text: Cyber Defense. Our dedicated cyber defense team provides services to identify, help prevent, detect and respond against cybersecurity threats and intrusions and collaborates with internal and external stakeholders to help protect PMI's information, mitigate operational disruptions and maintain business continuity. The cyber defense team's controls and procedures identify and enable escalation of cybersecurity incidents to the applicable governing body within PMI, as appropriate, to meet disclosure and reporting requirements for such incidents.


text: Third-Party Cyber Risk Management. Some of our information systems and networks are developed, supplied, or managed by third-party service providers. Our third-party cyber risk management process analyzes and seeks to control risks associated with outsourcing products or services, such as "supply chain" style cyberattacks, and identifies preventative and detective controls to mitigate third-party vendor and service provider cybersecurity risks that could adversely impact our business and operations.

companyName: Philip Morris International Inc.

ticker: PM

secItem: Item 1C


text: Education and Awareness. PMI regularly provides its workforce with mandatory cybersecurity awareness education and training addressing information security related tasks in line with our evolving information security policies, standards, procedures, and practice as well as supplemental role-based training and awareness programs.


text: We engage external assessors and other third parties to independently evaluate our cybersecurity risk management process, including the relevance to PMI of identified cybersecurity scenarios and the results of cybersecurity maturity assessments. The outcome of such evaluations, audits or reviews are reported to the Corporate Risk Governance Committee and to the Audit & Risk Committee, and our cybersecurity policies, standards and processes are adjusted, as necessary.


text: PMI follows a risk evaluation process for issues identified through internal audits, security assessments, third-party cybersecurity risk assessments, or self-assessment disclosures, and resulting information technology risks are recorded for risk remediation, transfer, avoidance, or acceptance as appropriate. Some of our information systems are managed by specialist third-party service providers, and we work with internal specialists to protect systems and data from unauthorized access and other cybersecurity threats.


text: The Audit and Risk Committee of our Board of Directors oversees our policies and practices with respect to risk assessment and risk management, including a review, in coordination with our management, of PMI's management of cybersecurity. Our CISO presents reports to the Audit and Risk Committee or to the full Board of Directors at least quarterly, which reports include cybersecurity risk status along with key performance indicators and key risk response strategies and plans.


text: The Corporate Risk Governance Committee receives quarterly reports on the Company's overall cybersecurity risk exposure including the individual top cybersecurity threat scenario residual risk ratings and the plan and status of the cybersecurity risk program, to facilitate calibration with other enterprise risk domains and validation of the risk response plans. The Corporate Risk Governance Committee includes our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), General Counsel ("GC"), Senior Vice President Operations, and our Chief Digital & Information Officer ("CDIO").


text: Cybersecurity incidents that have been determined to meet established SEC reporting consideration thresholds are promptly communicated to the Disclosure Committee, which is responsible for evaluating the potential materiality of such incidents and ensuring the accuracy, timeliness and completeness of related disclosures under applicable reporting obligations, and other relevant communications or presentations. The Disclosure Committee's membership includes the following executives: the Corporate Secretary; the GC; the CFO; the Controller & Principal Accounting Officer; the Chief Risk Assurance Officer; and the Vice President, Investor Relations. In addition, the CISO serves as an advisor to the Disclosure Committee.


text: The CISO has served in various roles in information technology and information security for over 25 years, including in the telecommunications and management consultancy sectors and serving as the Chief Information Security Officer of two large public companies. The CDIO holds an engineering degree and has served in various senior positions in information technology for over 20 years, including serving as Senior Vice President, IT Sales, and Global Chief Information Officer at a public company. The CEO has served in various positions in finance and general management at PMI for over 30 years, including as Chief Financial Officer and Chief Operating Officer, and holds a master's degree in economics. The CFO has over 15 years of experience in finance and management, having held several executive positions in charge of finance, legal affairs information systems and industry administration at various companies. The GC has served at PMI for 18 years in several positions within the Legal & Compliance department, including as Vice President and Associate General Counsel of various regions, and holds two master's degrees having studied law, management and finance.


text: As of the date of this Annual Report on Form 10-K, PMI is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect PMI, its business strategy, results of operations or financial condition. For additional information concerning PMI's risks related to cybersecurity, see Item 1.A. Risk Factors.


text: PMI relies heavily on the availability, reliability, and security of our information systems, networks, data, and intellectual property to, among other things, help manage our business processes and operations, collect and interpret data, and communicate internally and externally with employees, suppliers, consumers and customers, and business partners. We have a cross-functional cybersecurity risk program developed using standard industry practices, which monitors and manages cybersecurity threats to our business and information systems. We invest in administrative, technical, and physical safeguards, including continuity planning, to enhance resilience on our core processes, to maintain information security protections of our data and to safeguard the privacy of consumers, customers, employees and business partners. As of the date of this Form 10-K, cybersecurity threats have not materially affected our business, financial condition, or operating results.


text: Risk Management and Strategy Our cybersecurity risk program, managed by our Chief Information Security Officer ("CISO") and the information security team, is conducted under our enterprise risk management framework and operates on a risk-based approach in assessing risks from cybersecurity threats, as follows: • Cybersecurity Threat Scenarios. Our cybersecurity risk assessment process consists of identifying and compiling a catalogue of top cybersecurity threat scenarios relevant to PMI, which facilitates risk assessments with our IT and business stakeholders. • Cybersecurity Maturity Assessment. Our risk exposure from relevant cybersecurity threat scenarios is mitigated by evaluating existing cybersecurity capabilities and corresponding maturity to identify and address areas for improvement. • Cybersecurity Threat Assessment. To establish PMI's current and target cybersecurity risk exposure, residual risk exposure from the most relevant cybersecurity threat scenarios across IT platforms and regions is evaluated and measured based upon the cybersecurity maturity assessments. • Cybersecurity Risk Program. PMI has a cybersecurity risk program to enhance its ability to identify, prevent, mitigate, respond and recover from disruptive cybersecurity threats and incidents and to reduce cybersecurity risk exposure. Improvements in our cybersecurity defense capabilities are prioritized based upon the results of cybersecurity threat assessments and cybersecurity maturity assessments. Identified issues from these assessments form the improvement initiatives under our cybersecurity risk program. As discussed in more detail below under "Governance," the program's key improvement initiatives, their implementation status, and the overall progression in our cybersecurity capability maturity are regularly presented to the applicable governing body within PMI. In addition, our cybersecurity risk program operates in coordination with the following:


text: Education and Awareness. PMI regularly and annually provides its in scope workforce with mandatory cybersecurity awareness education and training addressing information security related tasks in line with our evolving information security policies, standards, procedures, and practice as well as supplemental role-based training and awareness programs.


text: We engage external assessors, auditors and other third parties to independently evaluate our cybersecurity risk management process and related controls, including the relevance to PMI of identified cybersecurity scenarios and the results of cybersecurity maturity assessments. The outcome of such evaluations, audits or reviews are reported to the Corporate Risk Governance Committee and to the Audit & Risk Committee, and our cybersecurity policies, standards and processes are adjusted, as necessary.


text: Cybersecurity threats and computer crime pose a risk to the security of the Company's information technology ("IT") systems and those of third-party service providers with whom it does business, as well as the confidentiality, integrity and availability of the data stored on those systems. As part of our overall risk management framework, the Company has developed and maintains an information security program consisting of policies, procedures, systems, controls and technology designed to help prevent, identify, detect and mitigate cybersecurity risks.

companyName: DallasNews Corp


text: Prevention, Identification, Detection and Mitigation Processes Effective assessment, identification and management of material risks from cybersecurity threats involve a comprehensive and proactive approach. The Company's key processes include, but are not limited to, the following:


text: Cybersecurity Policies and Procedures: The Company's IT department has developed and implemented cybersecurity policies and procedures designed to align with industry best practices, such as the National Institute of Standards and Technology Cybersecurity Framework, and applicable regulatory requirements.


text: Incident Response Plan: The Company has developed and maintains an incident response plan that outlines the steps to be taken in the event of a cybersecurity incident. Annual testing is conducted to determine the effectiveness of the incident response plan, and maintenance of backup and protective systems is performed as needed.


text: Employee Training and Awareness: Mandatory ongoing cybersecurity training is provided to all employees to educate them about potential cybersecurity risks. Management fosters a culture of cybersecurity awareness and encourages employees to be proactive in identifying and reporting security issues.


text: Access Control and Authentication: The IT department maintains strong access controls and multi-factor authentication to ensure that only authorized personnel have access to sensitive systems and data. This access is regularly reviewed and updated as needed based on job roles and responsibilities.


text: Security Control: The IT department has implemented and continually monitors security controls, including firewalls, end-point detection and response, intrusion detection/prevention systems, file integrity monitoring and data encryption, to protect against cybersecurity threats. These tools and controls are regularly updated to address vulnerabilities and ensure the security of information technology infrastructure.


text: Reviews of IT Internal Controls: Reviews are performed by the Company's internal audit team to assess the effectiveness of IT internal controls and compliance with regulatory policies and cybersecurity best practices, and any identified weaknesses are promptly addressed.


text: Vulnerability Scans: Vulnerability scans are executed quarterly across the environment to proactively identify software weaknesses and vulnerabilities that could be exploited in a cybersecurity attack. Any identified vulnerabilities are promptly addressed.


text: Encryption and Data Protection: Encryption methods are in place to protect certain sensitive data. There are also programs in place to monitor and secure the Company's retained data.


text: Asset Inventory: The Company maintains an up-to-date inventory of all assets, including hardware, software, data and network infrastructure. Assets critical to the Company's operations have been identified and prioritized accordingly.


text: Continuous Monitoring: The IT department has implemented monitoring tools and processes to detect and respond to cybersecurity threats in real time.


text: A third-party security information and event management ("SIEM") partner provides security monitoring and alerts twenty-four hours a day, seven days a week. The Company engages an independent Qualified Security Assessor organization to perform penetration testing in order to validate the Company's Payment Card Industry ("PCI") compliance and adherence to the PCI Data Security Standard. The Company also collaborates with outside legal counsel to ensure compliance with regulatory requirements.


text: The Company has implemented and continues to maintain its IT policies, standards, procedures, and controls to oversee, identify and manage cybersecurity risks associated with third-party service providers. These include, but are not limited to, an IT acceptable use policy, a contractor/consultant work policy and a vendor management policy.


text: Impact of Risks from Cybersecurity Threats The Company has experienced cybersecurity incidents in the ordinary course of business and will continue to experience risks from cybersecurity threats that could have a material adverse effect on its business strategy, results of operations, or financial condition. Although prior cybersecurity incidents have not had a material adverse effect on the Company's business strategy, results of operations, or financial condition to date, any actual or perceived breach of its security could cause operational disruption and result in delays or inability to produce, print and deliver its publications and other third-party print publications, damage the Company's reputation, cause the Company to lose existing customers, prevent the Company from attracting new customers, or subject the Company to third-party lawsuits, regulatory investigations and fines or other actions or liabilities, any of which could materially adversely affect the Company's business strategy, results of operations, or financial condition. In addition, more resources may be needed for the security of the Company's information technology systems in the future, which could increase the cost of doing business or otherwise materially adversely affect the Company's business strategy, results of operations, or financial condition.


text: Both management and the Company's board of directors are involved in the oversight of risks from cybersecurity threats. The Company's information security program is designed to ensure that management and the board of directors are adequately informed about, and provided with the tools necessary to monitor, (i) material risks from cybersecurity threats and (ii) the Company's efforts related to the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: Role of the Board of Directors The board of directors has delegated to the Audit Committee oversight responsibility for the Company's risk management, including cybersecurity. The Audit Committee receives an annual comprehensive report from the Company's President and Chief Financial Officer ("CFO") and Vice President ("VP") of IT Operations and Strategy covering the Company's cybersecurity posture, incidents, if any, and risk mitigation efforts, and receives ad hoc reporting of any material cybersecurity incidents.


text: Role of Management Management plays a crucial role in assessing and managing material risks from cybersecurity threats. At the management level, the Company's cybersecurity risk management and strategy is led by its VP of IT Operations and Strategy, who reports to the CFO. The qualifications of the VP of IT Operations and Strategy include 25 years of IT management, cybersecurity and information governance experience. The VP of IT Operations and Strategy is regularly informed about the latest developments in cybersecurity, including emerging threats and technologies to adapt security measures accordingly. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation and remediation of cybersecurity incidents. Management's role includes:


text: Risk Assessment: Management conducts annual cybersecurity risk assessments to identify and evaluate potential threats and vulnerabilities. Management considers the likelihood and potential impact of various cybersecurity risks, considering the Company's assets, systems and operations, in order to prioritize mitigation efforts.


text: Cybersecurity Policies and Procedures: Management reviews and approves the Company's cybersecurity policies and procedures and communicates these policies and procedures to all employees to ensure adherence to established security protocols.


text: Incident Response Plan Oversight: Management reviews, updates and approves the Company's incident response plan. Management ensures that the plan is tested annually to determine the Company's ability to respond effectively. Compliance with Regulations: Management implements and maintains compliance with relevant cybersecurity regulations and standards applicable to the Company.


text: Budgeting and Resource Allocation: Management reviews budgets for cybersecurity initiatives and ensures that adequate resources are allocated to address cybersecurity risks and that investments in cybersecurity align with the Company's risk tolerance and strategic objectives.


text: Reporting to the Audit Committee: Management provides an annual comprehensive report to the Audit Committee on the Company's cybersecurity posture, incident response activities and risk mitigation efforts.


text: The VP of IT Operations and Strategy is promptly informed of potential cybersecurity risks, threats and vulnerabilities by the Company's IT security team or the Company's SIEM partner. Once an incident has been identified, the VP of IT Operations and Strategy and the IT security team assess the criticality and impact of the incident on the Company's business operations. The VP of IT Operations and Strategy then formulates and oversees a response to contain, eradicate and resolve incidents in accordance with the Company's incident response plan. Management is responsible for reporting incidents to the appropriate authorities as necessary and engaging the Audit Committee on all material incidents.


text: Cybersecurity threats and computer crime pose a risk to the security of the Company's information technology ("IT") systems and those of third-party service providers with whom it does business, as well as the confidentiality, integrity and availability of the data stored on those systems. As part of our overall risk management framework, the Company has developed and maintains an information security program consisting of policies, procedures, systems, controls and technology designed to help prevent, identify, detect and mitigate cybersecurity risks.


text: Prevention, Identification, Detection and Mitigation Processes Effective assessment, identification and management of material risks from cybersecurity threats involve a comprehensive and proactive approach. The Company's key processes include, but are not limited to, the following:


text: Cybersecurity Policies and Procedures: The Company's IT department has developed and implemented cybersecurity policies and procedures designed to align with industry best practices, such as the National Institute of Standards and Technology Cybersecurity Framework, and applicable regulatory requirements.


text: Incident Response Plan: The Company has developed and maintains an incident response plan that outlines the steps to be taken in the event of a cybersecurity incident. Annual testing is conducted to determine the effectiveness of the incident response plan, and maintenance of backup and protective systems is performed as needed.


text: Employee Training and Awareness: Mandatory ongoing cybersecurity training is provided to all employees to educate them about potential cybersecurity risks. Management fosters a culture of cybersecurity awareness and encourages employees to be proactive in identifying and reporting security issues.


text: Access Control and Authentication: The IT department maintains strong access controls and multi-factor authentication to ensure that only authorized personnel have access to sensitive systems and data. This access is regularly reviewed and updated as needed based on job roles and responsibilities.


text: Security Control: The IT department has implemented and continually monitors security controls, including firewalls, end-point detection and response, intrusion detection/prevention systems, file integrity monitoring and data encryption, to protect against cybersecurity threats. These tools and controls are regularly updated to address vulnerabilities and ensure the security of information technology infrastructure.


text: Reviews of IT Internal Controls: Reviews are performed by the Company's internal audit team to assess the effectiveness of IT internal controls and compliance with the Company's policies, and any identified weaknesses are promptly addressed.


text: Vulnerability Scans: Vulnerability scans are executed quarterly across the environment to proactively identify software weaknesses and vulnerabilities that could be exploited in a cybersecurity attack. Any identified vulnerabilities are promptly addressed.


text: Encryption and Data Protection: Encryption methods are in place to protect certain sensitive data. There are also programs in place to monitor and secure the Company's retained data.


text: Asset Inventory: The Company maintains an up-to-date inventory of all assets, including hardware, software, data and network infrastructure. Assets critical to the Company's operations have been identified and prioritized accordingly.


text: Continuous Monitoring: The IT department has implemented monitoring tools and processes to detect and respond to cybersecurity threats in real time.


text: A third-party security information and event management ("SIEM") partner provides security monitoring and alerts twenty-four hours a day, seven days a week. The Company engages an independent Qualified Security Assessor organization to perform penetration testing in order to validate the Company's Payment Card Industry ("PCI") compliance and adherence to the PCI Data Security Standard. The Company also collaborates with outside legal counsel to ensure compliance with regulatory requirements.


text: The Company has implemented and continues to maintain its IT policies, standards, procedures, and controls to oversee, identify and manage cybersecurity risks associated with third-party service providers. These include, but are not limited to, an IT acceptable use policy, a contractor/consultant work policy and a vendor management policy.


text: Impact of Risks from Cybersecurity Threats The Company has experienced cybersecurity incidents in the ordinary course of business and will continue to experience risks from cybersecurity threats that could have a material adverse effect on its business strategy, results of operations, or financial condition. Although prior cybersecurity incidents have not had a material adverse effect on the Company's business strategy, results of operations, or financial condition to date, any actual or perceived breach of its security could cause operational disruption and result in delays or inability to produce, print and deliver its publications and other third-party print publications, damage the Company's reputation, cause the Company to lose existing customers, prevent the Company from attracting new customers, or subject the Company to third-party lawsuits, regulatory investigations and fines or other actions or liabilities, any of which could materially adversely affect the Company's business strategy, results of operations, or financial condition. In addition, more resources may be needed for the security of the Company's information technology systems in the future, which could increase the cost of doing business or otherwise materially adversely affect the Company's business strategy, results of operations, or financial condition.


text: Both management and the Company's board of directors are involved in the oversight of risks from cybersecurity threats. The Company's information security program is designed to ensure that management and the board of directors are adequately informed about, and provided with the tools necessary to monitor, (i) material risks from cybersecurity threats and (ii) the Company's efforts related to the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: Role of the Board of Directors The board of directors has delegated to the Audit Committee oversight responsibility for the Company's risk management, including cybersecurity. The Audit Committee receives an annual comprehensive report from the Company's President and the Vice President of Information Technology ("VP of IT") covering the Company's cybersecurity posture, incidents, if any, and risk mitigation efforts, and receives ad hoc reporting of any material cybersecurity incidents.


text: Role of Management Management plays a crucial role in assessing and managing material risks from cybersecurity threats. At the management level, the Company's cybersecurity risk management and strategy is led by its VP of IT, who reports to the Company's President. The qualifications of the VP of IT include 26 years of IT management, cybersecurity and information governance experience. The VP of IT is regularly informed about the latest developments in cybersecurity, including emerging threats and technologies to adapt security measures accordingly. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation and remediation of cybersecurity incidents. Management's role includes:


text: Risk Assessment: Management conducts annual cybersecurity risk assessments to identify and evaluate potential threats and vulnerabilities. Management considers the likelihood and potential impact of various cybersecurity risks, considering the Company's assets, systems and operations, in order to prioritize mitigation efforts.


text: Cybersecurity Policies and Procedures: Management reviews and approves the Company's cybersecurity policies and procedures and communicates these policies and procedures to all employees to ensure adherence to established security protocols.


text: Incident Response Plan Oversight: Management reviews, updates and approves the Company's incident response plan. Management ensures that the plan is tested annually to determine the Company's ability to respond effectively. Compliance with Regulations: Management implements and maintains compliance with relevant cybersecurity regulations and standards applicable to the Company.


text: Budgeting and Resource Allocation: Management reviews budgets for cybersecurity initiatives and ensures that adequate resources are allocated to address cybersecurity risks and that investments in cybersecurity align with the Company's risk tolerance and strategic objectives.


text: Reporting to the Audit Committee: Management provides an annual comprehensive report to the Audit Committee on the Company's cybersecurity posture, incident response activities and risk mitigation efforts.


text: The VP of IT is promptly informed of potential cybersecurity risks, threats and vulnerabilities by the Company's IT security team or the Company's SIEM partner. Once an incident has been identified, the VP of IT and the IT security team assess the criticality and impact of the incident on the Company's business operations. The VP of IT then formulates and oversees a response to contain, eradicate and resolve incidents in accordance with the Company's incident response plan. Management is responsible for reporting incidents to the appropriate authorities as necessary and engaging the Audit Committee on all material incidents.


text: We rely on the cybersecurity strategy and policies implemented by Oaktree. Oaktree maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated into Oaktree's overall risk management processes and focuses on the corporate information technology environment. The audit committee of the board of directors of Brookfield Oaktree Holdings, LLC oversees Oaktree's cybersecurity program. The cybersecurity team briefs the audit committee of Brookfield Oaktree Holdings, LLC on the effectiveness of Oaktree's cyber risk management program. The Internal Audit team also shares the results of its annual cybersecurity audits with the audit committee of Brookfield Oaktree Holdings, LLC.

companyName: Oaktree Specialty Lending Corp

ticker: OCSL


text: The underlying controls of the cyber risk management program are designed to meet Oaktree's business requirements, security risks and organization profile, and leverages many elements of the National Institute of Standards and Technology Cybersecurity Framework and the International Organization Standardization 27001 Information Security Management System Requirements. The Internal Audit team conducts an annual internal audit of the Company's cyber risk management program utilizing the services of a third-party provider. Additionally, Oaktree hires a third party provider to conduct an annual penetration test of Oaktree's systems. Oaktree has developed and implemented controls and processes to oversee and manage its engagements with third-party vendors. These procedures encompass pre-engagement due diligence efforts and the ongoing monitoring of the third-party vendors that are considered to be high-risk. Although these controls and processes are designed to mitigate risks associated with third-party engagements, they do not guarantee the elimination of all potential risks. The effectiveness of these controls and processes is dependent on a variety of factors, some of which are outside Oaktree's and our control.


text: A third party Managed Security Service Provider manages Oaktree's Security Operations Center to provide 24/7 monitoring of its global systems and to coordinate the investigation of alerts of potential security incidents. Alerts are then escalated to the Oaktree Cybersecurity team for investigation and remediation, if necessary. Cyber partners are a key part of Oaktree's cybersecurity infrastructure. Oaktree partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. Oaktree engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in Oaktree's environment. A Managing Director in Oaktree's information technology department heads Oaktree's cybersecurity team. This individual reports to Oaktree's Chief Information Officer. and is responsible for assessing and managing Oaktree's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of collective experience selecting, deploying and operating cybersecurity technologies, initiatives and processes and relies on threat intelligence as well as other information obtained from governmental, public and private sources, including external consultants engaged by Oaktree.


text: The head of Oaktree's cybersecurity team has substantial information technology and cybersecurity experience, with a career spanning over 30 years in managing global IT operations in a wide range of areas, including cybersecurity, IT governance, controls, compliance, data center operations, network engineering and cloud computing.


text: Our board of directors oversees our cybersecurity program and receives quarterly updates from the cybersecurity team on matters including Oaktree's cyber risk management program (and risks to us related to cybersecurity) and updates to the cybersecurity program, including active and recently completed initiatives.


text: We and Oaktree face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition or results of operations. We and Oaktree have experienced, and will continue to experience, cyber incidents in the normal course of its business. However, we are not currently aware of any current or past cyberattacks or other incidents that, individually or in the aggregate, have materially affected, or are reasonably likely to materially affect, our business, financial condition or results of operations. See "Risk Factors – Risks Relating to Our Business and Structure – We may face a breach of our cyber security, which could result in adverse consequences to our operations and exposure of confidential information."


text: We rely on the cybersecurity strategy and policies implemented by Oaktree. Oaktree maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated into Oaktree's overall risk management processes and focuses on the corporate information technology environment. The audit committee of the board of directors of BOH oversees Oaktree's cybersecurity program. The cybersecurity team briefs the audit committee of BOH on the effectiveness of Oaktree's cyber risk management program. The Internal Audit team also shares the results of its annual cybersecurity audits with the audit committee of BOH.


text: The head of Oaktree's cybersecurity team has substantial information technology and cybersecurity experience, with a career spanning over 25 years in managing global IT operations in a wide range of areas, including cybersecurity, IT governance, controls, compliance, data center operations, network engineering and cloud computing.


text: Risk Management and Strategy Prosper recognizes the critical importance of protecting the company's assets and customer data against new and existing risks using appropriate organizational measures, policies, procedures, and technical solutions while maintaining robust cybersecurity measures to safeguard our information systems and protect the security, confidentiality, integrity, and availability of our data.

companyName: PROSPER MARKETPLACE, INC


text: Managing Material Risks & Integrated Overall Risk Management Prosper has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our information security ("InfoSec") team works closely with our information technology team to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Third-Party Risk Management Engagement Prosper engages with a range of external experts, including external auditors, cybersecurity assessors and penetration testers as part of our InfoSec and cybersecurity programs. Our collaboration with these third-parties includes services such as external audits, threat assessments and guidance on key security initiatives. These partnerships allow us to leverage specialized knowledge and insights, consistent with our aim for industry-best practices.


text: Oversee Third-Party Risk Prosper maintains stringent processes to oversee and manage the risks associated with third-party service providers, including a team focused on vendor, enterprise, and procurement risk management. We conduct diligence and security assessments of material third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes an initial review of their information security program, annual re-assessments, and ongoing monitoring for security incidents. This approach is designed to mitigate risks related to data breaches or other security incidents originating from our material vendors and partners.


text: Risks from Cybersecurity Threats For a description of the cybersecurity risks which could materially affect Prosper's business strategy, results of operations, or financial condition, please refer to the following: (i) "Risk Factors—If the security of PFL's investors' and borrowers' confidential information stored in our systems is breached or otherwise subjected to unauthorized access, users' secure information may be stolen, our reputations may be harmed, and we may be exposed to liability,"; (ii) "Risk Factors—Any significant disruption in service in our marketplace or in PMI's computer systems could adversely affect PMI's ability to perform its obligations under the Administration Agreement,"; and (iii) "Risk Factors—Our marketplace may be vulnerable to malware, third-party software vulnerabilities, and similar disruptions." We and certain third party vendors occasionally have experienced cyber-attacks, breaches of our and their systems and other similar incidents, which to-date have not had a material effect on Prosper's business strategy, results of operations, or financial condition.


text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats.


text: Board of Directors Oversight of Risks The Board is directly responsible for overseeing risks related to cybersecurity and is composed of board members with diverse expertise, including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: The Board is informed of cybersecurity risks by our Chief Executive Officer ("CEO") and General Counsel ("GC"), who are kept updated on an ongoing basis of cybersecurity risks through our Chief Technology Officer ("CTO") and Head of Information Security (the "InfoSec Director"). Our InfoSec Director also prepares a quarterly update for each Board meeting that updates the Board of any information security and cybersecurity risks and threats to our systems. The InfoSec Director also met with the Board directly for training focused exclusively on our cybersecurity and information security program and risks starting in 2024 and expects to continue to provide such training in the future.


text: Risk Management Personnel Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our InfoSec Director. Our InfoSec Director has experience building global Information Security programs and has advised organizations across several highly- regulated industries, including financial services, technology, healthcare, government, non-profit, and retail. Our InfoSec Director, with oversight from the CTO, manages Prosper's information security risk management program and informs Prosper's Enterprise Risk & Information Security Committee ("eRISC"), which consists of members of Prosper's management team and includes our CEO, Chief Financial Officer ("CFO"), CTO, and GC, regarding the prevention, detection, mitigation, and remediation of cyber risks and incidents. The cybersecurity team has decades of experience in selecting, deploying, and operating cybersecurity technologies, initiatives, and processes. eRISC meets on at least a quarterly basis to discuss any cybersecurity incident reports, as applicable, ongoing cybersecurity initiatives and strategies, take any actions approved by the voting members of eRISC, and discuss escalation and reporting to the Board, as needed.


text: Process for Monitoring Cybersecurity Incidents The InfoSec Director and eRISC, as applicable, are continually informed about the latest developments in cybersecurity including potential threats and innovative risk management techniques. The InfoSec Director is an active thought leader and speaker within the CISO community, regularly participating in cybersecurity conferences such as FS-ISAC, and CISO summits. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The InfoSec Director implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the InfoSec Director is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Board of Directors As discussed above in "Cybersecurity Board of Directors Oversight of Risks," our InfoSec Director regularly updates our eRISC committee regarding all aspects related to cybersecurity risks and incidents and also maintains direct communication with the CEO, CFO, CTO, and GC for escalation of such incidents directly to the Board. This ensures that the highest levels of management and the Board are kept informed of the cybersecurity posture and potential risks facing Prosper.


text: Risk management and strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, which include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, and violation of data privacy or security laws.

companyName: Hillenbrand, Inc.

ticker: HI


text: We have developed and implemented a cybersecurity risk management program to protect critical assets, scale with business growth, identify and mitigate threats, and enable us to conduct our business securely. The program's design utilizes the National Institute of Standards and Technology (NIST) Cybersecurity Framework, while adapting certain elements to align with our specific operational needs and objectives. The program and other cybersecurity processes have been integrated into our overall risk management framework.


text: Protecting our technology and information systems: We use various tools to help manage our overall program including unauthorized access detection, 24x7 security monitoring, email protection, network intrusion prevention systems, security training, penetration testing, and other similar tools to protect the Company's data. When adopting or changing technology, we conduct risk-based security and privacy impact assessments and deploy administrative, physical, and technical safeguards that are designed to reasonably protect us from cybersecurity threats. We actively monitor and proactively research potential cybersecurity threats to our technologies and information systems and use what we learn to evolve our security controls over time to mitigate risks posed by such threats.


text: Incident response and recovery planning: We maintain incident response and recovery plans that direct our response to cybersecurity incidents. These plans guide how we evaluate and assign incident severity levels and reporting thresholds, escalate and engage cross functional incident response teams, perform materiality assessments, and manage and mitigate the related risks. We also maintain a cybersecurity insurance program to reimburse covered costs, losses and claims relating to a data or security breach.


text: Third-party risk management: We maintain a risk-based approach to identifying and managing cybersecurity threats presented by third-party systems that support our operations, as well as third-party users of our data and systems, including vendors, service providers, and subcontractors. Further, we require third-party users with such access to our data and systems to adhere to industry policies and standards that are comparable to or exceed our policies and standards. For third-party users that do not have access to our data and systems, we require those users to maintain cybersecurity practices that align with industry standards and applicable laws.


text: Training and awareness: We have a cybersecurity training program designed to educate and train employees on how to identify and report cybersecurity threats, which includes regular phishing exercises and recurring cybersecurity awareness training to all our associates and third parties who have access to Company email and networks. Training programs are conducted on a periodic basis and are focused on giving employees awareness and tools to manage the most relevant and prevalent cybersecurity risks to us. Specialized training is also offered to employees in sensitive roles.


text: Assessments and testing: We use third party specialists to conduct periodic assessment and testing of our policies, standards, processes, and practices that are designed to address cybersecurity threats. These efforts include tabletop exercises, risk assessments, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. Where appropriate we adjust our cybersecurity policies, standards, processes, and practices accordingly based on internal and external assessment and testing results.


text: As of the date of this Form 10-K, we are not aware of any cybersecurity threats or incidents that have materially affected us or are reasonably likely to materially affect us, including our business strategy, consolidated results of operations, or financial condition. However, despite our security measures, we cannot assure that we or our third-party partners will not experience a future cybersecurity incident that could materially affect us.


text: Our Board of Directors oversees overall cybersecurity risk and strategy, and the Audit Committee of the Board of Directors oversees information security compliance as part of its broader compliance oversight mandate. Together, this ensures that the Board of Directors has a comprehensive view of the Company's cybersecurity risk profile and framework. The Board of Directors and its Audit Committee include directors with knowledge, skills, and cybersecurity and information technology experience.


text: Our EMT receives periodic briefings, and the Board of Directors and its Audit Committee receives annual and quarterly briefings, respectively, on cybersecurity matters. These briefings may include updates on critical information security and cybersecurity risks and the threat landscape; cybersecurity improvement initiatives and the internal control environment; and, if relevant, the status of actions taken with respect to any cybersecurity incidents.


text: The Chief Information Security Officer ("CISO") is responsible for assessing, identifying, and managing cybersecurity risks, including implementation of our cybersecurity risk management program. The CISO works in partnership with the information technology, legal, finance, and internal audit functions to review information technology-related policies and internal controls in managing the cyber risk.


text: The CISO has information technology and information security experience, including enterprise risk management leadership, and holds a Certified Information Security Manager certification from the Information Systems Audit and Control Association (ISACA). The CISO reports to the Chief Information Officer ("CIO"), who is a member of the Company's Executive Management Team ("EMT") and reports directly to the CEO. The CIO has extensive experience overseeing and executing technology strategies and implementations in complex, global organizations.


text: As a part of our incident response plan, the CISO also reports and escalates cybersecurity incidents to the EMT and the Audit Committee as appropriate.


text: We use information technology and third-party service providers to support our global business processes and activities, which exposes us to cybersecurity risks. KDP's risk management strategy includes ongoing cybersecurity risk assessment and reporting, incident management, and a diligence and risk management process for third-party service providers. Employees with network access participate in ongoing phishing, social engineering, and cybersecurity awareness training efforts, and we also conduct periodic tabletop exercises led by external consultants.

companyName: Keurig Dr Pepper Inc.

ticker: KDP


text: Our cybersecurity risk assessment and reporting process leverages the National Institute of Standards and Technology's Cybersecurity Framework and is managed by our CISO, whose team comprises both internal personnel and third-party cybersecurity consultants. The CISO provides periodic reports to management, including our CEO, as well as other executive leadership members, and to the Audit and Finance Committee of our Board, which has oversight for cybersecurity risk management. These reports include updates on critical cybersecurity risks and the threat landscape; updates on the status of ongoing cybersecurity improvement initiatives, the internal control environment, and ongoing internal audit activities; and, if relevant, the status of actions taken with respect to certain cybersecurity incidents identified during the period.


text: We have an overall incident management plan, which is intended to provide guidance and protocols to facilitate timely notification and communication to key internal and external stakeholders during an incident. A subset of this incident management plan is our Security Incident Response Plan, or SIRP, which is based on leading cybersecurity incident response practices. Incidents may be escalated to the CISO, our Chief Information Officer, our Chief Legal Officer, or other members of management or the Board, depending on the severity of the incident, and are handled according to the SIRP protocols, which includes incident detection and analysis; containment, eradication and recovery; and post-incident monitoring. We have developed a framework for assessing the materiality of any such incidents, including a committee responsible for determining whether the incident is material for disclosure. The committee includes our CISO, our Chief Information Officer, our Chief Legal Officer, our Senior Vice President and Controller (Principal Accounting Officer), our head of Internal Audit, and other members of management with relevant subject matter expertise.


text: Our CISO has more than 25 years of experience in cybersecurity and information technology, including, prior to joining KDP in 2019, more than 11 years as a principal in Ernst & Young's cybersecurity practice. Our CISO reports directly to our Chief Information Officer, who also has over 36 years of experience in information technology and cybersecurity.


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For additional description of cybersecurity risks and potential related impacts on us, refer to the risk factors captioned "Our use of information technology and third-party service providers exposes us to cybersecurity breaches and other business disruptions that could adversely affect us" and "The use of information technology by our third party commercial partners and service providers exposes us to business disruptions or other negative impacts that could adversely affect us" in Item 1A, Risk Factors, in this Annual Report on Form 10-K.


text: We, and our third-party service providers, use information technology to support our global business processes and activities, which exposes us to cybersecurity risks. KDP's overall risk management system includes ongoing cybersecurity risk assessment and reporting, incident management, and a diligence and risk management process for third-party service providers. Employees with network access participate in ongoing phishing, social engineering, and cybersecurity awareness training efforts, and we also conduct periodic tabletop exercises led by external consultants.


text: We have an overall incident management plan, which is intended to provide guidance and protocols to facilitate timely notification and communication to key internal and external stakeholders, as appropriate, during an incident. A subset of this incident management plan is our Security Incident Response Plan, or SIRP, which is based on leading cybersecurity incident response practices. Incidents may be escalated to the CISO, our Chief Information Officer, our Chief Legal Officer, or other members of management or the Board, depending on the severity of the incident, and are handled according to the SIRP protocols, which includes incident detection and analysis; containment, eradication and recovery; and post-incident monitoring. We have developed a framework for assessing the materiality of any such incidents, including a committee responsible for determining whether the incident is material for disclosure. The committee includes our CISO, our Chief Information Officer, our Chief Legal Officer, our Senior Vice President and Controller (Principal Accounting Officer), our head of Internal Audit, and other members of management with relevant subject matter expertise.


text: Our CISO has more than 26 years of experience in cybersecurity and information technology, including, prior to joining KDP in 2019, more than 11 years as a principal in Ernst & Young's cybersecurity practice. Our CISO reports directly to our Chief Information Officer, who also has over 37 years of experience in information technology and cybersecurity.


text: Risk management and strategy We have implemented and maintain information security processes designed to identify, assess and manage material risks from cybersecurity threats to our information systems and critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature. Our most important information system is our satellite network and related ground systems that carry our customers' traffic on our network. We also maintain critical internal computer networks, as well as third-party hosted services, communications systems, hardware and software.

companyName: Iridium Communications Inc.

ticker: IRDM


text: Our management, led by our chief information officer, in conjunction with our internal management security committee and third-party service providers, helps to identify, assess and manage our cybersecurity threats and risks by monitoring and evaluating our threat environment and risk profile. These teams use a number of methods to do this, including manual and automated tools, internal and external threat assessments, and internal and external vulnerability assessments. The third parties we engage in this effort generally consist of threat intelligence service providers; cybersecurity consultants and software providers; penetration testing firms; monitoring services; forensic investigators; and other professional services firms, including legal counsel.


text: Depending on the environment and system, we implement and maintain several technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our systems and data. These include, for example, IT policies and procedures; a network security policy; an information and asset management policy; an information security policy; incident planning, detection and response plans, including backup systems; vulnerability management, including of third parties; risk assessments; establishment of network security controls, including physical security; annual employee training; systems monitoring; and penetration testing.


text: We integrate our assessment and management of material risks from cybersecurity threats into our overall risk management processes. For example, our management security committee generally meets on a monthly basis and evaluates material risks from cybersecurity threats against our overall business objectives. Our management generally provides reports and status updates to our board of directors on a quarterly basis, as the board monitors our overall enterprise risk. In addition to our internal resources, we also use third-party service providers, including application providers and hosting companies, distributors, and supply chain resources. We have an IT vendor management program designed to identify and manage cybersecurity risks associated with our use of these providers. As part of this program, we typically conduct risk assessments for certain IT vendors on an annual basis, including, for example, using security assessment measures such as a security questionnaire, perform a review of the vendor's own security program, audits, and vulnerability scans. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and may impose contractual obligations related to cybersecurity on the provider.


text: Despite these measures, we may not be successful in preventing, mitigating or recovering from a cybersecurity incident, which could have a material adverse effect on our operations or financial results or reputation. While we maintain cybersecurity insurance, it may not be adequate to cover the costs related to cybersecurity incidents we experience. For a description of the primary risks from cybersecurity threats that may materially affect our business and how they may do so, see Part I, Item 1A. Risk Factors in this Annual Report on Form 10-K, including "— Our networks and those of our third-party service providers may be vulnerable to cybersecurity risks."


text: Our board of directors addresses cybersecurity risk management as part of its general oversight function. The board oversees our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by members of our management team, led by our chief information officer, who has 15 years of experience in information technology roles and supported by our director of information security, who holds several certifications in the field of information security and technology. In addition to our chief information officer, our internal management security committee includes our chief executive officer, chief financial officer, chief operations officer and chief legal officer, as well as others within our organization in information technology roles.


text: Our chief information officer is responsible for hiring appropriate personnel and helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel. Our chief information officer is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Information regarding cyber incidents is reported at the monthly meeting of the management security committee or sooner if warranted. Members of this committee work with our incident response team to help mitigate and remediate cybersecurity incidents of which they are notified. Our incident response and vulnerability management processes include reporting by management to the board of directors for certain cybersecurity incidents.


text: The board generally receives quarterly reports from our chief operations officer, chief information officer or other members of management, as well as periodic presentations from outside advisors concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The board also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: As a publicly-traded financial institution, we are subject to various cybersecurity risks that could adversely affect our business, financial condition, results of operations and reputation, including, but not limited to, cyber-attacks against us or our critical third-party service providers. These cyber-attackers can attempt to gain unauthorized access to our digital systems for malicious purposes including, but not limited to: misappropriation of company assets, accessing Company confidential or sensitive customer non-public information, corrupting data, causing operational disruptions, or as part of a ransom demand for payment. As described below, we believe we have appropriate risk management processes, governance policies, standards, and procedures, a system of internal controls designed to address and mitigate these risks, and experienced internal resources to execute our information security and cybersecurity risk management programs.

companyName: Capital Bancorp Inc

ticker: CBNK


text: In 2024, the Company's Board of Directors approved the hiring of a full time Chief Information Security Officer ("CISO") reporting to the Company's Chief Information Officer ("CIO") to support a focus on information security and support the three lines of defense enterprise risk management framework. Our defense enterprise risk management framework includes processes and procedures used to identify, assess, mitigate, and monitor the risks faced by the Company, including cybersecurity risk.


text: Within the three lines of defense framework for cybersecurity risk, the first line of defense is provided by the Information Technology department and business lines, which are responsible for the design and execution of information security practices and risk mitigation.


text: The second line of defense is provided by the Enterprise Risk Management department (led by the Company's Independent Chief Risk Officer ("CRO")) and the CISO (reporting to the CIO). The second line of defense seeks to identify, assess, and monitor cyber risk, in collaboration with our first line, while maintaining independence in the oversight of our information security program. The CISO has dotted-line reporting to the CRO. The CRO is independent of management and reports to the Board Risk Committee Chair.


text: The third line of defense is independent Internal Audit, led by our Head of Internal Audit, who is responsible for ensuring that the first and second lines of defense are both designed and operationally effective in mitigating cybersecurity risk through internal audits of including but not limited to: cybersecurity, electronic banking, GLBA/Privacy, information security, information technology, and vendor risk management. The Head of Internal Audit is independent of management and reports to the Board Audit Committee Chair.


text: Our CISO, CRO, CIO, and Head of Internal Audit have nearly seven decades of combined work experience, including six decades in banking and financial services risk management and information security roles, and maintain several industry licenses and certifications through continuing professional education.


text: The Company's information security program is designed to preserve the confidentiality, integrity, and availability of Company confidential information, customer non-public personal information, and other data on our systems as well as securing our interfaces with our critical third-party service providers. Our information security program takes a risk-based approach to identifying and assessing the cybersecurity risks that exist within our business and information technology systems. The program addresses the roles and responsibilities of the Board, its committees, management, management's committees, as well as each individual Company employee.


text: The Board of Directors is ultimately responsible for the oversight of cybersecurity risk management, with the Board Risk Committee assisting the Board with oversight of the Company's cybersecurity risk program and reporting. The Board of Directors appoints the CISO, and the CISO is given the full authority of the Board for administering and executing the Company's written information security program. The CRO and CISO deliver reports to the full Board of Directors on the status and effectiveness of the Company's written information security program, and reports to the Board Risk Committee any emerging threats or cyber risks on a periodic basis throughout the year. The Board Risk Committee has also approved an Information Security and Cybersecurity Risk Appetite Statement.


text: At the management level, the Enterprise Risk Management Committee ("ERMC") is primarily responsible for cybersecurity risk management. The Committee is comprised of senior executives with risk management and information security expertise. The Information Technology Steering Committee ("ITSC") is a sub-committee of ERMC and is also comprised of senior executives and staff with risk management and information security expertise. ITSC governs the first line of defense cybersecurity risk management activities and furnishes approval items, status reports, and approved Committee minutes to ERMC following a meeting. ERMC governs the second line of defense cybersecurity risk management activities and furnishes key risk indicators, risk assessments, reports, issues and committee minutes to the Board Risk Committee. The CISO assigns quarterly cyber security training to all Company employees and ERMC reviews and approves the training curriculum on an annual basis. Additionally, the CISO ensures the Board receives annual cyber security training.


text: We strive to minimize the occurrence of cybersecurity incidents and the risks resulting from such incidents. However, when a cybersecurity incident does occur, the Company has in place an incident response program to guide our assessment of and response to the incident. The CISO coordinates the Company's response to a cybersecurity incident, including investigating, recording and evaluating any potential, suspected or confirmed incidents involving non-public customer information or Company confidential information. The CRO informs senior management and the Board Risk Chair and Board Audit Committee Chair as soon as practical if a significant security incident occurs. Formal incident reports, if/when applicable, are reviewed by ITSC, ERMC, and the Board Risk Committee.


text: The Company employs third parties in fulfilling certain aspects of its information security and cybersecurity programs. For example, we engage third parties to: monitor our network 24/7/365, escalate security alerts, when applicable, perform penetration testing, conduct social engineering tests and assist management with technology upgrades/installations. The CISO monitors information risks posed by third parties and any non-compliance with the controls created to address such risks. With respect to cybersecurity incidents affecting our third-party service providers, the CISO, CRO, and their respective teams, work with our service providers to understand and document any incidents, along with managing the impact to us and reporting such significant incidents to senior management, ITSC, ERMC, and the Board Risk Committee.


text: While we believe that our cybersecurity programs are appropriate to our risks, cybersecurity threats are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our customers.


text: Notwithstanding the investments made in mitigating our cybersecurity risks, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. As of the date of this filing, the Company is not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For further discussion, please see Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: We face cybersecurity risks due to the breadth of networks and systems we must defend against cybersecurity attacks and threat actors seeking to inflict harm on us; and the substantial level of harm that could occur to us were we to suffer impacts of a material cybersecurity incident. We are committed to maintaining robust governance and oversight of these risks and to implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. In the year ended December 31, 2023, we did not experience a material "cybersecurity incident" as such term is defined in Item 106(a) of Regulation S-K. However, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in us incurring significant costs related to, for example, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We seek to detect and investigate unauthorized attempts and attacks against our network, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools; however, we remain potentially vulnerable to known or unknown threats. In some instances, we and our suppliers may be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See "Item 1A. Risk Factors" of this Annual Report for more information on our cybersecurity risks and product vulnerability risks.

companyName: RARE ELEMENT RESOURCES LTD

ticker: REEMF


text: We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards and is maintained by a third-party technology firm. The third-party firm has processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things, annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools.


text: Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to Company priorities, resource allocations, and oversight structures. The Board of Directors is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board of Directors.


text: Our cybersecurity program is run by a third-party firm, which reports to our Chief Financial Officer ("CFO"). The third-party firm is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals within its team and through the use of technological tools and software. Our CFO regularly reports directly to the Audit Committee or the Board of Directors on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur at least annually, or more frequently as determined to be necessary or advisable.


text: We face cybersecurity risks due to the breadth of networks and systems we must defend against cybersecurity attacks and threat actors seeking to inflict harm on us; and the substantial level of harm that could occur to us were we to suffer impacts of a material cybersecurity incident. We are committed to maintaining robust governance and oversight of these risks and to implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. In the year ended December 31, 2024, we did not experience a material "cybersecurity incident" as such term is defined in Item 106(a) of Regulation S-K. However, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in us incurring significant costs related to, for example, implementing additional threat protection measures and increased cybersecurity insurance premiums, defending against litigation, responding to regulatory inquiries or actions, paying damages, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We seek to detect and investigate unauthorized attempts and attacks against our network, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools; however, we remain potentially vulnerable to known or unknown threats. In some instances, we and our suppliers may be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See "Item 1A. Risk Factors" of this Annual Report for more information on our cybersecurity risks and product vulnerability risks.


text: Our Board of Directors has ultimate oversight of our cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to Company priorities, resource allocations, and oversight structures. The Board of Directors is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board of Directors.


text: Our cybersecurity program is run by a third-party firm, which reports to our Chief Financial Officer (" CFO "). The third-party firm is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals within its team and through the use of technological tools and software. Our CFO regularly reports directly to the Audit Committee or the Board of Directors on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur at least annually, or more frequently as determined to be necessary or advisable.


text: During 2024, the Company engaged a third-party technology firm to conduct an annual cyber risk assessment. The assessment resulted in certain recommended upgrades being made to the Company's network. In early 2025, the Company engaged an independent cyber security firm to conduct a more comprehensive assessment of the Company's information technology system. The Company is currently awaiting the findings from that assessment.


text: The underlying processes and controls of our cyber risk management protocol incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF").

companyName: iBio, Inc.

ticker: IBIO


text: In addition, we maintain policies over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We consult with a third-party specialist with regard to our cyber risk management processes and controls.


text: Our management team is responsible for oversight and administration of our cyber risk management protocol, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. iBio's management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes and relies on threat intelligence as well as other information obtained from governmental, public, or private sources. Our Audit Committee also provides oversight of risks from cybersecurity threats.


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services, brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on iBio's processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. iBio acknowledges that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. To date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. See Item 1A. "Risk Factors" for more information on cybersecurity risks.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Enovis CORP

ticker: ENOV


text: Our cybersecurity risk management program utilizes a variety of frameworks, including the NIST Cybersecurity Framework and CIS Critical Security Controls, as guides to help identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements.


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes the following key elements, among others: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a team comprised of IT security and IT infrastructure personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • the periodic use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees and consultants with access to our IT systems; and • a cybersecurity incident response plan and Security Operations Center (SOC) to respond to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our information technology infrastructure could be subject to service interruptions, data corruption, cyber-based attacks, or network security breaches, which could result in the disruption of operations or the loss of data confidentiality."


text: Cybersecurity Governance Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees management's design, implementation and enforcement of our cybersecurity risk management program.


text: The Audit Committee receives reports at least quarterly from our Vice President of Information Technology and IT security leader on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents. Audit Committee members also receive periodic presentations on cybersecurity topics from our internal IT security personnel, or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Vice President of Information Technology, who works closely with and supervises our IT security leader, has overall responsibility for assessing and managing any material risks from cybersecurity threats. Our IT security leader has significant experience in the field and holds cybersecurity certifications from leading cybersecurity training and research institutes.


text: Our IT security leader helps our management team stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal personnel and our SOC, threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers, and alerts and reports produced by security tools deployed in the IT environment.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Risks Related to Government Regulation and Litigation — Our information technology infrastructure and information are vulnerable to service interruptions, data corruption, cyber-based attacks, or network security breaches, which could result in the disruption of operations or the loss of data confidentiality."


text: Cybersecurity Risk Management and Strategy We take cybersecurity seriously and have developed a cybersecurity program that consists of processes, policies, and controls for assessing, identifying, managing, and responding to material risks from these threats. Our cybersecurity program is integrated within our broader risk management function that identifies, monitors, and mitigates business, operational, financial, and legal risks.

companyName: Intrepid Potash, Inc.

ticker: IPI


text: Our processes include controls that our Director of Information Technology and our Technology Department implement, which seek to protect our company, assets, information, and our employees from cyber threats, and provide regular education for our employees. For example, as part of our cybersecurity program, we have implemented controls that are designed to prohibit unauthorized access to our systems. These include password requirements, onboarding and termination processes, multi-factor authentication, and other condition-based access controls. We also use external controls and security systems that identify and prevent malicious activity or unauthorized access on an ongoing basis such as firewalls, endpoint protection, intrusion detection, and email security, among others.


text: In addition, our intrusion detection systems identify patterns of behavior consistent with attack methods, as well as other anomalous behavior on our network. This technology acts autonomously to block activities deemed to be high risk. Our endpoint protection system is monitored twenty-four hours a day, seven days a week, by a third-party service provider who investigates every alert and remotely resolves issues such as removal of malware, blocking malicious activity, or by quarantining systems from the network if necessary.


text: We recognize that cybersecurity incidents are often a result of employees' actions, including responding to phishing emails, opening malicious attachments, or visiting compromised websites. Therefore, another aspect of our cybersecurity program focuses on preventing such incidents by way of strong email security, web browsing protection systems, and by providing regular education and communication to our employees to increase their cybersecurity awareness of how to detect and respond to cyber threats. We periodically assess our employees' awareness level of these risks by conducting periodic phishing tests.


text: In the event of an incident, meaning a compromise is not contained by our security systems and has the potential to adversely impact the organization, we have a structured Incident Response Plan in place that is based on National Institute of Standards and Technology (NIST) guidelines that provide rules for communicating incidents to management based on defined categorizations of the incident, as well as an orderly process for addressing and documenting the incident. As part of our business continuity and disaster recovery strategy, we have a strong backup and off-site data replication process, including an air-gap data vault solution for replication of backups of critical systems. Restorations from these systems are tested on a quarterly basis.


text: We use external third parties to perform annual security assessments such as penetration testing and vulnerability scans for both our internal network and critical online systems. We currently do not have any formal processes to oversee or identify cybersecurity risks associated with third-party service providers but our Director of Information Technology generally evaluates such risks.


text: Our Board of Directors, in coordination with the Audit Committee, oversees our risk management program, including the management of cyber threats. The Board of Directors and senior management are actively involved in reviewing our information security and cybersecurity strategies and updating as risks evolve.


text: Our Board of Directors and our Audit Committee each receive annual presentations and reports from our Director of Information Technology on developments in the cybersecurity space, including risk management practices, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by our peers and third parties. In addition, on an annual basis, our Board of Directors and the Audit Committee discuss our approach to overseeing cybersecurity threats with our Director of Information Technology and other members of senior management to better assess our approach to cyber threats.


text: When a threat or other issue is identified, our Director of Information Technology will notify the senior management team and initiate the appropriate response plan based on the criticality of the threat or issue. Our Director of Information Technology along with our management team, which includes our Chief Executive Officer, Chief Financial Officer, and General Counsel, will coordinate to execute the appropriate response plan and will also investigate any issue to determine whether an incident is material, requiring disclosure to shareholders in SEC filings. Our Board of Directors and our Audit Committee also receive prompt and timely information regarding any cybersecurity risk and ongoing updates regarding any such risk.


text: Our Director of Information Technology has thirty years of experience in information technology, which includes the past nineteen years managing Intrepid's information technology infrastructure, business applications, compliance programs, and cybersecurity systems. Although our management team and Audit Committee receive information regarding our cybersecurity program and help assess our strategy based on their knowledge of our business and industry, no member of the management team or Audit Committee has technology or cybersecurity expertise. Certain members of the Audit Committee have experience with cybersecurity programs and implementing cybersecurity procedures as leaders of businesses and through their service on other boards. Risks from cybersecurity threats have not materially affected our company, including our business strategy, results of operations, or financial condition. While we believe our approach to cybersecurity is reasonable, given the rapidly evolving nature of cybersecurity incidents, there can be no assurance that the controls we have designed and implemented will be sufficient in preventing future incidents or attacks.


text: We use a third party to perform annual security assessments. This includes both external penetration testing and internal vulnerability testing, as well as a security program maturity assessment based on the NIST framework (National Institute of Standards and Technology). External testing consists of scanning all our public IP addresses for open ports and determining if any device or service on those ports have known vulnerabilities. Internal vulnerability testing is performed from within the network to determine if any known vulnerabilities exist due to outdated patches or insecure configurations. The security program maturity assessment is a review of our policies and practices against a set of standard best practice controls identified by the NIST to determine a maturity level score. We use this assessment to focus our efforts on continually improving our cybersecurity policies and practices. We currently do not have any formal processes to oversee or identify cybersecurity risks associated with third-party service providers but our Director of Information Technology generally evaluates such risks.


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company- wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our Risk Management Team (see " Management's Role Managing Risk " below for details regarding the team members and scope) works closely with our Information Technology ("IT") team to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Energy Recovery, Inc.

ticker: ERII


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity consultants in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes an initial assessment by our Director, Information Technology and IT team, and on an ongoing basis of a few key high-risk third-party systems by our security engineers. We also rely upon certain third-party system providers, including cloud and non-cloud programs provided by software developers such as Microsoft Corporation, Blackline Systems, Inc., Workiva, Inc., and others, to review and notify their customers of any data breach. This approach, both internal and reliance on external review notification, is designed to mitigate risks related to data breaches or other security incidents originating from third- parties.


text: R isks from Cybersecurity Threats While we have a cybersecurity program designed to protect and preserve the integrity of our information systems, we also maintain cybersecurity insurance to manage potential liabilities resulting from specific cyber-attacks. However, it's important to note that although we maintain cybersecurity insurance, there can be no guarantee that our insurance coverage limits will protect against any future claims or that such insurance proceeds will be paid to us in a timely manner. As of December 31, 2023, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition.


text: The Board of Directors (the "Board") is acutely aware of the critical nature of managing risks associated with cybersecurity threats.


text: The Board has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.


text: Board of Directors Oversight T he Audit Committee of the Board (the "Audit Committee") is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. T he Audit Committee is composed of independent board members with diverse expertise and experience which allows them to oversee cybersecurity risks effectively.


text: Management's Role Managing Risk We have an internal management team comprising of our Chief Financial Officer ("CFO"), Chief Legal Officer ("CLO"), VP, Corporate Controller, Sr. Director, SEC Reporting, and Director, Information Technology (the "Risk Management Team"), that plays a pivotal role in informing the Audit Committee on cybersecurity risks. The Director, Information Technology and IT team monitor cybersecurity risks and perform continual risk exercises and assessments. The Risk Management Team meets quarterly to discuss current security breaches and threats, if any, and discuss new controls and results of the cybersecurity risk monitoring, exercises, and assessments. T he Risk Management Team provides comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year.


text: These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee and the Risk Management Team maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, the Board receives updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives.