems monitoring, patch management, and mandatory ongoing employee trainings. Additionally, we partner with third-party experts to conduct periodic penetration tests and to evaluate our information technology infrastructure for vulnerabilities. We also evaluate cybersecurity risks associated with third-party vendors that provide the hosted applications we use in our financial close process through review of their System and Organization Controls ("SOC") 1 reports at least annually. We continue to invest in our information technology infrastructure and cybersecurity program to strengthen our ability to protect the confidentiality, integrity, and availability of our data and the security of our information systems. In addition to our cybersecurity program, we assess cybersecurity risks as part of our overall risk management processes, primarily through our annual Enterprise Risk Assessment. Our Enterprise Risk Assessment surveys various employees and leaders throughout our organization with the goal of evaluating our risk landscape, enhancing our overall understanding of risks to our business, and ultimately managing and/or mitigating identified risks. We assess various risks, including cybersecurity related risks, based on the likelihood of an incident occurring, impact to our organization if an incident occurred, and the level of internal control we currently have over the risk. The results are analyzed to identify vulnerabilities and then risk management/mitigation plans are designed, implemented, and evaluated for effectiveness.

companyName: COLLEGIUM PHARMACEUTICAL, INC

ticker: COLL


text: If a cybersecurity incident were to occur, we would implement our incident response plan in an effort to contain and mitigate the threat. As part of our incident response plan, our Cybersecurity Incident Response Team (a cross-functional taskforce comprised of senior representatives), would convene to assess the potential impact to our business, including financial reporting requirements and legal implications.


text: We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we and/or our vendors have, from time to time, experienced threats to, or security incidents, related to our data and systems or that had the potential to otherwise impact our business. For more information about the cybersecurity risks we face, refer to "Item 1A. Risk Factors."


text: One of the key functions of our Board is informed oversight of our risk management process. Our Board administers this oversight function directly through our Board as a whole, as well as through various standing committees of our Board that address risks inherent in their respective areas of oversight. Our Audit Committee, a subcommittee of our Board, is responsible for the oversight of risks from cybersecurity threats. The Audit Committee receives updates at least quarterly from our Head of Information Technology regarding developments in our information technology infrastructure and cybersecurity program. This includes updates, as appropriate, on key information technology initiatives, new and existing cybersecurity risks, how management is managing those risks, and, if any, material cybersecurity incidents and the impact to our business and performance.


text: At the management level, our Head of Information Technology is responsible for assessing and managing risks from cybersecurity threats through oversight of our information technology infrastructure and cybersecurity program. The individual occupying this role has over 20 years of experience in information technology and cybersecurity and has served in senior cybersecurity leadership positions for over 10 years. Thus, we believe our Head of Information Technology is well-qualified to serve in this role. Our Head of Information Technology conducts bi-weekly meetings with our information technology department to remain apprised of cybersecurity matters. If a cybersecurity incident were to occur, our Head of Information Technology may inform our Executive Vice President and Head of Technological Operations and/or Audit Committee, depending on the severity of the incident in accordance with the established severity and response matrix as defined in our incident response plan.


text: Risk Management and Strategy The Company has adopted processes designed to identify, assess and manage material risks from cybersecurity threats, and the Company's full Board and management is actively involved in overseeing the risk management process. These processes include response to, and an assessment of, internal and external threats to the security, confidentiality, integrity and availability of Company data and systems, along with other material risks to Company operations. We recognize the critical importance of maintaining the trust and confidence of our customers, business partners and employees.

companyName: COMFORT SYSTEMS USA INC

ticker: FIX


text: As part of our risk management process, the Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Company's cybersecurity program is focused on the following key areas: • Departmental Collaboration: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats and are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, potential acquisition targets and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: The Company provides regular training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. • Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by members of management and relevant management committees.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, because of the inherent nature of cybersecurity threats and the evolution of such threats over time, the Company's processes, oversight and risk management cannot provide absolute assurance that a cybersecurity threat will not have a material effect on the Company in the future.


text: The Company has established a risk committee (the "Risk Committee") consisting of executive officers, including the Company's Chief Information Security Officer ("CISO"), that is directly responsible for the Company's risk management process. The Company's cybersecurity policies, standards, and practices are integrated into the Company's risk management process. The Board oversees information technology, data security, and cybersecurity risk management through regular reports and presentations from the CISO and other management members. Vance Tang, Chair of the Nominating, Governance, and Sustainability Committee, serves as the Board Liaison for Cybersecurity. Mr. Tang has completed extensive training on cybersecurity risk mitigation, including certification related to completion of the NACD Cyber Risk Oversight Program. The Risk Committee meets at least annually to define and improve the risk-mapping process and considers any updates at least quarterly. In addition, the Risk Committee presents comprehensive reports directly to the Board at least annually through the enterprise risk management matrix, which, as described below, is reviewed by the Audit Committee.


text: The Company's Audit Committee is briefed on cybersecurity risks at least once each calendar year and as necessary with respect to any material cybersecurity incidents. The Audit Committee also reviews the enterprise risk management matrix presented by the Risk Committee on an annual basis. The process of reviewing the matrix includes an overall assessment of the Company's compliance with cybersecurity policies, including topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We execute a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity risk management program includes a cybersecurity incident response plan and dedicated cybersecurity incident response team ("CSIRT"). We do not have actual or contractual access to the systems or information maintained by our tenants, who maintain their own cybersecurity risk management programs to protect their operations from various risks from cybersecurity threats.

companyName: SIMON PROPERTY GROUP L P


text: We use the National Institute of Standards and Technology Cybersecurity Framework and CIS Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements.


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, public relations and financial risk areas.


text: Our cybersecurity risk management program includes the following key elements: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology (IT) environment;


text: a team comprised of IT security, infrastructure, and compliance personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents, supported by legal, human resources, corporate security and other internal resources;


text: the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes, which enable us to leverage specialized knowledge and insights, with the goal of ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices; cybersecurity awareness training of employees with access to our IT systems;


text: a cybersecurity incident response plan and Security Operations Center ("SOC") to respond to cybersecurity incidents; and a third-party risk management process for service providers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See further discussion in Item 1A. Risk Factors.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees and is regularly updated on management's design, implementation and enforcement of our cybersecurity risk management program. The Audit Committee is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks.


text: Our Chief Financial Officer periodically provides reports to the Audit Committee, and, together with our Chief Technology Officer and Director of Cybersecurity, leads the Company's overall cybersecurity function. The Audit Committee receives regular reports on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents. Audit Committee members also receive periodic presentations on cybersecurity, IT and data protection topics.


text: Our Chief Financial Officer oversees our CSIRT, whose members have years of experience working in cybersecurity and certifications including CISSP (Certified Information Systems Security Professional), CCSP (Certified Cloud Security Professional), CGRC (Certification in Governance of Enterprise IT), GIAC (Global Information Assurance Certification) and GCED (GIAC Certified Enterprise Defender). Our CSIRT supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment.


text: The CSIRT is responsible for assessing and managing our material risks from cybersecurity threats. They have primary responsibility for leading our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our external cybersecurity service providers.


text: The Board recognizes the critical importance of maintaining the trust and confidence of our tenants and business partners. The Board plays an active role in overseeing management of our risks, and cybersecurity represents an important component of the Company's overall approach to risk management and oversight. The Company's cybersecurity processes and practices are integrated into our risk management and oversight program. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We utilize a third-party managed IT service provider (the "MSP") to provide comprehensive cybersecurity services for the Company, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery, and cybersecurity education and awareness. The Company has adopted a written information security incident response plan, which, as discussed below, is overseen by the Audit Committee of the Board (the "Audit Committee").

companyName: CTO Realty Growth, Inc.

ticker: CTO


text: Governance: As discussed in more detail under "Item 1C. Cybersecurity—Governance," the Board's oversight of cybersecurity risk management will be supported by the Audit Committee, which regularly interacts with the Company's management team.


text: Collaborative Approach: CTO has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, the Audit Committee, and the Board in a timely manner.


text: Technical Safeguards: Together with the MSP, we deploy technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention systems, endpoint detection and response systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: Together with the MSP, we have established a written information security incident response plan that addresses the response to a cybersecurity incident, which plan will be tested and evaluated on a regular basis.


text: Third-Party Risk Management: Together with the MSP, we maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: As directed by the Company, the MSP provides regular training for Company personnel regarding cybersecurity threats as a means to equip such personnel with effective tools to address cybersecurity threats, and to communicate evolving information security policies, standards, processes and practices.


text: Together with the MSP, we will engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts will include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The MSP regularly assesses our cybersecurity measures, including information security maturity, and regularly reviews our information security control environment and operating effectiveness. The results of such assessments, audits and reviews will be reported to the Audit Committee and the Board, and we will adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Board, in coordination with the Audit Committee, will oversee the Company's cybersecurity risk management process. The Audit Committee has adopted a charter that provides that the Audit Committee must review and discuss with the Company's management team the Company's privacy and cybersecurity risk exposures, including: the potential impact of those exposures on the Company's business, financial results, operations and reputation; the steps management has taken to monitor and mitigate such exposures;


text: the Company's information governance policies and programs; and major legislative and regulatory developments that could materially impact the Company's privacy and cybersecurity risk exposure.


text: The charter of the Audit Committee also provides that the Audit Committee may receive additional training in cybersecurity and data privacy matters to enable its oversight of such risks and that the Audit Committee will regularly report to the Board the substance of such reviews and discussions and, as necessary, recommend to the Board such actions as the Audit Committee deems appropriate.


text: Our President and Chief Executive Officer, Senior Vice President, Chief Financial Officer and Treasurer, and Senior Vice President, General Counsel and Corporate Secretary work collaboratively with the MSP to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with a written information security incident response plan that we have adopted. These members of our management team, together with the MSP, will monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and will report such threats and incidents to the Audit Committee when appropriate.


text: Our President and Chief Executive Officer, Senior Vice President, Chief Financial Officer and Treasurer, and Senior Vice President, General Counsel and Corporate Secretary each hold degrees in their respective fields, and have an average of over 20 years of experience managing risks at the Company and similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Walker & Dunlop, Inc.

ticker: WD


text: Our cybersecurity risk management program is guided by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include, but are no limited to the following: risk metrics and self-assessments designed to help identify cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: a security team principally responsible for managing: (1) our cybersecurity risk assessment processes, (2) our cybersecurity controls and processes, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our cybersecurity controls and processes; periodic required cybersecurity awareness training of our employees;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for key service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Risk Factors – "If we fail to comply with laws, regulations and market standards regarding the privacy, use, and security of customer information, or if we are the target of a successful cyberattack, we may be subject to legal and regulatory actions and our reputation would be harmed."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit and Risk Committee oversight of cybersecurity risks and the steps that management has taken to monitor and control exposure to such risks.


text: The Audit and Risk Committee receives quarterly reports from our Chief Information Security Officer ("CISO") and our Chief Information Officer on our cybersecurity risks and meets in executive session with our CISO following such reports. In addition, management updates the Audit and Risk Committee, as necessary, regarding significant cybersecurity incidents.


text: The Audit and Risk Committee reports to the full Board regarding its activities, including those related to cybersecurity. In 2023, the full Board also received a presentation from a third-party expert on cybersecurity risks.


text: Our management team, including our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. In 2023, we established an information technology risk committee comprised of senior managers in our information technology, loan origination, loan servicing, accounting, and legal groups that meet monthly to review information security risks and the development and implementation of policies and procedures and other controls to mitigate cybersecurity and other information security risks. Our CISO provides a report to our management risk committee on the activities of the information technology risk committee, which committee, in turn, reports regularly to the full Board on its activities.


text: The CISO manages a team of employees, which has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The CISO brings over 30 years of technology, cybersecurity, and risk management experience from the finance and healthcare industries. His work experience includes the design, implementation, and oversight of control and governance frameworks in complex, hybrid-cloud, and data intensive environments operating in highly regulated entities in the financial services and healthcare insurance industries.


text: Our information security management team is informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our information technology environment.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These material risks are managed across Riot, our subsidiaries, and third-party contractors, and monitoring such risks and threats is integrated into our overall risk management program. Our risk management program is comprised of, among other things, policies that are designed to identify, assess, manage, and mitigate cybersecurity risk, and is based on applicable laws and regulations, informed by industry standards and best practices.

companyName: Riot Platforms, Inc.

ticker: RIOT


text: We conduct risk assessments to evaluate the effectiveness of our systems and processes in addressing threats and to identify opportunities for enhancements. Additionally, we conduct privacy and cybersecurity reviews, as well as annual employee training, and monitor emerging laws and regulations related to information security and data protection. We utilize third party tools and techniques to test and enhance our security controls, perform annual cybersecurity framework assessments, conduct ongoing penetration testing of our systems, and benchmark against industry practices. Our internal audit function provides independent assessment on the overall operations of our cybersecurity program and the supporting frameworks.


text: In support of our risk management program, we have adopted an Information Security Policy (the "Info-Sec Policy") and an Incident Response Plan (the "Response Plan") that establish administrative, physical, and technical controls and procedures to protect the integrity, confidentiality, and accessibility of sensitive data that may exist throughout the Company as well as processes to assess, identify, manage, and report cybersecurity risks and incidents. Our Info-Sec Policy applies to all persons working for the Company, as well as any third parties working with Riot in any capacity. Violation of our Info-Sec Policy may result in revocation of access privileges, and disciplinary action up to and including termination of employment or service relations for third parties.


text: Our cybersecurity team analyzes all third-party vendors for compliance with our internal Info-Sec Policy in order to help us assess potential risks associated with their security controls. We also generally require third parties to, among other things, maintain security controls to protect our confidential information or data, and to notify us promptly, but in any case, no later than twenty-four (24) hours after the occurrence of any data breach or cybersecurity incident that may impact our data. After coordinating a response to any third-party cybersecurity incident, the incident response team reviews service providers' compliance with the privacy and data security requirements of our Info-Sec Policy, obtains written assurance of corrective actions, as appropriate, and considers whether additional measures need to be taken to protect the Company.


text: Our cybersecurity team engages and utilizes third-party services as it monitors and actively responds to cybersecurity threats. We utilize an Endpoint Detection and Response (EDR) platform, an anti-virus application, through which incoming electronic communications are filtered, and an email security platform which seeks out identifiers in communications that disguise, impersonate, or otherwise misrepresent the source of the communication. Any such communications are then subject to quarantine or removal depending on the severity of issue. Additionally, we use a Security Information and Event Management (SIEM) system, which allows us to store logs off the system of record to prevent log tampering and provides the cybersecurity team functionality to build alerts on specific use cases that are important and unique to our business. If our applications fail or our software does not successfully block a malicious electronic communication, employees are required to notify an immediate supervisor or the cybersecurity team promptly, but in no circumstances later than twenty-four (24) hours after such occurrence.


text: Our board of directors has ultimate oversight of our strategic and business risk management and, as such, has oversight responsibilities for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing and updating processes to ensure such potential risks are monitored, putting in place appropriate mitigation measures, and providing regular reports on cybersecurity trends and risks, and should they arise, any material incidents with our board of directors.


text: Our Chief Financial Officer is responsible for our cybersecurity program, and our Manager of Cybersecurity is our incident response team leader. In this position, our Manager of Cybersecurity oversees our cybersecurity team, and guides our incident response team, which is comprised of members from across our organization, including cybersecurity, IT support, mining operations, software engineering, compliance and legal, as well as contractors and other partners, as they support our cybersecurity functions. Our Manager of Cybersecurity has nearly two decades of experience in cybersecurity management and policy, achieved through job training, higher education, and military experience, and possesses a background in security and alignment of information technology solutions.


text: Our Response Plan, developed by management and our cybersecurity team, and IT support team, serves as a Company-wide guide to facilitate coordinated, prompt, and systematic responses to any cybersecurity incidents and utilizes four interconnecting phases: (1) Preparation; (2) Detection and Analysis; (3) Containment, Eradication, and Recovery; and (4) Post-Incident Activity.


text: Upon detection of a cybersecurity incident and initial intake and validation by our cybersecurity team, our incident response team triages and evaluates the cybersecurity incident, and, depending on the severity, escalates the incident to management and a cross-functional working group. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and reported to executive management. Determination of what resources are needed to address the incident, prioritizing of response activities, forming of action plans, and notification of external parties as needed are then undertaken by executive management and the cross-functional working group, led by our Chief Financial Officer and Manager of Cybersecurity. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our executive management makes the final materiality and disclosure determinations, among other compliance decisions.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we may not be successful in eliminating all risks from cybersecurity threats and can provide no assurances that undetected cybersecurity incidents have not occurred. See Part I, Item 1A. "Risk Factors" of this Annual Report for more information regarding the cybersecurity risks we face.


text: Risk management and strategy: Matson's information security, Internal Audit and risk management teams help to identify and assess cyber and information security threats and vulnerabilities, and establish the appropriate business systems, preventive controls and risk mitigation strategies. The main objectives of Matson's approach to cyber and information security are to protect confidential information while maintaining data integrity and availability; support legal and regulatory compliance; and prevent disruptions to business operations. The Company regularly enhances its systems, controls and strategies in an effort to guard against security breaches and unauthorized access to Matson systems or data and develops policies to guide the appropriate handling and protection of sensitive information by Matson. This includes managing third party supply chain risks with its key vendors and business partners. It also maintains incident response and remediation plans which provide that cybersecurity incidents be communicated to the Company's senior leaders who are responsible for assessing the risks associated with a cybersecurity incident and initiating the Company's incident response plan. The Company's incident response and remediation plans are further supported by ongoing security monitoring services as well as a dedicated management team focused on business continuity to help support operations and mitigate disruptions should a breach, unauthorized access or other disruption event occur. In addition, the Company has established a zero trust network access roadmap that includes key security controls designed to help protect Matson employees and contractors with access to Matson systems against phishing and brute force password attacks.

companyName: Matson, Inc.

ticker: MATX


text: The risk management process occurs throughout the organization, but is facilitated through a risk management steering committee comprised of senior management whose members meet regularly to identify and address specific significant risks. At least twice a year, management assesses and categorizes key risks based on their potential impact to the Company and the likelihood of the risk occurring as part of Matson's enterprise risk management ("ERM") program. The ERM program includes regular cyber and information security risk assessments conducted by independent, third-party cybersecurity professionals, including assessors, consultants, auditors and penetration testers. Results from these risk assessments, along with remediation recommendations, are provided to executive leadership and the Company's Board of Directors (the "Board"). The Board also consults with outside advisors and experts, when appropriate, to anticipate future threats and trends, and their impact on the Company's risk environment. In addition, the Company utilizes annual third-party audits to test its cybersecurity systems and incident response and remediation plans to help spot vulnerabilities and improve its ability to respond to unexpected events. For more information on Matson's ERM program, see "—Governance " below.


text: As part of its approach, the Company conducts varied due diligence on its key technology vendors to review their cybersecurity risk profiles and scores. This includes pre-contract award due diligence reviews of such vendors and cyber and information security requirements within its vendor contracts. Additionally, the Company leverages independent, third-party services to monitor the cyber and information security posture of key suppliers and vendors. The Company's Chief Executive Officer and Chief Financial Officer are briefed on a quarterly basis on the results of these reviews.


text: Training, education and awareness-building are mechanisms Matson uses to help embed a strong culture of cyber and information security within its workplace. The Company's long-term aim is to have a workforce with high-functioning knowledge of cybersecurity. In furtherance of this aim, the Company conducts training annually for employees that addresses cyber and information security, and holds additional training typically at least three times per year for specific topics such as data and email security. Furthermore, Matson requires enhanced training for employees with access to particularly sensitive information. The Company also has specific escalation processes and resources in place for employees to raise a concern should they notice anything suspicious.


text: The design of Matson's vessel and office information technology systems is informed in part by the following third-party frameworks or standards: NIST Cybersecurity Framework NIST 800-171 DFARS 252.204-7012


text: IMO MSC-FAL.1/Circ.3/Rev.2 BIMCO's Guidelines for Cyber Security Onboard Ships IAPH's Cybersecurity Guidelines for Ports and Port Facilities In addition, Matson participates in the following organizations in its effort to better understand best practices and advance its systems and policies over time:


text: National Security Administration ("NSA")'s Cybersecurity Collaboration Center U.S. Cybersecurity and Infrastructure Security Agency's Critical Partnership Federal Bureau of Investigation ("FBI") InfraGard U.S. Coast Guard Area Maritime Security Committees and Cybersecurity Subcommittees Cyber-Hawaii Maritime Transportation System Information Sharing and Analysis Center ("MTS-ISAC")


text: In the last fiscal year, Matson has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected the Company, but the Company faces certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect the Company. For more information on the risks and impacts of these matters to Matson, see Part I, Item 1A. Risk Factors – "The Company's information technology systems have in the past and may in the future be exposed to cybersecurity risks and other disruptions that could impair the Company's ability to operate and adversely affect its business. "


text: Governance: Matson's Board of Directors has oversight of the Company's risk management process, which includes overseeing our process for identifying, assessing and mitigating significant financial, operational, legal, strategic, and other risks that may affect the Company. These risks include, among other things, risks related to cybersecurity and information security. Risk oversight plays a role in major Board decisions, and the evaluation of key risks is a core part of the decision-making process – from guidance on strategy to review of major capital expenditures.


text: The Board administers its oversight role in part through its committees. The Audit Committee is responsible for overseeing and reviewing cyber and information security risks, policies and programs and reviews the Company's risk assessment, risk management and compliance policies twice a year. Senior leaders, including Matson's Chief Information Officer, review the Company's cybersecurity program with the Board of Directors at least annually, and the Chief Information Officer meets with the Audit Committee at least twice per year. Matson's information security efforts are led by its Chief Information Officer, who has over 25 years of experience in enterprise software development, infrastructure and management, including over 17 years with Matson and 7 years at Charles Schwab as Senior Manager of Middleware Security, and Senior Director, Information Security, who is a Certified Information Systems Security Professional, Certified Information Systems Auditor, and is AWS Certified. The Chief Information Officer and Senior Director provide regular briefings to the Chief Executive Officer, the Chief Financial Officer, the Board of Directors, and the Audit Committee. In addition, the Corporate Compliance Committee, comprised of business unit leaders, helps oversee cybersecurity initiatives and reports twice per year to the Audit Committee. These processes are part of the risk management processes described in the risk management and strategy section above.


text: The Audit Committee also oversees Matson's ERM program, which includes cyber and information security risks. The ERM process, which follows the Committee of Sponsoring Organization Framework, is designed to promote visibility to the Board and management of critical risks and risk mitigation strategies across various time frames, including the short-, medium- and long-term. Risk mitigation efforts are integrated into strategic plans and budgets. The Chief Financial Officer and Head of Internal Audit review the Company's risk management activities with the Audit Committee and the Board on a regular basis. Management also regularly updates the full Board at and between Board meetings on the ERM program and other risk-related matters. In addition, executive sessions of the Board, which are led by the Lead Independent Director, have focused on certain risk oversight topics from time to time. The Lead Independent Director consults with the Chairman of the Board regarding risk-focused topics at Board meetings.


text: Cybersecurity Risk Management and Strategy We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity, and availability of our information systems.

companyName: DIGITAL REALTY TRUST, INC.

ticker: DLR


text: We utilize the United States National Institute of Standards and Technology, Cybersecurity Framework (NIST CSF) in considering the design and in assessing our processes. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: We have integrated aspects of our cybersecurity risk management processes into our overall risk management program through, for example, common methodologies, reporting channels and governance processes that apply across the overall risk management program to other risk areas.


text: Index to Financial Statements Our cybersecurity risk management processes include, but are not limited to: independent maturity assessments designed to help identify significant cybersecurity risks to our IT environment and systems;


text: a cyber resilience team jointly responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a risk management process for service providers, suppliers, and vendors that aligns to our compliance requirements.


text: We have not identified risks from known cybersecurity threats as a result of any prior cybersecurity incidents that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face complex risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—We and our third-party providers may be vulnerable to cyberattacks and security breaches that could materially disrupt or compromise our operations, data and results." There can be no assurance that our cybersecurity risk management processes, including our policies, controls or procedures, will be fully implemented as currently anticipated, complied with or effective in protecting our systems and information or in allowing us to recover from a cybersecurity incident.


text: Cybersecurity Governance Our Board considers cybersecurity and other information technology risks as part of its risk management and compliance oversight function. The Board oversees management's implementation of our cybersecurity risk management processes and receives reports from management on our cybersecurity risks at least twice a year. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Board receives briefings from management on our cyber risk management processes, and it receives presentations on cybersecurity topics from our Chief Technology Officer, Chief Information Security Officer and Chief Information Officer, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team has overall responsibility for assessing and managing material risks from cybersecurity threats, and for executing on our cybersecurity risk management processes. Our Chief Technology Officer, Chief Information Officer and Chief Information Security Officer, among others, have decades of combined experience in areas such as information technology, compliance, and cybersecurity program design and management. Additionally, certain leaders and personnel within the cybersecurity operations team hold industry certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager. Our management team works closely with our cybersecurity operations team to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT, Operational Technology (OT), and products and services environments.


text: Risk Management and Strategy In the course of our operations, the Company receives and maintains sensitive information from our guests, employees, partners and business operations. To address cybersecurity threats to this information, the Company uses a risk-based approach to create and implement a detailed set of information security policies and procedures based on frameworks established by the National Institute of Standards and Technology. The Company's Head of Information Security leads the Company's cybersecurity efforts under the direct oversight of our Chief Technology Officer. Together, these individuals have over 50 years of experience involving information technology, including security, auditing, compliance, systems and programming. Additionally, the Company engages in the use of external cybersecurity experts for training, contingency planning, consultation and process documentation.

companyName: Texas Roadhouse, Inc.

ticker: TXRH


text: The Company has implemented detective and preventative controls designed to ensure the appropriate level of protection for the confidentiality, integrity and availability of data stored on or transferred through our information technology resources. The Company has a risk assessment process to identify risks associated with our use of third-party service providers and has implemented specific processes and controls designed to mitigate those identified risks. Both internal and third-party audits are performed routinely to verify that these controls are effective. Additionally, the Company has implemented trainings designed to provide best practices for protecting our network and systems, and also routinely leads exercises for employees to reinforce the risk and proper handling of targeted emails. The Company's Head of Information Security is responsible for developing and implementing these controls and training exercises with support from our information technology department.


text: The Company's enterprise risk management program has established an internal risk committee to evaluate information governance risks. This committee comprises members of management of the Company's information technology, human resources, marketing, accounting, risk, procurement, training, finance and legal functions, and is focused on performing risk assessments to identify areas of concern and implement appropriate changes to enhance its cybersecurity and privacy policies and procedures. The internal risk committee is informed of the Company's risk prevention and mitigation efforts on a regular basis. The committee is also briefed on detection and remediation of cybersecurity incidents in a timely manner following the detection of any potential events.


text: The Company has a crisis response team comprising senior members of various corporate functions to oversee the response to various crises including potential crises arising from cybersecurity incidents that may impact the Company and/or its vendor partners. This team conducts regular tabletop exercises to simulate responses to cybersecurity incidents. To the extent there is a cybersecurity incident impacting the Company and/or a vendor partner, the crisis response team's process would be to ensure that our Head of Information Security and Chief Technology Officer are informed immediately and that the potential impact of the incident and remedial measures arising from the incident are communicated to the executive officers of the Company.


text: There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face and how a cybersecurity incident may affect our business strategy, results of operations or financial condition, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incident, have not materially affected our business to date. We can provide no assurances that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition.


text: The Board has authorized the audit committee to oversee the Company's risk assessment and risk management practices and strategies. This delegation includes maintaining responsibility for overseeing the Company's enterprise risk management program. As a part of this oversight role, the audit committee receives regular updates from management on cybersecurity and privacy risks impacting the Company, which includes benchmarking these risks versus our industry. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events, receive training specific to cybersecurity risks and threats and regularly discuss any updates to our cybersecurity risk management and strategy programs.


text: Risks from cybersecurity threats or incidents (cybersecurity risks) are assessed, identified and managed by the Company in a manner that is consistent with leading cybersecurity frameworks, including the National Institute of Standards and Technology Cybersecurity Framework (NIST Framework). The Company's approach to cybersecurity risk management is generally based on the five core functions contained within the NIST Framework organizing structure: identify, protect, detect, respond and recover.

companyName: RLI CORP

ticker: RLI


text: As of the date of this report, risks from cybersecurity threats or incidents have not materially affected, nor are they reasonably likely to materially affect, the Company's business strategy, results of operations or financial condition. However, in light of emerging and changing cybersecurity threats and vulnerabilities, the Company cannot guarantee that it will not be a victim of a cybersecurity attack in the future that could materially affect the Company. See Item 1A, Risk Factors for more information.


text: The RLI Corp. Board of Directors provides oversight for cybersecurity risks primarily through its audit committee. The Company's chief information officer (CIO), who also serves as the Company's chief information security officer (CISO), along with the head of the Company's IT security department, present quarterly to the audit committee on cybersecurity risks and the Company's strategies and actions to assess and manage those risks. Additionally, the board receives periodic updates on emerging cybersecurity issues and developments through director education provided by the Company and third-party experts, detailed reviews provided by the CIO/CISO and the Company's head of IT security on select cyber security topics, and "table top" simulations of a cybersecurity event.


text: Management oversight of cybersecurity risks is provided through the Company's risk committee, which is chaired by the chief executive officer and comprised of members of senior management. Among its responsibilities, the risk committee identifies the Company's material risks and reviews the strategies, processes and controls in place to facilitate the understanding, identification, prevention, measurement, reporting and mitigation of those risks. The risk committee meets quarterly and reviews the Company's current assessment of cybersecurity risks conducted by the Company's CIO/CISO and IT security department based on leading cybersecurity frameworks. The risk committee also periodically conducts a detailed review of cybersecurity risks.


text: The Company's IT security department, which operates under general oversight of the Company's CIO/CISO, is responsible for day-to-day assessment and management of cybersecurity risks, including efforts to prevent and, if necessary, mitigate the effects of a cybersecurity incident. The Company's CIO/CISO has 25 years of technology and technology leadership experience, including 13 years serving as a CISO in the insurance industry.


text: The Company maintains a Cybersecurity Incident Response Plan (CIRP) providing a framework for identifying, evaluating and escalating potential or actual cybersecurity events. The CIRP assigns responsibilities and provides a workflow between the Company's IT security department; members of an Executive Cybersecurity Committee comprised of the chief executive officer and senior management; and the board of directors regarding the detection, assessment and response to a cybersecurity event.


text: The Company's internal audit department routinely engages third-party cybersecurity consultants to conduct network security audits. The Company also engages other third-party consultants in a number of areas to support the assessment, identification and management of cybersecurity risks, including risk assessments, log monitoring, threat intelligence, system penetration testing, training and incident response, among others. The Company performs cybersecurity due diligence and monitoring of third-party vendors, which may include the review of System and Organization Control (SOC) reports or the results of a security questionnaire to identify the cybersecurity controls and protections maintained by a third party.


text: Trinseo's business and production operations rely on secure access, processing, storage, and transmission of company confidential and personal identifiable information within various technology platforms. The Company has processes in place to monitor, identify, assess and respond to material risks from cybersecurity threats. Cybersecurity is incorporated into the Company's enterprise risk management ("ERM") program that is reviewed by the Board of Directors ("the Board"). Our Audit Committee has authority to oversee cybersecurity matters as part of its review of ERM. We maintain a cyber risk management program to identify, protect, detect, respond and recover from cyber threats and incidents. Our cybersecurity risk management and internal controls programs are aligned to ISO 27001 Standards and the National Institute of Standards and Technology (NIST) framework.

companyName: Trinseo PLC

ticker: TSEOF


text: As part of our program management activities, we actively engage internal and prominent external experts, as well as industry participants, as part of our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity policies and procedures. The Company has adopted a cybersecurity incident response plan (the "Incident Response Plan") which defines our approach for prompt detection, analysis and determination of materiality, prioritization and mitigation of cybersecurity incidents. The Incident Response Plan also includes criteria for escalation to cross-functional committees, including executive management, and notification to our Board, as appropriate. Management also periodically performs tabletop exercises to simulate actual cyber threats to strengthen our policies, standards and related governance processes in response to cyber events. In addition, our internal audit function performs periodic audits or other evaluations to assess our cybersecurity program and compliance with policies and procedures.