text: Cybersecurity Risk Management and Assessment Advanced Energy understands the importance of managing risks from cybersecurity threats and maintains a comprehensive cybersecurity program developed with reference to the National Institute of Standards and Technology ("NIST") cybersecurity framework. Our cybersecurity program includes administrative, organizational, technical, and physical safeguards reasonably designed to protect the confidentiality, integrity, and availability of our data. We devote significant resources to network, operations, and product security, data encryption, business continuity/disaster recovery, vulnerability management, event monitoring and incident response, and other measures to protect our systems and data from unauthorized external access or internal misuse, including, but not limited to, the following:

companyName: ADVANCED ENERGY INDUSTRIES INC

ticker: AEIS


text: Operational Security. Access to our systems is restricted to those who require access in accordance with the principle of least privilege. We also conduct background checks for our employees where permitted by local law, require signed confidentiality agreements and acceptable use agreements, and follow termination/access removal processes.

secItem: Item 1C


text: Employee Training. We provide all employees with annual training on information security, data protection, and relevant company policies so that they are empowered to identify cybersecurity risks and take action. To further enhance awareness and responsiveness to potential threats, we also conduct regular phishing simulations and email communications on cybersecurity trends awareness throughout the year. Third Party Assessment. We engage independent third party consultants to review the effectiveness and maturity of our cybersecurity program.


text: Incident Response Plan. We maintain an incident response plan to respond to and mitigate the effects of an information security incident. The plan provides for the formation of a multi-functional incident response team led by the Chief Information Officer ("CIO") and comprised of IT, legal, corporate communications, internal audit, and operational personnel.


text: Global Recovery. We have developed global cyber and disaster recovery processes for our information technology systems and critical information assets to preserve business continuity in the event of a cybersecurity incident.


text: Third Parties. We have an assessment and audit process for third party vendors. Prior to granting vendor access to our systems or data, we conduct pre-engagement diligence to ensure that each of our third party vendors involved in processing sensitive data have reasonable cybersecurity processes and procedures in place. We also have contractual provisions with key vendors for prompt notification of material cybersecurity incidents. Insurance. We maintain cyber insurance coverage to mitigate the risk of losses from a cybersecurity incident.


text: Risk Monitoring. Management and our Board monitor cybersecurity and data protection developments, including new or forthcoming changes to the legislative and regulatory landscape as well as Advanced Energy's cybersecurity processes, investments, and actions as described below.


text: Cybersecurity risk is a component of Advanced Energy's broader risk management program and managed at the highest levels of the company, starting with Advanced Energy's CIO, who meets with the Chief Executive Officer and other members of executive management regularly to discuss issues, assess risks, and coordinate company-wide cybersecurity initiatives. Our CIO leads a dedicated cybersecurity technical team that manages, monitors, and enforces compliance with the cybersecurity program.


text: Although we have experienced non-material information security incidents from time to time in the past, in the last three years, we have not experienced any material cybersecurity incidents, nor has any incident had a material impact on our operations or financial condition. For a discussion of how risks from cybersecurity threats are reasonably likely to affect us, including our business strategy, results of operations, or financial condition, please see "If our information security measures are breached or fail and a customer's or our data is improperly obtained or unauthorized access to our information technology systems occurs, we may incur significant legal and financial exposure and liabilities." under the heading Part I, Item 1A "Risk Factors".


text: Cybersecurity Governance Pursuant to its charter, the Audit and Finance Committee of our Board of Directors is principally responsible for oversight of managements' actions to monitor and control cybersecurity risk exposure. The CIO routinely reports to the Audit and Finance Committee on enterprise cybersecurity matters, including, as appropriate, information security strategy, policies, and procedures, status of cybersecurity initiatives, results of third party assessments, emerging cybersecurity threats and risks, steps taken to mitigate such threats and risks, and cybersecurity developments and trends. The Audit and Finance Committee reports to the full Board and, if warranted, coordinates with the Board to address material risks. In addition, the full Board receives a cybersecurity briefing from the CIO annually.


text: As discussed above, our cybersecurity risk management and strategy are led by our CIO, who has extensive leadership experience with enterprise information technology in the manufacturing and telecom industries, where he has held various executive roles in which he developed and executed IT strategy, including cybersecurity programs, helped achieve and maintain Sarbanes-Oxley compliance, and brought companies into compliance with ISO 27001, among other things.


text: Risk Management and Strategy Information security risks have significantly increased in recent years in part because of the proliferation of new technologies, the increasing use of the Internet and telecommunications technologies to conduct our operations, and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties, including, among others, foreign state agents. Our business and operations rely on the secure and continuous processing, transmission and storage of confidential, proprietary and other information in our computer systems and networks, including sensitive personal information, such as PHI, social security numbers, and/or credit card information of our patients, teammates, physicians, business partners and others. Our business and operations also rely on certain critical IT vendors that support such processing, transmission and storage (which have become more relevant and important given the information security issues and risks that are intensified through our increased use of remote work arrangements).

companyName: DAVITA INC.

ticker: DVA


text: To manage risks to our Company, including information and security risks, our Board oversees our enterprise-wide approach to risk management with a fundamental belief that the key components of risk management are: • Identifying potential risks that we face; • Assessing the likelihood and potential impact of the risks; • Adopting strategies and controls designed to manage the risks; • Reporting on a regular basis regarding the assessment and management of the risks; and • Monitoring these potential risks on a regular basis.


text: Our Enterprise Risk Management (ERM) team leads this risk management process, and evaluates risks to the enterprise on short, intermediate and long-term bases. Our ERM team reports to our ERM Committee, a group comprised of members of senior management who meet on a regular basis to oversee the performance of these risk management functions. We assess risks using a probability-magnitude lens, with shorter and intermediate term risks generally given greater weight. We prioritize mitigating activities on shorter and intermediate term risks, but also use risk analyses and oversight to proactively incorporate mitigating activities into our long-term strategy. The ERM process reflects a Company-wide effort designed to identify, assess, manage, report and monitor enterprise risks and risk areas. This effort includes the Company's Enterprise Risk Services (Internal Audit), Sarbanes-Oxley (SOX), Compliance Audit, legal and IT Security teams, among others. The identification and evaluation of cybersecurity threats and risks is integrated into this ERM process.


text: The ERM process is incorporated into our disclosure controls and procedures. Representatives of each of our ERM, Legal, Internal Audit and Compliance Audit teams sit on the Company's management Disclosure Committee, which is responsible for, among other things, the design and establishment of disclosure controls and procedures to help ensure the timeliness, accuracy and completeness of corporate disclosure. Our IT Security and Privacy teams, who are responsible for assessing cybersecurity threats and risks, in turn maintain policies and procedures designed to ensure appropriate escalation of cybersecurity incidents to meet external disclosure requirements. Our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) regularly meet and coordinate with our Chief Privacy Officer (CPO). Each of the CIO, CISO and CPO also advise members of the Disclosure Committee, including our Chief Legal and Public Affairs Officer (CLO), on disclosure matters on an as-needed basis.


text: With respect to assessing privacy, data and cybersecurity risks, the Company adopts a hybrid approach that primarily aligns with the National Institute of Standards and Technology (NIST) Cybersecurity Framework, including the guidance set forth in the NIST HIPAA Security Rule Cybersecurity Guide, while also evaluating against certain elements of the ISO 27001 and 27005 standards that management believes provide additional levels of guidance or structure. We regularly evaluate the Company's cybersecurity and privacy processes and procedures, both through regular audits by our Internal Audit and IT security teams, as well as regular retention of outside advisors under direction of our IT security team. Among other things, the IT security team oversees an external third party review at least every two years that evaluates the readiness of the entire Company against the NIST Cybersecurity Framework and provides an assessment that measures Capability Maturity Model Integration levels. Additionally, our CISO engages in regular consultations, typically monthly, with third-party cybersecurity advisors. Among other things, these sessions provide the Company with a broader review of the external cybersecurity environment, helping us to stay current on emerging or developing security approaches and risks. Among other initiatives, our CISO and the Company's IT security team have actively participated in industry conferences and maintain memberships to resources such as the Health Information Sharing and Analysis Center (Health-ISAC), a trusted community of critical infrastructure owners and operators within the Health Care and Public Health sector which, among other things, allows the Company to monitor email updates and alerts coordinated with the U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency. In order to maintain awareness of privacy, data and cybersecurity risks, the Company incorporates these topics into its annual compliance training materials that are mandatory for all teammates and new hires, and among other things cover HIPAA privacy and security requirements.


text: We maintain policies and have established processes involving our cybersecurity, privacy and legal teams that assess potential cybersecurity risks associated with our retention and use of third-party service providers. These policies and procedures are generally aligned with the NIST Cybersecurity Framework. Prior to retaining or renewing a third-party vendor, the Company policy requires a risk assessment of such potential new vendor or new engagement through a collaborative process among the Company's IT security, privacy, insurance and legal teams, among others. Potential vendor engagements also are reviewed to assess a range of other considerations and contractual terms and conditions, including, among other things, a potential vendor's liability insurance limits, scope and coverage of cyber insurance and privacy data protections. Our IT SOX team also conducts annual SOX reviews for those vendors that are considered in scope for SOX controls. All finalized vendor engagements are considered by Internal Audit as part of our ordinary course risk assessment and audit planning.


text: Cybersecurity Risks and the Impact on our Company Due to the continuously evolving series of laws and regulations related to cybersecurity, data protection and privacy that are applicable to our business, as well as the associated risks from cybersecurity threats, we have expended significant resources in order to protect our information systems and data. We regularly review, monitor and implement multiple layers of security measures through technology, processes and our people. We utilize security technologies designed to protect and maintain the integrity of our information systems and data, and our defenses are monitored and routinely tested internally and by external parties. Despite these efforts, our facilities and systems and those of our third-party service providers may be vulnerable to privacy and security incidents; security attacks and breaches; acts of vandalism or theft; computer viruses and other malicious code; coordinated attacks by a variety of actors, including, among others, activist entities or state sponsored cyberattacks; emerging cybersecurity risks; cyber risk related to connected devices; misplaced or lost data; programming and/or human errors; or other similar events that could impact the security, reliability and availability of our systems. Internal or external parties have attempted to, and will continue to attempt to, circumvent our security systems, and we have in the past, and expect that we will in the future, defend against, experience, and respond to attacks on our network including, without limitation, reconnaissance probes, denial of service attempts, malicious software attacks including ransomware or other attacks intended to render our internal operating systems or data unavailable, and phishing attacks or business email compromise. While we have experienced cybersecurity incidents in the past, to date none have had a material impact on our business, results of operations, financial condition and cash flows.


text: Cybersecurity requires ongoing investment and diligence against evolving threats and in the context of new or developing technologies. For further information regarding the risks we face from cybersecurity threats and how our business strategy, results of operations, and financial condition could be materially affected by such risks, see Item I.A. Risk Factors under the heading, "Privacy and information security laws are complex ".


text: As part of their oversight responsibilities, the Audit Committee and the Compliance and Quality Committee monitor privacy, data and cyber security as specific risk areas. Both Mr. Schechter, a member of the Audit Committee and the Compliance and Quality Committee, and Ms. Schoppert, a member of the Audit Committee and the Compliance and Quality Committee, hold a CERT Certificate in Cybersecurity Oversight. The Audit Committee engages in regular discussions with management on privacy, data, and cybersecurity risk exposures, receiving quarterly reports from the ERM team and the CIO. The CPO and/or CLO periodically reports to the Audit Committee about the Company's privacy program, and Internal Audit reports to the Audit Committee quarterly, providing the Audit Committee with results from any privacy, data, or cybersecurity audits.


text: Among other things, the Company's privacy team actively develops and implements policies designed to comply with the requirements of privacy laws in the countries where the Company operates. Working with Internal Audit and the CIO, the privacy team assesses the nature and potential severity of privacy risks within DaVita and guides the organization in taking steps to help mitigate such risks. The CPO or CLO provides periodic updates to the Audit Committee on the status of the privacy program. The Audit Committee also oversees the Company's negotiation of any cybersecurity insurance. Currently, the Company maintains a cybersecurity risk insurance policy providing coverage for certain cybersecurity breaches among other specified risks.


text: As referenced above, our IT Security team, in consultation with our Privacy Office, is primarily responsible for frontline assessments and management of day-to-day risks from cybersecurity threats, including the monitoring and detection of cybersecurity incidents and the execution of DaVita's cybersecurity and privacy incident response plans, as needed. Pursuant to the plan, the teams are responsible for assessing and classifying cybersecurity incidents and coordinating the response to such incidents, including managing both internal and external reporting obligations and remediation efforts. Our key personnel responsible for privacy and cybersecurity expertise include our CIO, CISO and CPO. Their qualifications include expertise in international privacy laws, compliance, global IT strategy, and security responsibilities, helping to ensure a comprehensive approach to risk management. Our CISO holds a Certified Chief Information Security Officer certification from EC-Council and a Certified Information Security Manager certification from ISACA. Our CPO is a Certified Information Privacy Professional and a Certified Compliance and Ethics Professional, and has more than two decades of experience in creating and implementing privacy and data protection programs that enable multinational organizations to respect and protect personal data and execute mission critical business strategies.


text: Our IT Security team also operates a 24x7 security operations center through a managed service provider. This dedicated center, alongside active monitoring of the dark web for DaVita-related data, and our use of both internal and external tools, is designed to ensure proactive detection, prevention and remediation of cybersecurity incidents. We inform and develop this integrated approach through our ongoing internal and external evaluations and risk assessments of our IT security program as described above.


text: Risk Management and Strategy Information security risks have significantly increased in recent years in part because of the proliferation of new technologies, the increasing use of the Internet and telecommunications technologies to conduct our operations, and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties, including, among others, foreign state agents. Our business and operations rely on the secure and continuous processing, transmission and storage of confidential, proprietary and other information in our computer systems and networks, including, but not limited to, sensitive personal information, such as PHI, social security numbers, and/or credit card information of our patients, teammates, physicians, business partners and others. Our business and operations also rely on certain critical IT vendors that support such processing, transmission and storage (which have become more relevant and important given the information security issues and risks that are intensified through our increased use of remote work arrangements).


text: To manage risks to our Company, including information and security risks, our Board oversees our enterprise-wide approach to risk management with a fundamental belief that the key components of risk management are: • Identifying potential risks that we face; • Assessing the likelihood and potential impact of the risks; • Adopting strategies and controls designed to manage the risks; • Reporting on a regular basis regarding the assessment and management of the risks; • Monitoring these potential risks on a regular basis; and • Evaluating whether there are new potential risks to assess.


text: Under our Enterprise Risk Management (ERM) process, the Company evaluates risks to the enterprise on short, intermediate and long-term bases. The ERM Committee, a group comprised of members of senior management, meet on a regular basis to oversee the performance of these risk management functions. We assess risks using a probability-magnitude lens, with shorter and intermediate term risks generally given greater weight. We prioritize mitigating activities on shorter and intermediate term risks, but also use risk analyses and oversight to proactively incorporate mitigating activities into our long-term strategy. The ERM process reflects a Company-wide effort designed to identify, assess, manage, report and monitor enterprise risks and risk areas. This effort includes the Company's Enterprise Risk Services (Internal Audit), Sarbanes-Oxley (SOX), Compliance Audit, legal and IT security teams, among others. The identification and evaluation of cybersecurity threats and risks is integrated into this ERM process.


text: The ERM process is incorporated into our disclosure controls and procedures. Representatives of each of our ERM, Internal Audit, legal and compliance teams sit on the Company's management Disclosure Committee, which is responsible for, among other things, the design and establishment of disclosure controls and procedures to help ensure the timeliness, accuracy and completeness of corporate disclosure. Our IT security and privacy teams, who are responsible for assessing cybersecurity threats and risks, in turn maintain policies and procedures designed to ensure appropriate escalation of cybersecurity incidents to meet external disclosure requirements. Our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) regularly meet and coordinate with our Chief Privacy Officer (CPO). Each of the CIO, CISO and CPO also advise members of the Disclosure Committee, including our Chief Legal and Public Affairs Officer (CLO), on disclosure matters on an as-needed basis.


text: With respect to assessing privacy, data and cybersecurity risks, the Company adopts a hybrid approach that primarily aligns with the National Institute of Standards and Technology (NIST) Cybersecurity Framework, including the guidance set forth in the NIST HIPAA Security Rule Cybersecurity Guide, while also evaluating against certain elements of the ISO 27001 and 27005 standards that management believes provide additional levels of guidance or structure. We regularly evaluate the Company's cybersecurity and privacy processes and procedures, both through regular audits by our Internal Audit and IT security teams, as well as regular retention of outside advisors under direction of our IT security team. Among other things, the IT security team oversees an external third party review at least every two years that evaluates the readiness of the entire Company against the NIST Cybersecurity Framework and provides an assessment that measures Capability Maturity Model Integration levels. Additionally, our CISO engages in regular consultations, typically monthly, with third-party cybersecurity advisors. Among other things, these sessions provide the Company with a broader review of the external cybersecurity environment, helping us to stay current on emerging or developing security approaches and risks. Among other initiatives, our CISO and the Company's IT security team actively participate in industry conferences and maintain memberships to resources such as the Health Information Sharing and Analysis Center (Health-ISAC), a trusted community of critical infrastructure owners and operators within the Health Care and Public Health sector which, among other things, allows the Company to monitor email updates and alerts coordinated with the U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency. In order to maintain awareness of privacy, data and cybersecurity risks, the Company incorporates these topics into its annual compliance training materials that are mandatory for all teammates and new hires, and among other things cover HIPAA privacy and security requirements.


text: We maintain policies and have established processes involving our IT security, privacy and legal teams that assess potential cybersecurity risks associated with our retention and use of third-party service providers. These policies and procedures are generally aligned with the NIST Cybersecurity Framework. Prior to retaining or renewing a third-party vendor, the Company policy requires a risk assessment of such potential new vendor or new engagement through a collaborative process among the Company's IT security, privacy, insurance and legal teams, among others. Potential vendor engagements also are reviewed to assess a range of other considerations and contractual terms and conditions, including, among other things, a potential vendor's liability insurance limits, scope and coverage of cyber insurance and privacy data protections. Our IT SOX team also conducts annual SOX reviews for those vendors that are considered in scope for SOX controls. All finalized vendor engagements are considered by Internal Audit as part of our ordinary course risk assessment and audit planning.


text: Cybersecurity requires ongoing investment and diligence against evolving threats and in the context of new or developing technologies. For further information regarding the risks we face from cybersecurity threats and how our business strategy, results of operations, and financial condition could be materially affected by such risks, see Part I Item IA. "Risk Factors" under the heading, "Privacy and information security laws are complex ".


text: As part of its oversight responsibilities, the Audit Committee monitors privacy, data and cybersecurity as specific risk areas. The Audit Committee also works with the Compliance and Quality Committee to oversee enterprise risks with healthcare and anti-corruption requirements, and those requirements include certain privacy, data and cybersecurity aspects. Both Mr. Schechter, a member of the Audit Committee, and Ms. Schoppert, a member of the Audit Committee, hold a CERT Certificate in Cybersecurity Oversight. The Audit Committee engages in regular discussions with management on privacy, data, and cybersecurity risk exposures, receiving quarterly reports from the ERM team and the CIO. On a periodic basis, the full Board of Directors also receives these reports from the ERM team and the CIO. The CPO and/or CLO periodically reports to the Audit Committee about the Company's privacy program, and Internal Audit reports to the Audit Committee quarterly, providing the Audit Committee with results from any privacy, data, or cybersecurity audits.


text: Among other things, the Company's privacy team actively develops and implements policies designed to comply with the requirements of privacy laws in the countries where the Company operates. Working with Internal Audit and the CIO, the privacy team assesses the nature and potential severity of privacy risks within DaVita and guides the organization in taking steps to help mitigate such risks. The Audit Committee also oversees the Company's negotiation of any cybersecurity insurance. Currently, the Company maintains a cybersecurity risk insurance policy providing coverage for certain cybersecurity breaches among other specified risks.


text: As referenced above, our IT security team, in consultation with our privacy team, is primarily responsible for frontline assessments and management of day-to-day risks from cybersecurity threats, including the monitoring and detection of cybersecurity incidents and the execution of DaVita's cybersecurity and privacy incident response plans, as needed. Pursuant to the plan, the teams are responsible for assessing and classifying cybersecurity incidents and coordinating the response to such incidents, including managing both internal and external reporting obligations and remediation efforts. Our key personnel responsible for privacy and cybersecurity expertise include our CIO, CISO and CPO. Their qualifications include expertise in international privacy laws, compliance, global IT strategy, and security responsibilities, helping to ensure a comprehensive approach to risk management. Our CISO has more than two decades of experience in information technology risk and compliance and holds a Certified Chief Information Security Officer certification from EC-Council, a Certified Information Security Manager certification from ISACA and a certification from the Massachusetts Institute of Technology on AI management in healthcare. Our CPO is a Certified Information Privacy Professional and a Certified Compliance and Ethics Professional, and has more than two decades of experience in creating and implementing privacy and data protection programs that enable multinational organizations to respect and protect personal data and execute mission critical business strategies.


text: Our IT security team also operates a 24x7 security operations center through a managed service provider. This dedicated center, alongside active monitoring of the dark web for DaVita-related data, and our use of both internal and external tools, is designed to ensure proactive detection, prevention and remediation of cybersecurity incidents. We inform and develop this integrated approach through our ongoing internal and external evaluations and risk assessments of our IT security program as described above.


text: Overview. Our Board of Directors and management consider information security and cybersecurity as high priorities in our strategic and operational plans. We understand the critical nature of the confidentiality, integrity, and availability of customer and bank sensitive information. Any loss of confidentiality, integrity, or availability introduces operational, compliance, strategic, transactional, reputational, legal, and capital risks which we actively seek to avoid. It is understood that any one of these risks, if realized, will have a negative impact upon Quant Oak Bancorp and Quaint Oak Bank. Our approach to information and cybersecurity is proactive and strives to avoid incidents where possible through the use technical, administrative, and physical controls.

companyName: QUAINT OAK BANCORP, INC.

ticker: QNTO


text: Governance. Our efforts for increased information and cybersecurity readiness are driven from the top of the organization. The Board of Directors reviews and approves an Information Technology and Information Security Risk Appetite Statement which guides the actions of the management team, staff members, and supporting third-party service providers. In addition, the Board is active in the review and approval of all policies concerning information technology and information security. The Board further reviews reports provided by the management team regarding the status of Quaint Oak Bank's GLBA compliance, risk management program, vendor management program, and the results of tests and exercises conducted for business continuity, disaster recovery, cybersecurity incident response, and pandemic response. Lastly, the Board of Directors reviews and approves the budget for information and cybersecurity, ensuring that we have sufficient resources to properly address all current and foreseeable information and cybersecurity threats.


text: Management and Strategy. Senior management takes the guidance provided by the Board of Directors and transforms this guidance into operational priorities which are implemented and maintained by the staff members and third-party service providers. In addition, the senior management team ensures that budgeted resources are allocated in a timely manner to support the various security initiatives.


text: Operational Information Technology and Information Security staff members, and third-party service providers utilize the direction and resources provided by the senior management team to develop procedures, standards, and guidelines to achieve the strategic goals defined by the Board of Directors. Operational and security health is reported monthly to Operating Risk and Executive Committees and the Board of Directors. Recommendations for improvements are shared between operational staff and the senior management team as part of a continuous improvement program for information security and cybersecurity.


text: Operational staff members actively maintain, review, update, and exercise plans and procedures designed to enhance our overall business resiliency. All staff members are trained annually on current information and cybersecurity trends, techniques, and their responsibilities to keep our information confidential, accurate, and available.


text: We also utilize the services of third-party providers to conduct an IT audit, external and internal vulnerability testing, external and internal penetration testing, and social engineering testing on at least an annual basis. The results of these independent audits and tests are sent to the Board of Directors for review.


text: Finally, Quaint Oak Bank complies with its regulatory requirements by having Federal and State safety and security examinations performed on a schedule dictated by the regulatory agencies. The results of these examinations are reviewed and approved by the Board of Directors. Additionally, all findings from these examinations are recorded and prioritized for remediation.


text: Conclusion. Our Board of Directors and management take very seriously the information security and cybersecurity obligations Quaint Oak Bancorp and Quaint Oak Bank have to their respective customers, shareholders, staff members, and regulatory agencies. In support of these obligations, we have and actively maintain a robust information security and cybersecurity program based upon industry best practices, regulatory requirements, and the expertise of staff members and supporting third-party vendors.


text: To our knowledge, we have not had a cybersecurity incident that has materially affected Quaint Oak Bancorp, its business strategy, financial condition, or results of operation.


text: Overview. Our Board of Directors and management consider information security and cybersecurity as high priorities in our strategic and operational plans. We understand the critical nature of the confidentiality, integrity and availability of customer and bank sensitive information. Any loss of confidentiality, integrity or availability introduces operational, compliance, strategic, transactional, reputational, legal and capital risks which we actively seek to avoid. It is understood that any one of these risks, if realized, will have a negative impact upon Magnolia Bancorp and Mutual Savings and Loan Association. Our approach to information and cybersecurity is proactive and strives to avoid incidents where possible through the use technical, administrative and physical controls.

companyName: Magnolia Bancorp, Inc.

ticker: MGNO


text: Governance. Our efforts for increased information and cybersecurity readiness are driven from the top of the organization. The Board of Directors reviews and approves an Information Technology and Information Security Risk Appetite Statement which guides the actions of the management team, staff members and supporting third-party service providers. In addition, the Board is active in the review and approval of all policies concerning information technology and information security. The Board further reviews reports provided by the management team regarding the status of Mutual Savings and Loan Association's compliance with the Gramm-Leach-Bliley Act, risk management program, vendor management program, and the results of tests and exercises conducted for business continuity, disaster recovery, cybersecurity incident response and pandemic response. Lastly, the Board of Directors reviews and approves the budget for information and cybersecurity, ensuring that we have sufficient resources to properly address all current and foreseeable information and cybersecurity threats.


text: The Director of Compliance and Internal Audit and third-party service providers utilize the direction and resources provided by the senior management team to develop procedures, standards and guidelines to achieve the strategic goals defined by the Board of Directors. Operational and security health is reported monthly to the Board of Directors. Recommendations for improvements are shared between operational staff and the senior management team as part of a continuous improvement program for information security and cybersecurity.


text: Operational staff members actively maintain, review, update and exercise plans and procedures designed to enhance our overall business resiliency. All staff members are trained annually on current information and cybersecurity trends, techniques and their responsibilities to keep our information confidential, accurate and available.


text: We also utilize the services of third -party providers to conduct an IT audit, external and internal vulnerability testing, external and internal penetration testing, and social engineering testing on at least an annual basis. The results of these independent audits and tests are sent to the Board of Directors for review. Finally, Mutual Savings and Loan Association complies with its regulatory requirements by having federal safety and security examinations performed on a schedule dictated by the regulatory agencies. The results of these examinations are reviewed and approved by the Board of Directors. Additionally, all findings from these examinations are recorded and prioritized for remediation.


text: Conclusion. Our Board of Directors and management take very seriously the information security and cybersecurity obligations that Magnolia Bancorp and Mutual Savings and Loan Association have to their respective customers, shareholders, staff members and regulatory agencies. In support of these obligations, we have and actively maintain a robust information security and cybersecurity program based upon industry best practices, regulatory requirements, and the expertise of staff members and supporting third-party vendors.


text: To our knowledge, we have not had a cybersecurity incident that has materially affected Magnolia Bancorp, its business strategy, financial condition or results of operation.


text: Overview. Our Board of Directors and management consider information security and cybersecurity as high priorities in our strategic and operational plans. We understand the critical nature of the confidentiality, integrity, and availability of customer and bank sensitive information. Any loss of confidentiality, integrity, or availability introduces operational, compliance, strategic, transactional, reputational, legal, and capital risks which we actively seek to avoid. It is understood that any one of these risks, if realized, will have a negative impact upon Quaint Oak Bancorp and Quaint Oak Bank. Our approach to information and cybersecurity is proactive and strives to avoid incidents where possible through the use of technical, administrative, and physical controls.


text: Governance. Our efforts for increased information and cybersecurity readiness are driven from the top of the organization. The Enterprise Risk Management Committee has the responsibility of assessing risks associated with technology and information security, including cybersecurity. The Enterprise Risk Management Committee reports directly to our Board of Directors. The Board of Directors reviews and approves Information Security Risk Assessments and performance reviews which guides the actions of the management team, staff members, and supporting third-party service providers. In addition, the Board is active in the review and approval of all policies concerning information technology and information security. The Board further reviews reports provided by the management team regarding the status of Quaint Oak Bank's GLBA compliance, risk management program, Third Party Risk Management program, and the results of tests and exercises conducted for business continuity, disaster recovery, cybersecurity incident response, and pandemic response. Lastly, the Board of Directors reviews and approves the budget for information and cybersecurity, ensuring that we have sufficient resources to properly address all current and foreseeable information and cybersecurity threats.


text: Operational Information Technology and Information Security staff members, and third -party service providers utilize the direction and resources provided by the senior management team to develop procedures, standards, and guidelines to achieve the strategic goals defined by the Board of Directors. Operational and security health is reported quarterly to the IT Steering Committee, Enterprise Risk Management Committee, and the Board of Directors. Recommendations for improvements are shared between operational staff and the senior management team as part of a continuous improvement program for information security and cybersecurity.


text: Operational staff members actively maintain, review, update, and exercise plans and procedures designed to enhance our overall business resiliency. Incident Response team members are trained annually on current information and cybersecurity trends, techniques, and their responsibilities to keep our information confidential, accurate, and available.


text: We also utilize the services of third -party providers to conduct an IT audit, external and internal vulnerability testing, external and internal penetration testing, and social engineering testing on at least an annual basis. The results of these independent audits and tests are sent to the Board of Directors for review.


text: Risk Management and Strategy As a financial services company entrusted with the safeguarding of sensitive information, including sensitive personal information, we believe that a strong enterprise cybersecurity program is a vital component of effectively managing risks related to the confidentiality, integrity and availability of our data. While no organization can eliminate cybersecurity and information technology risk entirely, we devote significant resources to a cybersecurity program designed to mitigate such risks.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: We manage cybersecurity and technology risk at the enterprise level according to our Framework, as described in more detail under "Part II—Item 7. MD&A—Risk Management" in this Report, which uses a three lines of defense model. Our cybersecurity risks are managed programmatically under the "operational risk" category of our Framework. Through this Framework, we establish practices for assessing our risk posture and executing key controls for cybersecurity and technology risk, data management, and oversight of third parties with which we do business.


text: These operational risks are managed within a governance structure that consists of defined roles and responsibilities, formal governance bodies, and processes, policies and standards.


text: Our policies and procedures define an overall, enterprise-wide approach for managing information security and technology risk. They establish the following process to identify, assess and manage such risks across our three lines of defense:


text: 1.Identification: We evaluate the activities of our lines of business on a regular basis to identify potential technology risk, including cybersecurity threats and vulnerabilities. This process takes into account the changing business environment, the technology and cyber threat landscape, and the objectives of the line of business being assessed. Capital One Financial Corporation (COF)


text: 2.Assessment, Measurement and Response: Management assesses identified risks to estimate such risk's potential severity and the likelihood of occurrence. Once a risk is identified and measured, management determines the appropriate response, including determining whether to accept the risk in accordance with our established risk appetite, or alternatively to implement new controls, enhance existing controls, and/or develop additional mitigation strategies to reduce the impact of the risk.


text: 3.Monitoring and Testing: Management is required to evaluate the effectiveness of risk management practices and controls through monitoring of key risk indicator metrics, testing and other activities. Identified issues are remediated, addressed via mitigation plans, or escalated, in line with our risk appetite.


text: 4.Aggregation, Reporting and Escalation: Management collects and aggregates risks across the Company in order to support strategic decision-making and to measure overall risk performance against risk appetite metrics. Management also establishes processes designed to escalate, report, and address risks and deficiencies within different business lines, according to the requirements of our policies. For additional information regarding the escalation of these risks to the Board of Directors, see "Governance" below.


text: Our policies and procedures collectively help execute a risk management approach that accounts for cybersecurity threats specifically targeting us, as well as those that may arise from our engagement with business partners, customers, service providers and other third parties. For example, we have processes designed to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers. The procedures, capabilities and processes established under our policies are subject to regular review by the Chief Information Security Officer ("CISO") and Chief Technology Risk Officer ("CTRO"). See "Governance" below for more information.


text: As part of our cybersecurity program, we employ a range of security mechanisms and controls throughout our technology environment, which include the use of tools and techniques to search for cybersecurity threats and vulnerabilities, as well as processes designed to address such threats and vulnerabilities. We also engage a number of external service providers with additional knowledge and capabilities in cybersecurity threat intelligence, detection, and response. In addition, a range of cyber educational initiatives are employed to promote best practices for protecting our information and data, and reporting cyber threats and other risks to corporate systems, data, and facilities.


text: We also maintain an Enterprise Cyber Response Plan ("ECRP") for handling potential or actual cybersecurity events that could impact us and our personnel, data, systems and customers. The ECRP defines the roles and responsibilities of various teams, individuals, and stakeholders in performing this enterprise response, guides decision making for escalation and other actions, and helps to plan follow-on actions designed to reduce the likelihood of similar events' recurrence in the future.


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, such as the 2019 Cybersecurity Incident, have materially affected our overall business strategy, results of operations, or financial condition. For further discussion of cybersecurity, and related risks for our business, see "Item 1A. Risk Factors" under the headings "We face risks related to our operational, technological and organizational infrastructure," and "A cyber-attack or other security incident on us or third parties (including their supply chains) with which we conduct business, including an incident that results in the theft, loss, manipulation or misuse of information (including personal information), or the disabling of systems and access to information critical to business operations, may result in increased costs, reductions in revenue, reputational damage, legal exposure and business disruptions."


text: The Board of Directors is responsible for providing oversight of our Framework. The Risk Committee of the Board of Directors ("Risk Committee") assists the full Board of Directors in discharging these responsibilities.


text: The Risk Committee is responsible for overseeing our Framework, including cybersecurity and technology risk. The Risk Committee regularly receives reports from management on our cybersecurity and technology risk profile, and key enterprise cybersecurity initiatives, and on any identified significant threats or incidents, or new risk developments. The Risk Committee coordinates with the full Board of Directors regarding the strategic implications of cybersecurity and technology risks.


text: At least annually, the Board of Directors, either directly or through the Risk Committee, reviews our technology strategy with the CIO; reviews our information security program with the CISO and the CTRO; and approves our information security policy and program. In addition, the Risk Committee and the Board of Directors participate in periodic cybersecurity education sessions.


text: We assess and manage risk at the enterprise level according to our Framework using a three lines of defense model.


text: For information security and technology risks, our first line of defense includes the following: • Chief Information Security Officer: The CISO establishes and manages the enterprise-wide information security program. • Chief Information Officer: The CIO oversees the establishment of appropriate governance, processes, and accountabilities within each business area to comply with our internal policies.


text: Our second line of defense includes the following: • Chief Technology Risk Officer: The CTRO provides independent oversight of our information security and technology risk programs and challenge of first line risk management and risk-taking activities pertaining to information security and technology risk. • The Executive Risk Committee: This committee provides a forum for our top management to have integrated discussions of risk management across the enterprise, including cybersecurity and technology risk, with the purpose of ensuring prioritization and awareness, encouraging alignment, and coordinating risk management activities among key executives. Primary responsibility for specialized risk categories, such as cybersecurity and technology, can also be delegated to other senior management sub-committees, as appropriate.


text: Our third line of defense is comprised of: • Internal Audit: Our internal audit team provides independent and objective assurance to senior management and to the Board of Directors that our information security and technology risk management processes are designed and working as intended.


text: In order to be appointed to one of the roles described above, we require the individuals to possess significant relevant experience and expertise in information security, technology, risk management or audit, as demonstrated by a combination of prior employment, possession of relevant industry certifications or related degrees, and other competencies and qualifications.


text: Risk Management and Strategy As a financial services company entrusted with the safeguarding of sensitive information, including sensitive personal information, we believe that a strong enterprise cybersecurity program is a vital component of effectively managing risks related to the confidentiality, integrity and availability of our data. While no organization can eliminate cybersecurity and technology risk entirely, we devote significant resources to a cybersecurity program designed to mitigate such risks. For further discussion of cybersecurity and technology risk, and related risks for our business, see "Item 1A. Risk Factors. "


text: We manage cybersecurity and technology risk at the enterprise level according to our Framework, as described in more detail under "Part II—Item 7. MD&A—Risk Management" in this Report, which uses a three lines of defense model. Our cybersecurity and technology risks are managed programmatically under the "operational risk" category of our Framework. Through this Framework, we establish practices for assessing our risk posture and executing key controls for cybersecurity and technology risk, data management, and oversight of third parties with which we do business.


text: These operational risks are managed within a governance structure that consists of defined roles and responsibilities, formal governance bodies, and processes, policies and standards.


text: Our policies and procedures define an overall, enterprise-wide approach for managing cybersecurity and technology risk. They establish the following process to identify, assess and manage such risks across our three lines of defense:


text: 1.Identification: We evaluate the activities of our lines of business on a regular basis to identify potential cybersecurity and technology risk, including cybersecurity threats and vulnerabilities. This process takes into account the changing business environment, the technology and cyber threat landscape, and the objectives of the line of business being assessed.


text: 2.Assessment, Measurement and Response: Management assesses identified risks to estimate such risk's potential severity and the likelihood of occurrence. Once a risk is identified and measured, management determines the appropriate response, including determining whether to accept the risk in accordance with our established risk appetite, or alternatively to implement new controls, enhance existing controls, and/or develop additional mitigation strategies to reduce the impact of the risk.


text: 3.Monitoring and Testing: Management is required to evaluate the effectiveness of risk management practices and controls through monitoring of key risk indicator metrics, testing and other activities. Identified issues are remediated, addressed via mitigation plans, or escalated, in line with our risk appetite.


text: 4.Aggregation, Reporting and Escalation: Management collects and aggregates risks across the Company in order to support strategic decision-making and to measure overall risk performance against risk appetite metrics. Management also establishes processes designed to escalate, report, and address risks and deficiencies within different business lines, according to the requirements of our policies. For additional information regarding the escalation of these risks to the Board of Directors, see "Governance" below.


text: Our policies and procedures collectively help execute a risk management approach designed to account for cybersecurity threats specifically targeting us, as well as those that may arise from our engagement with business partners, customers, service providers and other third parties. For example, our third-party risk management policy is designed to help enable timely and effective identification, measurement, and management of third-party risks throughout the lifecycle of such relationships, which includes planning, due diligence and third-party selection, contracting, risk-based monitoring, and termination. We also assess, identify, and manage cybersecurity and technology risks associated with our merger and acquisition activities. See "Governance" below for more information.


text: As part of our cybersecurity program, we employ a range of security mechanisms and controls throughout our technology environment, which include the use of tools and techniques designed to search for cybersecurity threats and vulnerabilities, as well as processes designed to address such threats and vulnerabilities. We also engage a number of external service providers with additional knowledge and capabilities in cybersecurity threat intelligence, detection, and response. When appropriate, we leverage partnerships with relevant government entities, law enforcement agencies, and industry information sharing forums, such as the Financial Services Information Sharing and Analysis Center ("FS-ISAC"), to further inform our understanding of the threat environment and how to effectively defend the Company against such threats. These defenses include, among other things, a range of cyber educational initiatives that we design and deliver to employees across the enterprise to promote best practices for protecting our information and data, and reporting cyber threats and other risks to corporate systems, data, and facilities. Employees are required to annually certify their completion of training on both cybersecurity and data privacy, and our cyber education program implements targeted testing and training focused on high-risk populations and responding to an evolving threat landscape.


text: We also maintain an Enterprise Cyber Response Plan ("ECRP") designed to handle potential or actual cybersecurity events that could impact us and our personnel, data, systems and customers. The ECRP defines the roles and responsibilities of various teams, individuals, and stakeholders in performing this enterprise response, guides decision making for taking actions and escalations to our executive management and the Board of Directors, as appropriate, and helps to plan follow-on actions that seek to reduce the likelihood of similar events' recurrence in the future. The ECRP is reviewed and refined periodically and refinement is informed in part by a series of table-top exercises that we conduct over the course of the year.


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, such as the 2019 Cybersecurity Incident, have materially affected our overall business strategy, results of operations, or financial condition. For further discussion of cybersecurity, and related risks for our business, see "Item 1A. Risk Factors" under the headings "We face risks related to our operational, technological and organizational infrastructure," and "A cyber-attack or other security incident on us or third parties (including their supply chains) with which we conduct business, including an incident that results in the theft, loss, manipulation or misuse of information (including personal information), or the disabling of systems and access to information critical to business operations, may result in increased costs, reductions in revenue, reputational damage, legal exposure and business disruptions."


text: The Board of Directors is responsible for providing oversight of our Framework. The Risk Committee of the Board of Directors ("Risk Committee") assists the full Board of Directors in discharging these responsibilities.


text: The Risk Committee is responsible for overseeing our Framework, including cybersecurity and technology risk. The Risk Committee regularly receives reports from management on our cybersecurity and technology risk profile, and key enterprise cybersecurity initiatives, and on any identified significant threats or incidents, or new risk developments, which, in the aggregate, are intended to present an overall view on the status of our cybersecurity program and the Company's compliance with applicable legal and regulatory requirements. The Risk Committee coordinates with the full Board of Directors regarding the strategic implications of cybersecurity and technology risks.


text: At least annually, the Board of Directors, either directly or through the Risk Committee, reviews our technology strategy with the Chief Information Officer ("CIO"); reviews our cybersecurity program with the Chief Information Security Officer ("CISO") and the Chief Technology Risk Officer ("CTRO"); and approves our cybersecurity policy and program. In addition, the Risk Committee and the Board of Directors participate in periodic cybersecurity education sessions.


text: We assess and manage risk at the enterprise level according to our Framework using a three lines of defense model. For cybersecurity and technology risks, our first line of defense includes the following: • Chief Information Security Officer: The CISO establishes and manages the enterprise-wide cybersecurity program. • Chief Information Officer: The CIO oversees the establishment of appropriate governance, processes, and accountabilities within each business area to comply with our internal policies.


text: our second line of defense includes the following: • Chief Technology Risk Officer: The CTRO provides independent oversight of our cybersecurity programs and challenges of first line risk management and risk-taking activities pertaining to cybersecurity and technology risk. Capital One Financial Corporation (COF)


text: • The Executive Risk Committee: This committee provides a forum for our top management to have integrated discussions of risk management across the enterprise, including cybersecurity and technology risk, with the purpose of ensuring prioritization and awareness, encouraging alignment, and coordinating risk management activities among key executives. Primary responsibility for specialized risk categories, such as cybersecurity and technology, can also be delegated to other senior management sub-committees, as appropriate.


text: our third line of defense is comprised of: • Internal Audit: Our internal audit team provides independent and objective assurance to senior management and to the Board of Directors that our cybersecurity and technology risk management processes are designed and working as intended.


text: In order to be appointed to one of the roles described above, we require the individuals to possess significant relevant experience and expertise in information security, technology, risk management or audit, as demonstrated by a combination of prior employment, possession of relevant industry certifications or related degrees, and other competencies and qualifications. In particular, our CISO has more than 30 years of cybersecurity and information technology experience, including for nearly five years as CISO at a major global technology company before joining the Company, and holds a CISO Certificate from Carnegie Mellon's Heinze College. Our CTRO has been in cybersecurity for approximately 25 years and spent over three years as the global CISO of a G-SIB. Prior to that, he served as a senior executive in cybersecurity in the U.S. government. Our CIO has been with the Company for approximately 20 years, during which he has overseen multiple technology transformation initiatives, including the Company's transition to the public cloud. He holds degrees in physics and business administration from Harvard University.


text: Risk Management and Security As a diversified healthcare services leader that is dedicated to advancing health outcomes for patients everywhere, cybersecurity risk management is integral to our enterprise risk management strategy. Our management, with involvement and input from external consultants and oversight from our Board of Directors ("Board"), performs an annual enterprise-wide risk assessment ("ERA") to identify key existing and emerging risks. One of the principal risks identified and assessed through this process is cybersecurity, which remains a key focus for the Company, management, and our Board.

companyName: MCKESSON CORP

ticker: MCK


text: Our Cybersecurity Incident Response Plan ("Response Plan") provides a framework for responding to cybersecurity incidents. The Response Plan governs activities such as preparation, detection, coordination, eradication, recovery, and appropriate escalations to the Company's senior management, disclosure committee, Board, and relevant Board committees. The Response Plan is routinely reviewed and updated as appropriate under the leadership of our Chief Information Security Officer (CISO).


text: Enterprise-wide cybersecurity and privacy training continue to serve an important role in risk reduction and protection of the Company and our stakeholders. We require periodic access-based and role-based privacy and cybersecurity training, which is updated to reflect changes in the threat environment, assessment or audit findings, laws, and regulations. We also engage and educate employees through cybersecurity and privacy awareness programs and communication campaigns.


text: We also engage internal and external assessors, consultants, auditors, and other third parties, to identify opportunities for improvements to our cybersecurity program. We manage cybersecurity risks associated with third parties, including vendors, service providers, and external users of our systems. This includes conducting due diligence on the third parties we use, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems, and by using contracts to reinforce their cybersecurity obligations.


text: McKESSON CORPORATION We develop and maintain systems and operate programs that seek to mitigate the impact of cybersecurity incidents. In the face of sophisticated and rapidly evolving attempts to overcome our security measures, we must continually monitor and update these systems and programs. Both intentional and unintentional occurrences have caused, and could cause in the future, a variety of adverse business impacts to our information systems and data. See "Risk Factors" in Item 1A of Part I above for additional information on risks related to our business, including for example, risks related to privacy and data protection, cybersecurity incidents, third-party relationships, and continuity of our information systems and networks, operational technology, and technology products or services.


text: Our joint Chief Information Officer and Chief Technology Officer (CIO/CTO) leads management's assessment and management of cybersecurity risk with the assistance of the Company's CISO who reports to the CIO/CTO. The CIO/CTO reports to our CFO, is a member of the Executive Operating Team, and provides updates to that group about cybersecurity matters. Our CIO/CTO has more than 28 years of experience managing technology and risks and advising on cybersecurity issues and our CISO has more than 20 years of relevant experience, is a Certified Information System Security Professional (CISSP), and a Certified Information Systems Auditor (CISA).


text: Cybersecurity is among the risks identified by our ERA for Board-level oversight. The Audit Committee of the Board has oversight of information technology controls related to financial reporting, while the Compliance Committee of the Board has oversight of technology-related risk, including privacy and cybersecurity. The Audit Committee and Compliance Committee meet jointly at least annually to review cybersecurity risks and programs, and they are updated as needed on cybersecurity threats, incidents, or new developments in our cybersecurity risk profile. The chairs of the Audit Committee and Compliance Committee provide updates to the Board after each committee meeting. The CIO/CTO and CISO provide regular updates to the Board, Audit Committee, or Compliance Committee about material risks from cybersecurity threats. The CIO/CTO or CISO also provide regular updates to the Board, Audit Committee or Compliance Committee about cybersecurity trends and regulatory updates, data governance and usage, technology infrastructure, our training and compliance efforts, and implications for our business strategy. External consultants also periodically update the Board on cybersecurity trends and developments. In addition to the information provided in these meetings, members of our Board have access to continuing education, which includes topics relating to cybersecurity risks.


text: Our Cybersecurity Risk Management Program ("RM Program") is aligned with the National Institute of Standards and Technology Cybersecurity Framework and other industry best practices. The RM Program is designed to identify, assess and mitigate material cybersecurity risks.


text: McKESSON CORPORATION We have implemented cybersecurity controls designed to protect our systems, data and operations from cybersecurity risks. Enterprise-wide cybersecurity and privacy training continue to serve an important role in risk reduction and protection of the Company and our stakeholders. We require periodic access-based and role-based privacy and cybersecurity training, which is updated to reflect changes in the threat environment, audit findings, laws, and regulations. We also engage and educate employees through cybersecurity and privacy awareness programs and communication campaigns. Our Cybersecurity Incident Response Plan ("Response Plan") provides a framework for responding to cybersecurity incidents. The Response Plan governs activities such as preparation, detection, coordination, eradication, recovery, and appropriate escalations to the Company's senior management, disclosure committee, Board, and relevant Board committees. The Response Plan is routinely tested, reviewed and updated as appropriate under the leadership of our Chief Information Officer and Chief Technology Officer ("CIO/CTO") with the assistance of the Company's Chief Information Security Officer ("CISO").


text: We also engage internal and external assessors, consultants, auditors, and other third parties, to assess our RM Program. We manage cybersecurity risks associated with third parties, including vendors, service providers, and external users of our systems. This includes conducting due diligence on the third parties we use, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems, and by using contracts to reinforce their cybersecurity obligations.


text: Although we believe that we maintain reasonable cybersecurity measures, we recognize that cyber threats continue to evolve, and no system is immune to risk.


text: Both intentional and unintentional occurrences have caused, and could cause in the future, a variety of adverse business impacts to our information systems and data. For a discussion of whether and how any risks from cybersecurity threats have affected or, if realized, are reasonably likely to materially affect the Company, see "Risk Factors" in Item 1A of Part I above for additional information on risks related to our business, including for example, risks related to privacy and data protection, cybersecurity incidents, third-party relationships, and continuity of our information systems and networks, operational technology, and technology products or services.


text: Our CIO/CTO leads management's assessment and management of cybersecurity risk with the assistance of the Company's CISO who reports to the CIO/CTO. The CIO/CTO reports to our CFO, is a member of the Executive Operating Team, and provides updates to that group about cybersecurity matters. Our CIO/CTO has more than 29 years of experience managing technology and risks, and advising on cybersecurity issues and our CISO has more than 21 years of relevant experience, is a Certified Information System Security Professional (CISSP), and a Certified Information Systems Auditor (CISA).


text: Cybersecurity is among the risks identified by our ERA for Board-level oversight. The Audit Committee of the Board has oversight of information technology controls related to financial reporting, while the Compliance Committee of the Board has oversight of technology-related risk, including privacy and cybersecurity. The Audit Committee and Compliance Committee meet jointly at least annually to review cybersecurity risks and programs, and they are updated as needed on cybersecurity threats, incidents, or new developments in our cybersecurity risk profile. The chairs of the Audit Committee and Compliance Committee provide updates to the Board after each committee meeting. The CIO/CTO and CISO provide regular updates to the Board, Audit Committee, or Compliance Committee about material risks from cybersecurity threats. The CIO/CTO or CISO also provide regular updates to the Board, Audit Committee or Compliance Committee about cybersecurity trends and regulatory updates, data governance and usage, technology infrastructure, our training and compliance efforts, and implications for our business strategy. In addition to the information provided in these meetings, members of our Board have access to continuing education, which includes topics relating to cybersecurity risks.


text: The Board of Directors recognizes the critical importance of maintaining the trust and confidence of our suppliers, customers, other business partners and employees. The Board of Directors is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating any cybersecurity threats and effectively responding to cybersecurity incidents should they occur.

companyName: Callon Petroleum Co


text: As of the date of this 2023 Annual Report on Form 10-K, the Company is not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, as discussed under "Item 1A. Risk Factors," specifically the risk titled "Our business could be negatively affected by security threats. A cyberattack or similar incident could occur and result in information theft, data corruption, operational disruption, damage to our reputation or financial loss," the sophistication of cyberattacks continues to increase, and the preventative actions the Company takes to reduce the risk of cyber incidents and protect its systems and information may be insufficient. Accordingly, no matter how well the Company's controls are designed or implemented, it will not be able to anticipate all security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. In light of these risks, the Company has also developed cybersecurity detection and response protocols as described below to attempt to mitigate the impact in the event of a breach.


text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Governance – The Board of Directors has responsibility for oversight of cybersecurity risk management and regularly interacts with the Company's ERM function, the Company's Chief Information Officer ("CIO"), and other members of management. • Collaborative Approach – The Company has implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. The Company also collaborates with others in the industry and actively participates in a specific oil and gas threat intelligence group with weekly meetings and up-to-date threat notices. • Technical Safeguards – The Company deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware software and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. The Company performs an annual penetration test for identification of any vulnerabilities; in 2023, this test was performed by a third-party audit firm. • Incident Response and Recovery Planning – The Company has established and maintains comprehensive incident response and recovery plans that address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis, with the participation of executive officers and employees in our IT, legal and operations departments. • Third-Party Risk Management – The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business. In 2023, the Company completed a comprehensive review of certain third-party providers that have access to the Company's data, such as banks, and SaaS vendors, and implemented a third-party risk management service which (i) allows for comprehensive vendor assessments with risk scoring, (ii) informs risk decisions with increased visibility and cybersecurity ratings, (iii) continuously monitors for vendor breaches and other significant events via various data feeds, and (iv) allows for collaboration with vendors to assess and remediate risk. • Education and Awareness – The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices. In addition to our annual required training, the Company promotes awareness through regular phishing simulations and educational opportunities, including an FBI-led training in 2023.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability management, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity and risk assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Board of Directors, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: The Board of Directors oversees the Company's ERM program, including the management of risks arising from cybersecurity threats. On an annual basis, the Board of Directors discusses the Company's approach to cybersecurity risk management with the CIO. The Board of Directors also receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties.


text: The CIO, in coordination with the Company's executive team, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CIO oversees the monitoring, prevention, detection, mitigation, and remediation of cybersecurity threats and incidents, and reports such threats and incidents to the Board of Directors when appropriate. The CIO is supported by, among others, a Cybersecurity Architect who is a Certified Information Systems Security Professional (CISSP) and an Application Director who is Certified in Risk and Information Systems Control.


text: Angelina C. Day has served as the Company's Vice President and CIO since July 2022. In this role, she is responsible for all aspects of information technology, including cybersecurity. Prior to joining the Company, Ms. Day was IT Director at EP Energy Corporation, an independent E&P company, from May 2012 until March 2022, where she oversaw the information technology and security functions. Prior to EP Energy, Ms. Day held various roles with increasing responsibility in technology and leadership at El Paso Corporation. Ms. Day has over 20 years of energy, technology and risk management experience. She is also a member of the Houston CIO Community (Evanta) Governing Body, an organization that fosters collaboration and knowledge sharing across the Houston CIO community. Ms. Day holds a B.B.A. in Computer Information Systems from the University of Houston Downtown.


text: Supporting our CIO in assessing and managing the Company's material risks from cybersecurity threats are the Company's COO, CFO, and General Counsel, each of whom have over 20 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: The Company faces a variety of cybersecurity threats that could impact its business, financial condition, results of operations, cash flows or reputation. The Company has established a Cybersecurity Incident Response Team (the "CIRT") to develop and continually enhance a cyber incident response plan, which guides the Company in identification, containment, eradication and recovery from cybersecurity incidents. The CIRT is charged with the evaluation and implementation of incident response tools, and the implementation of training procedures and exercises to mitigate and remediate potential cybersecurity incidents. The CIRT members are comprised of representatives from management, including the Company's Chief Executive and Financial Officers, information technology, legal and communications teams and reports to the Risk & Sustainability Committee of the Company's Board of Directors, which is tasked with oversight of the general risk and sustainability programs of the Company. The Board has an active role in overseeing management of the Company's risks and regularly reviews information regarding the Company's operations, liquidity and associated risks. While each committee of the board is responsible for evaluating certain risks and overseeing the management of those risks, the entire board is regularly informed through committee reports.

companyName: FLOTEK INDUSTRIES INC/CN/

ticker: FTK


text: The Company uses several real-time systems for detecting potential threats to its systems, devices and user accounts. The Company also engages third-party consultants to evaluate its security and disclose any potential weaknesses within the Company's systems. The CIRT will review the steps required to minimize the effects of any discovered weaknesses and implement changes as deemed necessary. The Company's information technology team is tasked with the initial assessment of a suspected incident and evaluates the suspected incident based on the Company's cybersecurity policy.


text: In the event of an incident, we intend to follow our cyber incident response plan. Any assessment that is deemed an actionable incident would trigger an alert to the CIRT. The CIRT will further assesses the incident according to a predefined scale (e.g., low, medium, high and critical) and initiate the Company's incident response plan and communication protocols. The CIRT, in conjunction with the Risk and Sustainability Committee, will assess the materiality of the incident with respect to the rules, regulations and disclosure requirements of the SEC and NYSE. See "Risk Factors" in Item 1A of this Annual Report. As of December 31, 2023, we have not identified any risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.


text: The Company faces a variety of cybersecurity threats that could impact its business, financial condition, results of operations, cash flows or reputation. The Company has established a Cybersecurity Incident Response Team (the "CIRT") to develop and continually enhance a cyber incident response plan, which guides the Company in identification, containment, eradication and recovery from cybersecurity incidents. The CIRT is led by the Company's Director of Information Technology (the "Director of IT"), who reports to the Company's Chief Financial Officer. The Director of IT has a formal education in Computer Information Systems and is a Microsoft Certified Information Systems Professional with 28 years of experience. The Director of IT has comprehensive experience in cybersecurity controls, including intrusion detection, network security, operating systems, incident response and a track record of identifying cyber risks and implementing countermeasures to mitigate cyber attacks.


text: The CIRT is charged with the evaluation and implementation of incident response tools, and the implementation of mandatory training procedures and exercises to mitigate and remediate potential cybersecurity incidents. The CIRT members are comprised of representatives from management, including the Company's Chief Executive and Financial Officers, information technology, legal and communications teams. The CIRT reports to the Risk & Sustainability Committee of the Company's Board of Directors, which is tasked with oversight of the general risk and sustainability programs of the Company. The Board has an active role in overseeing management of the Company's risks and regularly reviews information regarding the Company's operations, liquidity and associated risks. While each committee of the Board is responsible for evaluating certain risks and overseeing the management of those risks, the entire Board is regularly informed through committee reports.


text: The Company uses several real-time systems for detecting potential threats to its systems, devices and user accounts. In addition, the Company reviews controls implemented by its third-party service providers to ensure that the providers' controls have been designed to effectively mitigate cybersecurity risks that could affect the Company's systems. The Company also engages third-party consultants to evaluate its security and disclose any potential weaknesses within the Company's systems. The CIRT reviews the findings of these evaluations and will determine the steps required to minimize the effects of any discovered weaknesses and implement changes as deemed necessary. The Company's information technology team is tasked with the initial assessment of a suspected incident and evaluates the suspected incident based on the Company's cybersecurity policy.


text: In the event of an incident, we intend to follow our cyber incident response plan. Any assessment that is deemed an actionable incident would trigger an alert to the CIRT. The CIRT will further assesses the incident according to a predefined scale (e.g., low, medium, high and critical) and initiate the Company's incident response plan and communication protocols. The CIRT, in conjunction with the Risk and Sustainability Committee, will assess the materiality of the incident with respect to the rules, regulations and disclosure requirements of the SEC and NYSE. See "Risk Factors" in Item 1A of this Annual Report. As of December 31, 2024, we have not identified any risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.


text: Risk Management and Strategy Information security and protection of our data is important to Wesco, our customers and suppliers. We take a comprehensive, multi-layered approach to securing our data and business systems from attack, compromise or loss. This includes the combination of leading technologies, physical and organizational safeguards, including a robust suite of security policies and procedures. We have a dedicated 24 hours per day/seven days per week Cybersecurity Operations team, with a third-party service provider, monitoring our environment for signs of attack and responding in real-time.

companyName: WESCO INTERNATIONAL INC

ticker: WCC


text: The implementation of a multi-layer and multi-provider portfolio of technologies is designed to deliver overlapping coverage against today's cybersecurity threats with a strong defensive and response driven security posture. We evaluate risks, threats, intelligence feeds and vulnerabilities to adapt, mitigate or respond as appropriate to preserve a secure state. Additionally, Wesco has a comprehensive third-party risk management program to evaluate partners prior to onboarding, throughout the life of the relationship, and through the close out of the relationship. This program is designed to ensure our third-party partners adhere to Wesco's security policies and expectations as the threat landscape evolves and the relation between the organization changes. Wesco's cybersecurity programs are reviewed as part of our information security management system ("ISMS") by external, independent third parties and in 2022, we achieved ISO 27001 certification for our ISMS. We conduct mandatory information security awareness training for our employees at least annually and enhanced training for specialized personnel. We have instituted regular attack or malicious activity simulations for employees to enhance awareness and responsiveness to such possible threats, and we also employ third parties to perform penetration and vulnerability tests.


text: While we focus on prevention and detection, we have response and recovery plans in place, as well as service agreements and partner engagements should there be a need for us to respond to an attack. We have adopted a cybersecurity incident response plan that provides direction and a defined approach for preparing for, identifying and responding to cybersecurity incidents that may pose a potential threat to our information systems, networks and data. The plan defines the roles and responsibilities of our IT and security teams and other functional teams that comprise the cybersecurity incident response team, as well as provides controls and procedures for timely and accurate reporting of material cybersecurity incidents. Significant cybersecurity incidents are reviewed by a cross-functional team to determine whether further escalation is appropriate. Any incident that potentially is, or may become, material is reported to senior management for materiality and disclosure determinations. We also maintain cyber liability insurance coverage. While we did not experience any material data breaches in 2023 and no risks from cybersecurity threats have materially impacted or are reasonably likely to materially impact the Company's business strategy, operations, or financial condition, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: To more effectively prevent, detect and respond to information security threats, we have a dedicated Chief Information Security Officer ("CISO") whose team is responsible for leading enterprise-wide information security strategy, policy, standards, architecture and processes. The CISO, with over 30 years of technology experience, has been in this role with Wesco since 2020, has a total of eight years of experience serving in the role of Chief Information Security Officer, and has twelve years of experience dedicated to cybersecurity. The CISO reports to our Executive Vice President, Chief Information and Digital Officer ("CIDO"), who reports directly to our Chief Executive Officer. The CISO and CIDO regularly review cybersecurity matters with our Chief Executive Officer and other members of our senior management, including cybersecurity risks and threats and the status of our cybersecurity incident response plan and related processes relating to the prevention, detection, mitigation and remediation of cybersecurity incidents. As part of its oversight responsibility of cybersecurity risk and the overall enterprise risk management process, the Audit Committee of our Board of Directors meets at least quarterly with our CISO, CIDO, and other senior leaders to receive updates on cybersecurity risks and threats (and should they arise, any material incidents), the status of initiatives to strengthen our information security systems, management's assessments of our security program, and compliance with disclosure requirements. The Audit Committee and senior management report any findings and recommendations, as appropriate to the full Board of Directors for consideration. Wesco's cybersecurity program is regularly evaluated by internal and external experts with the results of those reviews reported to senior leadership and the Board of Directors. We also actively engage with strategic partners, industry groups, and intelligence and law enforcement to better understand macro trends and significant risk concerns to better inform and enhance our cybersecurity policies and procedures.


text: Risk Management and Strategy Information security and protection of our data is important to Wesco, our customers and suppliers. As a global company, we face various cybersecurity threats, ranging from phishing, ransomware and denial-of-service attacks to more recent threats incorporating the use of artificial intelligence. Our suppliers, third-party vendors, service providers, customers, and other business partners are also vulnerable to similar cybersecurity risks. In response to this evolving cybersecurity threat landscape, we have implemented a cybersecurity risk management program that follows a comprehensive, multi-layered approach to securing our data and business systems from attack, compromise or loss, guided by the National Institute of Standards and Technology (NIST) Cybersecurity Framework. This includes the combination of leading technologies, physical and organizational safeguards, including a robust suite of security policies and procedures. We have a dedicated 24 hours per day/seven days per week Cybersecurity Operations team, with a third-party service provider, monitoring our environment for signs of attack and responding in real-time. Our implementation of a multi-layer and multi-provider portfolio of technologies is designed to deliver overlapping coverage against continually evolving cybersecurity threats with a strong defensive and response driven security posture. We evaluate risks, threats, intelligence feeds and vulnerabilities to adapt, mitigate or respond as appropriate to preserve a secure state. Additionally, we identify, assess and manage risks associated with our use of third-party service providers and other business partners and we maintain a comprehensive third-party risk management program to evaluate partners prior to onboarding, throughout the life of the relationship, and through the conclusion of the relationship. This program is designed to ensure our third-party partners adhere to Wesco's security policies and expectations as the threat landscape and the relationship evolve.


text: We engage third-party experts, including auditors, consultants and advisors, to evaluate and enhance our cybersecurity program through security certifications, assessments and testing. Wesco's cybersecurity programs are reviewed as part of our information security management system ("ISMS") by external, independent third-party auditors. We have received ISO 27001 certification for our ISMS and we undergo annual audits by an independent accreditation body to maintain this certification. We also engage third-party consultants to perform penetration and vulnerability tests at least once per quarter, as well as annual "red team" engagements that simulate cyber threats. The results of these tests and assessments are used to establish priorities, allocate resources, and improve controls. We conduct mandatory information security awareness training for all new hires and employees at least annually as well as specialized training for certain functions, such as developers, platform administrators and finance personnel. We have instituted regular phishing, social engineering and other malicious attack simulations, generally at least once per quarter, to enhance our employees' awareness and responsiveness to such possible threats. We run several awareness campaigns each year covering a variety of topical cybersecurity subjects and we maintain an internal website that is accessible to all employees that has security policies, additional trainings, and current news events. Our security policies and trainings are regularly evaluated and updated to adapt to changing regulations and emerging cybersecurity risks. Our training program also includes expert guest speakers and additional training during cybersecurity awareness month each October.