text: Processes for the Identification, Assessment, and Management of Material Risks from Cybersecurity Threats Although Global Payments is unable to eliminate all risks associated with cybersecurity threats and we cannot provide full assurance that our cybersecurity risk management processes will be fully complied with or effective, we have adopted policies and procedures that are designed to facilitate the identification, assessment, and management of those risks, including any such risks that have the potential to be material.

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: We use multiple mechanisms to identify risks associated with cybersecurity threats, including but not limited to the following: • Our information security program describes three levels of risk assessment exercises to be performed or obtained on a periodic basis by the Information Security function, ranging from enterprise-level to system-level risk assessments; • Our Information Security function also includes a threat intelligence team that performs continual threat monitoring activities; • Our Business Technology Services function includes teams that provide architectural review, security advisory, and application testing services in connection with the development of new products, applications, and integrations; • Our Internal Audit function performs annual reviews designed to evaluate selected systems' compliance with our information security program and/or recognized external control frameworks; • Independent consultants and auditors evaluate selected systems and applications on an annual basis; and • All team members are empowered to submit self-identified information security risks for analysis by our internal risk management professionals.

secItem: Item 1C


text: Cybersecurity risks identified through any of the foregoing mechanisms and submitted to our governance, risk, and compliance platform are assessed by our internal risk management professionals, in collaboration with appropriate subject-matter experts ("SMEs"), pursuant to standards established by our Enterprise Risk Management ("ERM") organization. Our internal risk management professionals work with the SMEs and other stakeholders to establish remediation plans for identified information security risks and to determine when risk acceptance might be a reasonable and appropriate solution. Issues relating to cybersecurity identified by Internal Audit are reported to the Technology Committee of our board of directors ("Technology Committee").


text: Our ERM organization, under the supervision of the Chief Risk Officer, leads our efforts to consider and assess threats to the Company and the risks that result therefrom, including cybersecurity threats and related risks. With support from Information Security, Legal, and the Privacy Office, ERM conducts periodic evaluations of our information security posture, manages regular meetings with the executive leadership team to discuss risk levels across the company, and maintains and monitors risk tolerances and escalation criteria that drive executive and the board of director communications, as further described in our disclosures related to the board of directors oversight of material risks associated with cybersecurity threats.


text: We manage risks associated with cybersecurity threats first and foremost through our information security program. We have implemented a comprehensive, layered security approach, across our computing environment, that is designed to facilitate the reduction of cybersecurity risk through the establishment of technical, physical and administrative controls oriented towards the maintenance of the confidentiality, integrity and availability of our information and technical assets. The structure of the information security program is informed by the NIST Cybersecurity Framework, and the program includes controls designed to facilitate the compliance of our cardholder data environments with PCI-DSS. The information security program is under the responsibility of the Chief Information Security Officer ("CISO"), while governance and oversight is provided by the Technology Committee as set forth in the Technology Committee Charter. The CISO is responsible for the strategy, execution and administration of the program and reports directly to the Chief Information Officer ("CIO"), while also maintaining reporting lines to the Technology Committee, its chair and the full board of directors. We have also established a Management Risk Committee ("MRC"), composed primarily of executive management, that is responsible for identifying, assessing, prioritizing and monitoring action plans to mitigate key risks. The MRC meets regularly.


text: To encourage alignment on risk identification, assessment, and management objectives throughout all levels of the company, we have implemented a security education and awareness program that is designed to reinforce key behaviors that facilitate risk reduction and inform team members about the material cybersecurity risks facing our organization. We also include periodic training on information security to the board of directors.


text: Identification, Assessment, and Management of Third-Party Cybersecurity Risks We have designed our risk identification, assessment, and management processes and procedures to account for cybersecurity risks associated with our use of third-party service providers. In addition to performing periodic assessments of vendors that include evaluating those vendors for cybersecurity risks, we endeavor to reduce supply chain cybersecurity risks by: (1) seeking to impose contractual requirements on our counterparties related to the use and security of personal data and other confidential information, as well as compliance with applicable privacy and security laws, wherever required by law to do so; and (2) requiring new software integrations and connectivity with vendors to undergo an architectural review process that involves consultation with the information security function and other relevant stakeholders. Moreover, critical vendors receive periodic comprehensive risk assessments conducted by the vendor management office (a team within ERM), in collaboration with Information Security and our Business Resiliency Governance ("BRG") team, that include a focus on the vendor's cybersecurity practices.


text: Evaluation, Categorization, and Escalation of Cybersecurity Incidents Our information security program includes an incident response plan, which establishes (1) a framework for classifying security incidents according to their severity level, taking into account the nature and scope of the incident; and (2) protocols for the escalation of incidents, including to the attention of the Technology Committee as appropriate. The incident response plan is approved annually by the board of directors. We maintain a Global Security Operations Center ("GSOC"), staffed 24/7, and a Global Critical Incident Management ("GCIM") team, and the roles and responsibilities of the GSOC and GCIM in the incident response context are established by the incident response plan, as well as in associated playbooks and other procedural documentation. On an annual basis, we retain an outside consultant to develop and administer a simulation of a cybersecurity incident designed to test our response capabilities and capacity for effective cross-functional coordination in the wake of an incident and to inform management and the Technology Committee of the results of the exercise. We maintain a business resiliency program, overseen by BRG, that is designed to facilitate our ability to respond, recover and resume services in the event of an incident that causes an operational disruption.


text: Discussion of Material Cybersecurity Risks and Incidents We have not experienced any material cybersecurity incidents in the past calendar years and the expenses we have incurred from cybersecurity incidents during that period were immaterial. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For a full discussion of cybersecurity risks, see the section entitled "Risk Factors" in Item 1A.


text: Board and Management Oversight of Risks Associated with Cybersecurity Threats The Technology Committee provides the board of director-level oversight of our information technology and information security practices and cyber-risk profile and serves as a liaison between our board of directors and the CISO and the Chief Privacy Officer with respect to such matters. The Technology Committee reviews our key initiatives and practices relating to information technology, information security, cybersecurity, disaster recovery, business continuity, data privacy and data governance, and monitors compliance with regulatory requirements and industry standards. The Technology Committee helps to ensure that our strategic business goals are aligned with our technology strategy and infrastructure and that management has adequate support for the Company's internal technology and information security needs.


text: At every regular meeting of the Technology Committee, the CISO provides the Technology Committee with updates and changes to the state, strategy and risks related to the information security program as well as other security news and topics. Further, the Technology Committee and Audit Committee receive quarterly reports from the Chief Risk Officer regarding our risk exposure related to significant information technology and information security practices.


text: The CISO and CIO meet regularly with the chair of the Technology Committee outside of committee meetings. In addition, the board of directors regularly receives information about these topics from the chair of the Technology Committee, the CIO, and management, and the board of directors is apprised directly of incidents as appropriate, pursuant to our incident response plan.


text: Processes for the Identification, Assessment, and Management of Material Risks from Cybersecurity Threats Although Global Payments is unable to eliminate all risks associated with cybersecurity threats, and we cannot provide full assurance that our cybersecurity risk management processes will be fully complied with or effective, we have adopted policies and procedures that are designed to facilitate the identification, assessment, and management of those risks, including any such risks that have the potential to be material.


text: We use multiple mechanisms to identify risks associated with cybersecurity threats, including, but not limited to, the following: • Our information security program describes three levels of risk assessment exercises to be performed or obtained on a periodic basis by the Information Security function, ranging from enterprise-level to system-level risk assessments; • Our Information Security function also includes a threat intelligence team that performs continual threat monitoring activities; • Our Operations and Technology Solutions functions include teams that provide risk review, architectural review, security advisory and application testing services in connection with the development of new solutions, applications and integrations with the potential to create new information technology or information security risks; • Our Internal Audit function performs annual reviews designed to evaluate selected systems' compliance with our information security program and/or recognized external control frameworks; • Independent consultants and auditors evaluate selected systems and applications on an annual basis; and • All team members are empowered to submit self-identified information security risks for analysis by our internal risk management professionals.


text: We manage risks associated with cybersecurity threats first and foremost through our information security program. We have implemented a comprehensive, layered security approach, across our computing environment, that is designed to facilitate the reduction of cybersecurity risk through the establishment of technical, physical and administrative controls oriented towards the maintenance of the confidentiality, integrity and availability of our information and technical assets. The structure of the information security program is informed by the National Institute of Standards and Technology Cybersecurity Framework, and the program includes controls designed to facilitate the compliance of our cardholder data environments with the PCI DSS.


text: The information security program is under the responsibility of the Chief Information Security Officer ("CISO"), while governance and oversight is provided by the Technology Committee as set forth in the Technology Committee Charter. The CISO is responsible for assessing and managing risk from cybersecurity threats, as well as the strategy, execution and administration of the program, and reports directly to the Chief Information Officer ("CIO"), while also maintaining reporting lines to the Technology Committee, its chair and the full board of directors.


text: Our CIO has over 25 years of experience specializing in cloud migrations, launching innovative software products and advanced analytics as well as building high-performance development organizations. Our CISO has over 25 years of leadership experience managing global information technology, information security and IT infrastructure and operations.


text: We have also established a Management Risk Committee ("MRC"), composed primarily of executive management, which meets regularly and is responsible for identifying, assessing, prioritizing and monitoring action plans to mitigate key risks.


text: Lastly, our ERM organization, under the supervision of the Chief Risk Officer, leads our efforts to consider and assess threats to us and the risks that result therefrom, including cybersecurity threats and related risks. With support from the Information Security, Legal and the Privacy Office teams, our ERM organization conducts periodic evaluations of our information security posture, manages regular meetings with the executive leadership team to discuss risk levels across the Company, and maintains and monitors risk tolerances and escalation criteria that drive executive and the board of director communications, as further described in our disclosures related to the board of directors oversight of material risks associated with cybersecurity threats.


text: To encourage alignment on risk identification, assessment, and management objectives throughout all levels of the Company, we have implemented a security education and awareness program that is designed to reinforce key behaviors that facilitate risk reduction and inform team members about the material cybersecurity risks facing our organization. We also include periodic training on information security to the board of directors.


text: Identification, Assessment, and Management of Third-Party Cybersecurity Risks We have designed our risk identification, assessment and management processes and procedures to account for cybersecurity risks associated with our use of third-party service providers. In addition to performing periodic assessments of vendors that include evaluating those vendors for cybersecurity risks, we endeavor to reduce supply chain cybersecurity risks by: (1) seeking to impose contractual requirements on our counterparties related to the use and security of personal data and other confidential information, as well as compliance with applicable privacy and security laws, wherever required by law to do so; and (2) requiring new software integrations and connectivity with vendors to undergo an architectural review process that involves consultation with the information security function and other relevant stakeholders. Moreover, critical vendors receive periodic comprehensive risk assessments conducted by the vendor management office (a team within the ERM organization), in collaboration with Information Security and our Business Resiliency Governance ("BRG") team, that include a focus on the vendor's cybersecurity practices.


text: Evaluation, Categorization, and Escalation of Cybersecurity Incidents Our information security program includes an incident response plan, which establishes (1) a framework for classifying security incidents according to their severity level, taking into account the nature and scope of the incident; and (2) protocols for the escalation of incidents, including to the attention of the Technology Committee as appropriate. The incident response plan is approved annually by the board of directors. We maintain a Global Security Operations Center ("GSOC"), staffed 24/7, and a Global Critical Incident Management ("GCIM") team, and the roles and responsibilities of the GSOC and GCIM in the incident response context are established by the incident response plan, as well as in associated playbooks and other procedural documentation. On an annual basis, we retain an outside consultant to develop and administer a simulation of a cybersecurity incident designed to test our response capabilities and capacity for effective cross-functional coordination in the wake of an incident and to inform management and the Technology Committee of the results of the exercise. We maintain a business resiliency program, overseen by the BRG team, that is designed to facilitate our ability to respond, recover and resume services in the event of an incident that causes an operational disruption.


text: Discussion of Material Cybersecurity Risks and Incidents We have not experienced any material cybersecurity incidents in the past calendar year and the expenses we have incurred from cybersecurity incidents during that period were immaterial. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For a full discussion of cybersecurity risks, see the section entitled "Risk Factors" in Item 1A.


text: Board and Management Oversight of Risks Associated with Cybersecurity Threats The Technology Committee provides the board of director-level oversight of our information technology and information security practices and cyber-risk profile and serves as a liaison between our board of directors and the CISO with respect to such matters. The Technology Committee reviews our key initiatives and practices relating to information technology, information security, cybersecurity, disaster recovery, business continuity, data privacy and data governance, and monitors compliance with regulatory requirements and industry standards. The Technology Committee helps to ensure that our strategic business goals are aligned with our technology strategy and infrastructure and that management has adequate support for our internal technology and information security needs.


text: At every regular meeting of the Technology Committee, the CISO provides the Technology Committee with updates and changes to the state, strategy and risks related to the information security program as well as other security news and topics. Further, the Technology Committee and Audit Committee of the board of directors receive quarterly reports from the Chief Risk Officer regarding our risk exposure related to significant information technology and information security practices.


text: NSP-Minnesota is a wholly owned subsidiary of Xcel Energy. As such, its cybersecurity processes are maintained by Xcel Energy management and governed by its Board of Directors. As described in Item 1A – Risk Factors, Xcel Energy operates in an industry that requires the continued operation of sophisticated information technology, control systems and network infrastructure, as such, our business is subject to the risk of interruption by cybersecurity incidents that range from attacks common to most industries, such as phishing and denial-of-service, to attacks from more sophisticated adversaries, including nation state actors, that target the critical infrastructure used in the operation of our business.

companyName: NORTHERN STATES POWER CO


text: Xcel Energy has a security risk program in place to identify, assess, manage and report material risks from cybersecurity incidents. As a utility provider, Xcel Energy complies with reliability standards imposed by NERC, including critical infrastructure protection standards related to both cybersecurity and physical security. These standards imposed by NERC, in alignment with the NIST Cybersecurity Framework, are the basis for which Xcel Energy has designed the cybersecurity control framework within its security risk program.


text: Annually, as part of Xcel Energy's enterprise risk program, an integrated cybersecurity risk identification and assessment is completed across Xcel Energy's business, including generation, transmission, distribution and fuel storage facilities, information technology systems and other infrastructure or physical assets as well as information processed in our systems (including systems hosted by third parties) that could be affected by cybersecurity incidents. This analysis includes the impact, likelihood, timeframe and controllability of cybersecurity risks and is presented to the Board of Directors. Management monitors and reviews the results of this analysis, integrating them into the enterprise risk assessment processes and implements appropriate mitigating actions as needed.


text: Xcel Energy's cybersecurity policies, standards, practices and readiness are regularly assessed by third-party consultants. These partners are engaged to perform independent penetration testing and other security related services to assist in the prevention, detection, monitoring, mitigation and remediation of cybersecurity incidents and risks. The results of these assessments are communicated to management and the Board of Directors by the Chief Security Officer.


text: Xcel Energy employs a comprehensive risk based approach to assess the magnitude and significance of a vendor's risk to Xcel Energy. Certain third-party service providers are subject to vendor security risk assessments at the time of integration, contract execution/renewal, and upon detection of any increase in risk profile. Xcel Energy uses a variety of inputs in such risk assessments, including information supplied by providers and third parties (including information analysis centers that share daily threat intelligence and improve organizational agility associated with management of cybersecurity risks). In addition, Xcel Energy requires certain third-party service providers to meet appropriate security requirements, controls and responsibilities. Xcel Energy deploys periodic monitoring activities to assess compliance with our cybersecurity control framework and investigates security incidents that have impacted our third-party service providers as appropriate.


text: Management has assigned responsibility for the security risk program to the Chief Security Officer who has extensive experience in critical infrastructure protection, including multiple years of experience with the Department of Defense. The Chief Security Officer is informed about and monitors prevention, detection, mitigation and remediation efforts through a team of security professionals, many of whom are Certified Information Systems Security Professionals, Certified Information Security Managers or have received other cybersecurity certifications. The team has extensive experience selecting, deploying and operating cybersecurity technologies, initiatives and processes that aid in preventing, remediating and mitigating known and unknown cybersecurity threats.


text: The Chief Security Officer or members of management brief the Board on routine and regular cybersecurity risk and threat updates, typically on a quarterly basis. In the event of a significant threat or incident, management and the Chief Security Officer leverage Xcel Energy's incident response processes to assess impacts and resolve incidents. When a significant cybersecurity incident occurs, management communicates with the Board of Directors and relevant committees.


text: The Board of Directors oversees the risks associated with cybersecurity and the physical security of our assets, with information security matters being discussed at each regular board meeting as well as at the ONES and Audit Committee meetings throughout the year.


text: While the ONES Committee has primary committee responsibility for cybersecurity due to the operational issues involved, the Board of Directors has determined that the topic is of sufficient importance to warrant this comprehensive oversight approach. Augmenting such oversight efforts, the Board conducts drills to practice its response in a possible emergency situation to ensure it is well prepared and positioned to perform in a possible crisis.


text: Cybersecurity risks are a part of Xcel Energy's normal course of business. To date, no cybersecurity incident or attack has had a material impact on our business or results of operations. As of Feb. 21, 2024 there have been no material cybersecurity incidents to report.


text: The Company has a security risk program in place to identify, assess, manage and report material risks from cybersecurity incidents. As a utility provider, Xcel Energy complies with reliability standards imposed by NERC, including critical infrastructure protection standards related to both cybersecurity and physical security. These standards imposed by NERC, in alignment with the NIST Cybersecurity Framework, are the basis for which Xcel Energy has designed the cybersecurity control framework within its security risk program.


text: Xcel Energy's cybersecurity policies, standards, practices, annual cybersecurity training content and readiness are regularly assessed by third-party consultants. These partners are engaged to perform independent penetration testing and other security related services to assist in the prevention, detection, monitoring, mitigation and remediation of cybersecurity incidents and risks. The results of these assessments are communicated to management and the Board of Directors by the Chief Security Officer.


text: Xcel Energy employs a comprehensive risk based approach to assess the magnitude and significance of a vendor's risk to the Company. Certain third-party service providers are subject to vendor security risk assessments at the time of integration, contract execution/renewal, and upon detection of any increase in risk profile. Xcel Energy uses a variety of inputs in such risk assessments, including information supplied by providers and third parties (including information analysis centers that share daily threat intelligence and improve organizational agility associated with management of cybersecurity risks). In addition, the Company requires certain third-party service providers to meet appropriate security requirements, controls and responsibilities. The Company deploys periodic monitoring activities to assess compliance with our cybersecurity control framework and investigates security incidents that have impacted our third-party service providers as appropriate.


text: Management has assigned responsibility for the security risk program to the Chief Security Officer who has multiple years of experience in the Defense Industrial Base. The Chief Security Officer is informed about and monitors prevention, detection, mitigation and remediation efforts through a team of security professionals, many of whom are Certified Information Systems Security Professionals, Certified Information Security Managers or have received other cybersecurity certifications. The team has extensive experience selecting, deploying and operating cybersecurity technologies, initiatives and processes that aid in preventing, remediating and mitigating known and unknown security threats.


text: The Chief Security Officer or members of management brief the Board on routine and regular cybersecurity risk and threat updates, typically on an annual basis. In the event of a significant threat or incident, management and the Chief Security Officer leverage Xcel Energy's incident response processes to assess impacts and resolve incidents. When a significant cybersecurity incident occurs, management communicates with the Board of Directors and relevant committees.


text: The Board of Directors oversees the risks associated with cybersecurity and the physical security of our assets, with information security matters being discussed at board meetings as well as at the ONES and Audit Committee meetings throughout the year.


text: While the ONES Committee has primary committee responsibility for cybersecurity due to the operational issues involved, the Board of Directors has determined that the topic is of sufficient importance to warrant this comprehensive oversight approach. Augmenting such oversight efforts, the enterprise has the ability to notify and update the Board of Directors in the event of a possible crisis situation.


text: Cybersecurity risks are a part of Xcel Energy's normal course of business. To date, no cybersecurity incident or attack affecting us or our vendors has had a material impact on our business or results of operations. As of Feb. 27, 2025 there have been no material cybersecurity incidents to report.


text: Our Board of Directors administers its cybersecurity risk oversight function directly through our Audit and Finance Committee ("AFC"). Our AFC has primary responsibility for overseeing our risk management practices, programs, policies, and procedures related to data privacy, data protection, and cybersecurity. The AFC reviews and evaluates the processes utilized by management to identify and assess the material internal and external risks that may affect the Company's business. Our AFC regularly discusses with management, Company legal counsel, and the internal audit department the Company's major risk exposures. This includes potential financial impact on the Company and the steps taken to monitor and control those risks. Reviews with management are done annually which includes a summary of legal and regulatory compliance matters and risk management activities, including a review of the Company's cybersecurity program. Additionally, our AFC oversees the process by which our Board of Directors is informed regarding the risks facing the Company and coordinates with the Company's legal counsel to ensure our Board of Directors receives regular risk assessment updates from management.

companyName: EXACT SCIENCES CORP

ticker: EXAS


text: The Chief Information Security Officer ("CISO") is responsible for identifying, assessing and managing the Company's risks from cybersecurity threats. The CISO has been with the Company for two years and has over 30 years of experience in technology, including 15 years in cybersecurity, and has held the CISO position at prior companies before joining Exact Sciences. The CISO is supported by a cybersecurity team that is staffed with experts in strategy, governance, risk management, compliance, engineering and development, security operations, and incident management.


text: The CISO provides our AFC with quarterly updates about our cybersecurity program and material risks. This includes updates on cybersecurity practices, programs, and the status of projects designed to strengthen internal cybersecurity and data protection.


text: Risk Management and Strategy Processes for identifying and assessing cybersecurity risks The CISO, with the support of the cybersecurity team and the owners of information technology across the business, monitors current events and trends related to cybersecurity and assesses any potential impact on current systems and operations. There are several processes in place to monitor and review our systems, including third-party solutions, to identify potential risks. Third-party service providers are required to notify us in the event of a cybersecurity incident within their systems, and annual reviews are conducted on the Company's critical third-party vendors. Cybersecurity risks, threats, and incidents, including those from third-party service providers, are tracked and regularly provided to the CISO. Beginning in 2024, the Cybersecurity Leadership Team, which includes the CISO and executives from all business functions across the organization, meet at least quarterly to review and discuss cybersecurity risks facing the Company.


text: Processes for managing cybersecurity risks The cybersecurity team tracks risks and incidents related to cybersecurity until the risk is mitigated to an acceptable level or fully remediated. When risks are identified, the cybersecurity team oversees mitigation plans with the risk owner which are communicated to necessary teams and remediation steps are taken.


text: Processes for incorporating cybersecurity risks into the overall risk management process Our process for identifying, assessing, and managing risks related to cybersecurity is incorporated into our Enterprise Risk Management ("ERM") process. The Risk Management team meets at least annually with cybersecurity leadership to discuss cybersecurity related risks identified and the potential likelihood and severity of each risk. Through the ERM process, cybersecurity risks are presented to the executive leadership team, including the CEO and CFO, as well as reported to the AFC.


text: Currently, we are not aware of any risks from cybersecurity threats, or from previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company.


text: Our Board of Directors administers its cybersecurity risk oversight function directly through our Audit and Finance Committee ("AFC"). Our AFC has primary responsibility for overseeing our risk management practices, programs, and policies related to data privacy, data protection, and cybersecurity. The AFC reviews and evaluates the processes utilized by management to identify and assess the material internal and external risks that may affect our business. Our AFC regularly discusses the our major risk exposures with management, legal counsel, and the internal audit department. This includes potential financial impact on the Company and the steps taken to monitor and control those risks. Annual reviews with management include a summary of legal and regulatory compliance matters, risk management activities, and including a review of our cybersecurity program. Additionally, our AFC oversees the process by which our Board of Directors is informed regarding the risks facing the Company and coordinates with our legal counsel to ensure our Board of Directors receives regular risk assessment updates from management.


text: The Chief Information Security Officer ("CISO") is responsible for identifying, assessing, and managing our risks from cybersecurity threats. The CISO has been with the Company for three years, bringing more than 30 years of technology experience, including 15 years in cybersecurity, and has held the CISO position at other companies before joining Exact Sciences. The CISO leads the cybersecurity team consisting of experts in strategy, governance, risk management, compliance, engineering and development, security operations, and incident management.


text: Our Artificial Intelligence Council, which includes the CISO, oversees adherence to AI ethical principles and regulatory requirements in the development and utilization of AI systems, including generative AI tools. AI governance is integrated within the broader governance framework discussed above.


text: The CISO provides our AFC with periodic updates about our cybersecurity program and material risks. This includes updates on cybersecurity practices and projects designed to strengthen internal cybersecurity and data protection.


text: Risk Management and Strategy Processes for identifying and assessing cybersecurity risks The CISO, with the support of the cybersecurity team and the owners of information technology across the business, monitors current events and trends related to cybersecurity and assesses impact on current systems and operations. There are several processes in place to monitor and review our systems, including third-party solutions, to identify potential risks. Third-party service providers are required to notify us in the event of a cybersecurity incident within their systems, and annual reviews are conducted on the Company's critical third-party vendors. Cybersecurity risks, threats, and incidents, including those from third-party service providers, are tracked and regularly provided to the CISO. The Cybersecurity Leadership Team, which includes the CISO and executives from all business functions across the organization, meets at least quarterly to review and discuss cybersecurity risks facing the Company.


text: Processes for managing cybersecurity risks The cybersecurity team tracks risks and incidents related to cybersecurity until the risk is mitigated to an acceptable level or fully remediated. When risks are identified, the cybersecurity team oversees mitigation plans with the risk owner. The plans communicated to necessary teams and remediation steps are taken.


text: Processes for incorporating cybersecurity risks into the overall risk management process Our process for identifying, assessing, and managing risks related to cybersecurity is incorporated into our Enterprise Risk Management ("ERM") process. The Risk Management team meets at least annually with cybersecurity leadership to discuss identified cybersecurity-related risks and the potential likelihood and severity of each risk. Through the ERM process, cybersecurity risks are presented to the executive leadership team, including the CEO and CFO, as well as reported to the AFC.


text: Currently, we are not aware of any risks from cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company.


text: We are committed to maintaining robust governance and oversight of our information technology and security systems to maintain our facilities' physical security and to protect proprietary and confidential information, including that of our customers, suppliers and employees. Information about information technology and security risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "A breach of our information technology and security systems could materially adversely affect our business."

companyName: NLIGHT, INC.

ticker: LASR


text: As part of our overall risk management process, we conduct an annual assessment of information systems and organizational assets, as well as periodic vulnerability scanning, penetration testing, security audits, and ongoing risk assessments. We also maintain incident response plans that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs annually. We use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems. In addition to our in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: While we, like any technology-dependent company operating in the current environment, have experienced cybersecurity incidents in the past we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations. However, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in, among other things: unfavorable publicity, damage to our reputation, difficulty marketing our products, customer allegations of breach-of-contract, claims and litigation by affected parties, investigations by and other proceedings involving governmental authorities and possible financial liabilities for damages, any of which could materially adversely affect our business, financial condition, reputation and relationships with customers and partners.


text: Our cybersecurity risks and associated mitigations are evaluated by senior leadership and subject to oversight by the Information Technology and Security Committee of our Board of Directors. Our cybersecurity program is managed by our Vice President of IT & Information Security, who is a Certified Information Systems Security professional (CISSP) and reports to our Chief Operating Officer. Our Chief Operating Officer and Vice President of IT and Information Security provide periodic briefings about our cybersecurity risk management to the Information Technology and Security Committee.


text: We are committed to maintaining robust governance and oversight of our information technology and security systems to maintain our facilities' physical security and to protect the security of proprietary and confidential information, including that of our customers, suppliers and employees. Information about information technology and security risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "A breach of our information technology and security systems could materially adversely affect our business."


text: While we, like any technology-dependent company operating in the current environment, have experienced cybersecurity incidents in the past, we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations. However, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in, among other things: unfavorable publicity, damage to our reputation, difficulty marketing our products, customer allegations of breach-of-contract, claims and litigation by affected parties, investigations by and other proceedings involving governmental authorities and possible financial liabilities for damages, any of which could materially adversely affect our business, financial condition, reputation and relationships with customers and partners.


text: Our cybersecurity risks and associated mitigations are evaluated by senior leadership and subject to oversight by the Information Technology and Security Committee of our Board of Directors. Our cybersecurity program is managed by our Senior Director of IT & Information Security, who is a Certified Information Systems Security professional (CISSP) and reports to our Chief Operating Officer. Our Chief Operating Officer and Senior Director of IT and Information Security provide periodic briefings about our cybersecurity risk management to the Information Technology and Security Committee.


text: Risk Management and Strategy We have an information security program in place to safeguard our information systems and protect our confidential data. This cybersecurity risk management program is integrated into our broader enterprise risk management framework, under a Risk Committee that is led by our Chief Financial Officer and includes our Chief Technology Officer, who is responsible for cybersecurity and information technology matters, General Counsel, Chief Accounting Officer, Chief Human Resources Officer, Chief Commercial Officer, and other business and strategy leaders. The Risk Committee identifies, assesses, and manages enterprise level risks facing the Company, taking into account likelihood of occurrence and potential impact. The Risk Committee reports to our Executive Committee and this process is primarily overseen by the Audit Committee of our Board. Our Executive Committee consists of the Chief Executive Officer, Chief Financial Officer, General Counsel, Chief Technology Officer, Chief Human Resources Officer, Chief Commercial Officer, and Vice President, Communications and Corporate Social Responsibility.

companyName: QXO BUILDING PRODUCTS, INC.


text: Our information security program aligns with industry standards and best practices, such as the Center for Internet Security Critical Security Controls ("CIS Controls"). It consists of information security and privacy policies and procedures, which include, among other things, endpoint threat detection and response, identity and access management, vulnerability and patch management, and multi-factor authentication.


text: We also provide new hire and annual security awareness and privacy training to employees. We conduct monthly phishing assessment exercises to ensure employees are aware and educated about phishing threats and are trained to identify and report them. In addition, targeted training is conducted for key departments dealing with sensitive data types.


text: We use third-party security firms to assist us in performing assessments annually and penetration testing regularly throughout the year on our applications, networks, and environments. We perform an annual review to verify our compliance with the Payment Card Industries Data Security Standards ("PCI DSS").


text: We use a variety of methods to oversee and identify material cybersecurity threats related to the use of third-party technology and services. By way of example, we perform diligence with respect to third parties, obtain contractual protections, and utilize third-party risk monitoring security rating services.


text: In the event of a security issue, we have a written incident response plan and have retained trusted experts to assist us in quickly triaging, containing, and understanding the issue. Our management team periodically reviews our response readiness and completes tabletop exercises on potential cybersecurity breaches with the assistance of a third-party cybersecurity consultant. We use the results from these exercises to enhance our response plan and cybersecurity protections going forward.


text: We are not aware of any material risks from cybersecurity threats that have materially impaired or could materially impair our business, results of operations, or financial condition. However, our information security controls, no matter how well designed or implemented, will not fully eliminate cybersecurity risk. It is possible that we are unable to detect or underestimate certain vulnerabilities, or that we may not effectively implement security controls as intended. The Company does manage information security issues that are immaterial individually and in the aggregate from time to time as part of our routine operations.


text: For additional information regarding how cybersecurity threats could potentially materially affect our business strategy, results of operations or financial condition, see Part 1, Item 1A "Risk Factors – Risks Related to Information Technology". Interruption, interference with, or failure of information technology systems could hurt our ability to effectively provide our product and services, which could harm our reputation, financial condition, operating results and cash flows.


text: Board Oversight. The Audit Committee assists the Board in fulfilling its fiduciary duties regarding cybersecurity risk oversight. The Audit Committee is composed of directors with diverse professional experience, including three members with backgrounds in cybersecurity. We believe this expertise enables our Audit Committee to effectively oversee our cybersecurity risks and incident response plans. For more information on our directors' expertise, see our definitive proxy statement for our 2024 Annual Meeting of Stockholders to be filed with the SEC.


text: Our Chief Technology Officer briefs the Audit Committee of our Board quarterly, and our full Board annually, regarding cybersecurity risks and information security matters, including the current cybersecurity landscape and emerging threats, the status of ongoing cybersecurity initiatives and projects, the results of any third-party security ratings or assessments of our cybersecurity program, and regulatory updates. Members of management also provide regular updates to the Audit Committee on the categorization and management of enterprise risks, including information security risks. In addition, the Board participates in ongoing education and periodic tabletop exercises on cybersecurity breach response planning.


text: Management's Role. Our Vice President, IT – Technical Services reports to our Chief Technology Officer and is the head of our cybersecurity team. He is responsible for assessing and managing our cybersecurity management program, informs our Chief Technology Officer regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents, and supervises and monitors such efforts. Our Chief Technology Officer has more than 20 years of experience in cybersecurity and information systems management, and our Vice President, IT – Technical Services has nearly three decades of experience managing information systems, network infrastructure, and cybersecurity in the public and private sectors. This combined in-depth knowledge and experience has been critical in developing and implementing our cybersecurity programs. In addition to quarterly reports to the Audit Committee, as an Executive Vice President and member of the Executive Committee, our Chief Technology Officer regularly briefs the Executive Committee on the threat landscape, the Company's cybersecurity programs and risks, so that the highest level of management is regularly informed of cybersecurity issues for decision-making and guidance.


text: Risk Management and Strategy We have an information security program in place to safeguard our information systems and protect our confidential data. This cybersecurity risk management program is integrated into our broader enterprise risk management framework, under a Risk Committee that is led by our VP, Strategy & Transformation and includes our Chief Technology Officer, who is responsible for cybersecurity and information technology matters, General Counsel and other business and strategy leaders. The Risk Committee identifies, assesses, and manages enterprise level risks facing the Company, taking into account likelihood of occurrence and potential impact. The Risk Committee reports to our Executive Committee and this process is primarily overseen by the Audit Committee of our Board. Our Executive Committee consists of our executive officers and other senior members of management.


text: We also provide new hire and annual security awareness and privacy training to employees. We conduct monthly phishing assessment exercises to ensure employees are aware and educated about phishing threats and are trained to identify and report them.


text: For additional information regarding how cybersecurity threats could potentially materially affect our business strategy, results of operations, or financial condition, see Part 1, Item 1A "Risk Factors – Risks Related to Information Technology." Interruption, interference with, or failure of information technology systems could hurt our ability to effectively provide our product and services, which could harm our reputation, financial condition, operating results, and cash flows.


text: Board Oversight. The Audit Committee assists the Board in fulfilling its fiduciary duties regarding cybersecurity risk oversight. The Audit Committee is composed of directors with diverse professional experience, including three members with backgrounds in cybersecurity. We believe this expertise enables our Audit Committee to effectively oversee our cybersecurity risks and incident response plans. For more information on our directors' expertise, see our definitive proxy statement for our 2025 Annual Meeting of Stockholders to be filed with the SEC.


text: Management's Role. Our Vice President, IT – Technical Services reports to our Chief Technology Officer and is the head of our cybersecurity team. He is responsible for assessing and managing our cybersecurity management program, informs our Chief Technology Officer regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents, and supervises and monitors such efforts. Our Chief Technology Officer has more than 20 years of experience in cybersecurity and information systems management, and our Vice President, IT – Technical Services has nearly three decades of experience managing information systems, network infrastructure, and cybersecurity in the public and private sectors. This combined in-depth knowledge and experience has been critical in developing and implementing our cybersecurity programs. In addition to quarterly reports to the Audit Committee, as an Executive Vice President and member of the Executive Committee, our Chief Technology Officer regularly briefs the Executive Committee on the threat landscape, the Company's cybersecurity programs, and risks, so that the highest level of management is regularly informed of cybersecurity issues for decision-making and guidance.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and clinical trial data (Information Systems and Data).

companyName: MACROGENICS INC

ticker: MGNX


text: Our information security function, which is led by our Executive Director of Information Technology, with support from our Senior Information Security Manager, our legal team, a management-level Technology Steering Committee, and the Audit Committee of the Board, helps identify, assess, and manage the Company's cybersecurity threats and risks. We identify and assess cybersecurity risks by monitoring and evaluating our threat environment using various methods including, for example using automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating threats reported to us, evaluating our and our industry's risk profile, analyzing reports of threats and actors, audits, conducting vulnerability assessments, and conducting tabletop incident response exercises.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including: an incident response plan and procedures, incident detection and response playbook, business continuity plans, encryption of certain data, network security controls, identity management and access controls, physical security controls, 24/7 systems monitoring, vendor risk management processes, employee cybersecurity and privacy training, penetration testing, cybersecurity insurance, and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk register; (2) the information security function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our Technology Steering Committee evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including professional services firms, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, and dark web monitoring services.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, distributors, and supply chain management resources. We have vendor management processes to manage cybersecurity risks associated with our use of certain of these providers, such as reviewing security questionnaires, reviewing the vendor's written security program, conducting risk assessments for certain vendors, arranging security assessment calls with the vendor's security personnel, reviewing security assessments, or imposing contractual obligations on the vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify and mitigate cybersecurity risks associated with a provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' Audit Committee and management's Technology Steering Committee are responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Executive Director, Information Technology, who has fourteen years of information security experience and holds a Certified Information Systems Security Professional (CISSP) certification. Our Senior Information Security Manager holds CISSP certification, an MSc. in Information Security, and has over 20 years government and industry cybersecurity experience.


text: Company management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Company management is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances and incident severity, including our Executive Director Information Technology who works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents. In addition, the Company's incident response process includes reporting to the audit and technology steering committees of the board of directors for certain cybersecurity incidents.


text: The board of directors' Audit Committee receives periodic reports from our Executive Director Information Technolog concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The board of directors also receives regular reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and clinical trial data (Information Systems and Data).


text: Our information security function is led by our Executive Director of Information Technology and supported by the Senior Information Security Manager, our legal team, a management-level Technology Steering Committee, and the Audit Committee of the Board of Directors. This function is responsible for identifying, assessing, and managing the Company's cybersecurity threats and risks. We employ various methods to monitor and evaluate the threat environment, including automated tools, subscriptions to cybersecurity threat reports and services, analysis of threats reported to us, evaluations of our and our industry's risk profile, threat actor analyses, audits, vulnerability assessments, and tabletop incident response exercises.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These include: an incident response plan and procedures, incident detection and response playbook, business continuity plans, encryption of certain data, network security controls, identity management and access controls, physical security controls, 24/7 systems monitoring, vendor risk management processes, employee cybersecurity and privacy training, penetration testing, cybersecurity insurance, and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. Specifically, (1) cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk register; (2) the information security function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our Technology Steering Committee evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee of the board of directors, which evaluates our overall enterprise risk.


text: We engage third-party service providers, including professional services firms, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, and dark web monitoring services, to assist in identifying, assessing, and managing material risks from cybersecurity threats.


text: In addition, we use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, CROs, distributors, and supply chain management resources. We have vendor management processes to manage cybersecurity risks associated with our use of certain of these providers, such as reviewing security questionnaires, reviewing the vendor's written security program, conducting risk assessments for certain vendors, arranging security assessment calls with the vendor's security personnel, reviewing security assessments, or imposing contractual obligations on the vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify and mitigate cybersecurity risks associated with a provider.


text: The board of directors' Audit Committee receives periodic reports from our Vice President Information Technology concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The board of directors also receives regular reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: We utilize information technology that enables our operational leaders to access and share with their peers, both clinical and financial performance data in real time. Armed with relevant and current information, our operation leaders and their management teams can share best practices and the latest information, adjust to challenges and opportunities on a timely basis, improve quality of care, mitigate risk and improve both clinical outcomes and financial performance. We have also invested in specialized healthcare technology systems to assist our nursing and support staff. We have installed software and touch-screen interface systems in each operation to enable our clinical staff to monitor and deliver patient care and record patient information more efficiently. We believe these systems have improved the quality of our medical and billing records, while improving the productivity of our staff. Such uses of information systems give rise to cybersecurity risks, including system disruption, security breach, ransomware, theft, espionage and inadvertent release of information.

companyName: ENSIGN GROUP, INC

ticker: ENSG


text: We assess and identify security risk to the organization by: • conducting assessments of risk including likelihood and magnitude from unauthorized access, use, disclosure, disruption, modification or destruction of information systems and the related information processes, stored, or transmitted. • performing risk assessments and producing security assessment reports that document the results of the assessment for use and review by information technology (IT) senior leadership, including the Service Center's Chief Information Officer. • ensuring security controls are assessed for effectiveness, are implemented correctly, operating as intended and producing the desired outcome; and • continuously scanning for vulnerabilities and remedying all vulnerabilities in accordance with the associated risk.


text: We have established a continuous monitoring strategy and program, which includes: • a set of defined security metrics to be monitored. • performance of security control assessments on an ongoing basis. • addressing results of analysis and reporting security status to the executive team. • monitoring information systems to detect attacks and indicators of potential attacks. • identification of unauthorized use of the information system resources; and • deployment of monitoring devices strategically within the information system environment.


text: We have implemented an Information Security Management System (ISMS) Program to secure sensitive data protected by us. This program includes: • Establishing policies governing data security. • Monitoring data access throughout the organization's independent subsidiaries. • Providing continuous security training and awareness. • Establishing controls over devices on the network which are actively tracked, monitored and evaluated for new, missing, or updated software needed to strengthen security on the device, patch known vulnerabilities, or stabilize software or operating system issues. • Protecting sensitive data through encryption techniques. • Designing and implementing systems to include backup and recoverability principles, such as periodic data backups and safeguards in the case of a disaster.


text: Incident Management Plan Our cybersecurity incident management plan comprises the following six-step process: • The Service Center's Chief Information Officer and Director of Information Security lead its Information Security Office (ISO) team in the development, documentation, review and testing of security procedures and incident management procedures. Beyond initial creation, procedures are continually re-assessed, updated and tested on an ongoing basis. • The Service Center's Chief Information Officer and Director of Information Security work with the Executive Team on the identification, assessment, verification and classification of incidents to determine affected stakeholders and appropriate parties for contact. • The Service Center's Chief Information Officer and Director of Information Security are responsible for launching the Incident Response Team (IRT) if necessary and for notification to the Executive Team, who in turn will contact the Board of Directors and the Audit Committee to validate that the response is being addressed appropriately. • The IRT, in consultation with outside experts if needed, is responsible for the following: • Initial containment by making tactical changes to the computing environment to mitigate active threats based on currently known information. • Analysis to establish the root cause of incidents, identification and evidence collection from all affected machines and log sources, threat intelligence and other information sources. Once all appropriate information has been collected, we perform a careful analysis using forensically-sound tools and methods to prevent any contamination of evidence. • Incident containment by further analyzing additional information and further identifying any additional compromised machines or resources not previously identified. • Incident eradication by re-assessing the root cause of incidents where solutions are then implemented to solve underlying problems and prevent re-occurrence. • Recovery and restoring normal business functionality, which includes the reversal of any damage caused by the incident and responding as necessary. • Review after closure of each incident and conducting a lessons learned analysis to improve prevention and help to make incident response processes more efficient and effective. Also, the IRT evaluates competency and any additional training requirements needed. A final incident report will then be provided to key stakeholders and IRT members, which includes, but is not limited to the summary of the incident and its impact, a timeline of events, a detailed description of the incident, an evaluation of the organizational response and an assessment of the damages.


text: We have not experienced a material cybersecurity breach in the past five years and, as a result, there have been no charges related to a breach in the past five years. Moreover, no risks from cybersecurity threats have materially affected our business strategy, results of operations, or financial condition. While we have implemented processes and procedures that we believe are tailored to address and mitigate the cybersecurity threats that our Company faces, there can be no assurances that such an incident will not occur despite our efforts, as more fully described in Item 1A. Risk Factors.


text: Our Audit Committee receives quarterly reports on our information security and cyber fraud prevention programs from the Service Center's Chief Information Officer and Director of Information Security, who each have over 24 years of experience in IT, including various leadership roles at other large corporations. One of the three members of our Audit Committee is a cybersecurity expert.


text: The ISO has been established by the Service Center's Chief Information Officer, with dedicated cyber security staff focusing on security monitoring, vulnerability management, incident response, risk assessments, employee training, security engineering and management of cyber security policies, standards and regulatory compliance. Like many organizations, we align to a Cyber Security Framework and take a risk-based approach during control assessment and implementation. We align to the National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 4, a globally recognized cyber security framework of Policies, Standards and Controls that comprises of five categories of defense – Identify, Protect, Detect, Respond and Recover. We are committed to the protection of our data, systems, network and continually invest in enhancements to mitigate or reduce the impact from a cyber security threat. We conduct periodic tests to maintain readiness and resiliency while regularly reviewing policies in the interest of protecting data security. External companies or agencies may be called upon to provide consulting, guidance, assistance, or some other form of support in response to a cybersecurity incident. The regular training of employees, at least annually, on the ever-present threat of cybersecurity helps maintain data security.


text: We assess and identify security risk to the organization by: • conducting risk assessments to determine the likelihood and magnitude of an attack from unauthorized access, use, disclosure, disruption, modification or destruction of information systems and the related information processes, stored, or transmitted; • performing penetration testing assessments annually and producing security assessment reports that document the results of the assessment for use and review by information technology (IT) senior leadership, including the Service Center's Chief Information Officer; • ensuring security controls are assessed for effectiveness, are implemented correctly, operating as intended and producing the desired outcome; • continuously scanning for vulnerabilities and remediating vulnerabilities within their service level agreements in accordance with the associated risk level; and • reviewing third party and vendor risks to our organization through an internal interdisciplinary Technology Advisory Committee that includes members from our IT, Information Security Office (ISO), legal, compliance, clinical, finance and billing departments.


text: We have established a continuous monitoring strategy and program, which includes: • a set of defined security metrics to be monitored; • performance of security control assessments on an ongoing basis; • addressing results of analysis and reporting security status to the executive team; • monitoring information systems to detect attacks and indicators of potential attacks or compromises; • identification of unauthorized use of the information system resources; • deployment of monitoring systems and agents strategically within the information system environment; and • require that third party service providers who store, process or transmit data with access to electronic Protected Health Information (ePHI) undergo an independent third-party audit to achieve system organization controls certification annually.


text: We have implemented an Information Security Management System Program to secure sensitive data protected by us. This program includes: • establishing policies governing data security; • monitoring data access throughout the organization's independent subsidiaries; • providing continuous security training and awareness; • establishing controls over devices on the network which are actively tracked, monitored and evaluated for new, missing, or updated software needed to strengthen security on the device, patch known vulnerabilities, or stabilize software or operating system issues; • protecting sensitive data through encryption techniques; and • designing and implementing systems to include backup and recoverability principles, such as periodic data backups and safeguards in the case of a disaster.


text: Incident Management Plan Our cybersecurity incident management plan comprises the following six-step process: • The Service Center's Chief Information Officer and Director of Information Security lead its ISO team in the development, documentation, review and testing of security procedures and incident management procedures. Beyond initial creation, procedures are continually re-assessed, updated and tested on an ongoing basis. • The ISO team works with the Executive Team on the identification, assessment, verification and classification of incidents to determine affected stakeholders and appropriate parties for contact. • The Service Center's Chief Information Officer and Director of Information Security are responsible for launching the Incident Response Team (IRT) if necessary and for notification to the Executive Team, who in turn will contact the Board of Directors and the Audit Committee to validate that the response is being addressed appropriately. • The IRT, in consultation with outside experts if needed, is responsible for the following: • Initial containment by making tactical changes to the computing environment to mitigate active threats based on currently known information. • Analysis to establish the root cause of incidents, identification and evidence collection from all affected machines and log sources, threat intelligence and other information sources. Once all appropriate information has been collected, we perform a careful analysis using forensically-sound tools and methods to prevent any contamination of evidence. • Incident containment by further analyzing additional information and further identifying any additional compromised machines or resources not previously identified. • Incident eradication by re-assessing the root cause of incidents where solutions are then implemented to solve underlying problems and prevent re-occurrence. • Recovery and restoring normal business functionality, which includes the reversal of any damage caused by the incident and responding as necessary. • Review after closure of each incident and conducting a lessons learned analysis to improve prevention and help to make incident response processes more efficient and effective. Also, the IRT evaluates competency and any additional training requirements needed. A final incident report will then be provided to key stakeholders and IRT members, which includes, but is not limited to the summary of the incident and its impact, a timeline of events, a detailed description of the incident, an evaluation of the organizational response and an assessment of the damages.


text: We have not experienced a material cybersecurity breach in the past five years and, as a result, there have been no charges related to a breach in the past five years. Moreover, risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition. While we have implemented processes and procedures that we believe are tailored to address and mitigate the cybersecurity threats that our company faces, there can be no assurances that such an incident will not occur despite our efforts, as more fully described in Item 1A. Risk Factors.


text: The ISO has been established by the Service Center's Chief Information Officer, with dedicated cyber security staff focusing on security monitoring, vulnerability management, incident response, risk assessments, employee training, security engineering and management of cyber security policies, standards and regulatory compliance. Like many organizations, we align to a Cyber Security Framework and take a risk-based approach during control assessment and implementation. We align to the National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 4, a globally recognized cyber security framework of Policies, Standards and Controls is comprised of five categories of defense – Identify, Protect, Detect, Respond and Recover. We are committed to the protection of our data, systems, network and continually invest in enhancements to mitigate or reduce the impact from a cyber security threat. We conduct periodic tests to maintain readiness and resiliency while regularly reviewing policies in the interest of protecting data security. External companies or agencies may be called upon to provide consulting, guidance, assistance, or some other form of support in response to a cybersecurity incident. The regular training of employees, at least annually, on the ever-present threat of cybersecurity helps maintain data security.


text: Risk management and strategy We have implemented and actively maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including confidential information that is proprietary, and strategic or competitive in nature ("Information Systems and Data").

companyName: LUMOS PHARMA, INC.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: penetration and vulnerability testing, simulations, and other exercises designed to evaluate the effectiveness of our information security processes and improve our security measures.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our information technology department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We engage third party auditors to conduct periodic reviews of our security controls protecting our Information Systems and Data, as well as third party penetration testing of our network infrastructure and related systems. The results of these reviews are reported to the audit committee of our Board of Directors.


text: We use third party service providers to perform information systems and security services, such as developing a vendor management program to manage cybersecurity risks associated with our use of certain vendors. The program includes a review of the security controls and processes used by our vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the service provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a vendor and impose contractual obligations related to data security on the vendor.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I, "Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "Our business and operations would suffer in the event of system failures, security breaches or cyber-attacks."


text: Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function. The nominating and corporate governance committee of our Board of Directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management team, including our director, information technology and our IT security specialist, with input from outside parties specializing in cybersecurity risk. Our director, information technology is responsible for communicating key priorities to relevant personnel and helping to integrate cybersecurity risk considerations into our overall risk management strategy. Our IT security specialist is responsible for reviewing cybersecurity processes and security assessments, preparing security-related reports, and helping prepare for cybersecurity incidents. Our senior IT personnel have expertise in general IT matters and are pursuing certifications in cybersecurity. We utilize third parties for specialized IT matters, including cybersecurity, to augment the expertise of our internal IT personnel.


text: Our cybersecurity incident response plan is designed to actively monitor and escalate certain cybersecurity incidents to members of management depending on the circumstances, including our chief financial officer and general counsel. Management works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response plan includes reporting to the audit committee of the Board of Directors for certain cybersecurity incidents.


text: The nominating and corporate governance committee receives periodic reports from our chief financial officer concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The nominating and corporate governance committee also receives various reports, summaries or presentations related to cybersecurity threats, risks and mitigation.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and critical data, including intellectual property, and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Pulmonx Corp

ticker: LUNG


text: Our assessment, identification and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. We rely on a multidisciplinary team, including our information technology department, legal department, management, engineering operations, and third-party service providers (the "Security Function") to help assess, identify and manage the Company's cybersecurity threats and risks. Various members of the Security Function monitor and evaluate our cybersecurity threat environment using various methods including, for example, using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, and evaluating threats reported to us.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, an incident response plan, risk assessments, incident detection and response, vulnerability management, encryption of data, network security controls, data segregation, access controls, physical security, systems monitoring, employee training, cybersecurity insurance, and asset management, tracking and disposal.


text: We work with third-parties from time to time to assist us to identify, assess, and manage risks from cybersecurity threats, including, for example, professional services firms, including outside legal counsel, cybersecurity consultants, and cybersecurity software providers.


text: We use certain third-party service providers to perform a variety of functions that help us operate our business, such as application providers, hosting companies, contract research organizations, distributors, and supply chain resources. Depending on the nature of the services provided, the sensitivity and information processed, and the identity of the service provider, our vendor management process may include different levels of assessment designed to help identify cybersecurity risk associated with a provider. Such assessments include, for example, reviewing the written security program of such provider and conducting security assessments and audits.


text: See Part I, Item 1A, "Risk Factors" for a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, including the risk factor titled, If our information technology systems or data, or those third parties upon which we rely, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, interruptions to our operations such as our clinical trials, claims that we breached our data protection obligations, harm to our reputation, and a loss of customers or sales.


text: Our board of directors address the Company's cybersecurity risk management as part of its general oversight function. The board of directors' Audit Committee is responsible for overseeing the Company's cybersecurity risk management processes, including the Company's oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including the Senior Director of Information Technology, who has worked in various roles responsible for securing networks and application systems, the Chief Executive Officer, the General Counsel, the Interim Chief Financial Officer, and the VP of Finance and Administration. These members of management are responsible for hiring appropriate personnel, integrating cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. They are also responsible for approving budgets, helping to prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. When incidents are identified, these members of management are responsible for determining whether such incidents are material and may escalate material incidents to the Audit Committee and/or investors, based on the particular circumstances.


text: The Audit Committee receives periodic updates from management concerning the Company's significant cybersecurity threats, risks, and the processes the Company has implemented to address them. In addition, the Audit Committee and management maintain an ongoing dialogue regarding emerging or potential cybersecurity risks.


text: As of December 31, 2024, the Company has not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, but there can be no assurance that any such risk will not materially affect the Company in the future. See Part I, Item 1A, "Risk Factors" for a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, including the risk factor titled, If our information technology systems or data, or those of third parties with whom we work, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, interruptions to our operations such as to our LungTraX Platform services or our clinical trials, claims that we breached our data protection obligations, harm to our reputation, business operations, and financial condition, as well as a loss of customers or sales.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including the Senior Director of Information Technology, who has worked in various roles responsible for securing networks and application systems, the Chief Executive Officer, the General Counsel, and the Chief Financial Officer. These members of management are responsible for hiring appropriate personnel, integrating cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. They are also responsible for approving budgets, helping to prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. When incidents are identified, these members of management are responsible for determining whether such incidents are material and may escalate material incidents to the Audit Committee and/or investors, based on the particular circumstances.


text: As a financial institution, cybersecurity is a high priority for us as we receive and maintain the business and personal information of our customers on a daily basis. In addition, our business operations rely extensively on the continuous operation of our information and data processing systems and related back-up systems. Accordingly, we have developed and maintain a cybersecurity program that is focused on the goals of preparing for, preventing, detecting, mitigating, responding to and recovering from cyber threats and incidents, maintaining the privacy and protection of our customers' data, and the continuity of our information and data processing systems.

companyName: HOPE BANCORP INC

ticker: HOPE


text: Cybersecurity Risk Management We believe that we have a robust cybersecurity program that is aligned to industry-standard cybersecurity frameworks. To identify and assess material risks from cybersecurity threats, our corporate risk management team considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment and management process. To implement and maintain our cybersecurity program, we have a dedicated information security team that is managed by our Chief Information Security Officer. We believe our information security team is well positioned to identify risks from cybersecurity threats based on numerous job qualifications and on-going training.


text: As a regulated financial institution, we have designed our cybersecurity program based on the requirements of the Gramm-Leach Bliley Act of 1999 ("GLBA") and the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool. Our processes for identifying, assessing and managing material risks from cybersecurity threats includes reliance on the FFIEC Cybersecurity Assessment Tool as well as recurring audits and assessments of our cybersecurity program and controls. In addition to the above, we periodically (and at least annually) conduct an overall inherent cybersecurity risk assessment based on threats, the likelihood of the threats, and the potential impact of these threats to the Company. We conduct this assessment by reviewing industry-recognized breach reports, identifying the top threats, calculating the likelihood and impact of these threats, and thereby determining our overall inherent risk. We then use the Cybersecurity Assessment Tool to establish a risk profile. Based on the risk profile, the FFIEC Cybersecurity Assessment Tool recommends a program maturity level, which we use to determine whether we have the requisite minimum security controls in place that are effective. This control evaluation then helps us to determine our cybersecurity residual risk and whether we need to implement any additional controls. In addition to using FFIEC Cybersecurity Assessment Tool, we evaluate the robustness and effectiveness of our cybersecurity program both internally and externally with periodic internal risk assessments, and internal and third-party audits. We also use third party assessments to simulate threat actors to test and evaluate our cybersecurity controls and the effectiveness of our overall program. As part of our cybersecurity program, we have developed an incident response plan based on industry-standard cybersecurity frameworks, with procedures for responding to and remediating a cyber-incident, which also includes a process to activate our business continuity plan, if necessary. We also review and test our incident response plan through simulations and assessments. Furthermore, we employ recurring security awareness training for employees and produce recurring security awareness material for our customers.


text: The secure maintenance and transmission of confidential information, as well as execution of transactions over the systems of our third-party service providers, is essential to protect us and our customers against fraud and security breaches and to maintain customer confidence. Information security and risk management are an integral part of our new product and service implementation and vendor relationship management to confirm that they all meet the minimum standards and policies established and approved by our Board. We have developed processes to identify and oversee risks from cybersecurity threats associated with our third-party service providers, which includes the information security team assisting with and assessing cybersecurity robustness during vendor selection and onboarding as well as risk-based monitoring of vendors on an ongoing basis.


text: In the ordinary course of our business, we have experienced and expect to continue to experience cyber-based attacks and other attempts to compromise our information systems, although none, to our knowledge, has had a material adverse effect on our business, financial condition or results of operations. With regards to risks from cybersecurity threats, including as a result of previous cybersecurity incidents, we have conducted assessments and have determined that we do not believe any of the identified risks have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. While we do not believe cybersecurity threats are reasonably likely to affect us, our business strategy, our results of operations or our financial conditions, like all financial institutions, we face a risks of such threats, the consequences of which could be material. See Item 1A "Risk Factors – We are subject to operational risks relating to our technology and information systems," above. In addition, given the constant and evolving threat of cyber-based attacks, we incur significant costs in an effort to detect and prevent security breaches and incidents, and these costs may increase in the future.


text: Cybersecurity Governance Our Board oversees an enterprise-wide approach to risk management, designed to support the achievement of organizational objectives in the areas of strategy, operations, reporting, and compliance without exposing the organization to undue risk. While our Board has the ultimate oversight responsibility for the risk management process, the Board Risk Committee also has responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. Additionally, as part of our cybersecurity governance, we annually purchase cybersecurity insurance customary for companies in our industry. While our Board and the Board Risk Committee oversee our cybersecurity program, management is responsible for implementing the program.