text: SLB maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and addresses both the corporate information technology environment and customer-facing products and services.

companyName: SLB LIMITED/NV

ticker: SLB


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization Standardization ("ISO") 27001 Information Security Management System Requirements. SLB has an annual assessment, performed by a third party, of the Company's cyber risk management program against the NIST CSF.

secItem: Item 1C


text: SLB has a Cybersecurity Operations Center operating in three locations to provide 24/7 monitoring of its global cybersecurity environment and to coordinate the investigation and remediation of alerts. A program for staging incident response drills is in place to prepare support teams in the event of a significant incident.


text: Cyber partners are a key part of SLB's cybersecurity infrastructure. SLB partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. SLB engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in SLB's environment as well as, if necessary, assist in responding to cyber attacks.


text: SLB's Cybersecurity Director reports to SLB's Chief Information Officer and is the head of the Company's cybersecurity team. The Cyber Security Director is responsible for assessing and managing SLB's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and relies on threat intelligence as well as other information obtained from governmental, public, and private sources, including external consultants engaged by SLB.


text: The Audit Committee of the Board of Directors oversees SLB's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity team briefs the Audit Committee on the effectiveness of SLB's cyber risk management program, typically on a quarterly basis. In addition, cybersecurity risks are reviewed by the SLB Board of Directors, at least annually, as part of the Company's enterprise risk management process.


text: SLB faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. SLB has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on SLB's business, financial condition, results of operations, or cash flows. See "Risk Factors – Business and Operational Risks – Our operations are subject to cyber incidents that could have a material adverse effect on our reputation, business, financial condition, results of operations, and cash flows."


text: The Company's senior management is actively involved in oversight of the Company's risks and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). In general, the Company seeks to address cybersecurity risks through an approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: NOBILITY HOMES INC

ticker: NOBH


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including two factors: authentication, firewalls, anti-malware functionality, email threat protection and access controls, which are evaluated and improved through vulnerability assessments.


text: Third-Party Risk Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact on our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: The Company provides training, support and alerts for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: Senior management, in coordination with the Company's third-party service providers specializing in information technology, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. Through ongoing communications with third party service providers, Senior Management monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents.


text: Cybersecurity incidents have not materially affected the Company's results of operations or financial condition, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.


text: At Hexcel, we are committed to the security of our products and services, the protection of employee, customer and Company data, and the safeguarding of our manufacturing capability. Our cybersecurity program is led by our Chief Information Officer ("CIO"), who has over 20 years of experience in information technology leadership and 10 years of experience directly overseeing our information security program and holds a Master of Business Administration in technology management. As a part of our cybersecurity program, we have engaged, and in the future may continue to engage, third-party consultants and advisors, including a third-party consultant with extensive experience designing, leading, and maintaining the implementation and assurance frameworks for organizational information, to provide virtual chief information security officer services, including establishing a security architecture, policies, practices, and response capabilities.

companyName: HEXCEL CORP /DE/

ticker: HXL


text: Our CIO regularly updates senior management on our cybersecurity risk governance and management and the status of ongoing efforts to strengthen cybersecurity effectiveness. Our board of directors views cybersecurity as a strategic priority and therefore maintains oversight of management's actions in implementing our overall cybersecurity program, with our CIO regularly reporting directly to our board of directors. The audit committee of the board of directors also periodically reviews the cybersecurity program as part of its oversight of the Company's internal audit function and insurance program.


text: As part of our cybersecurity program, we maintain various protections designed to safeguard against cyberattacks, including firewalls, anti-malware, intrusion prevention and detection systems, access controls and other encryption configurations and cybertechnologies, and continuously monitor and audit our information technology and data assets to detect any anomalies and to respond quickly to threats that may arise. We periodically conduct intrusion and penetration testing through third parties to evaluate our cybersecurity response capability. We also regularly conduct employee awareness training on email management (phishing), safe internet browsing, malware, and other cybersecurity risks and routinely communicate with employees about the potential for cybersecurity threats, including the latest adversary trends and social engineering techniques, and how to avoid them through our established communications channels.


text: We have adopted and implemented an approach to identify and mitigate cybersecurity risks within our overall enterprise risk management program that is based on a recognized framework established by the National Institute of Standards and Technology. The board of directors is responsible for overseeing management's enterprise risk management program, and receives regular reports on cybersecurity risk identification, monitoring and mitigation from our Chief Financial Officer as part of its review of that program, in addition to the regular reports received from the CIO as part of the board's overall cybersecurity program review.


text: As part of our cybersecurity risk management, we have established controls and procedures to guide the Company through an active threat or incident to the recovery of normal business, following industry-standard data protection standards. The controls and procedures provide for the identification, notification, escalation, communication, and remediation of cybersecurity incidents to management, including where appropriate the board of directors, so that decisions regarding the public disclosure and reporting of such incidents can be made in a timely manner. We maintain an Executive Cyber Response Team composed of senior leaders across various functions, including our CIO, General Counsel, Chief Accounting Officer and VP Communications. The Executive Cyber Response Team is trained and experienced in managing cybersecurity incidents and meets regularly to practice and refine our processes for incident response, management and escalation through tabletop exercises simulating cyberattacks administered by a legal advisor with extensive experience in cyber investigations, cyber threats and cyber-enabled frauds. The results of such exercises are then reported to management and our board of directors. The third-party legal advisor also assesses and advises on our overall cybersecurity program, reports to our board of directors on a periodic basis and is engaged to provide support in the event an attack or other intrusion were to be successful.


text: Furthermore, as part of our cybersecurity management, we are committed to strong third-party risk management. We actively and routinely address cybersecurity capabilities with our top-tier suppliers and have implemented cybersecurity requirements in our standard supplier contract terms to address cybersecurity risk. Additionally, we validate cybersecurity practices of key suppliers as may be necessary to comply with applicable regulations or flow-down requirements from our customers.


text: The Company maintains disaster recovery plans for key applications and site-specific incident response plans, as well as a cybersecurity and related insurance policies as a measure of added protection.


text: As of the date of this report, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Cybersecurity Risk Management Program We recognize the importance of maintaining the integrity of our information systems and safeguarding the confidential business and personal information we receive and store about our residents, prospective residents, employees and suppliers. As such, we have implemented a cybersecurity risk management program designed to assess, identify and manage material risks from cybersecurity threats. Our cybersecurity risk management program is designed to employ what we believe are industry best practices, including monitoring and analysis of the threat environment, vulnerability assessments and third-party cybersecurity risks; detecting and responding to cyber attacks, cybersecurity incidents and data breaches; cybersecurity crisis preparedness, incident response plans, and business continuity and disaster recovery capabilities; and investments in cybersecurity infrastructure and program needs. Key processes in our program include: • regular cybersecurity training and testing for employees with company email and access to connected devices; • continuous security event monitoring, management and incident response; • regular testing of incident response procedures; • regular internal reporting; • regular consulting with external advisors and specialists regarding opportunities and enhancements to strengthen our cyber practices and policies and enhance our cybersecurity maturity; • independent third-party testing of our information technology controls and defenses, including penetration tests; • independent third-party audits of our cybersecurity controls; and • annual independent third-party reviews of program maturity based on the National Institute of Standards and Technology (NIST) cybersecurity framework.

companyName: Mid-America Apartments, L.P.


text: In addition, as part of our cybersecurity risk management program, we have processes designed to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers, and our cybersecurity risk management program takes into account third-party systems through which we could be impacted by the compromise of the security of a third-party service provider. In this regard, we conduct due diligence on third-party service providers with respect to cybersecurity risks prior to entering into relationships with them, and we regularly assess security risks associated with our use of third-party service providers, including onboarding contract employees through the same process we onboard our own employees. In addition, we contractually require third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations, and we continuously track mission critical vendors using a third-party monitoring service.


text: We maintain a cyber insurance policy, we periodically meet with our insurance broker and insurer to discuss emerging trends in cybersecurity and we utilize self-assessment tools and other services provided by our insurance broker and insurer, including annual tabletop exercises conducted by cybersecurity experts.


text: Our cybersecurity risk management program is integrated into our overall risk management system. To help identify, assess and manage material risks from cybersecurity threats, we include cyber risk in our enterprise risk management, or ERM, evaluation and strategy process. Our ERM process takes a top-down, enterprise view of risks; it is an ongoing process consisting of risk identification, risk rating, analysis and action plans, and reporting and monitoring. Our Vice President Cyber Security has a dotted line reporting relationship to our Chief Administrative Officer and General Counsel to help ensure that risks from cybersecurity threats are considered as part of the broader ERM process. At a management level, our Chief Administrative Officer and General Counsel leads our ERM process.


text: We do not believe that any risks from cybersecurity threats of which we are aware, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For information regarding the risks we face associated with cybersecurity incidents, see "Risk Factors – We rely on information technology systems in our operations, and any breach or security failure of those systems could materially adversely affect our business, financial condition, results of operations and reputation" included in this Annual Report on Form 10-K.


text: The Audit Committee of our Board of Directors is responsible for oversight of risks from cybersecurity threats. At a management level, our cybersecurity risk management program is led by our Chief Technology and Innovation Officer who has over 20 years of experience providing business and information technology, or IT, process consulting and regulatory compliance services, including founding a cyber-security consulting and regulatory compliance firm and serving as Sarbanes-Oxley subject matter specialist for an international public accounting firm, and whose certifications include Certified Public Accountant and Certified Information Systems Auditor. Partnering with our Chief Technology and Innovation Officer is our Vice President Cyber Security, who has over 30 years of IT technical and IT business process experience and has been an IT and cyber security leader for multiple financial services companies. Collectively, our cybersecurity team consists of 5 professionals with an average cybersecurity tenure of 15 years and various relevant certifications. Members of our cybersecurity team deliver regular updates to our Chief Technology and Innovation Officer and Chief Administrative Officer and General Counsel.


text: The Audit Committee of our Board of Directors receives regular reports, including an annual cybersecurity maturity assessment and quarterly scorecards, from our Chief Technology and Innovation Officer. Those reports cover topics related to information security, privacy, and cyber risks and our risk management processes, including the status of any recent cybersecurity events, the emerging threat landscape, and the status of capital investments in our information security infrastructure. The Audit Committee provides regular reports to the full Board of Directors. In addition, the Audit Committee and the full Board of Directors have authority to engage external consultants, including legal, accounting or other advisors, such as cybersecurity firms, in carrying out its oversight of our cybersecurity risk management program. Likewise, the Audit Committee or the Board of Directors may request members of management or others to attend meetings at which cybersecurity risk management is addressed.


text: As part of our cybersecurity risk management program, we have adopted an incident response plan which provides for controls and procedures upon the occurrence of a cybersecurity event. In connection with that plan, we have established a cross-functional critical response team, comprised of members of management under the direction of our Chief Technology and Innovation Officer and Chief Administrative Officer and General Counsel, which is responsible for monitoring our cybersecurity incident response. In addition, this critical response team performs an impact assessment in the event of the occurrence of a cybersecurity event meeting certain criteria, which is elevated for the team's review and, if any such cybersecurity event is determined by the critical response team to have the potential to have a material impact on the Company, the cybersecurity event is elevated for further review and assessment by a senior management team, which includes all of the members of our standing crises control committee, and, under certain circumstances, the Audit Committee and/or the full Board of Directors.


text: Cybersecurity risks are part of the broader ERM process overseen by our Board of Directors. ERM risk assessment results are presented annually to the Board of Directors, and status updates are delivered quarterly to the Audit Committee.


text: We believe Manhattan has appropriate processes for assessing, identifying, and managing material risks from cybersecurity threats. Those processes are embodied in our enterprise-wide Cyber Risk Management Program (the "Cyber Program"), which includes our cybersecurity governance structure and our cybersecurity strategy and processes.

companyName: MANHATTAN ASSOCIATES INC

ticker: MANH


text: Governance Structure Board Oversight. Our Board of Directors has delegated oversight of our Cyber Program to the Board Audit Committee. Despite that delegation, the full Board also remains informed, through quarterly presentations to the full Board by our Chief Financial Officer or their designee (or more frequently as necessary), followed by the opportunity for Q&A and discussion, on the status of the Cyber Program. The presentations cover, among other things, our cyber incident experience, ongoing cyber threats, material risks, deployment of cybersecurity controls and risk mitigants, engagement of third parties (e.g., consultants and auditors) and third-party tools, our cyber insurance coverages, and our employee-training programs. If further Board engagement on cybersecurity matters is required, management, through the CEO, CFO or CLO, communicate directly with the Audit Committee chair, who engages the Audit Committee as they deem appropriate.


text: Management's Assessment and Management of Cybersecurity Threats. Members of Manhattan's executive management team, along with others from Company senior management, and others with varying areas of expertise, are engaged as part of our Cyber Program: • Chief Financial Officer and Chief Information Officer – Direct management of our Cyber Program falls within our Information Technology department, which reports up through our CIO, who reports to our CFO. Both our CIO and CFO have familiarity and oversight experience, appropriate for their positions, regarding general cybersecurity matters and threats affecting business-to-business software and cloud services vendors such as Manhattan. The CFO is a member of our Disclosure Committee, which is responsible for determining whether a cybersecurity incident is "material" for purposes of publicly reporting cybersecurity incidents, and is a member of our "Core Response Team" under the Company's Crisis Response Program. Our CFO also chairs our management Cybersecurity Committee. • Chief Legal Officer – Our CLO has experience providing legal advice regarding cybersecurity-related programs as well as engaging with outside advisors and insurance brokers and underwriters on cybersecurity coverage, claims, and loss mitigation. Our CLO also is member of the Disclosure Committee and the Core Response Team. • Senior Director, Global Security – Our Senior Director, Global Security, has managed our Cyber Program for eight years. He manages its day-to-day operations, oversees our security analysts and engineers, and leads our Cybersecurity Committee meetings. He is trained in cybersecurity strategy, planning, and execution and holds industry recognized security certifications, including Certified Information Systems Security Professional (CISSP) from the International Information System Security Certification Consortium (ISC2) and Certified Information Security Manager (CISM) from the Information Systems Audit and Control Association (ISACA). • Cybersecurity Committee – Members include, in addition to the CFO and SD, Global Security, business representatives of Manhattan's material business lines and administrative departments, cyber-risk operational heads from our material business lines, and our VP, Contracts and Administration (or their designee). The Cybersecurity Committee's purpose is to review cybersecurity risks, discuss emerging threats, prioritize cybersecurity efforts, and make recommendations to leadership. • Crisis Response Team – Pursuant to our Crisis Response Program, our Crisis Response Team, which comprises the CLO, CFO, Chief People Officer and Chief Marketing Officer, and an expanded team from our material business lines and administrative departments, as well as outside advisors/experts (cyber forensics, external legal counsel, law enforcement, public relations), is charged with managing the Company through a cybersecurity incident (or other event or series of events) that rise to the level of a Company "crisis." The Program includes protocols by which the CLO, on behalf of the Team, will report to or engage the CEO and the Chairman of the Board if and when an incident becomes a crisis or potential crisis.


text: • Other Roles – The Cyber Program includes engagement of other Company management employees and outside service providers to oversee or perform specific roles in connection with cybersecurity risk assessment and management, and incident management. That includes risk and security heads from our material business lines who implement and administer policies specific to those business lines and independent auditors to certify compliance with the Company's internal control over financial reporting, the American Institute of Certified Public Accountants' Systems and Organization Controls (SOC 2) security framework, and the Federal Government's Federal Risk and Authorization and Management Program (FedRAMP) criteria for federal use of cloud services. We also conduct reviews for compliance with data protection regulation such as Europe's General Data Protection Regulation (GDPR) and regulation of various U.S. states such as the California Consumer Privacy Act (CCPA). Risk Management and Strategy Overview of Processes for Assessing, Identifying, and Managing Material Cyber Risks.


text: The principal objectives of our Cyber Program are to minimize the risks associated with cybersecurity threats to our business operations, financial performance and financial condition, and protect the confidential information, intellectual property, and other assets of Manhattan, and those of our customers, vendors, partners, employees, and consumers that can be at risk due to cybersecurity threats to Manhattan.


text: Manhattan has incorporated industry recognized cybersecurity frameworks and standards into its Cyber Program, including frameworks from the National Institute of Standards and Technology (NIST) and security control auditing protocols from the Center for Internet Security (CIS) and the International Organizations for Standardization (ISO). Recognizing that the nature of cybersecurity threats and the particular threat vectors we face continually change, we continue to invest in updating and enhancing our Cyber Program. Annually, as part of Manhattan's budgeting process, our Senior Director, Global Security, submits to our CIO their recommendations for Cyber Program enhancements, including the associated capital requests, for inclusion in the CIO's proposed IT budget. Those recommendations are then evaluated at the executive level, taking into account the projected return on investment and the anticipated enhancement of our cybersecurity risk profile.


text: Under our Cyber Program, our Senior Director, Global Security, and the staff, along with our management-led Cybersecurity Committee, with input where appropriate from our third-party advisors, work to identify our cybersecurity threats, assess the risks, and deploy appropriate technologies and processes to mitigate the risks. When cybersecurity incidents occur, these resources work to manage through the incident utilizing advanced security tools and playbooks, and in accordance with processes set out in various Company policies and practice documents, which include internal communications protocols to keep the executive team and, where appropriate, the Audit Committee and Board, informed. Pertinent policy and practice documents include, among others, Manhattan's Incident Response Policy, our Incident Escalation Matrix, our Materiality Determination Process for Cybersecurity Incidents (governing the Company's materiality determination for reporting purposes) and our Crisis Response Plan.


text: As an important cybersecurity risk mitigant, Manhattan provides mandatory training to its new hires and quarterly training of its employees, including phishing simulation tests and follow-up tests as needed, along with monthly cybersecurity newsletters and other cyber risk-related communications.


text: Integration into Overall Risk Management System or Processes. Our risk management systems and processes comprise numerous components, including published policies and procedures, risk detection systems, tools, and protocols (automated and human), internal and external independent auditing, management committee review, defined lines of communications, employee training, engagement of outside advisors and experts, assessment and utilization of both commercial and self-insurance opportunities, customer contract standardization where possible, legal review of vendor engagements and new products for regulatory compliance, regular operations reviews with the CEO, and Board (and Board Committee) oversight. Manhattan utilizes the foregoing systems and processes to best ensure effective management of our risks and associated cybersecurity threats. The CFO or their designee reports to the full Board at least quarterly on the status of our Cyber Program.


text: Engagement of Third Parties. As part of its Cyber Program, Manhattan engages outside independent auditors, consultants, and professional advisors. We also engage industry-leading cybersecurity service and systems providers to assist with protection from and detection of cybersecurity threats and incidents and our responses to them.


text: Risks from Third Party Service Providers and Others. Manhattan's cybersecurity team, under the oversight of the Senior Director, Global Security, performs risk assessments on third party service providers and other third parties (such as partner companies), as well as third party software and hardware utilized in its operations, that may have the potential to create cybersecurity threats to our data and operations.


text: Risks from Cybersecurity Threats—Likely Material Impact. See Item 1A, "Risk Factors—Risks Related to Our Intellectual Property and Cybersecurity." We do not believe any risks from previous cybersecurity threats have materially affected or are reasonably likely to materially affect Manhattan.


text: The Company's corporate information technology, communication networks, and accounting and financial reporting platforms are necessary for the operation of its business. The Company uses these systems, along with others, to manage its tenant and vendor relationships, for internal and external communications and for accounting to operate recordkeeping and reporting functions. The Company has implemented and maintains various information security processes designed to identify, assess and manage material risks from cybersecurity threats to its critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including confidential information.

companyName: CAPITAL PROPERTIES INC /RI/

ticker: CPTP


text: Management works primarily with third parties (principally professional services and consulting firms) to assist them in identifying, assessing, and managing cybersecurity risks. To operate its business, the Company utilizes certain third-party service providers to perform a variety of functions and seeks to engage reliable, reputable service providers that maintain cybersecurity programs. The Company is not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect it, including its business strategy, results of operations, or financial condition.


text: The Board of Directors oversees the Company's strategy and risk management, including material risks related to cybersecurity threats. The Board has delegated to the Audit Committee oversight of cybersecurity matters.


text: Management is responsible for day-to-day assessment and management of cybersecurity risks. The Treasurer has primary oversight of material risks from cybersecurity threats and works primarily with third parties to identify, assess, and manage cybersecurity risks. The Treasurer meets with the Audit Committee periodically to review the Company's information technology systems and discuss key cybersecurity risks.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying and managing material cybersecurity risks, and have integrated these processes into our overall risk-management processes. We have also established policies and processes for managing and responding to material cybersecurity incidents.

companyName: IMPINJ INC

ticker: PI


text: We routinely assess material cybersecurity risks, including potential unauthorized occurrences on, or conducted through, our information systems that may compromise the confidentiality, integrity or availability of those systems or information maintained in them. We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments when there is a material change in our business practices that we believe could affect information systems that are vulnerable to cybersecurity threats. These risk assessments include identifying reasonably foreseeable internal and external risks and the potential harm if the risks were to materialize. We conduct these risk assessments directly and also engage third parties to support these processes.


text: Following these risk assessments, we evaluate how to appropriately implement and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate members of our management, including our VP, IT and Facilities, or VP IT, who reports to our Chief Financial Officer, and our Senior Information Security Manager, or Senior ISM, to manage the risk assessment and mitigation process. We also engage third parties to help us design and implement our cybersecurity systems, as well as monitor and test our safeguards. As part of our overall risk management, we collaborate cross-functionally to monitor and test our safeguards and to train our employees on cybersecurity risks and safeguards. We include employees at all levels and departments, and all contractors, in our cybersecurity training programs.


text: We require appropriate third-party service providers to certify that they can implement and maintain appropriate security measures, consistent with all applicable laws, in connection with their work for us, and to promptly report any suspected breach of their security measures that may affect our company. We oversee and identify risks from cybersecurity threats associated with our use of service providers through an onboarding vendor risk management program, including an inherent risk assessment.


text: We have not, to date, experienced a cybersecurity incident which was determined to be material, although, like any technology provider, we have experienced incidents in the past. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors under the heading entitled "Risks Relating to Privacy and Cybersecurity."


text: Cybersecurity Governance One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing our strategic risk exposure, and our executive officers are responsible for day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk-oversight function as a whole, as well as through the audit committee.


text: Our Vice President Information Technology, or VP IT, and Senior Information Security Manager, or Senior ISM, are responsible for assessing and managing material risks from cybersecurity threats, as well as managing and responding to material cyber incidents if any occur. Our VP IT has a bachelor's degree in management information systems and more than 25 years experience managing enterprise information-technology systems and resources. Our Senior ISM has an undergraduate degree in management information systems, an MBA and multiple professional cybersecurity certifications, has specialized in cybersecurity for more than a decade and is focused primarily on cybersecurity.


text: Our VP IT and Senior ISM provide periodic briefings to the audit committee and to the board of directors about our cybersecurity risks and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In addition, our policies for managing and responding to cybersecurity incidents include procedures for appropriate escalations to our Chief Compliance Officer and to our audit committee chair.


text: Cybersecurity Risk Management and Strategy As an externally managed REIT, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Manager, an indirect subsidiary of Apollo. Apollo determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for us and other entities managed by Apollo, and we rely on Apollo for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Apollo Commercial Real Estate Finance, Inc.

ticker: ARI


text: The Apollo Global Management, Inc. ("AGM") board of directors is involved in overseeing Apollo ' s risk management program, including with respect to cybersecurity, which is a critical component of Apollo ' s overall approach to enterprise risk management ("ERM"). Apollo ' s cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are based, in part, on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.


text: As one of the critical elements of Apollo ' s overall ERM approach, Apollo ' s cybersecurity program is focused on the following key areas: • Governance. As discussed further under the heading "Cybersecurity Governance," the AGM board of directors has an oversight role, as a whole and also at the committee level, in overseeing management of Apollo ' s risks, including its cybersecurity risks. Apollo ' s Chief Information Security Officer ("CISO") and the CISO of Athene Holding Ltd. ("AHL"), a subsidiary of AGM, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, as well as, as appropriate, with our executive officers and other representatives of the Manager and its affiliates. • Collaborative Approach. Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, in consultation with our management and our board of directors, as applicable, in a timely manner. • Technical Safeguards. Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.


text: Apollo engages in the periodic assessment and testing of its policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of its cybersecurity measures. Apollo regularly engages third parties, including auditors and consultants, to perform assessments on its cybersecurity measures, including information security maturity assessments, audits and independent reviews of its information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to Apollo ' s risk management function, and Apollo adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews.


text: C ybersecurity threat risks have not materially affected our company, including our business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to Our Business and Structure—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, a misappropriation of funds, and/or damage to our business relationships, all of which could negatively impact our financial results."


text: Cybersecurity Governance The AGM board of directors ' oversight of cybersecurity risk management is supported by the audit committee of the AGM board of directors (the "AGM audit committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. The AGM board of directors, the AGM audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo ' s information technology, cybersecurity risk profile and strategy, and risk mitigation plans from Apollo ' s risk management professionals, the AGM's Chief Security Officer ("CSO"), AGM's CISO, other members of management and relevant management committees and working groups. The Cyber Security Working Group is chaired by AGM's CISO and has representation from Apollo ' s Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. AGM's CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, AGM ' s board of directors and/or the AGM audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM board of directors or the AGM audit committee receives presentations and reports on cybersecurity risks from AGM ' s CSO or CISO, as well as from AHL ' s CISO, at least annually.


text: AGM ' s CISO, in coordination with the Apollo Technology and ERM teams, works collaboratively across Apollo to implement a program designed to protect its information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with its incident response and recovery plans. To facilitate the success of Apollo ' s cybersecurity risk management program, multidisciplinary teams throughout Apollo are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, AGM's CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the AGM audit committee or AGM board of directors, as appropriate.


text: AGM ' s CSO holds an undergraduate degree in Management Information Systems and Business Administration, which he received magna cum laude. He has over 25 years of cyber-related experience, having served in various roles in technology and cybersecurity, including as Head of IT Risk Management, Executive Director of IT & Risk Compliance, and Global IT Risk Evaluation Lead at large financial institutions and consulting firms. He was also previously AGM ' s CISO for nearly eight years. AGM ' s CISO holds a master ' s degree in Business Information Systems and has served in various roles in information technology and information security for over 25 years across a number of large financial institutions, including as Director, Cybersecurity and Risk.


text: As part of the risk management oversight (including oversight of cyber risks) of the audit committee of our board of directors, our audit committee regularly interacts with, and receives reports from, our management, the Manager, Apollo, and other service providers. The audit committee of our board of directors receives presentations and reports on cybersecurity risks from AGM ' s CSO or CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Apollo ' s peers and third parties. Additionally, Apollo and other service providers periodically report to management as it relates to our cybersecurity practices.


text: Apollo ' s cybersecurity incident response plan provides for proper escalation of identified cybersecurity threats and incidents, including, as appropriate, to our management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to our company, the Manager, and evaluation of the adequacy of our cybersecurity program (as coordinated through the Manager and Apollo), including risk mitigation, compliance and controls.


text: For purposes of the following disclosure, the terms "cybersecurity incident" and "cybersecurity threat" have the meanings given to such terms in Item 106 of Regulation S-K promulgated under the Exchange Act.

companyName: UNITIL CORP

ticker: UTL


text: Risk management and strategy The Company has a Cybersecurity Plan for assessing, identifying, and managing material risks from cybersecurity threats. The intent of the Cybersecurity Plan is to provide a proactive and systemic approach to meet the evolving requirements for cybersecurity and related compliance in the utility industry. The Cybersecurity Plan's objectives include: • adopting and using established cybersecurity standards and industry best practices; • protecting personally identifiable information; • protecting infrastructure operations, including Supervisory Control and Data Acquisition (SCADA) systems at electric substations and natural gas plants; • securing customers', employees', and the Company's data; • complying with North American Reliability Corporation Critical Infrastructure Protection Reliability Standards and standards for the protection of Bulk Electric System Cyber Systems; and • continually assessing and, as necessary, enhancing the Company's cybersecurity through a managed process integrated with the Company's risk management principles.


text: The Cybersecurity Plan includes annual assessments using (i) the Department of Energy's Cybersecurity Capability Maturity Model, (ii) the National Institute of Standards and Technology Cybersecurity Framework, and (iii) the Center for Internet Security Controls. The Company uses the results of these assessments to benchmark the Company's cybersecurity posture, to identify risks from cybersecurity threats, to prioritize any such risks that may have potential material effects on the Company, and to establish effective controls to manage, mitigate and remediate such risks.


text: The Cybersecurity Plan is part of the Company's corporate Enterprise Risk Management (ERM) program. The Company's ERM program includes an annual review of new or emerging risks (including risks from cybersecurity threats), the assessment of such risks and their potential effects on the Company, the velocity of potential cybersecurity incidents resulting from such risks, and risk mitigation strategies.


text: The Company maintains a Cybersecurity Employee Awareness Program, which provides targeted education and mandatory quarterly training to employees. The Cybersecurity Employee Awareness Program also conducts monthly phishing test exercises with employees, which includes an escalation procedure for repeated failures. Additionally, the Company performs an annual cyber knowledge assessment of all employees to address any identified knowledge gaps.


text: The Company engages or otherwise collaborates with cybersecurity consultants, cybersecurity experts, energy sector leaders, and other third parties in connection with the Cybersecurity Plan. Unitil Corporation also is a member of the cyber committees of both the American Gas Association and the Edison Electric Institute.


text: Third party entities that provide hardware, software or related support services to the Company or hold the Company's customer data represent material cybersecurity risks to the Company. To help mitigate those risks, the Company has robust procurement processes and requirements for such third-parties (which include a formal assessment of the third-party's cyber posture, cyber liability insurance, and breach reporting protocols) that help the Company to oversee and identify cybersecurity risks associated with its use of such third party entities.


text: During the fiscal year ended, and as of, December 31, 2024, there were no risks from cybersecurity threats (including as a result of previous cybersecurity incidents) that have materially affected or are reasonably likely to materially affect the Company (including its business strategy, results of operations, or financial condition).


text: The Board is responsible for oversight of the Company's ERM program, including risks from cybersecurity threats. The Board has not assigned that responsibility to any committee or subcommittee of the Board. The Company's management generally provides the Board with updates on and assessments of ongoing and emerging risks from cybersecurity threats at regularly scheduled Board meetings.


text: The Company's cybersecurity management team is responsible for assessing and managing the Company's material risks from cybersecurity threats, including implementing the Cybersecurity Plan. The team includes the Company's Chief Technology Officer and Vice President of Information Technology (the "CTO"), the Director of Information Security and Cyber Operations, Manager of Cyber Security Operations and two Cyber Operations Engineers, all of whom have an educational background relevant to, professional experience in, or other expertise in cybersecurity. This team is supported by the Company's Information Technology department. The CTO holds a Master of Business Administration and a Bachelor of Science in Electrical Engineering with over 30 years of professional experience in the utility industry with extensive management experience in engineering, operations and information technology. The CTO also assumes responsibilities as the Company's Chief Information Security Officer and Chief Cyber Security Officer. The CTO has overall management responsibility for the Company's cybersecurity. The CTO reports to the Company's Chief Executive Officer. The Director of Information Security and Cyber Operations holds a Bachelor of Science in Computer Science and a Masters Certificate in Cyber Security with a concentration in Power Systems and has over 30 years of experience in the information technology field. The Director of Information Security and Cyber Operations has primary responsibility for the cyber security program including threat and vulnerability management, vendor security posture assessment, Industrial Control System (ICS) and SCADA infrastructure cyber security protection at electric substations and natural gas plants, as well as leading the Cyber Incident Response Team. The Manager of Cyber Security Operations has a Bachelor of Science in Information Technology and over 20 years of experience in various information technology and cyber roles.


text: The Company's cybersecurity management team assesses and manages the Company's material risks from cybersecurity threats through or by: • active monitoring of cyber threat alerts, warnings, advisories, notices, vulnerability assessments, incident bulletins, security briefings, reports and white papers from industry and national organizations, including: downstream Natural Gas Information Sharing and Analysis Center; Electricity Information Sharing and Analysis Center; Cybersecurity and Infrastructure Security Agency; and Federal Bureau of Investigation; • threat and vulnerability management; • vendor security posture assessment; • Industrial Control System and Supervisory Control and Data Acquisition infrastructure cyber security protection at electric substations and natural gas plants; and • leading the Company's Cyber Incident Response Team.


text: In addition, the Company uses (i) a Security Operations Center vendor with 24x7 monitoring and response capabilities to identify any suspicious activity on the Company's networks and (ii) a security consulting firm for assessments, penetration testing and incident response. In the event of a cybersecurity threat, the CTO and these parties would collaborate to assess and manage the risk with ultimate responsibility residing with the Board.


text: Also, in the event of a cybersecurity threat or cybersecurity incident, the Company's cybersecurity management team will investigate and perform impact analysis and, as necessary, the CTO will activate the Company's Cyber Incident Response Team. The Cyber Incident Response Team is a subset of the Company's Crisis Response Team, which has responsibility for operational and business resilience, as well as tactical and strategic response. A foundational aspect of the Crisis Response Team is prompt and comprehensive communications to all concerned parties, both internal and external, including direction for management to inform the Board about risks from cybersecurity threats.


text: In the event that a cybersecurity incident occurs which results in damage to the Company's data or infrastructure, the Cyber Incident Response Team would follow the Company's Cyber Incident Response Plan. The Cyber Incident Response Plan was developed using the guidelines described in the National Institute of Standards and Technology Special Publication 800-61 Revision 2 Computer Security Incident Handling Guide, has been reviewed and assessed by outside experts, is updated annually, and is used to train for cybersecurity incidents. The Cyber Incident Response Plan details the identification, containment, eradication and recovery processes specific to the Company's environment with prioritization of critical assets. The Cyber Incident Response Plan also details emergency actions required to isolate and protect industrial control system environments, should the incident pose a risk to electric or gas operations. The Company participates in annual industry drill exercises to test the Cyber Incident Response Plan.


text: The Company's determination of the materiality of a cybersecurity incident would generally include an evaluation of the incident's effect on the Company (including (i) its business strategy, results of operations, or financial condition, (ii) the integrity, confidentiality, resiliency, and security of the Company's networks and systems, and (iii) the Company's operations).


text: With oversight from the Board of Directors, NNN's management is responsible for managing all cyber risks and overseeing NNN's security programs. Primary cybersecurity risk oversight has been delegated to the Audit Committee. The Chief Accounting and Technology Officer (the "CATO") oversees NNN's security programs and its Incident Response Policy and Plan and provides direct oversight and guidance to the technology team that manages NNN's day-to-day technology and cybersecurity operations. The CATO has been with NNN for over 25 years and has overseen NNN's information systems, including its cyber risk management program, for the last 15 years. The technology team has the appropriate educational background and certifications in the area of information security governance and technical controls, penetration testing and vulnerability assessments, incident response and digital forensics and secure systems design and architecture.

companyName: NNN REIT, INC.

ticker: NNN


text: The Audit Committee cybersecurity risk oversight role includes: (i) reviewing and approving technology security policies and internal cybersecurity controls, (ii) monitoring cybersecurity and information security exposures, and (iii) confirming management has adequate procedures in place to not only control and limit these exposures but also to timely respond to any cyber incident. NNN's cybersecurity risk profile and cybersecurity program status, including results of any third-party evaluations are reported to the Audit Committee by the CATO.


text: NNN's information systems process and store critical and sensitive NNN data. Management and the Board of Directors are committed to protecting NNN systems and data through layered perimeter, interrogation and access controls, as well as following a constant process of researching, assessing, patching and remediating. Processes to assess, identify, isolate, remediate and manage cybersecurity risks have been integrated into NNN's overall risk management system. Below are examples of actions NNN takes to protect NNN's information systems and data from cybersecurity risk: • Align systems and processes with best practices, including the National Institute of Standards and Technology Cybersecurity Framework, for securing NNN information systems and data; • Perform continuous systems monitoring and tactical measures for impending viruses, malware, tampering, exploits and other cyber threats; • Deploy systems tools to detect, prevent and neutralize cyber threats; • Engage independent third-party consultants to assist in evaluating cybersecurity risks and response profile and plans; • Identify, oversee and evaluate the risks associated with third-party service providers and consultants; • Continuously educate and provide procedural training to all associates and the Board of Directors regarding cybersecurity awareness and risks such as enterprise security, malware, data protection best practices, anti-phishing exercises and updates with respect to other implemented information security measures; • Periodically measure the effectiveness of associate training; • Cybersecurity risk management is periodically reviewed with NNN's Enterprise Risk Management Team; • Perform ongoing internal and external penetration testing and vulnerability assessments with a high priority for timely remediation; and • Establish reporting deadlines and hierarchies so that data regarding an incident or possible incident is communicated in a timely manner to NNN's management, to the Audit Committee of the Board of Directors, and if, appropriate or required by law, to the Commission.


text: Management is aware that preventive measures cannot prevent all cyber incidents. The CATO has direct oversight over the Company's security programs on a daily basis. When a cyber incident occurs, NNN's actions are guided by an incident response plan decision tree to (i) detect, contain and eradicate any threats, (ii) assess materiality, (iii) notify internal parties and the Audit Committee Chairperson, (iv) recover any compromised NNN data and information systems, (v) limit impacts of any such incident on NNN's operations, and (vi) report any such incident as require by law or as otherwise necessary. For a detailed discussion of risks from cybersecurity threats, please see "Item 1A. Risk Factors."


text: Cybersecurity Risk Management In the ordinary course of our business, we use, store and process data including data of our employees, partners, collaborators, and vendors. We also process anonymized information about participants in clinical trials involving certain of our product candidates. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems.

companyName: CRISPR Therapeutics AG

ticker: CRSP


text: Our cybersecurity risk management program includes a number of components, including information security program assessments and continuous monitoring of critical risks from cybersecurity threats using automated tools. We periodically engage third parties to conduct risk assessments on our systems, including penetration testing and other vulnerability analyses. Our finance department, with the assistance of outside technical advisors, periodically conducts an internal assessment of different systems to assess our risk management processes, including cybersecurity risk management. Additionally, we have implemented an employee education program that is designed to raise awareness of cybersecurity threats, including risks posed by phishing attempts. This training is included during the employee onboarding process and periodically thereafter. As part of our cybersecurity risk management program, we maintain processes to assess and review the cybersecurity practices of third-party vendors and suppliers. Prior to engaging third-party vendors and key suppliers, we conduct a security assessment and, as appropriate, include security requirements in contracts. We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, we have, from time to time, experienced threats to and security incidents related to our data and systems, including phishing attacks. For more information on our cybersecurity related risks, see "Risk Factors—Risks Related to Information Security and Privacy—Our Internal Information Technology Systems, Or Those Of Our Collaborators Or Other Contractors Or Consultants, May Fail Or Suffer Security Breaches, Which Could Result In A Material Disruption Of Our Product Development Programs."


text: Under the ultimate direction of our chief executive officer, or CEO, and our executive management team (including our General Counsel who serves as our Chief Compliance Officer), with oversight from our audit committee of the board of directors, or Audit Committee, our Head of Information Technology, or Head of IT, has primary responsibility for assessing, operating and managing our cybersecurity threat management program. Our Head of IT meets periodically with our Chief Compliance Officer to discuss current developments in the cybersecurity landscape and our cybersecurity risk management program, including providing updates regarding the sources and nature of critical risks we face and how the IT department assesses those risks, including the likelihood of such risks, the severity of impact, and progress on vulnerability remediation.


text: Our Chief Compliance Officer and Head of IT consult with other members of our information technology department, and with third parties with expertise in cybersecurity, to develop strategies to assess, address and align cybersecurity efforts with our business objectives and operational requirements. The Head of IT role is currently held by an individual who has over 20 years of experience with information security and business systems, including digital infrastructure and cybersecurity.


text: As part of our board of directors' enterprise risk management program, our board of directors has responsibility for oversight of cybersecurity risk management. Our board of directors has delegated to our Audit Committee oversight of our cybersecurity risk management program, including oversight of information security and cybersecurity threats and related compliance and disclosure requirements. On an annual basis, our Head of IT provide an update to our Audit Committee regarding our cybersecurity risk management program, including as relates to critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards. The Audit Committee periodically reports on cybersecurity risk management to the full board of directors.


text: Risk Management and Strategy As is the case for similar companies of our size and industry, we may be the target of cyber attacks and other cyber incidents and, therefore, cybersecurity is an important element of our overall enterprise risk management program. We have certain processes to systematically evaluate, identify, address, and manage cybersecurity risks, which are built into our overall risk management program and are designed to help safeguard our information assets and operational integrity from internal and external cyber threats, protect employee information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, response plans, and continuity exercises on our systems. We also routinely review our policies and procedures to identify risks and refine our practices. By prioritizing cyber risk comprehension and management, we aim to enhance business resiliency, protect information from unauthorized access or attacks, and secure our digital footprint.

companyName: Sage Therapeutics, Inc.


text: We engage certain external parties, including cybersecurity and privacy firms, to enhance our cybersecurity oversight and risk reduction abilities. We also perform an annual cybersecurity assessment designed to help align our cybersecurity program with industry best practices. In addition, we regularly consult with industry groups, peer organizations, and external executives to assess the cybersecurity threat landscape throughout the year.


text: Our cybersecurity policies, standards, and procedures include cyber and data breach response plans benchmarked against multiple cybersecurity risk frameworks. Our incident response plan is designed to help coordinate the response to and recovery from cybersecurity incidents and includes processes to identify, investigate, triage, assess the severity of, escalate, contain, and remediate incidents and comply with applicable legal or regulatory obligations. We also regularly perform technical reviews of our systems to help secure our digital environment and confirm software patches are appropriately up-to-date.


text: To oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we have implemented a third-party risk management program designed to help protect against information misuse and assess the information technology security measures of potential third parties and business partners. We perform a third-party risk assessment before starting a relationship with certain service providers and utilize a third-party risk intelligence program to monitor the activity of critical vendors following engagement. In addition, we maintain cyber insurance coverage as part of our overall risk mitigation strategy. This cyber insurance coverage may not be sufficient to cover against all claims.


text: We do not believe that there are currently any risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: Our Audit Committee of the Board of Directors provides direct oversight over cybersecurity risk. The Audit Committee receives annual updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents, if applicable.


text: We also have a cybersecurity steering committee responsible for assisting with our overall day-to-day cybersecurity responsibilities and implementing our cybersecurity programs. The cybersecurity steering committee is currently comprised of members of our digital and enterprise capabilities team and is chaired by our executive director of cybersecurity. Among other things, the cybersecurity steering committee: • reviews our internal controls to help protect our information assets; • assists with developing practices, procedures, and controls designed to identify, assess, and manage critical cybersecurity programs and risks; and • works to align our risk governance structure, including policies and procedures, with our business objectives.


text: The chair of the cybersecurity steering committee, our executive director of cybersecurity, has over 25 years of information technology industry experience, including 20 years focused on cybersecurity, and master's degrees in a cybersecurity discipline and in business administration, in addition to multiple certifications related to information technology and cybersecurity.


text: In addition, to help prevent and detect cybersecurity threats, we provide all employees, including part-time and temporary employees, with monthly cybersecurity and privacy training, which covers timely and relevant cybersecurity topics, including social engineering, phishing, password protection, confidential data protection, asset use, and mobile security.


text: The utility industry has been the target of several cyberattacks on operational systems and has seen an increased volume and sophistication of cybersecurity incidents from international activist organizations, other nation state actors, and individuals. In addition, the advancement of AI has given rise to additional vulnerabilities and potential entry points for cyberattacks. We expect to continue to experience attempts to compromise our information technology and control systems, network infrastructure, and other assets. To date, we have not experienced a cybersecurity incident that has had a material impact on our business or results of operations.

companyName: BLACK HILLS CORP /SD/

ticker: BKH


text: Risk Management and Strategy Our enterprise risk management program, which includes cybersecurity risks that are identified through our cybersecurity risk management program, is designed to identify, report, and manage relevant material risks and opportunities.


text: Management of the identified risks is embedded into business processes and key decision making at every level of the Company. Our enterprise risk management team works closely with our CSO and IT risk management team to evaluate and address material cybersecurity risks in alignment with our business strategy and operational needs.


text: We have a cybersecurity risk management program that is managed by a team of full-time cybersecurity professionals that utilizes a variety of tools and techniques to identify and assess material cybersecurity threats, their potential impact and opportunities for mitigation. The industry-standard security frameworks that we apply to our cyber environment include various security and risk assessments, such as internal threat assessments and internal control self-assessments. Because we are aware of the risks associated with third-party providers, we conduct third-party provider security assessments and benchmarking before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. These assessments include evaluation of risk profiles through vendor questionnaires, review of System and Organization Controls attestation reports and monitoring on an ongoing basis by our IT risk management team. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties.


text: We regularly engage with third-party assessors and auditors as part of our ongoing cybersecurity risk assessment process to leverage specialized knowledge and insights and to identify areas for continued focus, improvement, compliance, and effectiveness of mitigation. We also utilize government and industry-related security intelligence sources, and actively participate in industry peer groups and public-private partnerships to assist in the identification of potential threats. We conduct ongoing cybersecurity training and monthly email phishing drills for all employees.


text: We also have a cybersecurity incident response plan and procedures to manage cybersecurity incidents. These procedures include steps to identify, classify, communicate, contain, eradicate, and recover from a cybersecurity incident. These procedures also include notification to a cross-functional management team to assess incident materiality and an escalation process to members of our senior management team and our Board of Directors.


text: Our Board of Directors is responsible for the oversight of risks from cybersecurity threats. Our Chief Information Officer provides our Board of Directors quarterly reports that summarize material cybersecurity threats and the countermeasures taken to mitigate the associated risks. These reports address a variety of topics including updates on strategic cyber initiatives, industry trends, threat vulnerability assessments, and efforts to prevent, detect, and respond to internal and external critical threats. From time to time, our Board of Directors also engages third-party consultants to provide further education about cybersecurity risks.


text: Our cybersecurity risk management program, which is discussed above, is led by our CSO, who has 34 years of experience in various roles involving managing information security of large-scale global security operations, including developing cybersecurity strategy and implementing effective information and cybersecurity programs. Our CSO maintains industry certifications, including an ISC2 Certified Information Systems Security Professional certification.


text: Through oversight of the cybersecurity risk management program, our CSO is continually informed about the status of the program, including the effectiveness of the process and controls to monitor, prevent, detect, mitigate, and remediate cybersecurity incidents. The CSO is also made aware of the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CSO, in his capacity, regularly informs the Chief Information Officer and other members of our senior management team of all aspects related to cybersecurity risks and incidents.


text: Cybersecurity represents an important component of our overall approach to business strategy, risk management and financial oversight. Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, business partners and employees, and is actively involved in oversight of our risk management program. The board of directors performs this oversight function at the full board level, as well as through its standing committees that address risks inherent in their respective areas of oversight. The audit committee is responsible for assisting the board of directors in reviewing and assessing the quality and effectiveness of our cybersecurity policies, practices and procedures protecting our information technology systems, data, products and services across all business functions, and reporting its findings to the board of directors, which has final oversight responsibility over cybersecurity-related matters.

companyName: HUBSPOT INC

ticker: HUBS


text: Our cybersecurity policies, standards, processes and practices are informed by industry-recognized standards. In general, we seek to address cybersecurity risks through a cross-functional approach that is designed to preserve the confidentiality, security and availability of the information that we collect and store.


text: Cyber Risk Management and Strategy Under the board of directors'and audit committee's oversight, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment and treatment (through mitigation, transfer, avoidance and/or acceptance) of cybersecurity risks. This risk management program addresses, but is not limited to, risks identified by internal auditors and assessors, threat intelligence providers, internal stakeholders, vulnerability management programs and security management programs. We also engage external independent assessors from time to time to conduct cyber risk assessments and to report both findings and recommendations to management.


text: Risk assessments: Our security team, in coordination with our enterprise risk management team, conducts periodic risk assessments to identify and analyze the business and security risks, vulnerabilities, emerging technologies, laws and regulations. Our internal audit team evaluates the results of these risk assessments to determine critical areas for audit as part of our annual internal audit plan. The results of the internal audits are reported to the audit committee, and the security team manages and maintains remediation strategies for identified risks.


text: Vendor risk management: As part of our risk management program, our vendor risk management teams are responsible for conducting due diligence on vendors submitted for risk evaluation where medium- or high-risk data are in scope. We require assessments of these third-party vendors prior to establishing a business relationship, and monitor high-risk vendors on an ongoing basis, as part of our efforts to require these vendors to maintain their commitments related to data security, availability and confidentiality. Our security team's assessment of vendors' security controls and processes is calibrated to the risk level assigned to the vendor.


text: Incident response: We employ a formal process to identify, track, prioritize and remediate cybersecurity incidents that may impact the confidentiality, integrity and availability of data stored and processed on our information systems. This process addresses event detection, triage and classification, investigation and escalation, containment and mitigation, recovery and corrective actions. We maintain a written incident response plan that establishes roles, responsibilities and procedures to guide incident response operations.


text: Policies and procedures: Our security and legal teams actively participate in industry and other advisory groups and monitor regulatory requirements to keep apprised of evolving risks. Policies and procedures, including our Written Information Security Policy, are periodically updated to adapt to evolving business conditions and information technology requirements.


text: We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats and security incidents relating to our and our third party vendors' information systems. For more information, please see "Item 1A, Risk Factors."


text: Governance Related to Cybersecurity Risks Board oversight: Our board of directors has final oversight responsibility over cybersecurity-related matters. The full board of directors participates in interactive sessions with management, typically twice a year, dedicated to cybersecurity risks. These sessions, led by our Chief Information Security Officer (CISO), address a range of cybersecurity-related topics, such as recent developments related to the threat landscape, security controls, vulnerability assessments, third-party reviews, internal audits, technological trends and information security considerations arising with respect to our peers and third parties.


text: The audit committee assists the board of directors in fulfilling its oversight responsibilities with respect to the management of risks arising from cybersecurity threats, and our security team provides written reports to the audit committee for its review. The audit committee is responsible for reporting findings related to its review of these matters to the board of directors.


text: As appropriate, the board of directors also receives information regarding cybersecurity incidents as well as ongoing updates regarding mitigation of any such incidents until they have been resolved.


text: Management's role in assessing and managing cybersecurity risk: Our risk management program for cybersecurity is led by the HubSpot Security & Privacy Committee, which we refer to as the Committee. The Committee oversees our information and technology risk management, compliance, and control functions, and serves as a forum for the discussion of issues involving information security and risk management.


text: The Committee's members include senior members of management who are responsible for and collectively have experience in information security, information technology, data protection, risk management and compliance. This collaboration helps us incorporate cyber risk management across all of our significant risk management programs.


text: The Committee is chaired by the CISO, who works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. The CISO attends regular meetings with representatives from the legal, ERM and security teams to review newly identified cybersecurity risks and re-review previously identified risks. The Committee then determines how identified risks should be treated. The results of these risk review processes are included in periodic presentations to our executive leadership team and the audit committee.


text: Our CISO has over 25 years of experience working in security and infrastructure for SaaS and hosted services. She has a master's degree in cybersecurity and has maintained an active CISSP certification since 2012.The CISO reports to the Chief Technology Officer, who has overseen the cybersecurity team since 2020 and has led infrastructure teams at the Company for over 12 years.


text: Risk Management and Strategy In the ordinary course of our business, we collect and store sensitive data, including IP, proprietary business information of ours and that of our suppliers and licensees, and personally identifiable information of persons who use our medicines, clinical trial participants and employees. Our licensees and third-party providers also possess certain of our sensitive data. The secure maintenance of such information and the secure performance of our information technology ("IT") systems are critical to our operations and business strategy. As our dependency on, and the complexity of, our IT systems increases, the confidentiality, integrity and availability of our IT systems and the data that they store is critical to managing our business.

companyName: Alkermes plc.

ticker: ALKS


text: Our Information Security Management System ("ISMS") is a key element of our information security program, designed to identify, assess, help mitigate, and monitor IT risks across our organization, including information security risks. The ISMS is informed by the structured principles of International Standard- ISO/IEC 27001:2022 (Information security, cybersecurity, and privacy protection), which outlines guidance for the establishment, implementation, maintenance, and improvement of information security management systems. Our ISMS is comprised of processes designed to identify cybersecurity risks, safeguard information assets and preserve the confidentiality, integrity, and availability of information owned, managed and maintained by us. Our ISMS includes formal written policies and procedures, technical security controls, such as automated tools designed to detect and prevent cybersecurity incidents, and programs designed to promote internal and third-party IT risk management, audit management, incident response and security awareness, including employee awareness trainings and other initiatives. Our ISMS includes periodic security audits, vulnerability assessments and penetration testing to proactively identify potential system vulnerabilities. Our ISMS is periodically assessed by third-party assessors and the results of such assessments, including any cybersecurity risks and related mitigations identified, are reported to the audit and risk committee of our board of directors, as described below, and are used by us to improve our ISMS and our broader information security program.


text: As part of our information security program, we also have processes in place for management of cybersecurity risks associated with third-party handling of our confidential information, including in such third parties' provision of critical services on our behalf. We conduct due diligence of our third-party vendors through an assessment of their security practices and overall risk profile, including through their completion of vendor assessment questionnaires and ongoing monitoring of such third parties, utilizing tools such as security ratings services and periodic reassessment questionnaires.


text: As of the date of this Annual Report, we have not experienced any information security incidents that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition, and we have not identified any current cybersecurity threats that we believe are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: Governance and Oversight We have a multi-layered information security governance framework in place to provide oversight of our information security program and strategy, our ISMS, and related risks and opportunities. This governance framework includes procedures for escalation of identified information security risks, threats or incidents through various management levels, including up to our Information Security Governing Body, which is comprised of our Chief Executive Officer, Chief Information Officer, Chief Operating Officer, Chief Financial Officer, Chief Legal Officer and other members of management, and as appropriate, up to our board of directors.


text: Our information security team is responsible for developing, implementing and overseeing our Company-wide information security strategy and related policies and practices. This team works cross-functionally throughout our organization to assess and prepare the Company for identification and mitigation of, and if necessary respond to, information security risks. The information security team is led by our Chief Information Officer, who has over 35 years of experience in various information technology roles, including 18 years at the Company serving in roles with increasing levels of responsibility. Our Vice President of Information Security and Technology, a Certified Information Systems Security Professional, with over 20 years of global experience in various information security roles, including 14 years of experience at the Company, is responsible for day-to-day management of information security team initiatives. The other members of the information security team have extensive IT, IT security and cloud industry experience, as well as certifications pertaining to information security and privacy (such as Certified Information Security Manager, Certified Information Privacy Technologist, GIAC Security Essentials and GIAC Information Security Professional certifications).


text: Our board of directors, as a whole and through its committees, has responsibility for the oversight of risk management. The audit and risk committee of our board of directors specifically oversees critical risks and opportunities facing the Company and, in this context, reviews and provides feedback on our company-wide enterprise risk management program, which encompasses risks related to IT and cybersecurity and mitigations put in place, or to be put in place, in response to such risks and opportunities. The audit and risk committee periodically reports to the full board of directors regarding its oversight of the Company's enterprise risk management program and periodic risk assessment results. In addition, our board of directors receives periodic updates from our CIO and Vice President of Information Security on our ISMS and other information security initiatives, and on our information security governance framework.


text: Cybersecurity risk management is an integral part of our enterprise risk management program. Our cybersecurity program is designed to align with industry best practices and provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers.

companyName: American Well Corp

ticker: AMWL


text: Our Board has overall oversight responsibility for our risk management and is briefed periodically on cybersecurity risk management and any material cybersecurity incidents by our Chief Information Officer, or CIO, and General Counsel. The Board is responsible for ensuring that management has processes in place designed to (i) identify and evaluate cybersecurity risks to which the company is exposed and (ii) manage cybersecurity risks and mitigate cybersecurity incidents.


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Specifically, our Security Steering Committee ("SSC"), a cross-functional team of employees chaired by our CIO, is responsible for providing strategic guidance and oversight to Amwell's privacy, risk and security programs and policies. Management has instituted an Information Security Management System ("ISMS"). The ISMS establishes risk-based safeguards that are designed to adequately protect the Company and information acquired through business operations. Amwell maintains its ISMS in accordance with ISO 27001 standards. Amwell is audited annually by a third-party assessment firm that determines the effectiveness of the procedures and processes of its ISMS. Amwell also self-assesses the performance and effectiveness of the ISMS through monitoring, measurement, analysis, and evaluation of controls and control objectives. The SSC ensures the workforce complies with the ISMS policies, procedures and controls through many channels, including annual review of audit and risk assessment results, multifactor authentication, annual employee training and company-wide communications.


text: Our team of cybersecurity focused employees, under the direction of our CIO, is responsible for assessing our cybersecurity risk and detecting, mitigating and remediating cybersecurity incidents. Our CIO and dedicated personnel are certified and experienced information systems security professionals and information security managers. Personnel with significant security responsibilities receive specialized education and training on their roles and responsibilities prior to being granted access to systems and resources. The pre-employment process for these roles is designed to ensure that security responsibilities are specifically defined. Our CIO has over 15 years of technology leadership experience.


text: Amwell's cybersecurity team has implemented processes to: • assess the severity of a cybersecurity threat through continuous monitoring and determine the nature, scope and timing of the event to assess whether it is material; • identify the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider, utilizing our Information Security Incident Response Plan; • implement cybersecurity countermeasures and mitigation strategies; • and inform our board of directors of material cybersecurity threats and incidents.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Risks Related to Our Business and Industry" and "Risk Factors – Risks Related to Government Regulation" in this annual report on Form 10-K.


text: The Company relies on our internal Technology Solutions team and third-party vendors to deliver effective and efficient services to our customers, process claims, and report information accurately and promptly to carriers. This often requires the secure handling of confidential, sensitive, proprietary, and other types of information. We actively monitor the risks associated with potential cybersecurity breaches of any of these systems. Therefore, we have made investments, and will continue to invest, in technology security initiatives, information technology policies, resources, and teammate training to mitigate the risk of unauthorized access to sensitive or personally identifiable information.

companyName: BROWN & BROWN, INC.

ticker: BRO


text: The Audit Committee, composed entirely of independent directors, is responsible for organization-wide oversight regarding information security and reports to the full board of directors. All directors typically attend our committee meetings, which we believe creates transparency and a more collaborative and informed Board. The Audit Committee receives reports on at least a quarterly basis from the Company's chief security officer on the Company's latest information security risks and mitigation strategies.


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) program. As part of the Company's ERM program, the Board receives a report at least annually from the Company's chief executive officer and chief legal officer concerning the Company's risks, which include cybersecurity risks.


text: The Company's chief security officer is responsible for developing and implementing our information security program. Our chief security officer has more than 35 years of experience in technology, operations, information risk and security. Our chief security officer has deep experience developing comprehensive information security programs for large and complex organizations. He also brings extensive experience in both the military and the private sector and is a specialist in attack surface reduction, incident response and recovery, targeted threat hunting, forensics/malware analysis and threat group analysis.


text: Our information security team deployed a structured and measured vulnerability management program that proactively identifies vulnerabilities across our platforms and processes. The program is composed of the following: Internal persistent scans and external monthly scans;


text: • Internal persistent scans and external monthly scans; • Static and dynamic software custom code to develop scans for secure code development; • Periodic third-party executed penetration tests and risk assessments; and • A model to comply with SOC 2 Type II standards or other industry certifications at certain offices based on an office's contractual agreements with carrier partners or other third parties.


text: Additionally, external partners and products undergo a comprehensive security risk assessment process using our security scorecard tool, which evaluates data security risks and vulnerability maturity. Our teammates participate in an annual online security and compliance training program that includes testing. They are also subject to security awareness communications and random simulated phishing campaigns. Moreover, teammates are required to complete Health Insurance Portability and Accountability Act of 1996 (HIPAA) training every one or two years, depending on their location. In 2024, nearly all Brown & Brown teammates completed ethical conduct training, cybersecurity awareness training, the California Consumer Privacy Act (CCPA) Survey, and the Annual Certification for Insurance Licensees training, which serves as a reminder of the regulatory obligation to report certain changes to the jurisdictions where they are licensed.


text: We have also established a structured incident response process driven by the severity and type of issue. This process, which engages our security operations center (SOC) for incident identification, our internal security team for incident analysis and assignment, our Technology Solutions team for isolation/remediation and our third-party business partner for continuity awareness and escalations. These teams operate at the direction of our Legal Department when we identify potentially impactful information security incidents, which, among other things, directs external and internal reporting, including escalation to other functional areas within the Company and the board of directors. We have adopted an in-depth defense approach that includes intrusion detection systems and intrusion prevention systems, endpoint protection, endpoint detection and response and a log management platform. Additionally, to defray the costs of any future data breach, we have a cyber liability insurance policy.