text: AMN's Privacy function, which reports up through our Chief Legal Officer, works collaboratively with the Information Security function to create and review policies, standards and processes. In addition to updating the Audit Committee, the CIO and Vice President, Information & Security, and Privacy team provide regular updates to the Corporate Governance and Compliance Committee, as well as our Chief Executive Officer and other members of our senior management as appropriate.


text: AMN's information and cybersecurity program has adopted policies, standards, processes, and practices that follow recognized frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization, and other relevant standards. AMN Healthcare has also implemented certain controls and procedures that allow its management to assess, identify, and manage material risks from cybersecurity threats. Our processes are integrated into the overall enterprise risk management program, which includes financial risk, compliance risk and other strategic and operational risks that affect the Company. These processes complement our enterprise-wide risk assessment architecture, as implemented by the Company's management and as overseen by the Board through its Audit Committee.

companyName: AMN HEALTHCARE SERVICES INC

ticker: AMN

secItem: Item 1C


text: To identify and assess material risks from cybersecurity threats, we engage in regular network and endpoint monitoring, vulnerability assessments, penetration testing, and periodic tabletop exercises. We have developed an incident response plan to manage identified vulnerabilities and further improve our cybersecurity preparedness and response infrastructure. The incident response plan sets forth the actions to be taken in responding to and recovering from cybersecurity incidents, which include triage, assessing the severity of incidents, escalation protocols, containment of incidents, investigation of incidents, and remediation. In addition to our in-house capabilities, we engage with key security and technology vendors, industry participants and intelligence communities to assess our program and test our technical capabilities and enhance the effectiveness of our information and cybersecurity policies and procedures. We use a combination of tools and technologies to protect AMN Healthcare's assets and information. We maintain and operate a proactive threat intelligence program to identify and assess risk. We have implemented processes to identify, monitor and address material risks from cybersecurity threats associated with our use of third-party vendors, including those in our supply chain or who have access to our systems, data or facilities that house such systems or data.


text: Our team members receive annual training to understand the behaviors necessary to protect company and personal information and receive annual training on privacy laws and requirements. We also offer ongoing practice and education for team members to recognize and report suspicious activity, including phishing campaigns.


text: The Company has experienced cyber threats resulting in immaterial cyber incidents and expects cyber threats to continue with varying levels of sophistication.


text: Risk Management and Strategy Our Adviser and Administrator have implemented ongoing processes that are designed to continually identify, assess, manage, monitor and mitigate the dynamic and evolving material risks to us from cybersecurity threats. Our Adviser's and Administrator's resource management, information technology ("IT"), and compliance departments work in conjunction with an independent third-party information technology service provider ("ISP") engaged by our Adviser to manage our information technology strategy. The ISP regularly performs cyber assessments and assist our Adviser and Administrator in monitoring our cyber and information security programs. The ISP proposes recommendations for improvements to our Adviser's Head of Resource Management, Director of IT, and Chief Compliance Officer ("CCO"), which then are considered by other relevant officers of our Adviser and Administrator before implementation.

companyName: GLADSTONE CAPITAL CORP

ticker: GLAD


text: In addition, regular ongoing cybersecurity threat risk assessments, which also cover third-party business applications, are performed throughout the year and reported to our officers and Board of Directors by our CCO no less than quarterly. Cybersecurity risks are assessed in general as part of the overall enterprise risk management for us, but also specifically between the ISP and our Adviser and Administrator in monitoring and determining not only the risks but also in assessing corresponding processes and procedures to mitigate those risks appropriately.


text: Our ISP constantly monitors information technology risk and cybersecurity threats globally. When risks are detected the Director of IT, Head of Resource Management, and CCO consult with the ISP to assess if the risk is a cybersecurity threat to our information technology systems or data. If a risk to our information systems or data is identified, we, through our Adviser and Administrator, work in conjunction with the ISP to implement recommended processes, improvements, or safeguards to our systems or processes to address the risks as needed. Relevant examples of such efforts include but are not limited to: • implementation of industry leading Cloud solutions and business applications which possess integrated cybersecurity safeguards; • anti-malware, antivirus and threat detection software; • ransomware containment and isolation software; • enhanced password requirements and multifactor authentication requirements; • endpoint encryption; • intrusion detection and response system conduct file integrity monitoring; • email archiving, firewalls, and quarantine capabilities; • mobile device management of business applications; • frequent systems backups with recovery capabilities; and • regular vulnerability scans and penetration testing.


text: Contractually, we require the ISP to annually provide a third-party report on its systems and on the suitability of the design and operating effectiveness of its controls relevant to information and cyber security. In addition to the ongoing dialogue and technology interaction between the director of IT, our Adviser and Administrator and the ISP, any significant findings in these reports are shared with us, including our Board of Directors and other officers, to enhance ongoing monitoring and assessment of our information technology and cybersecurity risk management.


text: Our Adviser and Administrator also regularly trains employees working on our behalf on the evolving threats and educates them on cybersecurity risks to provide an additional protection barrier through end-user knowledge.


text: Notwithstanding our risk management and strategy described above, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. We are not currently aware of any known cybersecurity risks that may materially impact our operations and we may not be able to determine the likelihood of such risks. See "Risk Factors - Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, or the operations of businesses in which we invest, a compromise or corruption of our confidential information and/or damage to our business relationships, all of which could negatively impact our business, financial condition and operating results." for a discussion of risks related to cybersecurity and cyber incidents.


text: Our Board of Directors is actively engaged in overseeing our cybersecurity and information security program. Our Board of Directors receives regular reports during board meetings from our CCO on our and our Adviser's and Administrator's efforts concerning information security and addressing information technology and cybersecurity risks, no less than quarterly, and regularly receives updates from third parties on various business risks, which include cybersecurity matters. The reports are distributed to our Board of Directors, and our CCO engages in detailed discussions with the independent board members during the independent members' session. The reports cover potentially material cybersecurity threats facing us, as well as key risks and mitigation efforts undertaken by us and our Adviser and Administrator. As significant threats or events are identified by management or the ISP between regular reporting periods, our CCO will inform our Board of Directors immediately and keep it informed as to the developments of assessing the risks, mitigating efforts, and potential disclosure. Appropriate members of management and third party providers will be involved as deemed necessary based on the potential impact.


text: Our Head of Resources Management, who is also a member of our Board of Directors, and our CCO lead our cybersecurity program. Our Head of Resources Management has more than 30 years of overall experience and more than 20 years directly assessing and managing our cyber information technology and human resources systems, and the associated security concerns. Our CCO has more than 30 years of overall experience as a CPA, with more than 15 years managing information technology systems and databases, and more than 15 years supporting our Adviser's and Administrator's resource management department. This includes identifying, assessing, mitigating, and monitoring cyber information security risks. Our Director of IT has over 20 years of experience in IT, with a focus in the implementation of information security projects to enhance organizations' resilience against emerging threats, and has collaborated closely with security vendors/partners to contain and address cybersecurity incidents. These managers, as well as other management personnel, attend various professional continuing education programs, which include cybersecurity matters. Certain members of our Board of Directors have, or previously held, positions with other companies, including other public companies, that involved managing risks associated with their cyber and information technology systems.


text: Our management and Board of Directors recognize the importance of maintaining the capacity, reliability, and security of our information technology environment and data security infrastructure. Both management and the Board of Directors are actively involved in our enterprise risk management process, which specifically identifies cybersecurity as a key risk to us. To address cybersecurity risk, we have instituted policies, processes, and internal controls aligned with the framework established by the Secure Controls Framework, a meta-framework that reflects the standards of multiple security frameworks including those of the National Institute of Standards and Technology (NIST) and International Organization for Standardization (ISO). The focus of our cybersecurity program is to preserve the confidentiality, security, and availability of our systems and data, mitigate cybersecurity threats, and effectively respond to and recover from cybersecurity incidents when they occur.

companyName: ACUITY INC. (DE)

ticker: AYI


text: Material Cybersecurity Risks, Threats, and Incidents While prior compromises of our security have not had, individually or in the aggregate, a material impact on our operations and/or financial condition, the Company expects risks from cybersecurity threats, including, but not limited to, security breaches, viruses, malware, ransom attacks, other cyber-attacks, or other similar threats, to continue as events of this nature are becoming more sophisticated and frequent, and the techniques used in such attacks change rapidly. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.


text: Cybersecurity Risk Management and Strategy We have established and implemented processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity risk management efforts are led by our Chief Information Security Officer ("CISO"). We deploy technical safeguards designed to protect the Company's information systems from cybersecurity threats, including firewalls, network access control, end point protection, privileged access management, user behavior analytics, and multi-factor authentication, among others, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We also perform robust security reviews of third-party software vendors prior to purchasing their software or engaging their services. We maintain a comprehensive, risk-based, third-party risk management process to identify, oversee, assess, and manage cybersecurity risks presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Cybersecurity risks are identified and responded to by our cybersecurity team lead by our CISO. Cybersecurity incidents are managed, evaluated, investigated, and responded to in accordance with the Company's documented Cyber Incident Response Plan ("CIRP"). The CIRP is administered by the Cyber Incident Response Team ("CIRT"), which is overseen and managed by the CISO. We test and evaluate the CIRP on at least an annual basis through tabletop exercises designed to achieve incident readiness and promote cybersecurity awareness. We also from time to time engage third parties, including assessors and consultants, and our internal audit function to perform assessments, reviews, and audits on our cybersecurity measures. The results of such assessments, reviews, and audits are reported to the Audit Committee of the Board of Directors as well as the CIRT. We adjust our CIRP and other cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, reviews, and audits.


text: Our Board of Directors, in coordination with the Audit Committee of the Board of Directors, oversees the Company's overall enterprise risk management process, including the management of risks arising from cybersecurity threats. The Audit Committee is responsible for reviewing and discussing with management our risk exposure to cybersecurity risks and the steps management has taken to monitor and control the Company's exposure to risk. Additionally, the Board of Directors and the Audit Committee of the Board of Directors each receive regular presentations and reports on cybersecurity risks as well as prompt and timely information regarding any cybersecurity incident identified as significant by our CISO or Chief Privacy Officer, as required by the CIRP, and ongoing updates regarding any such incident until it has been addressed.


text: On an annual basis, the Board of Directors and the Audit Committee of the Board of Directors discuss the Company's approach to cybersecurity risk management, as well as our overall risk management strategy, with the members of senior leadership, which includes the Company's CISO, Chief Executive Officer, and Chief Financial Officer. The Audit Committee also receives periodic updates on risk management and enterprise risk management, including cybersecurity, throughout the year.


text: Our CISO has over three decades of relevant experience across the information technology landscape. His work experience has included managing cybersecurity risks at large multinational companies. Reporting to our CISO and leading a team of security engineers is our Vice President, Enterprise Security, who also has decades of experience architecting and deploying secure network, system, and data center infrastructure as well as designing and deploying processes and technology platforms that are designed to protect the enterprise from cybersecurity threats. In addition to board oversight and the presence of a cybersecurity team, we provide all applicable employees and contractors with cybersecurity awareness training and testing on an annual basis. We also deliver phishing exercises to all applicable employees and select contractors, as well as targeted phishing training to select employees and contractors, on a quarterly basis. Our product development teams keep current through specialized training on secure development practices for firmware, software, and hardware. Our training programs are designed to educate our employees on current cybersecurity risks and the programs we have in place that are designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.


text: Our management and Board of Directors recognize the importance of maintaining the capacity, reliability, and security of our information technology environment and data security infrastructure. Both management and the Board of Directors are actively involved in our enterprise risk management process, which specifically identifies cybersecurity as a key risk to us. To address cybersecurity risk, we have instituted policies, processes, and internal controls aligned with the framework established by the Secure Controls Framework, a meta-framework that reflects the standards of multiple security frameworks including those of the National Institute of Standards and Technology ("NIST") and International Organization for Standardization ("ISO"). The focus of our cybersecurity program is to preserve the confidentiality, security, and availability of our systems and data, mitigate cybersecurity threats, and effectively respond to and recover from cybersecurity incidents when they occur.


text: Our CISO has over three decades of relevant experience across the information technology landscape. His work experience has included managing cybersecurity risks at large multinational companies. Reporting to our CISO and leading a team of security engineers is our Vice President, Enterprise Security, who also has decades of experience architecting and deploying secure network, system, and data center infrastructure as well as designing and deploying processes and technology platforms that are designed to protect the enterprise from cybersecurity threats. In addition to board oversight and the presence of a cybersecurity team, we provide all applicable employees and contractors with cybersecurity awareness training and testing on an annual basis. We also deploy phishing exercises to all applicable employees and select contractors, as well as targeted phishing training to select employees and contractors, on a quarterly basis. Our product development teams keep current through specialized training on secure development practices for firmware, software, and hardware. Our training programs are designed to educate our employees on current cybersecurity risks and the programs we have in place that are designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee of the Board of Directors when appropriate.


text: We have processes in place designed to protect our information systems, data, assets, infrastructure, and computing environments from cybersecurity threats and risks while maintaining confidentiality, integrity, and availability. Our cybersecurity risk management processes are integrated into our enterprise risk management program.

companyName: ASBURY AUTOMOTIVE GROUP INC

ticker: ABG


text: We conduct regular training for cybersecurity awareness of our employees, senior executives, and certain other vendors or personnel. We also perform phishing and social engineering simulations and provide cybersecurity training for personnel with Company email and access to Company assets. We disseminate security awareness communications to certain employees to highlight emerging or urgent cybersecurity threats.


text: Asbury's information and data security training programs are housed in a Learning Management System (LMS). We migrate our acquired companies into Asbury's current LMS.


text: Our Chief Information Officer ("CIO"), who has over 35 years of experience in the technology field, oversees cybersecurity, data privacy and manages Asbury's information and security procedures. Asbury also has a Director of Cybersecurity, as well as a formal team of analysts.


text: Our Board of Directors maintains ultimate oversight of the Company's enterprise risk management program, which includes material cyber security risks. Under the oversight of the audit committee and capital allocation and risk management committee of the Company's Board of Directors, and as directed by the Company's Chief Executive Officer, our CIO is primarily responsible for the assessment and management of material cybersecurity risks. Our CIO oversees the Company's cybersecurity incident response plan and related processes that are designed to assess and manage material risks from cybersecurity threats.


text: The CIO also coordinates with the Company's legal counsel and third parties, such as consultants and legal advisors, to assess and manage material risks from cybersecurity threats. Our CIO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in the Company's incident response plan and related processes.


text: The capital allocation and risk management committee of the Company's Board of Directors assists the Board in the periodic review and evaluation of the Company's risk profile and related risk management processes which identify and manage the Company's key financial, strategic and operational risks. The audit committee of the Company's Board of Directors oversees, among other things, the adequacy and effectiveness of the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria as set forth in the Company's disclosure controls and procedures. Further, our CIO reports on cybersecurity matters, including material risks and threats, to the Company's audit committee on a quarterly basis, and the audit committee provides updates to the Company's Board of Directors at regular board meetings. In addition, the audit committee and capital allocation and risk management committee hold a joint meeting annually during which the CIO provides a comprehensive update regarding the assessment and management of material cybersecurity risks. Our CIO also provides updates as appropriate to the Company's Board of Directors.


text: We have processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company conducts security assessments of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company from time to time engages third-party consultants, legal advisors, and audit firms in evaluating and testing the Company's risk management systems and assessing and remediating certain potential cybersecurity incidents as appropriate.


text: In an effort to effectively prevent, detect, and respond to cybersecurity threats, we employ a multi-layered cybersecurity risk management program supervised by our CIO, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, architecture, and processes. This responsibility includes identifying, considering, and assessing potentially material cybersecurity incidents on an ongoing basis, establishing processes designed to prevent and monitor potential cybersecurity risks, implementing mitigation and remedial measures, and maintaining our cybersecurity program. To do so, our program leverages both internal and external techniques and expertise. Internally, among other things, we may perform penetration tests, internal tests/code reviews, and simulations using cybersecurity professionals to assess vulnerabilities in our information systems and evaluate our cyber defense capabilities. Our cybersecurity capabilities, processes, and other security measures also include, without limitation: • Service Organization Controls ("SOC")-as-a-Service (SOCaas) wherein a third-party vendor operates and maintains a fully-managed SOC on a subscription basis via the cloud; • Security Information and Event Management ("SIEM") software, which provides a threat detection, compliance, and security incident management system; • Endpoint Detection and Response ("EDR") software, which monitors for malicious activities on internal endpoints (e.g., Windows workstations, servers, MAC clients, and Linux endpoints); • Cloud monitoring; and • Disaster recovery and incident response plans, including a ransomware response plan.


text: Although we believe we have systems and processes in place to protect against risks associated with cybersecurity incidents in the future, depending on the nature of an incident, these protections may not be fully sufficient. We have experienced targeted cybersecurity incidents in the past that have resulted in unauthorized persons gaining access to certain of our information systems, and we could in the future experience similar incidents. As of the date of this Form 10-K, no cybersecurity incident or attack, or any risk from cybersecurity threat, has materially affected or has been determined to be reasonably likely to materially affect the Company, our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats we face, see the section captioned. For further discussion of the risks associated with cybersecurity incidents, see "A failure of any of our information systems or those of our third-party service providers, or a data security breach with regard to personally identifiable information ("PII") about our customers or employees, could have a material adverse effect on our business, results of operations, financial condition and cash flows." beginning on page 27 of the section entitled "Item 1A. Risk Factors" in this Form 10-K.


text: Asbury's information and data security training programs are housed in a Learning Management System ("LMS"). We migrate our acquired companies into Asbury's current LMS.


text: Our Board of Directors maintains ultimate oversight of the Company's enterprise risk management program, which includes material cyber security risks. Under the oversight of the audit committee and capital allocation and risk management committee of the Company's Board of Directors, and as directed by the Company's Chief Executive Officer, our CIO is responsible for the assessment and management of material cybersecurity risks. Our CIO oversees the Company's cybersecurity incident response plan and related processes that are designed to assess and manage material risks from cybersecurity threats. The CIO also coordinates with the Company's legal counsel and third parties, such as consultants and legal advisors, to assess and manage material risks from cybersecurity threats. Our CIO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in the Company's incident response plan and related processes.


text: Although we believe we have systems and processes in place to protect against risks associated with cybersecurity incidents in the future, depending on the nature of an incident, these protections may not be fully sufficient. We, or the business partners or services providers on which we rely, have experienced cybersecurity incidents in the past that have resulted in disruptions, technology failures, or unauthorized persons gaining access to certain information systems, and we could in the future experience similar incidents. As of the date of this Form 10-K, no cybersecurity incident or attack, or any risk from cybersecurity threat, has materially affected or has been determined to be reasonably likely to materially affect the Company, our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats we face, see the section captioned. For further discussion of the risks associated with cybersecurity incidents, see "A failure of any of our information systems or those of our third-party service providers, or a data security breach with regard to personally identifiable information ("PII") about our customers or employees, could have a material adverse effect on our business, results of operations, financial condition and cash flows." beginning on page 27 of the section entitled "Item 1A. Risk Factors" in this Form 10-K.


text: We manage cyber risk on a daily basis, as we face a multitude of threats ranging from ransomware and phishing attacks, business email compromise, and a wide array of other cyber-criminal tactics aimed at impacting our operations and compromising our sensitive information. Our customers, suppliers, subcontractors and partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. Accordingly, we have invested in resources (people, process, and technology) aimed at identifying, assessing, and responding to cyber threats.

companyName: INSULET CORP

ticker: PODD


text: Our Board of Directors ("Board") oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure to our strategic objectives. While the Board reviews the Company's cybersecurity program annually, the Nominating, Governance, and Risk Committee of the Board has primary responsibility for cybersecurity as part of its risk oversight mandate. The Nominating, Governance, and Risk Committee is scheduled to have regular updates on cybersecurity matters from our Chief Information Security Officer ("CISO") and members of the CISO's team at least two times per year. The CISO will discuss management's actions to identify and detect threats and review the structure of and enhancements to the Company's defenses as well as management's progress on its cybersecurity strategic roadmap. The Nominating, Governance, and Risk Committee Chair reports back to the full Board after each Committee meeting, including information relating to the cybersecurity discussions.


text: Our Cybersecurity organization, which includes corporate and product security, is led by our CISO. Our CISO, reporting directly to our Chief Technology Officer ("CTO"), is responsible for developing and implementing our cybersecurity program, including setting the directional security strategy and continuous improvement plans for the overall security program. Our CISO has over a decade of experience as a leader of cyber-security and technology risk management programs in both healthcare and medical device manufacturing organizations. This experience is coupled with obtaining and maintaining multiple industry certifications, including Certified Information Systems Security Professional certifications (CISSP), and Certified Information Security Manager (CISM). The CTO ensures cyber-security measures are prioritized across research and development, software engineering, and our IT functions.


text: Assessing, identifying and managing cybersecurity-related risks are also integrated into our overall enterprise risk management ("ERM") process. Cybersecurity-related risks are included in the risk universe that the ERM function evaluates to assess top risks to the enterprise on an annual basis. To the extent the ERM process identifies a heightened cybersecurity-related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. The ERM annual risk assessment is presented to the Board, with additional reporting during the year to the Nominating, Governance and Risk Committee.


text: We leverage the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to better manage and respond to cybersecurity risks in protecting our infrastructure and sensitive data. We have mapped our people, process, and technology in alignment with the categories defined in the NIST industry standard framework: Identify, Protect, Detect, Respond, and Recover. Additionally, Insulet's information security management system is ISO 27001 and 27701 certified. For the sixth consecutive year, Insulet received re-certification from the ISO, which is the recognized standard for information security management and privacy best practices that adheres to the highest international data security standards.


text: We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. We maintain a cybersecurity risk register, and cybersecurity team leaders hold monthly meetings to discuss and prioritize risks as well as the status of any remediation activity. Key facets of our cybersecurity program include:


text: •24/7 cyber monitoring. Our security operations center is located in multiple time zones to ensure around-the-clock coverage and timely threat detection and response.


text: • External Threat Landscape Assessment. Our integrated privacy, legal, and security teams are continuously monitoring for any external threat that may impact our operations. Third-party threat intelligence feeds are leveraged to monitor Insulet's digital footprint and activity that may cause brand damage. • Insider Risk Detection. We have targeted tools aimed at detecting insider threats and suspicious data movement. • Cloud and Vulnerability Management. To enhance cloud and data security, we reduce the attack surface by establishing secure defaults, implementing least privilege, and monitoring configurations continuously. As part of vulnerability and overall security posture management, we have a focused cross-functional team that meets regularly to address issues identified by security scans and security configuration checks to maintain hygiene of Insulet's computing devices. • Testing and Audits. Regular penetration testing, incident response tabletop testing, and audits are performed by trusted third-party security consultants. These final reports and gap analysis documents are logged into our risk register as appropriate. • Operating Technology ("OT") Visibility. As a manufacturer of medical devices, OT is a vital component of our business operations. Interconnectedness between OT technology and other business critical IT infrastructure can create a material cyber risk. Insult deploys segmentation and OT-specific monitoring capabilities to mitigate and monitor this risk as our OT environment continues to expand to meet the needs of our business. • Vendor Management. Vendors and key partners are subject to Insulet's Vendor Risk assessment process and subsequently monitored by our threat intelligence capability, which tracks our key vendors and suppliers. • Training and Culture. Training, awareness, and incorporating security into Insulet's culture is key to reducing risk around common threats such as phishing. We have an operational information security training program for all employees. In addition to annual trainings, we have frequent "nanolearning" targeted trainings. These quick trainings encourage participation, provide constant reminders to our employees to be vigilant and give them the tools to recognize and protect against cyber threats. We also conduct phishing simulations to test effectiveness of our training program with the aim of reducing the percentage of employees who click on suspicious emails.


text: We are intensely focused on protecting the security of our products; our guiding principle of "secure by design" underlies all of our product development. We have a cybersecurity team embedded with our research and development group to deliver on this mission as well as a Product Cybersecurity Risk Management Policy which is aligned with FDA guidance. Omnipod DASH was the first FDA-cleared insulin pump certified under the Diabetes Technology Society's "Standard for Wireless Diabetes Device Security" cybersecurity assurance standard and program, known as DTSec. This certification is a cybersecurity standard intended to raise confidence in the security of network connected medical devices through independent expert evaluation. Omnipod 5 incorporates cybersecurity by design principles, which includes secure data transfer between the Pod, Controller, cloud storage, and compatible continuous glucose monitors. Our Secure Software Development Lifecycle enforces application testing and continuous monitoring to identify security risks. Omnipod 5 is certified by ISO 27001 and the U.K. Cyber Essentials. Omnipod 5 incorporates authentication, encryption, and cybersecurity protection to ensure only trusted devices and authorized people can access the system.


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. Should a cyber incident occur, we have in place the Insulet Cybersecurity Incident Response Procedure ("CIRP"), which is designed to enable us to respond efficiently to any incidents. Pursuant to the CIRP, cybersecurity incidents are reviewed and rated by our CISO and his team. A cybersecurity incident rated at predefined risk levels will be escalated to CTO, the Chief Compliance Officer, and the General Counsel and assessed for materiality and disclosure to the CEO and the Board. Our internal Disclosure Committee would review any planned public disclosures or filings. CIRP provides the organizational and operational structure to respond to incidents that may affect the confidentiality, integrity or availability of our information systems.


text: We currently do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected the Company's business strategy, results of operations, or financial condition. While Insulet maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity and other risks which may impact Insulet.


text: We manage cyber risk on a daily basis, as we face a multitude of threats ranging from ransomware, phishing attacks, business email compromise, and a wide array of other cyber-criminal tactics aimed at impacting our operations and compromising our sensitive information. Our customers, suppliers, subcontractors, and partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. Accordingly, we have invested in resources (people, processes, and technology) aimed at identifying, assessing, and responding to cyber threats.


text: Our Board of Directors ("Board") oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure to our strategic objectives. While the Board reviews the Company's cybersecurity program annually, the Nominating, Governance, and Risk Committee ("NGR Committee") of the Board has primary responsibility for cybersecurity as part of its risk oversight mandate. The NGR Committee is updated on cybersecurity matters from our Chief Information Security Officer ("CISO") and members of the CISO's team at least twice annually. The CISO discusses management's actions to identify and detect threats and reviews the structure of and enhancements to the Company's defenses as well as management's progress on its cybersecurity strategic roadmap. The NGR Committee Chair reports to the full Board after each Committee meeting, including information relating to the cybersecurity discussions.


text: Our Cybersecurity organization, which includes infrastructure security, product security, technology risk management, and security awareness and culture is led by our CISO. Our CISO, reports directly to our Chief Technology Officer ("CTO") and is responsible for developing and implementing our cybersecurity program, including setting the directional security strategy and continuous improvement plans for the overall security program. Our CISO has over a decade of experience leading cyber-security and technology risk management programs in both healthcare and medical device manufacturing organizations and maintains multiple industry certifications, including Certified Information Systems Security Professional and Certified Information Security Manager.


text: The CTO ensures cyber-security measures are prioritized across research and development, software engineering, and our information technology functions. The CTO supports the CISO in chairing a quarterly Technology Risk Committee aimed at providing proper oversight and governance of the cybersecurity program, remediation of identified technology risks, and execution of the cybersecurity strategy. Our processes for assessing, identifying, and managing cybersecurity-related risks is also included within our overall enterprise risk management (ERM) program.


text: We leverage the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to better manage and respond to cybersecurity risks in protecting our infrastructure and sensitive data. We have mapped and base-lined our people, processes, and technology in alignment with the categories defined in the NIST industry standard framework: Identify, Protect, Detect, Respond, and Recover. Additionally, Insulet's information security management system is ISO 27001 and 27701 certified. For the seventh consecutive year, Insulet received re-certification from the ISO, which is the recognized standard for information security management and privacy best practices that adheres to the highest international data security standards. In 2024, we also added ISO certifications specific to Cloud Computing and Health Informatics, which pairs with and supports other applicable medical device and international certification requirements.


text: We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection, and mitigation. We maintain a cybersecurity risk register, and cybersecurity team leaders hold monthly meetings to discuss and prioritize risks as well as the status of any remediation activity. Key facets of our cybersecurity program include:


text: • External Threat Landscape Assessment. Our integrated privacy, legal, and security teams are continuously monitoring for any external threat that may impact our operations. Third-party threat intelligence feeds are leveraged to monitor Insulet's digital footprint and activity that may cause brand damage. • Insider Risk Detection. We have targeted tools aimed at detecting insider threats and suspicious data movement. • Cloud and Vulnerability Management. To enhance cloud and data security, we reduce the attack surface by establishing secure defaults, implementing least privilege, and monitoring configurations continuously. As part of vulnerability and overall security posture management, we have a focused cross-functional team that meets regularly to address issues identified by security scans and security configuration checks to maintain hygiene of Insulet's computing devices. • Testing and Audits. Regular penetration testing, incident response tabletop testing, and audits are performed by trusted third-party security consultants. These final reports and gap analysis documents are logged into our risk register as appropriate. • Operating Technology ("OT") Visibility. As a manufacturer of medical devices, OT is a vital component of our business operations. Interconnectedness between OT technology and other business critical information technology infrastructure can create a material cyber risk. Insult deploys segmentation and OT-specific monitoring capabilities to mitigate and monitor this risk. • Vendor Management. Vendors and key partners are subject to Insulet's Vendor Risk assessment process and subsequently monitored by our threat intelligence capability, which tracks our key vendors and suppliers. • Training and Culture. Training, awareness, and incorporating security into Insulet's culture is key to reducing risk around common threats such as phishing. We have an operational information security training program for all employees. In addition to annual trainings, we require and monitor completion of frequent "nanolearning" targeted trainings. These quick trainings provide constant reminders to our employees to be vigilant and give them the tools to recognize and protect against cyber threats. We also conduct phishing simulations to test effectiveness of our training program with the aim of reducing the percentage of employees who click on suspicious emails.


text: We are intensely focused on protecting the security of our products; our guiding principle of "security and privacy by design" underlies all of our product development. We have a cybersecurity team embedded with our research and development group to deliver on this mission as well as a Product Cybersecurity Risk Management Policy that aligns with FDA guidance. Omnipod 5 incorporates cybersecurity by design principles, which includes secure data transfer between the Pod, Controller, cloud storage, and compatible CGMs. Our Secure Software Development Lifecycle enforces application testing and continuous monitoring to identify security risks. Omnipod 5 is certified by ISO (27001, 27017 and 27799) and the U.K. Cyber Essentials. Omnipod 5 incorporates authentication, encryption, and cybersecurity protection to ensure only trusted devices and authorized people can access the system.


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. Should a cyber incident occur, we have in place the Insulet Cybersecurity Incident Response Procedure ("CIRP") and Crisis Management Plan, which are designed to enable us to respond efficiently to any incidents. Pursuant to the CIRP, cybersecurity incidents are reviewed and rated by our CISO and his team. A cybersecurity incident rated at predefined risk levels will be escalated to CTO, the Chief Compliance Officer, and the General Counsel and assessed for materiality and disclosure to the CEO and the Board. Our internal Disclosure Committee will review any planned public disclosures or filings. CIRP provides the organizational and operational structure to respond to incidents that may affect the confidentiality, integrity or availability of our information systems.


text: The Managing Owner has written procedures and policies that govern the Trust's general cybersecurity program. These policies and procedures include, among other things, the identification of risks, locations of information, management of third party risk and incident response, among other factors, and are designed to address real world concerns.

companyName: GLOBAL MACRO TRUST


text: The Cybersecurity Committee (the "Committee") of the Managing Owner is responsible for overseeing cyber and information security. The Committee meets at least quarterly to discuss cybersecurity risks and frequently holds more informal discussions in the interim. The Committee is subject to oversight by the board of directors of the Managing Owner (the "Board"). The Committee is co-chaired by the Managing Owner's President/Chief Operating Officer, Chief Technology Officer/Co-Head of Trading, and General Counsel/Chief Compliance Officer who oversee day-to-day implementation of cyber and information security by employees with specialized expertise and experience in such matters. The Board is kept apprised of the cybersecurity policies and procedures on a formal basis at least annually, and is kept informed on a less formal basis through participation in training and policy updates. The Committee meets at least quarterly to discuss and review testing, cybersecurity risks/events and all other relevant matters. Committee members are given the opportunity at these meetings to ask questions of all relevant personnel.


text: The Managing Owner utilizes a combination of statistics, data and testing by third party service providers and software in order to monitor and identify cybersecurity threats. To the extent those threats require immediate attention, they are dealt with and reported to the Committee thereafter in accordance with the procedures outlined in the Managing Owner's incident response plan. Other threats, as well as follow ups once threats are properly dealt with, are then discussed and analyzed by the Committee. Reports on these activities are discussed with the Board on at least an annual basis, with any material issues raised promptly to the Board as well.


text: To assess the effectiveness of the Managing Owner's cybersecurity programs and to mitigate exposure, the Managing Owner has consulted with strategic partners, such as outside counsel specializing in this subject matter as well as the Managing Owner's cyber insurance provider. The Managing Owner also undertook a table top exercise designed to identify and mitigate issues and train personnel.


text: The Managing Owner's head of risk management (who is also mentioned above as one of the co-chairmen of the Committee) participates in all Committee meetings and, as part of the risk management function, the Committee applies principles of risk management to its information security program. As with all risks identified by the Managing Owner, risks are identified and evaluated, with higher risk items receiving priority attention.


text: The Managing Owner has undertaken efforts to mitigate cyber risks and their impact, including, but not limited to, certain implementation of firewalls, anti-virus/anti-malware, controls around remote network access, multi-factor authentication, system event monitoring and notifications and electronic surveillance, frequent backups, encryption and password protection, education and testing, supervision of third parties, limitations on access, vulnerability scanning, patch installation, physical safeguards, virus scanning, and penetration testing.


text: Employees are required to complete initial cybersecurity training upon commencement of employment and, thereafter, on an annual basis. The training is designed by a third party service provider. The Managing Owner carries cyber insurance. The Managing Owner maintains formal cybersecurity procedures that are considered during contract review with respect to third party vendors handling and having access to information.


text: The Managing Owner has not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Managing Owner or the Trust's business strategy, results of operation or financial condition. Nonetheless, there is no guarantee that a future cyber incident would not materially affect the Managing Owner or the Trust's business strategy, results of operations or financial condition. Despite the various efforts the Managing Owner has undertaken to mitigate cyber risks and their impact, systems, networks and/or devices potentially can be breached. Such cybersecurity breaches may cause: (i) disruptions and impacts to business operations, potentially resulting in financial losses to the Trust and Unitholders; (ii) interference with the Managing Owner's ability to calculate the value of an investment; (iii) impediments to trading; (iv) the inability of the Trust and its service providers to transact business; (v) violations of applicable privacy and other laws; (vi) regulatory fines, penalties, reputational damage, reimbursement or other compensation costs or additional compliance costs; and (vii) the inadvertent release of confidential information. Similar adverse consequences could result from cybersecurity breaches affecting counterparties with which the Trust engages in transactions; governmental and other regulatory authorities; exchange and other financial market operators, banks, brokers, dealers, insurance companies and other financial institutions; and other parties. In addition, substantial costs may be incurred by these entities in order to prevent any cybersecurity breaches in the future. The nature of malicious cyber-attacks is becoming increasingly sophisticated and the Trust cannot control the cyber systems and cybersecurity systems of counterparties or third party service providers. While, to date, we have not been subject to cyberattacks that, individually or in the aggregate, have been material to our operations or financial condition, the preventive actions we take to reduce the risks associated with cyberattacks may be insufficient to repel or mitigate the effects of a major cyberattack in the future.


text: We operate in a highly-regulated industry. Federal, state and international laws and contractual commitments guide our collection, use and disclosure of confidential information such as protected health information, personal financial information and personally identifiable information. Our success depends on maintaining a high level of trust among our stakeholders, including our consumers, clients, business partners, providers, regulators and associates. Failure to effectively secure, maintain and upgrade our information systems, or the availability and integrity of our data, could adversely affect our business, including our business strategy, cash flows, financial condition and results of operations.

companyName: Elevance Health, Inc.

ticker: ELV


text: Cybersecurity Risk Assessment We work to identify and manage cybersecurity risks through established processes and accountability. We also conduct periodic reviews and updates to uphold our security standards. Our management has implemented ongoing and annual risk assessment processes to identify and manage risks that could affect our ability to safeguard sensitive data or provide reliable transaction processing. These risks include, but are not limited to: • Regulatory compliance • Third-party management, including risks from business partners and software providers • Mergers and acquisitions • System availability and disruption of business operations • Data security • Vulnerability and configuration management • Fraud and extortion • Reputational risk As of December 31, 2023, no known cybersecurity threats have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, cash flows, financial condition or results of operations. See Part I, Item 1A. "Risk Factors" for more information on the Company's cybersecurity-related risks.


text: Governance and Management of Cybersecurity Risk Our Board of Directors ("Board") oversees and guides our business and oversees our exposure to major risks. The Board receives periodic reports from management on various risks, and delegates to its Audit Committee certain oversight responsibilities. The Board monitors cybersecurity risks and receives a report at least quarterly from our Chief Information Security Officer (the "CISO") regarding our Information Security Program. In addition, certain cybersecurity incidents are escalated to the Board in accordance with our escalation criteria as described below. Periodically, the Board also receives third party assessments of our information security. The Audit Committee receives regular updates on both information security and data privacy matters, and oversees data privacy, integrity, incident and breach risks.


text: We have a cross-organizational steering committee, the Information Security Steering Committee ("ISSC"), that supports direction and governance of our enterprise-wide Information Security Program. The ISSC is chaired by the CISO and is comprised of accountable senior business leaders including the Chief Compliance Officer ("CCO"), Chief Risk Officer ("CRO"), legal counsel, and human resources, procurement and business segment leaders. In addition to the ISSC, we have defined risk functions to cover overall enterprise risks and information technology and cybersecurity risks, including: • IT Risk Management program led by the CISO • Compliance led by the CCO • Internal Audit led by Chief Audit Executive ("CAE") • Enterprise Risk Management programs led by the CRO • Third-Party Risk Management, comprised of business and information security leaders • IT Due Diligence, comprised of business, technology and information security leaders • Corporate Insurance Program, including cybersecurity insurance, led by the Treasurer To evaluate cybersecurity and privacy incidents and enable the Company to comply with public disclosure requirements, we have defined escalation criteria in support of our incident response processes. We have a Cyber Incident Response Taskforce, comprised of our Chief Privacy Officer, our CISO, and applicable legal counsel and business and corporate services leaders, which is responsible for reviewing such incidents and reporting relevant incidents to a subcommittee of our disclosure committee in order to assess the materiality of an incident as well as reporting to the senior leadership team, the chief legal officer, the CEO and ultimately the Board based on the facts and circumstances of an incident.


text: Cybersecurity Expertise Our Information Security Program has been established with the mission of minimizing risk to our member, client and associate data and it is managed by our CISO. Our current CISO has over 30 years of experience in information security and technology and has held a wide variety of technical and strategic leadership positions. He holds advanced certifications including Certified Information Systems Security Professional and Certified Secure Software Lifecycle Professional.


text: Our associates, including those responsible for cybersecurity, are evaluated for competence, including the knowledge and skills necessary to accomplish tasks that define associates' roles and responsibilities and undergo regular training regarding privacy, security, ethics and compliance. Our job summaries contain specific educational and knowledge requirements necessary for cybersecurity jobs. In addition, a criminal background check is completed for all new associates and performance reviews are conducted annually to measure performance results and achievements and to assess the job competency of our associates.


text: We use our Information Security teams, as well as trusted third-party auditors, recognized cybersecurity consultants and certified assessors, to assess cybersecurity risks, related controls, and alignment to relevant regulatory and legal requirements. A third party evaluates our Information Security Program and control environment at least annually. Assessments are performed against industry best practices and widely recognized security frameworks.


text: We operate in a highly regulated industry. Federal, state and international laws and contractual commitments guide our collection, use and disclosure of confidential information such as protected health information, personal financial information and personally identifiable information. Our success depends on maintaining a high level of trust among our stakeholders, including our consumers, clients, business partners, providers, regulators and associates. Failure to effectively secure, maintain and upgrade our information systems, or the availability and integrity of our data, could adversely affect our business, including our business strategy, cash flows, financial condition and results of operations.


text: Cybersecurity Risk Assessment Our cybersecurity and risk management programs are part of our continuously evolving enterprise-wide risk management practices. Aligned and measured against the National Institute of Standards and Technology (NIST) Cybersecurity Framework, recognized best practices and standards for cybersecurity and information technology, industry and government standards and other guidelines, our cybersecurity and risk management programs utilize policies, processes, and technologies to identify, assess, manage and mitigate cybersecurity risks and threats we face. We also conduct periodic reviews and updates to uphold our security standards, including implementation of tabletop crises exercises. Our management implements ongoing and annual risk assessment processes to identify and manage risks that could affect our ability to safeguard sensitive data or provide reliable transaction processing and to minimize financial risk exposure. These risks include, but are not limited to, regulatory compliance; third-party management, including risks from business partners and software providers; mergers and acquisitions; system availability and disruption of business operations; data use and security; vulnerability and configuration management; fraud and extortion; and reputation risk.


text: The steps we take to reduce vulnerability to cyber-attacks and to mitigate and remediate the impact of cybersecurity incidents in a timely and coordinated manner include, but are not limited to: establishing information security policies and standards, implementing information protection processes, tools and technologies, monitoring information technology systems for cybersecurity threats, coordinating internal reporting, assessing cybersecurity risk profiles of key third-parties, implementing cybersecurity training and collaborating with public and private organizations on cyber threat information and best practices. In addition to our internal Information Security teams, we also utilize trusted third-party auditors and recognized cybersecurity consultants and certified assessors, to assess cybersecurity risks, related controls, and alignment to relevant regulatory and legal requirements. A third party evaluates our information security policies, standards and control environment at least annually. Assessments and testing protocols are performed against industry best practices and widely recognized security frameworks.


text: We face many cybersecurity risks in connection with our business. As of December 31, 2024, no known cybersecurity threats have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, cash flows, financial condition or results of operations; however, future cybersecurity incidents or threats may materially affect us, including by affecting our business strategy, results of operations or financial conditions. See Part I, Item 1A. "Risk Factors" for more information on the Company's cybersecurity-related risks.


text: Management and Governance of Cybersecurity Risk To manage our cybersecurity risk, we employ a cross-organizational steering committee, the Information Security Steering Committee ("ISSC"), that supports the direction and governance of our enterprise-wide Information Security Program. The ISSC is chaired by our Chief Information Security Officer ("CISO") and is comprised of accountable senior business leaders including our Chief Compliance Officer ("CCO"), Chief Risk Officer ("CRO"), legal counsel, and human resources, procurement and business segment leaders. In addition to the ISSC, we have defined risk functions to cover overall enterprise risks and information technology and cybersecurity risks within our enterprise risk management framework, including, but not limited to: our IT Risk Management program, led by our CISO; our Responsible Artificial Intelligence ("RAI") Program, led by our Chief Digital Information Officer; Compliance, led by our CCO; Internal Audit, led by our Chief Audit Executive ("CAE"); Enterprise Risk Management programs led by our CRO; Third-Party Risk Management, comprised of business and information security leaders; IT due diligence processes, led by business, technology and information security leaders; and our Corporate Insurance Program, including cybersecurity insurance, led by our Treasurer.


text: To evaluate cybersecurity and privacy incidents and enable us to comply with public disclosure requirements, we have a Privacy and Security Incident Response and Reporting Policy and Procedure (the "Policy") with defined escalation criteria (the "Plan") in support of our incident response processes. The Plan provides a framework to our Cyber Incident Response Taskforce, comprised of our Chief Privacy Officer ("CPO"), CISO and applicable legal counsel and business and corporate services leaders, for responding to cybersecurity incidents. The Policy, together with the Plan, identifies applicable requirements for incident disclosure and reporting and also provides protocols for incident evaluation based on facts and circumstances of each incident, including the use of third-party service providers and partners, processes for notification and internal escalation of information to our senior management, including to our chief legal officer and CEO, a subcommittee of our SEC disclosure committee, and ultimately, our Board of Directors and appropriate Board committees. The Policy also addresses requirements for our external reporting obligations. The Policy is reviewed and updated, as necessary, under the leadership of our CISO and CPO.


text: Our Board oversees and guides our business and oversees our exposure to major risks, including steps taken by management to monitor and mitigate cybersecurity risks. The Board receives and reviews periodic reports from management on various risks, and delegates to its Audit Committee certain oversight responsibilities. The Board monitors cybersecurity risks and receives a report at least quarterly from our CISO regarding our Information Security Program. In addition, certain cybersecurity incidents are escalated to the Board in accordance with our Plan as described above. Periodically, the Board also receives third party assessments of our information security. The Audit Committee receives regular updates on both information security and data privacy matters, and oversees data privacy, integrity, incident and breach risks.


text: Our associates, including those responsible for cybersecurity, are evaluated for competence, including the knowledge and skills necessary to accomplish tasks that define associates' roles and responsibilities and undergo regular training regarding security-awareness, privacy, ethics and compliance. Our job summaries contain specific educational and knowledge requirements necessary for cybersecurity jobs. In addition, a criminal background check is completed for all new associates and performance reviews are conducted annually to measure performance results and achievements and to assess the job competency of our associates.


text: As a highly regulated global financial services company, we understand the substantial operational risks for companies in our industry as well as the importance of protecting the information and data of our clients and employees. As such, our Global Informational Security (GIS) Program is designed and operated to mitigate information security risks and threats to the company. Its intent is to safeguard the confidentiality, integrity and availability of our information and services. The GIS Program is designed to strengthen the integrity of the global markets we support, protect CME Group's information assets, maintain client and employee trust, support our pursuit of strategic objectives, contribute to shareholder value and preserve our reputation and brand. We implement technical, physical and administrative safeguards to protect the confidential and sensitive information of our clients, employees and other information under CME Group's stewardship. We manage cybersecurity risk to the organization as part of our business strategy, risk management and financial functions in alignment with our overall Enterprise Risk Management Program and regularly engage with the risk committee of the board of directors and the board of directors as a whole regarding the effectiveness of the GIS Program.

companyName: CME GROUP INC.

ticker: CME


text: The GIS Program is led by CME Group's Chief Information Security Officer (CISO), who has worked in various roles in information security for over 20 years, and has led our GIS Program for more than four years since joining the company in 2016 in a senior role in GIS. The CISO reports to our Chief Information Officer (CIO), a member of our Management Team. Our GIS team is comprised of over 200 full-time employees, many of which hold cybersecurity, risk, or management certifications, such as Certified Information Systems Security Professional, Certified Information Security Manager, Certified in Risk and Information Systems Control, Series 99, Certified Information Systems Auditor, Project Management Professional, various cloud provider certifications and various levels of ITIL certifications. As part of our GIS Program, CME Group operates a state-of-the-art Cyber Defense Center that virtually links 24/7 to our international operational cybersecurity teams and serves as a global hub for cybersecurity risk management activities, including log collection, event monitoring, threat detection and incident response, resiliency, operations, vulnerability management and the proactive collection and processing of both open source and proprietary threat and intelligence feeds allowing the company to efficiently manage, investigate and respond to cybersecurity events. Our GIS team conducts analyses and aims to prevent, detect and respond to systemic events that might threaten our company, industry or the economy.


text: The GIS Program includes a Cyber Defense team, which manages the Incident Response Plan (IRP). This Cyber Defense team consists of subject matter experts from GIS and Information Governance, who work together to monitor and respond to cybersecurity incidents. The IRP outlines our cyber and incident response policies and governs our incident response lifecycle, which divides overall incident response into serial phases. The Crisis Management Team (CMT) is responsible for oversight during an incident, in conjunction with the Cyber Coordination Team (CCT). The CCT manages responses to cybersecurity and compliance incidents, collaborating with subject matter experts (SMEs) from various departments in response to specific incidents. When an incident reaches a certain threshold of severity, our CISO and CIO escalate the matter to our Chief Operating Officer, who is another member of our Management Team, to determine next steps, as well as possible customer and external communication. Throughout the incident response process, the Legal team is engaged, as appropriate, and helps consider whether disclosure is required once a determination is made in connection with the company's leadership and the CMT.


text: We identify, assess and manage material risks from cybersecurity threats through our GIS Program as follows: • We deploy a defense-in-depth strategy, acknowledging the importance of people, processes and technology in upholding information security. The strategy incorporates multiple layers of controls, including, monitoring, vulnerability management, identity and access management and security assessments. • Our program is based on the National Institute of Standards and Technology Cybersecurity Framework (NIST) and other technical standards and frameworks. • We have a robust cybersecurity defense response plan that provides a documented framework for handling security incidents and facilitates coordination across multiple parts of the company. • We invest in threat intelligence and operate a state-of-the-art Cyber Defense Center, which acts as our hub of information sharing and threat intelligence analysis. • We incorporate external expertise and reviews into our cybersecurity risk management program and continue to engage a leading professional consulting firm to assist our company in incorporating cybersecurity best practices. • We provide annual cybersecurity awareness and ongoing phishing training, such as routinely performing cybersecurity attack simulation exercises, which includes participation from various levels of management. • Following a risk-based approach, we conduct due diligence reviews of our third party providers for potential cybersecurity risks to the company. Our Enterprise Risk Management (ERM) team oversees our Third Party Risk Management (TPRM) program, which partners with our GIS, Information Governance, and Operational Resilience groups to manage and monitor third party risk of CME Group vendors and certain third parties of customers (fourth parties). The teams monitor cyber-related incidents and known third party vulnerabilities with the goal of enhancing processes, improving risk management and partnering on exit planning and testing for certain vendors associated with essential functions. • We have insurance against certain cybersecurity and privacy risks and attacks. • We are an active participant in the financial services industry and government forums and information sharing programs, designed to improve both internal and sector cybersecurity defense. These valuable external partnerships are established and maintained in order to gain more timely, comprehensive and actionable threat information across geographies and industries and to facilitate the exchange of best practices and security techniques. They allow for a high degree of collaboration and cooperation with local, state, federal, and international law enforcement and intelligence agencies, industry groups, and other private sector chief information security officers. • We regularly test the design and effectiveness of our information security controls and processes through a program of testing performed by internal and independent third-party teams. Gaps and opportunities identified through testing are assigned to certain members of management and tracked through to closure. Testing activities support a variety of regulatory requirements and external industry certifications held by CME Group.


text: The board provides oversight of cybersecurity risks and has designated primary responsibility to the risk committee who oversees our information security programs, including cybersecurity, and is actively involved in monitoring the progress of key cybersecurity initiatives. Our board and risk committee receive regular updates on the activities and effectiveness of our GIS Program, including reports on incident response plan testing exercises and results of compliance testing and third-party evaluation results. Our CISO provides quarterly, or as needed. reports and updates to our board and risk committee on the company's cybersecurity risk management program and meets with the risk committee at least annually in a private session. The CISO has an indirect reporting line to the risk committee. We also engage with a leading professional consulting firm to provide regular updates to the board on cybersecurity-related risks in the evolving threat landscape and to provide education on best practices for board oversight of our GIS Program.


text: Historically, and at the time of this filing, we have not experienced cybersecurity incidents that were deemed by the company to be material individually or in the aggregate, or reasonably likely to be material, but we have experienced cyber attacks of varying degrees in the past.


text: See "Item 1A - Risk Factors" beginning on page 16 for additional information on cyber attacks and other cybersecurity risks the company faces.


text: As a highly regulated global financial services company, we understand the substantial operational risks for companies in our industry as well as the importance of protecting the information and data of our clients, third parties and employees and the resilience of our systems. As such, our Global Informational Security (GIS) Program is designed and operated to mitigate information security risks and threats to the company. Its intent is to safeguard the confidentiality, integrity and availability of our information and services. The GIS Program is designed to strengthen the integrity of the global markets we support, protect CME Group's information assets, maintain client, third party and employee trust, support our pursuit of strategic objectives, contribute to shareholder value and preserve our reputation and brand. We implement technical, physical and administrative safeguards to protect the confidential and sensitive information of our clients, third parties, employees and other information under CME Group's stewardship. We manage cybersecurity risk to the organization as part of our business strategy, risk management and financial functions in alignment with our overall Enterprise Risk Management Program and regularly engage with the risk committee of the board of directors and the board of directors as a whole regarding the effectiveness of the GIS Program and the management of our cybersecurity risks.


text: The GIS Program is led by CME Group's Chief Information Security Officer (CISO), who has worked in various roles in information security for over 20 years and has led our GIS Program for more than five years since joining the company in 2016 in a senior role in GIS. The CISO reports to our Chief Information Officer (CIO), a member of our Management Team. Our GIS team is comprised of over 200 full-time employees, many of whom hold cybersecurity, risk, or management certifications, such as Certified Information Systems Security Professional, Certified Information Security Manager, Certified in Risk and Information Systems Control, Series 99, Certified Information Systems Auditor, Project Management Professional, various cloud provider certifications and various levels of ITIL certifications. As part of our GIS Program, CME Group operates a Cyber Defense Center that virtually links 24/7 to our international cybersecurity teams and serves as a global hub for cybersecurity risk management activities, including log collection, event monitoring, threat detection and incident response, resiliency, operations, vulnerability management and the proactive collection and processing of both open source and proprietary threat and intelligence feeds allowing the company to efficiently manage, investigate and respond to cybersecurity events. Our GIS team conducts analyses and aims to prevent, detect and respond to systemic events that might threaten our company, industry or the economy.


text: The GIS Program includes a Cyber Defense team, which manages the Incident Response Plan (IRP), and consists of subject matter experts from GIS and Information Governance, who work together to monitor and respond to cybersecurity incidents. The IRP outlines our cyber and incident response policies and governs our incident response lifecycle, which divides overall incident response into serial phases. The Crisis Management Team (CMT) is responsible for oversight during an incident, in conjunction with the Cyber Coordination Team (CCT). The CCT manages responses to cybersecurity and compliance incidents, collaborating with subject matter experts from various departments in response to specific incidents. When an incident reaches a certain threshold of severity, our CISO and CIO escalate the matter to our Chief Operating Officer, who is another member of our Management Team, to determine next steps, as well as possible customer and external communication. Throughout the incident response process, the Legal team is engaged, as appropriate, and helps consider whether disclosure is required once a determination is made in connection with the company's leadership and the CMT.


text: We identify, assess and manage material risks from cybersecurity threats through our GIS Program as follows: • We deploy a defense-in-depth strategy, acknowledging the importance of people, processes and technology in upholding information security. The strategy incorporates multiple layers of controls, including, monitoring, vulnerability management, identity and access management and security assessments. • Our program is aligned with the National Institute of Standards and Technology Cybersecurity Framework (NIST) and other technical standards and frameworks. • We have a robust cybersecurity defense response plan that provides a documented framework for handling security incidents and facilitates coordination across multiple parts of the company. • We invest in threat intelligence and operate a Cyber Defense Center, which acts as our hub of information sharing and threat intelligence analysis. • We incorporate external expertise and reviews into our cybersecurity risk management program and continue to engage leading professional consulting firms to assist our company in incorporating cybersecurity best practices. • We provide annual cybersecurity awareness and ongoing phishing training, and we routinely conduct cybersecurity attack simulation exercises, which includes participation from various levels of management. • Following a risk-based approach, we conduct due diligence reviews of our third party providers for potential cybersecurity risks to the company. We also maintain a cross-functional Third Party Risk Management program, which partners with our GIS, Information Governance, and Operational Resilience teams, among others, to manage and monitor third party risk presented by CME Group vendors and certain third parties of third parties (fourth parties). The teams conduct initial due diligence on vendors and monitor cyber-related incidents and known vulnerabilities with the goal of enhancing processes, improving risk management and partnering on exit planning and testing for certain vendors associated with essential functions. • We have insurance against certain cybersecurity and privacy risks and attacks. • We are an active participant in the financial services industry and government forums and information sharing programs, designed to improve both internal and sector cybersecurity defense. These valuable external partnerships are established and maintained in order to gain more timely, comprehensive and actionable threat information across geographies and industries and to facilitate the exchange of best practices and security techniques. They allow for a high degree of collaboration and cooperation with local, state, federal, and international law enforcement and intelligence agencies, industry groups, and other private sector chief information security officers. • We regularly test the design and effectiveness of our information security controls and processes through a program of testing performed by internal and independent third-party teams. Remediation of gaps and opportunities identified through testing are tracked through to closure. Testing activities support a variety of regulatory requirements and external industry certifications held by CME Group.


text: The board provides oversight of cybersecurity risks and has designated primary responsibility to the risk committee which oversees our information security programs, including cybersecurity, and is actively involved in monitoring the progress of key cybersecurity initiatives. Our board and risk committee receive regular updates on the activities and effectiveness of our GIS Program, including reports on incident response plan testing exercises and results of compliance testing and third-party evaluation results. Our CISO provides quarterly, or as needed, reports and updates to our board and risk committee on the company's cybersecurity risk management program and meets with the risk committee at least annually in a private session. The CISO has an indirect reporting line to the risk committee. We also engage with leading professional consulting firms to provide periodic updates to the board on cybersecurity-related risks in the evolving threat landscape and to provide education on best practices for board oversight of our GIS Program.


text: To date, the company is not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the company, including our business strategy, results of operations or financial condition.


text: We maintain a comprehensive cybersecurity program and process for identifying, assessing and managing risks from cybersecurity threats as part of our broader risk management system. Our cybersecurity program is run by a dedicated team of cybersecurity professionals with deep expertise in incident prevention, detection and remediation, led by our Vice President, Information Security (a certified information systems security professional with a degree in computer science and more than 30 years of relevant work experience) and our Chief Information Officer (a seasoned executive with a degree in management information systems and decades of product and technology experience, including more than 20 years with the Company). The Information Security team is responsible for identifying, assessing and mitigating cybersecurity vulnerabilities, threats and risks; evaluating and deploying appropriate security tools; and operating a 24x7 security operations center to promptly detect, remediate and prevent security incidents. The team maintains a comprehensive incident response policy that includes prompt reporting of security incidents to a cross-functional working group (including our Chief Information Officer, General Counsel, Chief Compliance Officer and other security and privacy personnel) in order to ensure that information required to be disclosed by the Company with respect to security incidents is timely identified and reported.

companyName: COMSCORE, INC.

ticker: SCOR


text: We have aligned our information security management system to the International Organization for Standardization ("ISO") 27001 standard and our privacy management system to the ISO 27701 standard. An outside auditor tests the effectiveness of our security and privacy controls against the ISO 27001 and 27701 standards on an annual basis. We also undergo client security audits and cybersecurity program assessments by outside consultants, and we regularly update our program and processes to incorporate recommendations from auditors, consultants and other experts. Finally, we maintain a third-party risk management process that includes screening and evaluation by the Information Security team of service providers who will have access to our systems or confidential information, in order to identify and manage cybersecurity risks associated with our use of such providers.


text: Our Board of Directors has an active role, as a whole and at the committee level, in overseeing management of our material risks from cybersecurity threats. The Board's Audit Committee oversees management of financial, regulatory, compliance and security risks and receives reports at least quarterly from our Chief Information Officer regarding our cybersecurity programs, vulnerabilities, threats and risks. The full Board is regularly informed about such risks through committee reports, attendance at committee meetings and other communications.


text: Our executive leadership team is responsible for designing and implementing our enterprise risk management program, with input from our Chief Information Officer, General Counsel and other security and privacy personnel regarding material risks from cybersecurity threats. The executive leadership team regularly discusses security threat trends; incident trends, including any significant incidents that may arise; risk mitigation; and overall security strategy as part of our enterprise security governance process. We consult with outside counsel as appropriate, including on materiality analyses and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions. Our management apprises our independent public accounting firm of any relevant developments.


text: We have experienced, and may in the future experience, cybersecurity incidents. While prior incidents have not materially affected our business strategy, results of operations or financial condition to date, and although our processes are designed to help prevent, detect and mitigate the impact of such incidents, we cannot guarantee that a future security incident would not materially affect our strategy, results of operations or financial condition. For more information on our cybersecurity related risks, see Item 1A, "Risk Factors" of this 10-K.


text: We maintain a comprehensive cybersecurity program and process for identifying, assessing and managing risks from cybersecurity threats as part of our broader risk management system. Our cybersecurity program is run by a dedicated team of cybersecurity professionals with deep expertise in incident prevention, detection and remediation, led by our Vice President, Information Security (a certified information systems security professional with a degree in computer science and more than 30 years of relevant work experience) and our Chief Operating Officer (a seasoned executive with a degree in industrial systems and decades of product and technology experience, including more than 19 years with the Company). The Information Security team is responsible for identifying, assessing and mitigating cybersecurity vulnerabilities, threats and risks; evaluating and deploying appropriate security tools; and operating a 24x7 security operations center to promptly detect, remediate and prevent security incidents. The team maintains a comprehensive incident response policy that includes prompt reporting of security incidents to a cross-functional working group (including our Chief Operating Officer, General Counsel, Chief Compliance Officer and other security and privacy personnel) in order to ensure that information required to be disclosed by the Company with respect to security incidents is timely identified and reported.


text: Our Board of Directors has an active role, as a whole and at the committee level, in overseeing management of our material risks from cybersecurity threats. The Board's Audit Committee oversees management of financial, regulatory, compliance and security risks and receives reports at least quarterly from our Chief Operating Officer regarding our cybersecurity programs, vulnerabilities, threats and risks. The full Board is regularly informed about such risks through committee reports, attendance at committee meetings and other communications.


text: Our executive leadership team is responsible for designing and implementing our enterprise risk management program, with input from our Chief Product Officer, Chief Operating Officer, General Counsel and other security and privacy personnel regarding material risks from cybersecurity threats. The executive leadership team regularly discusses security threat trends; incident trends, including any significant incidents that may arise; risk mitigation; and overall security strategy as part of our enterprise security governance process. We consult with outside counsel as appropriate, including on materiality analyses and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions. Our management apprises our independent public accounting firm of any relevant developments.


text: We have processes in place for assessing, identifying and managing significant risks from potential cyber threats and vulnerabilities. To protect our information systems from cyber threats, we use a wide variety of tools, controls, technologies, methods, systems and other processes that are designed to prevent, detect, escalate, investigate, mitigate and/or remediate data loss, theft, misuse, unauthorized access or other security incidents or vulnerabilities affecting information systems and data.

companyName: ADVANCE AUTO PARTS INC

ticker: AAP


text: Our Senior Vice President, Chief Information Security Officer ("CISO") and Senior Vice President, Internal Audit and Risk, who oversees our enterprise risk management ("ERM") framework, partner on definition and treatment of cyber risks. Cybersecurity is a component of our ERM framework and processes. We utilize a wide range of capabilities to help us identify and assess potential cyber threats and vulnerabilities, which feed into our development and regular updating of a risk treatment plan to help us manage our cybersecurity risk posture. We evaluate risks on an ongoing basis across several categories in terms of probability of the likelihood and magnitude of potential impact, using evaluation results to inform our areas of focus and prioritization.


text: We evaluate risks associated with use of third-party providers through a lifecycle-based approach, conducting risk-based due diligence before engagement, using contractual provisions to apportion risk, and for certain third-party providers, engaging in architectural review and validation at the beginning of engagement. We use third parties to assist with penetration testing, simulated attacks and survey and other threat intelligence reporting on third parties, as well as review and enhancement of associated response processes.


text: Our cyber risk treatment plan is reviewed in a bimonthly cadence with a cross-functional Cyber Steering Committee, the managerial governing body that regularly reviews our top cyber risks and receives reports on progress on key cyber initiatives. Our CISO leads the Cyber Steering Committee, which also includes individuals with experience identifying and managing enterprise risks, including our President and Chief Executive Officer, Executive Vice President, Chief Financial Officer, Executive Vice President, General Counsel and Corporate Secretary and Senior Vice President, Internal Audit, as well as individuals with technical expertise in information technology, data and cyber matters and/or experience in managing cyber incident responses, including our Executive Vice President, Chief Technology Officer, Senior Vice President, Information Technology Operations and Senior Vice President, Deputy General Counsel and Chief Compliance Officer. Our CISO has over 15 years of Chief Information Security Officer experience leading security strategy and execution for large companies. He holds a Certificate in Secure Software and Information Engineering from Pace University and is a Certified Information Systems Security Professional.


text: The Internal Audit function assesses cyber security risks and audits components of cyber security on an annual basis. At least every three years, we use an external party to evaluate the maturity of our program against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.


text: The Audit Committee of our Board of Directors is charged with reviewing, discussing with management and overseeing the Company's information technology and cybersecurity risk. Our CISO and Senior Vice President, Internal Audit and Risk report regularly to the Audit Committee, and at least annually, to the full Board of Directors on cybersecurity risks and management thereof.


text: The Company has processes in place for assessing, identifying and managing risks from potential cyber threats and vulnerabilities. To protect the Company's information systems from cyber threats, the Company uses a variety of tools, controls, technologies, methods, systems and other processes that are designed to prevent, detect, escalate, investigate, mitigate and/or remediate data loss, theft, misuse, unauthorized access or other security incidents or vulnerabilities affecting information systems and data.


text: The Company's Chief Information Security Officer ("CISO") and Vice President, Chief Audit Executive, who oversees the Company's enterprise risk management ("ERM") framework, partner on definition and treatment of cyber risks. Cybersecurity is a component of the Company's ERM framework and processes. The Company utilizes a range of capabilities to help identify and assess potential cyber threats and vulnerabilities, which feed into the development and regular updating of a risk mitigation plan to help manage the Company's cybersecurity risk posture. The Company evaluates cyber security risks on an ongoing basis across several categories in terms of probability of the likelihood and magnitude of potential impact, using evaluation results to inform areas of focus and prioritization.


text: The Company evaluates risks associated with use of third-party providers through a lifecycle-based approach, conducting risk-based due diligence before engagement, using contractual provisions to apportion risk, and for certain third-party providers, engaging in architectural review and validation at the beginning of engagement. The Company uses third parties to assist with penetration testing, simulated attacks and survey and other threat intelligence reporting on third parties, as well as review and enhancement of associated response processes.