text: Recognizing the complexity and evolving nature of cybersecurity threats, incidents and risks, we engage third-party experts, including managed IT service providers and cybersecurity consultants, to evaluate and support our risk management systems. We also have processes to assess third party risks, and we perform third-party risk management to identify and mitigate risks from third party providers, such as vendors, suppliers, CROs, and other business partners associated with our use of third-party service providers.


text: As of the date of this Annual Report on Form 10-K, risks from cybersecurity threats have not materially affected, and we do not believe are reasonably likely to materially affect, us, our business strategy, results of operations, or financial condition. However, cybersecurity threats are constantly evolving, becoming more frequent and more sophisticated and are being made by groups of individuals with a wide range of expertise and motives, which increases the difficulty of detecting and successfully defending against them. While we have implemented measures to safeguard our operational and technology systems, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. For more information about these risks, please see "Risk Factors – Cyber-attacks or other failures in our telecommunications or information technology systems, or those of our collaborators, contract research organizations, third-party logistics providers, distributors or other contractors or consultants, could result in information theft, data corruption and significant disruption of our business operations." in this Annual Report on Form 10-K.

companyName: Karuna Therapeutics, Inc.

secItem: Item 1C


text: Cybersecurity Governance Our board of directors has overall oversight responsibility for our risk management, and delegates information security and related risk management oversight to the audit committee of the board of directors through the audit committee charter. Members of the audit committee receive updates on a regular basis from management regarding matters of cybersecurity. This includes existing and new cybersecurity risks, how management is addressing or mitigating those risks, cybersecurity and data privacy incidents (if any), and the status of key information security initiatives.


text: Management is responsible for identifying, considering and assessing material risks for the business on an ongoing basis, including in relation to cybersecurity. As part of this process, our Vice President of Information Technology is tasked with establishing processes to ensure that potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our Vice President of Information Technology receives reports from our cybersecurity team and oversees the monitoring of the prevention, detection, mitigation, and remediation of cybersecurity incidents, if any. In addition, our Vice President of Information Technology reports cybersecurity incidents to our compliance committee, which is composed of relevant members of management, and, where appropriate, to the audit committee.


text: Our Vice President of Information Technology and our cybersecurity team are experienced information systems security professionals. These individuals, working with cybersecurity vendors, including managed IT service providers and training partners, monitor for vulnerabilities and threats, which are reported to other members of management, where appropriate.


text: Cyber Risk Management and Strategy Kymera uses, stores and processes data for and about our research programs, clinical trials, employees, and suppliers. We have developed and maintain an information security program designed to assess, identify, and manage risks from cybersecurity threats, including to our data and systems. We conduct periodic assessments of our assets, including internal and external security testing, as part of our risk management process and to evaluate the effectiveness of applicable security controls. These assessments are informed by industry standards. Our cybersecurity risk management process is a part of our overall risk management program. We also have an employee education program that includes training designed to raise awareness of cybersecurity threats. We have adopted an Incident Response Policy that outlines the legal and governance process for identifying and managing material cyber risks to our information and information systems and our framework for assessing and responding to cyber incidents, as applicable.

companyName: Kymera Therapeutics, Inc.

ticker: KYMR


text: Governance Related to Cybersecurity Risks Under the ultimate direction of the Chief Executive Officer and our executive management team, the Cybersecurity Supervisory Committee (CSSC) has primary responsibility for overseeing our management of cybersecurity risks, which includes representatives from finance, legal, operations, human resources, and information technology. The CSSC meets as circumstances warrant to review and update incident response procedures and to provide oversight of incident response activities of the Cyber Security Incident Response Team.


text: The head of information technology and the CSSC have primary responsibility for assessing and managing our cybersecurity program. The head of information technology, who reports to the Chief Operating Officer, has more than 25 years of experience in building and leading information technology and security teams.


text: The board of directors has ultimate oversight of our risk management program and has delegated oversight of that program, including, oversight of cybersecurity, to the audit committee of the board of directors. The S.V.P. of Information Technology presents to the audit committee periodically regarding cybersecurity matters. The Chief Financial Officer and the Chief Legal Officer are responsible for informing the audit committee in the event of any material cybersecurity incidents and any potential disclosure obligations arising from such incidents.


text: Risk Management and Strategy We recognize that cybersecurity threats have been increasing in number and severity in the general marketplace and in our industry. In an effort to address these threats, we maintain a cybersecurity risk management strategy that is designed to identify, assess, and manage cybersecurity risks to our business. Our cybersecurity risk management strategy includes various policies and components, including cybersecurity assessments, an incident response plan, evaluation of the security practices of our key vendors, and cybersecurity awareness training for our staff. We also leverage third-party technology and security tools and solutions, including alerting and monitoring tools, to support our cybersecurity program.

companyName: Amylyx Pharmaceuticals, Inc.

ticker: AMLX


text: We engage a third-party to conduct a cybersecurity risk assessment on an annual basis, which is informed by the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We have established a process for our IT security team to track and quantify known IT security risks and our remediation efforts through a cybersecurity risk register. The IT security team meets periodically to review and update the cybersecurity risk register based on feedback across the organization and the findings contained in our NIST-informed annual cybersecurity risk assessment. The IT security team reports on findings on at least an annual basis to the executive leadership team and the board of directors.


text: We have established a process to review and assess major software vendors' security practices prior to onboarding, which includes review of the vendors' responses to cybersecurity questionnaires and security audit reports and certifications, as applicable. Our process also includes contractual requirements for major vendors that process data on our behalf to maintain data protection safeguards.


text: We maintain a security awareness training program for employees, which is provided during onboarding. We also provide additional mandatory trainings, including phishing training, throughout the year.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected, and we do not believe they are reasonably likely to materially affect, our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and security incidents related to our and our third-party vendors' information systems. For more information about the cybersecurity risks we face, see the risk factor entitled "Cyber-attacks or other failures in our telecommunications or IT systems, or those of our collaborators, CROs, third-party logistics providers, distributors or other contractors or consultants, could result in information theft, data corruption and significant disruption of our business operations" in Item 1A- Risk Factors.


text: Governance of Cybersecurity Risks Our board of directors is responsible for the general oversight of cybersecurity risks and is informed of key updates to our cybersecurity processes by our audit committee and relevant members of our executive leadership team on at least an annual basis.


text: Our audit committee and members of our executive leadership team meet with our Head of Global Information Technology on a quarterly basis, along with other members of our IT security team from time to time, to discuss cybersecurity matters, such as the emerging cybersecurity threat landscape, significant developments to our cybersecurity processes, and our cybersecurity risk assessments.


text: Our IT security team, led by the Head of Global Information Security, Governance and Architecture ("Head of Global ISGA"), is responsible for managing and directing the day-to-day information security strategy of the organization, including oversight of our cybersecurity tools, controls and strategies to protect organization assets, networks and data. The Head of Global ISGA reports to our Head of Global Information Technology. The Head of Global ISGA routinely reports on cybersecurity risks, projects, and initiatives to the Head of Global Information Technology, who regularly reports to executive management and the audit committee on these matters as described above.


text: The Head of Global ISGA maintains a Certified Information Systems Security Professionals, or CISSP, certification and has approximately two decades of IT security management experience. The IT security team is supported by external vendors that provide managed services for network support, security operations and other IT areas as needed. Our IT security team also meets regularly with our Global Privacy Committee, which oversees our Enterprise Data Protection Program, to coordinate on cybersecurity initiatives and strategy related to protection of personal data.


text: Partnership management considers risks from cybersecurity threats as a component of its entity-wide risk assessment that includes various processes and procedures to assess, identify, and manage material risks. The Partnership uses a variety of information technology solutions in the operation of its business, all of which are maintained by reputable third-party providers, including an information technology managed services system provider that is an affiliate of Greystone.

companyName: Greystone Housing Impact Investors LP

ticker: GHI


text: Management regularly reviews material technology services used, the population of technology service providers, and material and/or sensitive financial and operational data, and then assesses the material risks from cybersecurity threats associated with these items. Management has developed processes, procedures, and internal controls to address materials risks focusing on application security (levels of access, passwords, etc.), system change controls, and operations processing. The design and operating effectiveness of internal controls are subject to testing annually by the Partnership's internal audit function.


text: Management has also developed procedures to assess the operations and internal controls of material service providers through the use of questionnaires, reviews of available policy statements, and evaluation of System and Organization Controls assurance reports, which are assessed in the aggregate to determine if the service providers have adequately addressed the risks of cybersecurity threats within their operations. The overall assessment includes an evaluation of a service provider's breach notification policies and procedures and any reported cybersecurity incidents. Management is not aware of any cybersecurity incidents at any of its service providers that have materially affected or are reasonably likely to materially affect the Partnership's operations.


text: Notwithstanding the extensive approach the Partnership takes to cybersecurity in conjunction with Greystone, the Partnership may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Partnership. See "Item 1A. Risk Factors," for a discussion of cybersecurity risks.


text: Certain employees of Greystone Manager that provide services to the Partnership are responsible for assessing and managing material risks from cybersecurity threats and are overseen by the Partnership's Chief Financial Officer. The Chief Financial Officer and relevant Greystone Manager employees collectively have over 20 years of experience in information technology risk assessment and audit evaluations. These individuals will also consult with experts from Greystone's affiliate that provides information technology managed services systems, particularly the Chief Information Security Officer ("CISO") of the Greystone affiliate, when assessing and evaluating risks of cybersecurity threats. These consultations with the CISO typically encompass a broad range of topics, including the current cybersecurity landscape and emerging threats; the status of ongoing cybersecurity initiatives and strategies; incident reports and learnings from any cybersecurity events; and compliance with regulatory requirements and industry standards.


text: The Partnership has established incident response procedures to be followed in the event of a cybersecurity incident that is overseen by the Partnership's Chief Executive Officer and Chief Financial Officer. The Chief Executive Officer and the Chief Financial Officer are notified of cybersecurity incidents as soon as the Partnership receives notification from a third-party service provider or is informed by other means, and will determine if additional internal and/or external resources are needed to evaluate, mitigate, and remediate the cybersecurity incident. At a minimum, the Board of Managers will be notified of material cybersecurity incidents prior to any public announcement and will receive updates on material developments and remediation activities.


text: The Board of Managers considers risks from cybersecurity threats in conducting its oversight of the Partnership's overall risk assessment, primarily through the activities of the Audit Committee of the Board of Managers. The Chief Financial Officer reports to the Audit Committee the results of the evaluation of risks from cybersecurity threats, the process, procedures and internal controls designed to address such risks, and other relevant information needed for the Audit Committee to operate its oversight responsibilities. The Partnership's internal audit function reports to the Audit Committee annually the results of its assessment of design and operating effectiveness testing of internal controls. In addition, the Audit Committee conducts an annual review of the Partnership's cybersecurity posture and the effectiveness of its risk management strategies. This review assists in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework of the Partnership.


text: Additional third parties, contracted with by our third-party service providers, also play a role in the Partnership's overall cybersecurity. Our third-party service providers engage with a range of additional third-party service providers and external experts, including cybersecurity assessors, consultants, and auditors, to evaluate and test their risk management systems. These services include, but are not limited to, penetration testing, independent audits, and consulting on best practices to address new challenges, and also include testing both the design and operational effectiveness of our security controls. These engagements enable our service providers to leverage specialized knowledge and insights, ensuring cybersecurity strategies and processes remain at the forefront of industry best practices.


text: Risks from Cybersecurity Incidents The Partnership has not encountered a cybersecurity incident that has materially impaired our operations or financial condition.


text: WTW's management is responsible for the day-to-day management of risks, and the board, including through its committees, is responsible for understanding and overseeing the various risks facing WTW.

companyName: WILLIS TOWERS WATSON PLC

ticker: WTW


text: Cybersecurity Risk Management and Strategy Increased global cybersecurity vulnerabilities, threats and more sophisticated and targeted cyber-related attacks pose an ongoing risk to the security of our information systems and networks. WTW seeks to manage cybersecurity risks consistent with its general approach to enterprise risk management ('ERM'). Technology and cyber risks that meet certain thresholds are escalated and tracked by the ERM team within the Risk function.


text: WTW engages third parties to conduct assessments to help it identify, categorize and manage cyber risks including SOC 2 - Type 2, ISO 27001 and a National Institute of Standards and Technology ('NIST') cybersecurity maturity assessment. Additionally, management and third parties from time to time conduct penetration testing and vulnerability scanning to help WTW identify and reduce the threat of known and emerging cybersecurity risks.


text: Board Oversight and Governance WTW's board of directors has delegated the oversight of risks to the Audit and Risk Committee through its charter. The Audit and Risk Committee assists the board of directors in its oversight of the ERM framework, policies and practices used by WTW to identify, assess and manage key risks facing WTW, including financial and strategic risks as well as risks relating to matters of compliance and internal control, tax and pension, among other matters. The Operational Transformation Committee (the 'OT Committee') oversees risks arising out of WTW's operations related to cybersecurity and other risks. WTW's Chief Information Security Officer ('CISO') and Chief Information Officer ('CIO') report to the OT Committee on cybersecurity matters, including key risks. The OT Committee reports to the board of directors at each formal board meeting and the board of directors discusses those reports.


text: Management Oversight and Governance Management plays an important role in assessing and managing WTW's material risks from cybersecurity threats. The CISO is responsible for designing and implementing a security program and strategy. WTW's CISO has served in various roles in information technology and information security for over 32 years, including serving as CISO of several public companies. The CISO holds undergraduate and graduate degrees in mathematics and strategic information systems and has attained the professional certification of Certified Information Systems Security Professional. The CISO reports to the CIO. WTW's CIO has served in various roles in information technology for over 36 years.


text: As part of the WTW cybersecurity program, cross-functional teams throughout WTW address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and escalate such threats and incidents as appropriate through the processes described in more detail below.


text: Management's cybersecurity risk management strategy and processes focus on several key areas, including: • Incident Response Planning: WTW has a global Information and Cyber Security Incident Response Plan ('ICSIRP' or 'Plan') for identifying and managing cyber and data security threats. The ICSIRP defines the roles and responsibilities of WTW stakeholders involved in responding to cyber and data security events, severity levels and incident categories, and it outlines a process for incident management, including escalation and communication procedures. • Technical Safeguards: WTW seeks to continuously improve implemented technical safeguards that are designed to protect WTW's information systems. Standards include controls for access management, cyber threat and incident management, data security, encryption, human resource security, network and device security, secure asset management, secure system development, security operations and third-party security. While WTW seeks to maintain adequate controls, they may not always be effective. See Part I, Item 1A Risk Factors under the heading 'Data and cybersecurity breaches or improper disclosure of confidential company or personal data could result in material financial loss, regulatory actions, reputational harm, and/or legal liability' for more information about WTW's technical controls, management, mitigation, and security practices as well as the risks related thereto. • Education and Awareness: WTW's policy is that all WTW colleagues are required to receive annual, mandatory privacy and information security training. • Third-Party Risk Management: WTW's risk management strategy includes a third-party risk management process that is intended to be aligned to the technology security key controls across the organization. • Threat Intelligence: WTW seeks to obtain threat intelligence on cyber threats to WTW at the strategic, operational and tactical levels.


text: Material Effects of Cybersecurity Incidents We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected our business strategy, results of operations, or financial condition. However, there is no guarantee that a future cyber incident would not materially affect our business strategy, results of operations or financial condition. To learn more about risks from cybersecurity threats, review the risk factors included in Part I, Item 1A Risk Factors in this Annual Report on Form 10-K, as updated by WTW's subsequent SEC filings. The risks described in such filings are not the only risks facing WTW. Additional risks and uncertainties not currently known or that may currently be deemed to be immaterial also may materially adversely affect WTW's business, financial condition or results of operations.


text: Risk Management and Strategy The Company maintains robust and comprehensive processes, procedures and controls to protect and secure its information systems and data infrastructure from cybersecurity threats. The Company's cybersecurity program is led by its Chief Information Security Officer ("CISO"). The Company's cybersecurity program interfaces with other functional areas within the Company, including but not limited to the Company's business segments and information technology, legal, risk management, human resources and internal audit departments, as well as external third-party partners, to identify and understand potential cybersecurity threats. The Company regularly assesses and updates its processes, procedures and management techniques in light of ongoing cybersecurity developments.

companyName: Builders FirstSource, Inc.

ticker: BLDR


text: Internally, the CISO coordinates oversight of reviewing security alerts, identifying and monitoring ongoing and potential cybersecurity threats, evaluating strategic business impacts of cybersecurity threats and developing programs and initiatives to educate the Company's employees regarding cybersecurity. The CISO also manages the Company's Security Incident Response Plan (the "Incident Response Plan"), which outlines action steps for the preparation, identification, triage, analysis, containment, eradication, recovery and reflection stages of a cybersecurity incident. The Incident Response Plan serves as the charter for the Company's Security Incident Response Team (the "Incident Response Team"), which includes a strategic team comprised of executives from various cross-functional management teams, as well as a tactical team comprised of internal technical support roles and external third-party service providers. The Incident Response Plan provides how the Incident Response Team will analyze and, as necessary, escalate cybersecurity incidents both internally and with third-party service providers based on type and severity of the specific incident.


text: The Company also requires cybersecurity training for all active employees, focusing on the appropriate protection and security of confidential company and third-party information. Additionally, the Company provides quarterly cybersecurity awareness training that covers a broad range of security topics, including secure access practice, phishing schemes, remote work and response to suspicious activities. In addition to online training, employees are educated through several methods, including event-triggered awareness campaigns, recognition programs, security presentations, company intranet articles, videos, system-generated communications, email publications and various simulation exercises.


text: The Company has engaged a third-party managed detection and response company to monitor the security of its information systems around-the-clock, including intrusion detection, and to provide instantaneous alerting should a cybersecurity event occur. The Company also maintains a cybersecurity insurance policy and has engaged a third-party digital forensics and incident response consultant and legal counsel on retainer.


text: The Company does not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected the Company. However, the sophistication of cyber threats continues to increase, and the preventative actions the Company has taken and continues to take to reduce the risk of cyber incidents and protect its systems and information may not successfully protect against all cyber incidents. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.


text: The Company's Audit Committee and Board of Directors provide ultimate oversight of the Company's cybersecurity risk management. The Audit Committee regularly reviews and discusses with management the strategies, processes, procedures and controls pertaining to the management of the Company's information technology operations, including cyber risks and cybersecurity. The Company's Chief Information Officer ("CIO") provides quarterly reports to the Audit Committee regarding the evolving cybersecurity risk landscape, including emerging risks, as well as the Company's processes, program and initiatives for managing these risks.


text: The Company's CISO reports directly to the CIO, who in turn reports to the CFO. The CISO maintains the certified information systems security professional (CISSP) certification and GIAC G2700 (Certified ISO 27000 Specialist) and has over 20 years of experience in cybersecurity. Under the direction of the CISO, the Company's cybersecurity department continuously analyzes cybersecurity and resiliency risks to our business, considers industry trends and implements controls, as appropriate, to mitigate these risks. The team consists of cybersecurity professionals holding multiple certifications such as the CISSP, CEH (Certified Ethical Hacker), GSOM (GIAC Security Operations Manager), GCIA (GIAC Certified Intrusion Analyst), GCFA (GIAC Certified Forensic Analyst), GNFA (GIAC Network Forensic Analyst), GCTI (GIAC Cyber Threat Intelligence), CISM (Certified Information Security Manager) and CISA (Certified Information Systems Auditor). This analysis drives the Company's long- and short-term cybersecurity strategies, which are executed through a collaborative effort within the IT department and are communicated to the Board of Directors regularly.


text: Our EVP and Chief Financial Officer is responsible for the oversight of the Company's information technology and cybersecurity function, which consists of five employees and is led by our VP, Information Systems & Solutions. Our VP, Information Systems & Solutions has over 25 years of experience in information technology leadership, including oversight of information technology general controls and management of information technology security and cybersecurity programs. The information technology and cybersecurity team also includes our Director, Information Technology, who has held information technology leadership roles for over 15 years, including in management of infrastructure, applications, information technology security, and cybersecurity prevention and education programs. The Audit Committee of the Board of Directors oversees the evaluation of the policies and practices developed and implemented by the Company with respect to the risk assessment and risk mitigation of information technology and cybersecurity matters.

companyName: Broadstone Net Lease, Inc.

ticker: BNL


text: The Company has implemented a Computer Security Incident Response Plan (the "Incident Response Plan") that sets forth the process for identifying, responding to, and recovering from cybersecurity incidents. We have a dedicated cross-functional Incident Response Team (the "IRT") that participates in annual tabletop exercises and simulations with our external cybersecurity legal counsel to test the Incident Response Plan as part of our business continuity, incident response, risk assessment, and disaster recovery planning. The IRT is also responsible for evaluating the level of materiality of any cybersecurity incident in accordance with the Incident Response Plan and may engage the services of third-party experts to assist in the event of a cybersecurity incident.


text: To our knowledge, in the last three years we have not experienced a cybersecurity incident that has had, and we are not aware of any cybersecurity incident that is reasonably likely to have, a material impact on us, our business strategy, results of operations or financial condition. However, as (i) our business involves the storage and transmission of numerous classes of sensitive and confidential information and proprietary information, including tenants' information, private information about our investors and our employees, and financial and strategic information about us and (ii) we also rely on third-party service providers that have access to such information in connection with providing necessary information technology and security and other business services to us, we face risks associated with security breaches through cyber-attacks or cyber-intrusions, malware, computer viruses, attachments to e-mails, persons inside our organization or persons with access to systems inside our organization, and other significant disruptions of our IT networks and related systems that could have a material impact on us, our business strategy, results of operations or financial condition. See "Risks Related to Our Business and Properties – Security breaches and other technology disruptions could compromise our information systems and expose us to liability, which could materially and adversely affect us" for additional information.


text: In an effort to mitigate the impact of cybersecurity events, we conduct mandatory information technology and cybersecurity training for all employees upon hire and at least annually thereafter, and regularly test our employees for information security awareness and adherence to our information technology and cybersecurity policies, which are reviewed at least annually. We also provide our employees with access to educational newsletters and articles regarding relevant information technology and cybersecurity matters on a regular basis. Additionally, we utilize third-party experts to review and test our information technology infrastructure, including constant monitoring for suspicious activity, routine penetration testing of our networks, and an annual security assessment of the effectiveness of our informational technology environment to identify potential vulnerabilities. For example, our VP, Information Systems & Solutions and Director, Information Technology receive periodic reporting from our managed security service provider and meet regularly to discuss reported activity and assess any recommendations. The Company also receives a quarterly cyber risk rating from an external enterprise risk management service provider and our VP, Information Systems & Solutions and Director, Information Technology meet to discuss the rating and potential enhancements to our cybersecurity program. The cyber risk rating reports are also shared with the Audit Committee on a quarterly basis. Our third-party service providers of technology services are generally required to provide us with system and organization controls (SOC) reports prior to formal engagement and annually thereafter. The reports are reviewed by our VP, Internal Audit and our VP, Information Systems & Solutions, or their designee(s), to assess and monitor compliance with cybersecurity best practices.


text: In conjunction with the operational day-to-day processes discussed above, material risks from cybersecurity threats are identified and assessed in connection with the Company's enterprise risk management process. Our Enterprise Risk Management Committee ("ERMC"), which is overseen by our SVP and General Counsel and is comprised of our senior leadership team and key functional personnel, meets quarterly to discuss the Company's enterprise risks, including cybersecurity risks. Cybersecurity risks are reviewed in detail and assigned risk ratings on an annual basis. The ERMC also discusses mitigation efforts, potential enhancements to processes and policies, and key risk indicators for the Company's risks, including cybersecurity risks. The ERMC's annual risk assessment is presented to the Board of Directors and the Audit Committee on an annual basis. In addition to the Company's annual ERMC risk assessment, our VP, Information Systems & Solutions and Director, Information Technology brief the Audit Committee on information technology and cybersecurity matters at least annually and provide interim updates to the Audit Committee on such matters on a quarterly basis.


text: We face a number of cybersecurity risks in connection with our business and recognize the growing threat within the general marketplace and our industry. To help the Company address these risks, we have implemented a cybersecurity risk management program that is informed by recognized industry standards and frameworks and incorporates elements of the same, including elements of the National Institute of Standards and Technology Cybersecurity Framework.

companyName: Intellia Therapeutics, Inc.

ticker: NTLA


text: Our cybersecurity risk management program includes a number of components, including but not limited to a Cybersecurity Incident Response Plan ("CSIRP"), annual cybersecurity awareness training for our employees, vendor risk management, regular system maintenance including application of security patches as appropriate, regular penetration test and security assessments and implementation of enhancements to security measures used to protect our systems and data.


text: We maintain a CSIRP that is designed to guide our incident response process for cybersecurity incidents that could affect our systems, network, or data. The CSIRP identifies the individuals responsible for developing, maintaining, and following appropriate procedures to identified cybersecurity incidents. We periodically test our CSIRP using tabletop exercises with the goal of improving our processes and preparedness.


text: Risks from cybersecurity threats have not to date materially affected us, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled "Our internal computer systems, or those of our collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our operations and development efforts" in Item 1A-Risk Factors.


text: The Board of Directors, as a whole and through its committees, has responsibility for the oversight of risk management, which includes ensuring that the risk management process implemented within our organization is appropriate and functioning as designed. The Audit Committee of our Board of Directors oversees cybersecurity risks pursuant to its charter, and our governance framework includes oversight by the Audit Committee. The Audit Committee, with assistance from our management, including our Head of IT, periodically reports to the full Board of Directors to inform them of potential cyber risks and threats, the status of projects to further develop our information security systems, and the emerging cybersecurity threat landscape.


text: Our Head of IT is responsible for strategic leadership of our cybersecurity risk management program. The Head of IT role is currently held by an individual who has approximately eighteen years of professional IT management experience. Our Head of IT also provides regular updates on our cybersecurity risk to our executive leadership team and other management committees responsible for IT and cybersecurity risk management.


text: Risk Management and Strategy AVITA Medical has implemented an Information Security Management System ("ISMS"). The Company's ISMS is a continuous process designed to analyze the potential risks, vulnerabilities, the likeliness of occurrence and the related consequences of cybersecurity threats. The process is based on establishing the context, assessing the risks, and treating the risks. The key concept of the ISMS is to consistently maintain and improve confidentiality, integrity, and availability of information assets that should be protected by the organization on behalf of itself and its clients, and third parties. Once a risk, threat or vulnerability is identified, the Company establishes a risk treatment plan to take corrective action to prevent risks that can be avoided and minimize the ones that cannot. We engage an independent third-party cybersecurity services and consulting firm to continuously review our information security. We also conduct internal phishing campaigns and perform an independent penetration test on an annual basis. In addition, we conduct regular security awareness training and testing of our employees. The Company has not had any material cybersecurity incidents.

companyName: AVITA Medical, Inc.

ticker: RCEL


text: 1. Context establishment - Established in accordance with the requirements of International Organization for Standardization 27001 and 27002 ("ISO 27001" and "ISO 27002"). The ISO 27001, Information security management systems, provides a framework and guidelines for establishing, implementing and managing an ISMS and ISO 27002, Information security controls, provides a reference set of generic information security controls including implementation guidance.


text: 2. Risk Assessment - Relates to an evaluation and identification of risks, threats and vulnerabilities that exist or could exist, identifies the likelihood of occurrence and potential consequences. As part of the risk assessment management prioritizes the assessed risks from low to high based on likelihood and level of impact.


text: 3. Risk Treatment – will detail the remediation process for risks, vulnerabilities and threats identified to reduce the risk to an acceptable level.


text: 4. Risk Acceptance- The Company's risk assessment is evaluated from a Low (1) to a High (3) on the Impact the threat would have on the Company and its operations and the likelihood of occurrence. Threat ratings created from the Impact and probability calculations will result with a value from 1- 9.


text: a. Low (1 – 2.99) = Risk level acceptable and no further action deemed necessary b. Medium (2 – 5.99) and High (6 - 9) – implement risk management to reduce the risk to an acceptable level 5. Risk Communications- Results of the risk assessment are communicated to appropriate level of management. Report includes the identified risk and vulnerability summaries. Updates will include treatment plans and status updates.


text: 6. Risk Monitoring and Review -Continuously performed to evaluate any changes or the need for changes. The Company uses the Ontrack software solution ("Ontrack") to monitor and track all aspects of risk assessment. Ontrack also serves as tool to track any cybersecurity incidents and remediation tasks.


text: Disclosure of Management's Responsibility The Company's Chief Financial Officer is primarily responsible for overseeing the Cybersecurity Risk Management Program and leading the Company's efforts to mitigate technology risks in partnership with various business leaders in the organization. For qualifications of the CFO refer to Item 10 of the form 10-K. We have protocols, policies and tools in place to mitigate cybersecurity risk. They also provide the administrative, technical, and physical safeguards to ensure the security, confidentiality, integrity and availability of confidential information and personal information from unauthorized access, use, disclosure, alteration, destruction or theft. In addition, we engage an independent third party annually to assess our IT general controls and IT security. Special focus is given to maintaining and improving our alignment with ISO 27001. Additionally, we have a cybersecurity incident response plan in place that provides a documented framework for handling high and low severity security incidents and facilitates coordination across multiple parts of the business. We have engaged an external consultant to provide oversight and technical expertise to our ISMS process. Finally, cybersecurity is integrated into the Company's training as all employees are required to take security awareness training.


text: Disclosure of the Board's Responsibility While management is primarily responsible for assessing and managing cybersecurity risks on a day-to-day basis, the Company's Board of Directors oversees management's efforts to assess and manage risk. The Board (in conjunction particularly with the Audit Committee) monitors the cybersecurity risk assessment and response process. The Audit Committee is briefed by our Chief Financial Officer on our cybersecurity ISMS program and the overall cybersecurity risk environment. The briefing may include discussions on topics such as: information security and technology risks, cybersecurity risk assessment process and updates, information risk management strategies, and progress on cybersecurity and data protection training initiatives for employees, among others.


text: We rely on our technology network infrastructure and information systems to operate our business, rent our equipment, interact with vendors and customers, support and grow our customer base and bill, collect and make payments, among other functions. Our internally developed infrastructure and systems, as well as those systems and processes provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information. Such attacks have become more sophisticated over time, especially as threat actors have become increasingly well-funded by, or themselves include, governmental actors with significant means. We expect that sophistication of cyber-threats will continue to evolve as threat actors increase their use of AI and machine-learning technologies.

companyName: H&E Equipment Services, Inc.


text: The Company has robust processes for assessing, identifying and managing material risks from cybersecurity threats that are integrated into our overall risk management process. The Company utilizes the National Institute of Standards and Technology (NIST) framework as the basis for our cybersecurity management approach. Under the supervision of the Chief Information Officer ("CIO"), we review our cybersecurity insurance policy and regularly identify all computing assets including hardware, software, and network infrastructure for a comprehensive risk assessment. We consider threats that may originate from both internal and external sources and build in technical security controls based on a defense-in-depth strategy. To identify risks, we complete vulnerability assessments on a recurring basis to proactively identify potential weaknesses. We additionally employ third party external and internal penetration testing on an annual basis to assist in identifying additional vulnerabilities in our environment. We also perform disaster recovery exercises throughout the organization annually by our in-house team. In connection with our threat management and overall risk management process, we receive recurring threat intelligence from our partners that help us recognize the updated tactics, techniques, and procedures being utilized by threat actors and apply the MITRE ATT&CK framework to review defensive coverage against cybersecurity attacks. Employees at H&E receive mandatory recurring cybersecurity training and phishing exercises to reduce the likelihood of success by threat actors. Our managed detection and response partner provides 24/7 monitoring and detection of our cybersecurity environment, which allows us to timely respond to cybersecurity events with the goal of reducing its potential impact. The Company performs an IT security assessment of critical third-party vendors prior to establishing a formal relationship and has additional processes in place to continue to oversee and identify risks associated with the use of our third-party service providers once a formal relationship is established. We additionally have a comprehensive incident response plan that outlines the appropriate procedures, communication flow and response for potential cybersecurity incidents as well as categorizations of scope, incident and impact of such incidents.


text: The Company's information security and cybersecurity program is managed by our CIO whose team includes a VP of Infrastructure and Director of IT Security (collectively, "the IT Security Team"), whom all have the necessary expertise, certifications and experience to lead our enterprise-wide cybersecurity strategy, policy, architecture and processes. The CIO has over 25 years of experience and has been a member and leader of our Company's information systems and technological advancements for the past 21 years. The Director of IT Security, reporting to our VP of Infrastructure, is responsible for our overall network security and assessing and managing cybersecurity risks and threats. The Director of IT Security has over 15 years of experience working in IT security and holds CISSP and GIAC certifications. The VP of Infrastructure reports to our CIO, and has principal responsibility for our network infrastructure and the operation of our cybersecurity program, network and system administration. The VP of Infrastructure has over 29 years of experience in system administration and has specialized in ERP systems and network infrastructure. Collectively, the IT Security Team prepares updates and presentations for the Board of Directors, Audit Committee and executive management.


text: The IT Security team reports the detection, mitigation and remediation of cybersecurity incidents to executive management and the Audit Committee of the Board of Directors. If we were to experience a cybersecurity incident, our Director of IT Security will inform the rest of the IT Security Team, which will then evaluate and assess the materiality of the incident to the Company, its information technology infrastructure and data integrity, and in accordance with our incident response plan, notify executive management and the necessary finance, operations and legal team functions. The CIO would determine whether the cybersecurity incident should be reported to the Audit Committee of the Board in advance of the next scheduled cybersecurity update. Once a cybersecurity incident is reported to the Audit Committee of the Board and potentially the overall Board of Directors, the Audit Committee, with the input of the IT Security Team and executive management, will determine how to address it and whether or not the incident would require external reporting.


text: The Company's Board of Directors, specifically the Audit Committee, is responsible for oversight and governance related to our cybersecurity processes and risk management. The CIO reports the results of the annual comprehensive risk assessment, including the evaluation of cybersecurity risks, the actions we have taken to mitigate these risks and an analysis of cybersecurity threats and incidents across the industry to the Board of Directors on an annual basis and reports cybersecurity risk updates to the Audit Committee on a semi-annual basis, or more frequently should a cybersecurity risk or event emerge requiring additional communication. The Audit Committee will report on the cybersecurity risk updates it receives from the CIO to the Board of Directors or as needed have the CIO report subsequently to the full Board of Directors.


text: To help address cybersecurity threats, Western Union has developed a strategy and implemented a program to identify, assess, and prioritize cybersecurity risks as part of our broader enterprise risk management processes. We recognize that cybersecurity threats are constantly evolving and that there is no single solution that can guarantee complete protection.

companyName: Western Union CO

ticker: WU


text: Our cybersecurity strategy is designed to protect the confidentiality of our data from unauthorized access, the integrity of information throughout its lifecycle, and the availability of that information and the related systems. Our strategy is guided by the National Institute of Standards and Technology Cybersecurity Framework, which helps us identify, assess, and manage cybersecurity risks relevant to our business.


text: Within our cybersecurity program, we have identified and implemented a variety of processes for cybersecurity risk management: • We conduct regular risk assessments to identify and evaluate potential cybersecurity threats, including threats to our business operations, technology infrastructure, and data. • We monitor threat intelligence feeds to stay updated on the latest cybersecurity threats and vulnerabilities. • We scan our systems for vulnerabilities on an ongoing basis, with vulnerabilities prioritized and remediated based on their potential impact. • We have implemented a variety of access controls to restrict access to our systems and data, including user authentication, authorization, and encryption. • We conduct regular security awareness training for our employees to help them identify and avoid cybersecurity threats. • We periodically conduct test exercises to review our cybersecurity controls and identify improvements. • Consultants and other third-party vendors that assist with cybersecurity risks or processes are included in our vendor risk assessment program, which identifies and oversees cybersecurity risks specific to our use of these vendors.


text: Our cybersecurity governance framework is designed to manage cybersecurity risks at all levels of the organization. As part of this governance framework, our Board of Directors regularly devotes time during its meetings to review and discuss the most significant risks facing the Company, including cybersecurity threats, and management's process for identifying, prioritizing, and responding to them. The Audit Committee of the Board of Directors assists the Board in overseeing the significant risk exposures facing the Company and regularly reviews cybersecurity risks at its committee meetings. Cybersecurity risks are integrated into the broader company risk management system through our Information Security and Privacy Committee ("ISPC"), which is a subcommittee of our Enterprise Risk Committee (the "ERC"), is co-chaired by the Chief Information Security Officer and Chief Privacy Officer, and consists of senior leaders across the company. The ISPC is charged with oversight, advisory, and decision-making responsibilities with respect to information security and privacy risks. Management, including the ERC, is responsible for communicating cybersecurity risks to the Audit Committee and Board of Directors. Our cybersecurity program, led by our Chief Information Security Officer, who reports to our Chief Risk and Compliance Officer, has a team of dedicated, experienced cybersecurity professionals responsible for day-to-day security operations and strategic cybersecurity programs. The Chief Information Security Officer has over 20 years of experience in security risk management, with over 10 years of experience leading cybersecurity teams. All employees are responsible for protecting Western Union's data and systems and are required to follow Western Union's cybersecurity policies.


text: We have been, and continue to be, the subject of cybersecurity attacks and threats, including distributed denial of service and ransomware attacks. Historically, none of these attacks or breaches has individually or in the aggregate resulted in any material liability to us or any material damage to our reputation. Disruptions related to cybersecurity have not caused any material interruption to our business, strategy, results of operations, or financial condition. There can be no assurance that such attacks or disruptions will not have a material adverse impact on us in the future.


text: Cybersecurity Program Our and our Manager's cybersecurity and related controls, policies and procedures ("Cybersecurity Program") are critical business functions protecting our and our Manager's enterprise information systems, data and business operations from external and internal threats. The Cybersecurity Program prioritizes detection, analysis, response and prevention to known, anticipated or unexpected cybersecurity threats, with regular internal and third-party assessments and enterprise risk management governance reviews. The Cybersecurity Program is informed by the National Institute of Standards and Technology's ("NIST") cybersecurity framework standard, which our Manager uses to assist with our overall enterprise risk management framework, along with our compliance requirements under federal and state cybersecurity and related regulations. We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. Our Risk Factors include further detail about our material cybersecurity risks.

companyName: PennyMac Mortgage Investment Trust

ticker: PMT


text: Our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") each have over 24 years of information system experience and are primarily responsible for implementing the Cybersecurity Program and managing our information security personnel and consultants. The CIO has served in a variety of information technology leadership positions in the finance industry and holds a Bachelor of Science in Electrical Engineering. The CISO served in a variety of cybersecurity operations, cybersecurity architecture, and critical infrastructure cybersecurity enhancement programs in the finance industry, the utility industry and in government and holds a Bachelor of Science in Management Information Systems and Decision Sciences.


text: The Cybersecurity Program is integrated into our and our Manager's enterprise risk management framework that assesses, identifies and protects our and our Manager's enterprise information systems, data and business operations from various security threats and contains the following elements: • Information Security Risk Assessment - Conducting internal and external risk and control assessment, quality control and assurance testing. • Identity and Access Management - Managing enterprise identity and access control systems. • Security Architecture - Managing security architecture, including secure code deployment standards, architecture security reviews, and cybersecurity advisory support. • Security Engineering - Designing, implementing and operating security technologies, including but not limited to malware protections, security event and incident management, data loss prevention, and phishing defenses. • Security Operations - Ensuring continuous operational coverage of security events and alerts, maintaining and executing processes for triage, containment, investigation and escalation/communication and threat intelligence. • Attack Surface Management - Managing vulnerability and patch management, network penetration testing, application security testing and exercises, including cyber-attack simulations and tabletop exercises with senior management to detect control gaps. • Third-Party Assessments - Coordinating, reviewing and analyzing third-party providers' assessments of the Cybersecurity Program. Internal Audit may also perform a periodic cybersecurity program audit that may be supported by external consulting firms. • Third-Party Service Provider Reviews – Identifying and reviewing material risks from cybersecurity threats associated with certain third-party service providers.


text: Information Security Monitoring and Incident Reporting We and our Manager continuously monitor our enterprise information systems and user activity to detect anomalous activity and identify potential security related incidents. Our cybersecurity monitoring and incident reporting program is informed by NIST guidelines and is internally and externally monitored. When a potential cybersecurity incident is detected, we and our Manager gather the necessary information to classify the incident by type and severity and activate containment plans and response teams depending on the nature of the incident. Cybersecurity incidents that may impact enterprise business operations, compromise critical systems or result in unauthorized access to critical data will be escalated to the CISO and an internal incident response team comprised of senior IT, business operations and compliance personnel to coordinate any internal and external responses. The CISO and the internal incident team will also elevate any material cybersecurity incidents or unauthorized occurrences that jeopardize the confidentiality, integrity or availability of enterprise information to senior management and the board of trustees.


text: Enterprise Risk Management Framework and Governance The Cybersecurity Program is integrated with our and our Manager's enterprise risk management framework and is primarily managed by the CIO, the CISO, and other information security personnel and consultants, and is overseen by risk management, internal audit, senior management and the board of trustees to ensure the confidentiality, integrity and the availability of the Company's enterprise information systems, data and business operations. The Cybersecurity Program utilizes specialized third-party cybersecurity service providers to periodically perform penetration testing across certain internet-facing and business critical applications as well as external and internal network penetration tests.


text: Our and our Manager's Enterprise Risk Management unit separately provides independent oversight and monitoring of the Cybersecurity Program through periodic quality control testing and regulatory compliance verification of the Cybersecurity Program's controls. Our Internal Audit unit is an independent corporate function reporting to the board of trustees' Audit Committee that also reviews the effectiveness of the Cybersecurity Program and whether it is effectively integrated into our and our Manager's overall enterprise risk management framework. Additionally, our and our Manager's Enterprise Risk Management and Internal Audit units may from time to time separately engage consulting services to perform independent cybersecurity controls audits and provide expert guidance.


text: Board of Trustees Oversight The board of trustees oversees our cybersecurity risks by periodically evaluating cybersecurity reports from senior management, including the CIO and CISO, as well as reports from the board committees and third-party consultants. The Risk Committee oversees our enterprise risk management framework including risks associated with data security, cybersecurity, IT infrastructure, and data privacy. The Audit Committee oversees the internal and external auditors' review of our cybersecurity risks.


text: Management Oversight Senior management's Technology Committee includes the CIO, the CISO and other senior executives who oversee the Company's enterprise IT infrastructure and ensures that our enterprise information systems are protected from internal and external cybersecurity threats by monitoring cybersecurity controls, risk assessments and information system reports. The Technology Committee, the CIO and the CISO periodically provide cybersecurity reports about our Cybersecurity Program to senior management's Executive Committee and the board of trustees and its Risk Committee.


text: Recognizing the importance of assessing, identifying, and managing material risks from cybersecurity threats, we maintain a cybersecurity program that is led by our management team and overseen by the Audit Committee of our Board of Directors. Material risks from cybersecurity threats to our company may include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: UNIVERSAL DISPLAY CORP \PA\

ticker: OLED


text: To identify and manage the risks from cybersecurity threats, our cybersecurity program includes various preventative, detection and responsive measures, including without limitation the following: use of monitoring and detection software applications, ongoing employee education and certification about cybersecurity threats, routine security access reviews, and the implementation of physical security measures. As standard practice, we require third-party service providers that may electronically interact with or handle our sensitive information to maintain an effective security management program and to notify us in the event of any known or suspected cyber incident.


text: Members of our management team, most notably our Chief Financial Officer, who has responsibility for managing our Information Technology and Security functions, are responsible for leading our cybersecurity program. Our management team meets regularly with our information technology leadership personnel, including our Head of Information Technology, who reports to our Chief Financial Officer, to receive updates and data on cybersecurity management activities, including assessments on emerging technologies and evaluations of recommended practices related to cybersecurity measures. Our Head of Information Technology, who has managed information technology services and security for over 25 years, and our Chief Financial Officer maintain their expertise through participating in events such as continuing education and training, and information-sharing collaborations. We also retain a third-party Information Security consulting firm to advise on and assess our cybersecurity processes on an ongoing basis.


text: The Audit Committee of our Board of Directors has oversight responsibility for our cybersecurity program. Our Chief Financial Officer and Head of Information Technology provide periodic updates regarding our cybersecurity risk management strategy and related activities to the Audit Committee, and provide other information as needed or requested to facilitate the committee's oversight of our cybersecurity risk. The chair of our Audit Committee, who previously founded and for 19 years led an information technology consulting company that specialized in providing software and systems integration, business process and technical consulting to multinational companies, holds a certification in Systemic Cyber Risk Governance for Corporate Directors. Other members of our full Board of Directors, which also receives periodic briefings on cybersecurity matters, also have received professional education and training related to cybersecurity.


text: Despite our efforts to manage the risk from cybersecurity threats, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. "Risk Factors" for a further discussion of our cybersecurity risks.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, along with personal data and other sensitive information, including our trade secrets, data we may collect about trial participants in connection with clinical trials, and other sensitive data ("Information Systems and Data").

companyName: DYNAVAX TECHNOLOGIES CORP

ticker: DVAX


text: Our Senior Director of IT Infrastructure & Security also functions as our information security officer ("ISO"). The ISO (as part of our security function), along with our broader internal cybersecurity, IT infrastructure, and digital technology automation functions, as well as third-party service providers, all help identify, assess and manage our cybersecurity threats and risks. Our security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, coordinating with law enforcement concerning threats, responding to proactive outreach from CISA and FBI, internal and/or external audits, conducting threat assessments for internal and external threats, third-party threat assessments, conducting vulnerability assessments to identify vulnerabilities, and use of external intelligence feeds.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to help manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: a corporate security incident response plan, a vulnerability management policy, incident detection and response processes, IT systems disaster recovery procedures, risk assessments, reasonable implementation of security controls in accordance with applicable security standards/certifications, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, employee training, penetration testing, cybersecurity insurance, dedicated cybersecurity staff/officer. We also rely on third-party vendor backup/restore, disaster recovery and business continuity procedures as stated in the respective SOC 1 and SOC 2 reports if provided by such vendors as they pertain to certain of our managed services.


text: Our procedures for assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, (1) cybersecurity risk is evaluated as a component of our broader enterprise risk management program, identified in our risk register and monitored and managed more specifically by our Corporate Security Incident Response Team (CSIRT); (2) the security function works with the CSIRT to help prioritize our risk management processes and help mitigate cybersecurity threats that we believe are more likely to lead to a possible material impact to our business; (3) our ISO evaluates material risks identified from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors (the "Audit Committee"), which reviews and discusses with senior management our overall risk assessment and management.


text: We use third-party managed service providers to assist us in identifying, assessing, mitigating and managing potential risks from cybersecurity threats. In addition, we engage other advisors from time to time to help identify, assess, mitigate and manage new or developing risks in a changing threat landscape. Such ongoing services and periodic services include professional services from providers such as legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, dark web monitoring services, and forensic investigators (as needed).


text: We use third-party service providers to perform a variety of functions throughout our business, such as application service providers, software-as-a-service providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and other supply chain resources. We have a vendor management process to help manage cybersecurity risks associated with our use of these providers. This includes risk assessment for each vendor, review of security assessments, supplemental security questionnaires (as needed), security assessment calls with the vendor's security personnel, and imposition of certain information contractual obligations on the vendor. In addition, depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or those of third parties upon which we rely, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for reviewing and discussing with management our cybersecurity risk assessment and management processes, including our oversight and the steps we take to monitor and help control risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our management, including our ISO, who has over 20 years of experience in information security. Our ISO oversees a global team of information security professionals consisting of multiple full time equivalent employees in multiple countries.


text: Our ISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our ISO (in coordination with our CSIRT) is also responsible for other functions, including preparing for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our CSIRT reviews, approves and prioritizes information security and cybersecurity policies, projects and initiatives. Executive management is responsible for prioritizing initiatives and approving budgets to allocate funding for the foregoing based on feedback from the ISO, the CSIRT and the Audit Committee.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our ISO. The ISO works with our CSIRT to help us mitigate and remediate cybersecurity threats or incidents of which they are notified. The ISO is responsible for designing and promoting general security awareness and training, as well as defining and training relevant participants on our incident response processes. Our security and incident response processes include escalation and reporting to the CSIRT, Disclosure Committee, senior management and Audit Committee for certain information security incidents, as warranted under the circumstances.


text: The Audit Committee receives periodic reports from the ISO concerning our significant cybersecurity threats and risk, and the processes we have implemented to address them. The Audit Committee also has access to various reports, summaries of reports or presentations related to cybersecurity threats, risk and mitigation.


text: We believe cybersecurity is of critical importance to our success. We are susceptible to a number of significant and persistent cybersecurity threats, including those common to most industries as well as those we face as a retailer, operating in an industry characterized by a high volume of customer transactions and collection of sensitive data. These threats, which are constantly evolving, include data breaches, ransomware, and phishing attacks. We, and our vendors and suppliers, regularly face attempts by malicious actors to breach our security and compromise our information technology systems, and a cybersecurity incident impacting us or any vendor or supplier could significantly disrupt our operations and result in damage to our reputation, costly litigation and/or government enforcement action. Accordingly, we are committed to maintaining robust cybersecurity and data protection and continuously evaluate the impact of cybersecurity threats, considering both immediate and potential long-term effects of these threats on our business strategy, operations, and financial condition.

companyName: Sprouts Farmers Market, Inc.

ticker: SFM


text: Under the oversight of our Board of Directors, and the Board's risk committee, our management has established comprehensive processes for identifying, assessing and managing material risks from cybersecurity threats, and these processes are integrated into our overall enterprise risk management program. Our approach is proactive and adaptive, featuring regular security assessments, third-party audits, team member training, and continuous improvement of our cybersecurity infrastructure. We work to align our practices with industry best practices and regulatory standards. Our processes include detailed response procedures to be followed in the event of a cybersecurity incident, which outline steps to be followed from detection to assessment to notification and recovery, including internal notifications to management, the risk committee and the Board, as appropriate.


text: The risk committee of our Board is primarily responsible for oversight of risks, including those from cybersecurity threats, and is currently chaired by a director with extensive functional expertise in cybersecurity matters. Members of management, including our Chief Technology Officer, provide the risk committee updates on cybersecurity risk matters on a quarterly basis and more frequently if circumstances dictate. In these updates, members of the risk committee are apprised of cybersecurity incidents that are deemed to have had a moderate or higher impact even if immaterial to us. In addition, the risk committee reviews and actively discusses with management and among themselves the risks related to cybersecurity and critical systems in order to provide input on the appropriate level of risk for our company and reviews management's strategies for adequately mitigating and managing the identified risks. The risk committee and management regularly update our full Board with respect to cybersecurity matters.


text: Our Chief Technology Officer is primarily responsible for managing material risks from cybersecurity threats, and is supported by our Vice President of Information Technology, Operations and Security, along with a dedicated team of internal cybersecurity specialists. The Information Technology leaders participate in periodic training and education on cybersecurity related topics, while members of our internal security team also maintain industry certifications, such as Certified Information Systems Security Professional (CISSP). Our current Chief Technology Officer has more than 35 years of experience in information technology. Our Chief Technology Officer is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from the internal team. We also engage specialized cybersecurity consultants and leverage third-party expertise to bolster our cybersecurity defenses. Our enterprise risk management program is designed to identify, prioritize and assess a broad range of risks, including risks from cybersecurity threats, that may affect our ability to execute our corporate strategy and fulfill our business objectives. Our Vice President of Risk Management oversees this program and works with our information technology leadership team to formulate plans to mitigate the effects of risks from cybersecurity threats. In addition, we have an escalation process in place to inform senior management and the Board of Directors of material issues.


text: In addition, our third-party vendors and service providers play a role in our cybersecurity. These third parties are integral to our operations but pose cybersecurity challenges due to their access to our data and our reliance for various aspects of our operations, including our supply chain. We have developed a third-party vendor risk management program to assess and manage the risks associated with third-party partnerships, particularly in data security and cybersecurity. We conduct due diligence before onboarding new vendors and maintain ongoing evaluations to ensure compliance with our security standards.


text: As of the date of this report, no cybersecurity incidents have had, either individually or in the aggregate, a material adverse effect on our business, financial condition or results of operations. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cyber risk insurance, the costs relating to certain kinds of security incidents could be substantial, and our insurance may not be sufficient to cover all losses related to any future incidents involving our data or systems.


text: See Item 1A. "Risk Factors – Disruptions to, security breaches or non-compliance involving, our information technology systems could harm our ability to run our business and expose us to potential liability and loss of revenues." for a discussion of cybersecurity risks that may materially impact us.


text: Cybersecurity Risk Management Strategy We have implemented various processes and policies for identifying, assessing, and managing material risks from cybersecurity threats. Our cybersecurity risk management strategy is designed following the Cybersecurity Framework set by the National Institute of Standard and Technology, or NIST.

companyName: LeonaBio, Inc.

ticker: LONA


text: We assess our information technology, or IT, environment against the NIST Cybersecurity Framework, as well as various cyber-attack vectors, working to identify and remediate risks. We implement reasonable administrative, technical and procedural safeguards to manage cybersecurity risks, for example, by enforcing single sign-on or multi-factor authentication where supported, and the use of mobile device management to secure company resources on employee personal devices. Additionally, we engage third-party cybersecurity experts to assess the security of our network and perform continuous system monitoring, and we engage a third party to perform internal audits of our IT General Controls, or ITGCs. We have implemented certain processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, for example, by evaluating such service providers' own cybersecurity processes and reviewing available certification and audit reports, including International Organization for Standardization, or ISO, certifications for information security management systems, and System and Organization Controls, or SOC, reports.


text: At this time, we have not experienced cybersecurity incidents, or are aware of any risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Board of Directors Our board of directors is responsible for general oversight and regular review of information regarding our risks, including cybersecurity risks. Members of management communicate an overview of our current cybersecurity environment to our board of directors at least annually and provide updates to our board of directors regarding cybersecurity matters periodically throughout the year. Additionally, our third-party auditors inform the audit committee of our board of directors of our ITGC framework and control testing results, which include controls related to cybersecurity risks. Further, management has established cybersecurity incident response processes for escalating the communication of cybersecurity incidents up to the board of directors, as appropriate.


text: Material risks from cybersecurity threats are assessed and managed by a dedicated team comprised of internal and external IT professionals experienced in cybersecurity threat risk management, who ultimately report to our chief operating officer. Our chief operating officer has extensive strategic and operational experience at several life sciences companies, leading a wide range of business functions, including IT. Our technology team leader has over 20 years of experience with IT and cybersecurity risk management, having served in senior executive-level IT positions at multiple Fortune 500 companies and companies within the life sciences industry.


text: The technology team leader oversees our internal team of IT professionals, which continuously monitors our IT environment for cybersecurity threats and incidents. Our IT professionals routinely report on cybersecurity incident prevention, detection, mitigation, and remediation efforts to our technology team leader and chief operating officer. Additionally, we have established policies addressing processes for responding to potential cybersecurity incidents, including assessment, communication, and remediation protocols. Our incident response processes further provide for the escalation of cybersecurity incidents to our executive management team and board of directors, as appropriate.


text: We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process and have been embedded in our operating procedures, internal controls and information systems. On a regular basis, we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify and manage material risks.

companyName: VAPOTHERM INC


text: Specifically, we engage a third-party cybersecurity firm to assist with network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures. Further, we employ periodic penetration testing and tabletop exercises to inform our risk identification and assessment of material cybersecurity threats.


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we: • Monitor emerging data protection laws and implement changes to our processes to comply • Conduct periodic customer data handling and use requirement training for our employees • Conduct periodic vulnerability assessments and mitigate vulnerabilities for our systems and processes that include sensitive data; • Conduct regular security awareness trainings and phishing simulation attacks • Carry cybersecurity risk insurance that provides protection against the potential losses arising from a cybersecurity incident; and • Perform periodic gap analyses to review our cybersecurity controls for gaps and implement the closure actions Our incident response plan coordinates the activities that we and our third-party cybersecurity provider take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: As part of the above processes, we engage with consultants to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.


text: Our processes also include assessing cybersecurity threat risks associated with our use of third-party services providers in normal course of business use, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our risk management process discussed above. In addition, we assess cybersecurity considerations in the selection and oversight of our third-party services providers, including due diligence on the third parties that have access to our systems and facilities that house systems and data.


text: Management has implemented risk management structures, policies and procedures, and manages our risk exposure on a day-to-day basis. We have a cybersecurity organization within our information technology department that focuses on current and emerging cybersecurity matters and leverages cybersecurity consultants and third-party cybersecurity firms. Our cybersecurity function is led by our Chief Financial Officer, who reports to our Chief Executive Officer. Our Chief Financial Officer and cybersecurity organization are actively involved in assessing and managing cybersecurity risks. They are responsible for implementing cybersecurity policies, programs, procedures, and strategies.


text: Our Audit Committee of the Board of Directors is responsible for oversight of our risk assessment, risk management, disaster recovery procedures and cybersecurity risks. Periodically during each year, the Audit Committee receives an overview from our Chief Financial Officer of our cybersecurity threat risk management and strategy processes, including potential impact on the Company, the efforts of management to manage the risks that are identified and our disaster recovery preparations. Members of the Board of Directors regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: As of the date of this filing, we do not believe that our business strategy, results of operations or financial conditions have been materially affected by any cybersecurity incidents for the reporting period covered by this report. However, companies like us, as well as our employees, service providers and other third parties, have experienced information security and cybersecurity attacks in the past and will likely continue to be the target of cyber actors.


text: We describe whether and how risks from identified cybersecurity threats have or that are reasonably likely to affect our financial position, results of operations and cash flows, under the heading "Risks Related to Our Business" included as part of our "Item 1A. Risk Factors" of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: The Company faces various risks from cybersecurity threats in connection with its business on a day to day basis, including, without limitation, information theft, destruction and inaccessibility; unauthorized disclosure of sensitive or confidential information; extortion; harm to clients and employees; reputational risk, legal and regulatory risk and increased costs to manage cyber risk, which could materially adversely affect our business, strategy, results of operations and financial condition. Our cybersecurity risks arise out of managing sensitive and confidential information of our clients, as well as our own confidential and proprietary information, and our dependence on information technology systems and networks to securely process, transmit and store this information and to communicate among our global locations and with third parties, including our clients and other key stakeholders involved in our clients' transactions. The cyber threat landscape is constantly evolving, and the increase in periodic work-from-home workforce and their reliance on technology that enables such work has increased the cyber threat landscape and related risks. While we do not believe we have, as of the date of this Form 10-K, experienced a cybersecurity incident that materially affected our business, our business strategy, our results of operations or financial condition, there can be no guarantee that we will not experience such an incident in the future. For further information, see "Our business is subject to various cybersecurity and other operational risks" and "We may incur losses as a result of unforeseen or catastrophic events, including the emergence of a pandemic, cybersecurity incidents and events, terrorist attacks, war, trade policies, military conflict, climate-related incidents, or other natural disasters" in Item 1A, Risk Factors of this Annual Report.

companyName: Moelis & Co

ticker: MC


text: We maintain a cybersecurity program, which includes processes for the continuous monitoring of our information systems in order to assess, identify and manage cybersecurity threats. We use known industry strategies to manage these cyber threats, including, without limitation, identity and access management, security awareness training, network security, physical access controls, endpoint security, encryption, incident response planning and vulnerability management. The relevant information collected from the tools is, among other things, leveraged to identify potential weaknesses, monitor threats that seek to identify and exploit these weaknesses and refine and adjust our security controls as the cyber threat landscape changes. Our cybersecurity program includes policies governing how employees access, use and interact with our firm assets and data deemed to be in our custody. Our security team considers industry cybersecurity best practices and applicable statutory and regulatory obligations when creating policies, implementing controls and engineering technology integrations.


text: Recognizing the complexity and continuously developing nature of cybersecurity threats, Moelis periodically engages with a variety of external experts, including consultants, auditors and cybersecurity assessors in evaluating and testing our cyber risk management systems. Our collaboration with these third parties include, but are not limited to; threat assessments, consultation on security enhancements and regular periodic audits.


text: Our security program also contains a third-party risk management process which is designed to assess third-party vendors' information security posture and inform management on the potential cyber risk introduced by third-party products and services and the broader security team's recommendations for risk management.


text: Our cybersecurity program is overseen by a full-time security team led by our Chief Information Security Officer ("CISO"), reporting directly to our Chief Information Officer ("CIO"). Our CISO has over 20 years of experience in the field of cybersecurity, including prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CIO has over 17 years of experience as a Chief Information Officer, over 35 years of experience in the field of information technology and oversees the cybersecurity function.


text: Our cyber security program includes a cyber incident response policy overseen by our CISO. This incident policy sets forth the procedures to be followed in the event of a cybersecurity event, including escalation, mitigation, and remediation steps. Our cyber security procedures provide criteria for the escalation of cybersecurity events to management of the other operational functions of the Company to participate in determining and executing on the response. Depending on the nature and severity of the incident, we have procedures for escalating notification to our executive officers and Board of Directors.


text: Our Board of Directors is responsible for oversight of our cybersecurity risks. Cybersecurity risk management is integrated into our broader risk management framework. Our Board meets at least quarterly to conduct a review of matters related to cybersecurity, including an assessment of the cybersecurity threat landscape, cyber risk mitigation initiatives, the status of projects to strengthen internal cybersecurity, and an update on security events during the period. In addition, management will escalate cybersecurity incidents to the Board of Directors between quarterly meetings in accordance with our escalation procedures.


text: To effectively identify, assess and manage risks from cybersecurity threats, the Company maintains a cybersecurity and cyber risk management program which is comprised of the Company-wide cybersecurity strategy and its supporting policies, processes and architecture. This program is part of the Company's enterprise risk management program.

companyName: Apple Hospitality REIT, Inc.

ticker: APLE


text: Risk Management Strategy The Director of Information Technology, who reports to the Chief Financial Officer, has extensive information technology ("IT") and cybersecurity knowledge and skills gained from over 15 years of relevant work experience at the Company, and is responsible for leading the Company's cybersecurity and cyber risk management program which includes certain cybersecurity processes covering the Company's corporate systems. These processes include, among other items, the Company's information technology and risk management departments' use of an internal set of applications and control activities to actively monitor potential threats to its corporate IT environment and regularly conduct internal testing to identify potential vulnerabilities to the Company's corporate information technology infrastructure and systems. These activities include, but are not limited to, continuous monitoring of network and infrastructure vulnerabilities, automated patching and software updates, redundancy and back-up systems, and incident response planning and handling. The Company's employees are required to report cybersecurity events, including suspicious activity or emails, to the Company's information technology department. Should a cybersecurity event occur within its corporate systems, the Company is positioned to coordinate a swift response to mitigate impacts to its information technology infrastructure and systems. The Company has in place an incident response plan which provides guidance for leadership and employees to swiftly evaluate and respond to cybersecurity incidents. The Company also carries cybersecurity insurance to further mitigate certain potential losses from a cybersecurity incident affecting its corporate IT equipment and systems.


text: The Company's cybersecurity processes also include self-assessments using industry benchmarks as well as input from external industry consultants and ongoing communication with third-party business partners to identify cybersecurity incidents and threats that could potentially impact the Company. The Company has relationships with a number of third-party business partners to assist with cybersecurity incident containment and recovery efforts and assesses the processes and tools used by its third-party business partners to manage their cybersecurity risks. The Company uses a risk-based approach with respect to its use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of network connectivity or of data accessed, processed, or stored by such third-party service provider.


text: The Company's corporate IT systems are not used to process business transactions with its guests and those systems currently have no connectivity to hotel and/or third-party management and brand technology platforms. The Company's information technology and risk management departments regularly engage with its third-party management companies and brands to understand and benchmark their execution and alignment with applicable policies and industry practices for data protection and cybersecurity.