text: Our cybersecurity program leverages various industry standards like the National Institute of Standards and Technology ("NIST") and Center for Internet Security Program framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our enterprise risk management team reviews cybersecurity risks, and key cybersecurity risks are incorporated into the enterprise risk management ("ERM") reports reviewed and discussed internally and with the Board. In addition, we have several avenues to gather risk intelligence, and potential threats identified by various services and capabilities to adjust our security strategy. We also have a set of Company-wide policies and procedures concerning cybersecurity and technology standards, which include a Technology Use policy, as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to endpoint and network protection, encryption standards, malware/ransomware protection, remote access, multi-factor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.


text: The Company's Chief Information Security Officer ("CISO") is responsible for developing and implementing our information security program and reporting quarterly on cybersecurity matters to the Cybersecurity and Data Privacy Steering Committee, as well as to the Board and the Cybersecurity Committee. Our Chief Information Officer is an Executive Sponsor of the Cyber Security Program, has over two decade of experience leading cyber security oversight, and others on our cyber security team have cybersecurity experience and certifications, such as the Certified Information Systems Security Professional, or other industry leading certifications.

companyName: HASBRO, INC.

ticker: HAS

secItem: Item 1C


text: We have invested in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also prepares a cyber scorecard, regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment. Further, we conduct periodic external penetration tests, red team testing and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party vendors and service providers. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: The Cybersecurity Committee and the full Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. The Cybersecurity Committee meets regularly during the year and discusses cyber-related industry events, critical cyber incidents, alignment with our information security framework, threat assessment, security capabilities, response readiness and training efforts. A third-party cyber security firm also advises the Cybersecurity Committee on cybersecurity threats, trends in the industry, and best practices. This third party also evaluates and assesses our programs. The Cybersecurity Committee conducts an ongoing review of the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, planned actions in the event of a response or recovery situation, as well as a review of recent enhancements to the Company's security detection and response capabilities, and management's progress on its cybersecurity strategic roadmap. The Cybersecurity team also subscribes various threat intelligence services to evaluate our security strategy or defense mechanism against such threats.


text: The Board receives regular updates from the Cybersecurity Committee, including a summary of key performance indicators, test results and related remediation, and recent threats and how the Company is managing those threats. To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on these topics.


text: We face a number of cybersecurity risks in connection with our business. During the past three years we have not suffered a material breach or a reportable incident, and cybersecurity risks (including breach of third parties with whom we work) have not materially affected us, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see Item 1A. Risk Factors.


text: We have an in-depth approach to monitoring and addressing cybersecurity risk. Members of management together with our Board, the Audit Committee of the Board (the "Audit Committee"), our internal Cybersecurity and Data Privacy Steering Committee (a cross-functional team which includes members of our Executive Leadership Team), and the members of an enterprise risk management team (a task force comprised of senior representatives of the company assessing risk in the organization), have developed cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner.


text: Our cybersecurity program leverages various industry standards like the National Institute of Standards and Technology ("NIST") and Center for Internet Security ("CIS") Program framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection, mitigation and continuous process improvements. Our enterprise risk management team reviews cybersecurity risks, and key cybersecurity risks are incorporated into the enterprise risk management ("ERM") reports reviewed and discussed internally and with the Board. In addition, we have several avenues to gather risk intelligence, and potential threats identified by various services, internal and external assessments, and capabilities to adjust our security strategy. We also have a set of Company-wide policies and procedures concerning cybersecurity and technology standards, which include a Technology Use policy, as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to endpoint and network protection, encryption standards, malware/ransomware protection, remote access, multi-factor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.


text: The Company's Chief Information Security Officer ("CISO") and the Cybersecurity and Data Privacy Steering Committee are responsible for developing, implementing and evaluating our information security program. The CISO regularly reports on cybersecurity matters to the Cybersecurity and Data Privacy Steering Committee, as well as to the Board and the Audit Committee. Our Chief Digital and Information Officer is an Executive Sponsor of the Cyber Security Program, has over two decades of experience leading cyber security oversight, and others on our cyber security team have cybersecurity experience and certifications, such as the Certified Information Systems Security Professional, or other industry leading certifications.


text: We have invested in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests), tabletop exercises and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also prepares a cyber scorecard, regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment. Further, we conduct periodic external penetration tests, red team testing and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party vendors and service providers. The internal business owners of the hosted critical applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: The Audit Committee and the full Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. The Audit Committee meets during the year and discusses cyber-related industry events, critical cyber incidents, alignment with our information security framework, threat assessment, security capabilities, response readiness and training efforts. The Audit Committee conducts an ongoing review of the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, planned actions in the event of a response or recovery situation, as well as a review of recent enhancements to the Company's security detection, prevention and response capabilities, and management's progress on its cybersecurity strategic roadmap. The Cybersecurity team also subscribes to various threat intelligence services to evaluate our security strategy or defense mechanism against such threats.


text: The Board receives regular updates from the Audit Committee, as well as from the Cybersecurity team, including a summary of key risk indicators, test results and related remediation, and recent threats and how the Company is managing those threats.


text: Hawkins is committed to maintaining robust cybersecurity practices to safeguard our operations, data, and stakeholders' interests. We monitor our cybersecurity landscape and adapt our strategies and governance practices to mitigate risks in this rapidly evolving area.

companyName: HAWKINS INC

ticker: HWKN


text: The Company acknowledges that cybersecurity threats present a risk of material adverse impacts on our operations, reputation, and financial condition. Cybersecurity threats are continuously evolving, becoming more sophisticated, and increasing in frequency. For Hawkins, these threats can potentially lead to data breaches, theft of intellectual property, operational disruptions, damage to persons and property, and financial losses. We have a comprehensive cybersecurity risk management strategy designed to promptly identify, assess, and mitigate the risk of occurrence and impact from cybersecurity threats. Despite our efforts, it is not possible to completely identify, prevent or mitigate the impacts of cybersecurity threats.


text: Cybersecurity Governance Our Board of Directors is primarily responsible for oversight of risks from cybersecurity threats. Our audit committee is specifically responsible for oversight of cybersecurity risks within the Board of Directors. The audit committee is informed of our cybersecurity risk management practices at regularly scheduled meetings, including: • Our cybersecurity policies and strategies. • Incident response and recovery plans. • Employee training and awareness programs. • Cybersecurity audits and engagement with external cybersecurity experts and advisors on an as-needed basis.


text: Our Chief Information Officer ("CIO") is responsible for implementing our cybersecurity strategy, developing policies and procedures, and ensuring that appropriate resources are allocated to cybersecurity initiatives. The CIO and senior network and security resources at Hawkins have decades of experience in cybersecurity practices and compliance. The CIO is continually informed about the latest threats and developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is important for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CIO implements and oversees processes based on the National Institute of Standards and Technology ("NIST") cybersecurity framework and is responsible for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. Management reports at least twice yearly to the audit committee on the status of our cybersecurity efforts, including assessments of significant risks identified and actions designed to mitigate such risks.


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management strategy is a separate component of our overall risk management process and is designed to protect our assets, including information technology systems, data, and operations, from cybersecurity threats. This involves: • Continuous monitoring and assessment of our cybersecurity posture. • Implementation of security measures such as firewalls, intrusion detection systems, and encryption. • Ongoing cybersecurity training and testing of our employees. • Regular cybersecurity assessments and penetration testing. • Vendor risk management to ensure third-party compliance with our cybersecurity standards.


text: We also maintain an incident response plan ("IRP") that outlines procedures for responding to cybersecurity incidents, minimizing their impact, and communicating with relevant stakeholders, including regulators, customers, and employees. During a cyber incident, our CIO and network security team assess the severity of the incident and notify key management and (if deemed necessary) our audit committee as promptly as practicable. Our incident plan is reviewed annually and updated as appropriate to address evolving threats and our business conditions.


text: In the normal course of business, we experience cybersecurity threats and attempted breaches of our systems and network. We classify and track these events based on significance and implement remediation actions that we consider appropriate to address the risks relating to such incidents. We have not experienced any cybersecurity incident and the risks presented by cybersecurity threats have not materially impacted our business strategy, results of operations or financial condition. However, even well-designed and implemented cybersecurity programs cannot completely eliminate cybersecurity threats, and we cannot guarantee that such events or material impacts will not occur in the future.


text: Our Chief Information Officer ("CIO") is responsible for implementing our cybersecurity strategy, developing policies and procedures, and ensuring that appropriate resources are allocated to cybersecurity initiatives. Our CIO has over 25 years of experience in the information technology field, including consulting on cybersecurity risks and mitigation in a variety of industries. He is a member of the local Infragard chapter and a regular speaker on cybersecurity topics at the Chlorine Institute. Additionally, the senior security and network engineering team has decades of experience in network and application security. The CIO is continually informed about the latest threats and developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is important for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CIO implements and oversees processes based on the National Institute of Standards and Technology ("NIST") cybersecurity framework and is responsible for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. Management reports at least twice yearly to the audit committee on the status of our cybersecurity efforts, including assessments of significant risks identified and actions designed to mitigate such risks.


text: In the normal course of business, we experience cybersecurity threats and attempted breaches of our systems and network. We classify and track these events based on significance and implement remediation actions that we consider appropriate to address the risks relating to such incidents. We have not experienced any cybersecurity incident, and the risks presented by cybersecurity threats have not materially affected, and are not reasonably likely to materially affect, our business strategy, results of operations or financial condition. However, even well-designed and implemented cybersecurity programs cannot completely eliminate cybersecurity threats, and we cannot guarantee that such events or material impacts will not occur in the future.


text: The Company prioritizes cybersecurity as a strategic pillar integral to its business strategy, risk management, and governance frameworks. The Board of Directors and executive management play an active role in evaluating the effectiveness of our cybersecurity policies, practices, and procedures. Regular updates are provided by the Chief Information Officer to ensure cybersecurity risks are continuously monitored and addressed across all business functions. Our cybersecurity program incorporates policies, procedures, systems, and controls designed to safeguard the accessibility, confidentiality, and integrity of our data and systems. These processes are shaped by industry trends, and the evolving cybersecurity landscape.

companyName: HEICO CORP

ticker: HEI


text: Cybersecurity Risk Management and Strategy Our cybersecurity program is an integral part of our overall risk management framework and is aligned with recognized industry standards, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). The cybersecurity program is designed to identify, detect, protect against, respond to, and recover from cyber threats. Our program safeguards the confidentiality, integrity, and availability of our systems and data through a comprehensive and multi-layered approach.


text: We deploy robust controls, including firewalls, anti-malware systems, intrusion detection and prevention, encryption, and access controls. These measures are supplemented by continuous monitoring, vulnerability assessments, and penetration testing conducted both internally and by third-party assessors. Insights from these assessments inform the enhancement of our security controls and help us mitigate emerging threats effectively. We also actively engage with key consultants as part of our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity program.


text: We proactively monitor networks for suspicious activity and collaborate with governmental and industry partners to stay informed on emerging cybersecurity risks. We also emphasize a culture of vigilance through regular employee training that includes phishing awareness, malware prevention, and reporting protocols.


text: Governance and Oversight Our governance and oversight framework for cybersecurity risks operates at multiple levels within the organization. The Board of Directors has final oversight responsibility for cybersecurity-related matters and receives regular updates from the Chief Information Officer and senior management on the status of the cybersecurity program, vulnerability assessments, strategic initiatives, and any significant incident response activities.


text: The Chief Information Officer has over 27 years of experience in cybersecurity and is responsible for designing and implementing the organization's cybersecurity strategy. The cybersecurity program and the Information Security Team are led by the Senior IT Director, who reports to the Chief Information Officer. The Senior IT Director has over 20 years of experience in cybersecurity. The Information Security Team is responsible for security operations, cybersecurity monitoring, application security audits, and responding to incidents through a structured Incident Response Plan.


text: Cybersecurity Risks and Incidents We have experienced cybersecurity incidents in the ordinary course of business and recognize that such incidents are an inherent risk to any organization. While prior incidents have not materially impacted our business strategy, financial condition, or results of operations, we remain vigilant in anticipating and mitigating future threats.


text: Our cybersecurity program is designed to address and minimize the risks posed by evolving threats. However, no system can completely eliminate the possibility of a significant cybersecurity incident. Therefore, we continuously assess and enhance our cybersecurity measures to adapt to the changing threat landscape and ensure organizational resilience. For more information about the potential impact of cybersecurity risks, please refer to Item 1A. Risk Factors.


text: The Chief Information Officer has over 28 years of experience in cybersecurity and is responsible for designing and implementing the organization's cybersecurity strategy. The cybersecurity program and the Information Security Team are led by the Senior IT Director, who reports to the Chief Information Officer. The Senior IT Director has over 21 years of experience in cybersecurity. The Information Security Team is responsible for security operations, cybersecurity monitoring, application security audits, and responding to incidents through a structured Incident Response Plan.


text: Our cybersecurity program is designed to address and minimize the risks posed by evolving threats. However, no system can completely eliminate the possibility of a significant cybersecurity incident. Therefore, we continuously assess and enhance our cybersecurity measures to adapt to the changing threat landscape and ensure organizational resilience. For more information regarding the potential impact of cybersecurity risks, please refer to the risk factor entitled "Cybersecurity events or other disruptions of our information technology systems could adversely affect our business" in Item 1A. Risk Factors.


text: Our cybersecurity program is designed to protect our information and operations from external and internal cyber threats while supporting business resiliency. We employ a risk-based information security process aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to identify, prioritize and mitigate cyber risks. The cybersecurity program is part of our broader enterprise risk management program.

companyName: Helmerich & Payne, Inc.

ticker: HP


text: Board of Directors Our Board of Directors ("Board") and its committees oversee the risk management functions of the Company. Our Audit Committee plays a significant role in oversight of risks, including cybersecurity. At least quarterly, the Audit Committee receives an update on cybersecurity matters from the Company's Senior Vice President of Information Technologies and Engineering and our information security leadership. These updates address a broad spectrum of cybersecurity topics including recent developments, evolving technology practices, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, cybersecurity considerations arising with respect to the Company's third party service providers, and other cybersecurity considerations. Our Vice President of Internal Audit also updates the Audit Committee at least quarterly on internal audit matters, including those related to information technology and security. Additionally, the Company's Cybersecurity Incident Reporting process (described below), provides that potentially significant cybersecurity incidents be promptly reported to the Chairman of the Audit Committee, who will also receive ongoing updates regarding any such incident as appropriate. Cybersecurity incidents determined to be material are reported to the Board of Directors promptly following such determination.


text: Our Director of IT Governance and Response, who manages our cybersecurity program, is currently on leave and expects to retire from the Company in January 2025. During this time and until we appoint a new Director of IT Governance and Response, our Vice President - Information Technology ("VP-IT"), who has extensive cybersecurity knowledge and skills gained from 25 years of information technology work experience at the Company and elsewhere, has assumed responsibilities for this role with the assistance of a third party security leadership service. The VP-IT reports directly to our Senior Vice President of Information Technology and Engineering, who provides oversight of cybersecurity risk and mitigation strategies.


text: Our cybersecurity and information technology teams actively maintain a register of risks and mitigation measures under the umbrella of our enterprise risk management program. Our enterprise risk management program is designed to identify and monitor risks to the Company, assess the Company's risk mitigation plans, and consult on further measures that can be taken to address new and existing risks. Our Enterprise Risk Management Committee, which meets quarterly, is comprised of our executive officers, Senior Vice President of Information Technologies and Engineering, Chief Accounting Officer, Vice President of Internal Audit, Corporate Secretary, and Director – Risk Management & Insurance. Our Risk Management and Insurance Department is responsible for the implementation of our enterprise risk management program and maintains a register of risks and initiates reviews and assessments. The Director of Risk Management and Insurance reports to the Audit Committee and full Board on a quarterly basis.


text: Cybersecurity Program Our cybersecurity program includes, among other things: • ongoing monitoring of systems for security threats at a base level • an internal team that focuses on higher level threats and conducts threat hunting activities • monitoring of the cyber threat landscape using a variety of sources, including engagement with domestic and international governmental security agencies, and industry groups • periodic engagement of third parties to test for vulnerabilities in our information technology systems, assess cybersecurity risk levels, and assess our cybersecurity policies and framework • compliance audits of our information technology processes by our internal audit team, which also monitors the progress of any remediation activities • employee training to raise awareness of cyber risks and behaviors that increase vulnerabilities • periodic exercises to test information technology security protocols • periodic exercises to test information security protocols to enhance crises management readiness and business continuity capabilities • systems and processes designed to assess, oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use • overseeing alignment with customer cybersecurity requirements • a Cybersecurity Incident Reporting process Cybersecurity Incident Reporting Process ("CIR Process")


text: Our CIR Process is a formalized approach following the NIST framework for evaluating cybersecurity incidents and prioritizing response efforts based on established criteria. The key components of the CIR Process includes: • cybersecurity incident prioritization • timelines and communications protocols, including establishing reporting thresholds pursuant to which incidents are escalated within the Company, and, where appropriate, reported promptly to the Cyber Review Committee, the Audit Committee Chairman, the Chief Executive Officer and Chief Financial Officer, and the Board of Directors • procedures related to our Cyber Review Committee described below • a formalized methodology for evaluating the impact of cybersecurity incidents The Cyber Review Committee ("Cyber Committee") is a sub-committee of our Disclosure Committee comprised of our Chief Accounting Officer; Senior Vice President of Information Technology and Engineering; General Counsel; Vice President – Investor Relations; Director – Risk Management & Insurance; and Director – Global Security & Administration. Pursuant to the CIR Process, cybersecurity incidents classified as high priority are reported to the Cyber Committee. The Cyber Committee's responsibilities include: • providing feedback and direction to our information technology teams on incident investigations • coordinating other departments, consultants, and advisors as needed • communicating with our executive officer team, Disclosure Committee, independent auditor, and the Chair of the Audit Committee • initiating the materiality determination methodology and assessing materiality of incidents (quantitative and qualitative) • based on materiality analysis, making a recommendation to the Chief Executive Officer and Chief Financial Officer that an incident should be deemed material


text: Material Cybersecurity Risks and Threats Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Additional information on cybersecurity risks we face can be found in Item 1A—Risk Factors of this Report under the heading "Our business is subject to cybersecurity and information technology system disruption risks," which should be read in conjunction with the foregoing information.


text: Our cybersecurity program is designed to protect our information and operations from external and internal cyber threats while supporting business resiliency. We employ a risk-based information security process aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to identify, prioritize and mitigate cyber risks.


text: Board of Directors Our Board of Directors ("Board") and its committees oversee the risk management functions of the Company. Our Audit Committee plays a significant role in oversight of risks, including cybersecurity. At least quarterly, the Audit Committee receives an update on cybersecurity matters from the Company's Senior Vice President of Information Technologies and Engineering and our Vice President & Global Chief Information Security Officer ("CISO"). These updates address a broad spectrum of cybersecurity topics including recent developments, evolving technology practices, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, cybersecurity considerations arising with respect to the Company's third-party service providers, and other cybersecurity considerations. Our Vice President of Internal Audit also updates the Audit Committee at least quarterly on internal audit matters, including those related to information technology and security. Additionally, the Company's Cybersecurity Incident Reporting process (described below), provides that potentially significant cybersecurity incidents be promptly reported to the Chairman of the Audit Committee, who will also receive ongoing updates regarding any such incident as appropriate. Cybersecurity incidents determined to be material are reported to the Board of Directors promptly following such determination.


text: Our CISO has over 20 years of experience in information security and global compliance. The CISO reports directly to our Senior Vice President of Information Technology and Engineering, who provides oversight of cybersecurity, risk, mitigation strategies, and governance.


text: Our CISO oversees an internal cross-functional information technology governance, risk, and compliance team that actively maintains a register of risks and mitigation measures under the umbrella of our enterprise risk management program. Our enterprise risk management program is designed to identify and monitor risks to the Company, assess the Company's risk mitigation plans, and consult on further measures that can be taken to address new and existing risks. Our Enterprise Risk Management Committee, which meets quarterly, is comprised of our executive officers, Senior Vice President of Information Technologies and Engineering, CISO, Chief Accounting Officer, Vice President of Internal Audit, Corporate Secretary, and Director – Risk Management & Insurance. Our Risk Management and Insurance Department is responsible for the implementation of our enterprise risk management program and maintains a register of risks and initiates reviews and assessments. The Director of Risk Management and Insurance reports to the Audit Committee and full Board on a quarterly basis.


text: Our CIR Process is a formalized approach following the NIST framework for evaluating cybersecurity incidents and prioritizing response efforts based on established criteria. The key components of the CIR Process include: • Cybersecurity incident prioritization • Timelines and communications protocols, including establishing reporting thresholds pursuant to which incidents are escalated within the Company, and, where appropriate, reported promptly to the Cyber Review Committee, the Audit Committee Chairman, the Chief Executive Officer and Chief Financial Officer, and the Board of Directors • Procedures related to our Cyber Review Committee described below • A formalized methodology for evaluating the impact of cybersecurity incidents The Cyber Review Committee ("Cyber Committee") is a sub-committee of our Disclosure Committee comprised of our Chief Accounting Officer; Senior Vice President of Information Technology and Engineering; CISO; general counsels; Vice President – Investor Relations; Director – Risk Management & Insurance; and Vice President – Global Security & Administration. Pursuant to the CIR Process, cybersecurity incidents classified as high priority are reported to the Cyber Committee. The Cyber Committee's responsibilities include: • providing feedback and direction to our information technology teams on incident investigations • coordinating other departments, consultants, and advisors as needed • communicating with our executive officer team, Disclosure Committee, independent auditor, and the Chair of the Audit Committee • initiating the materiality determination methodology and assessing materiality of incidents (quantitative and qualitative) • based on materiality analysis, making a recommendation to the Chief Executive Officer and Chief Financial Officer that an incident should be deemed material


text: Material Cybersecurity Risks and Threats Risks from cybersecurity threats, including any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Additional information on cybersecurity risks we face can be found in Item 1A—Risk Factors of this Report under the heading "Our business is subject to cybersecurity and information technology system disruption risks," which should be read in conjunction with the foregoing information.


text: Cybersecurity Risk Management and Strategy Information technology is important to our business operations, and we are committed to protecting the privacy, security and integrity of our data, as well as our employee and customer data. The Company has a comprehensive cybersecurity program in place for assessing, identifying and managing cybersecurity risks that is designed to protect its systems and data from unauthorized access, use or other security impact. This program is integrated into the Company's overall Enterprise Risk Management and Resiliency process.

companyName: HERSHEY CO

ticker: HSY


text: We continuously monitor and update our information technology networks and infrastructure to prevent, detect, address and mitigate risks associated with unauthorized access, misuse, computer viruses and other events that could have a security impact. We invest in industry standard security technology to protect the Company's data and business processes against risk of cybersecurity incidents. Our data security management program includes identity, trust, vulnerability and threat management business processes, as well as adoption of standard data protection policies. We measure our data security effectiveness by benchmarking against industry-accepted methods and we work to remediate any significant findings. We maintain and routinely test backup systems and disaster recovery and also have processes in place to prevent disruptions resulting from our implementation of new software and systems.


text: The Company has a comprehensive incident response plan to address cybersecurity incidents. The Company's incident response plan includes procedures for identifying, containing and responding to cybersecurity incidents and is subject to regular review and assessment to ensure that it is effective in protecting the Company's information technology. To date, the Company believes that its cybersecurity program has been effective in protecting the confidentiality, integrity, and availability of its information; however, the Company cannot guarantee that its cybersecurity program will be successful in preventing all cybersecurity incidents. Further, we currently maintain a cyber insurance policy that provides coverage for security breaches; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.


text: The Company engages external parties, including consultants, computer security firms and risk management and governance experts, to enhance its cybersecurity oversight. In order to oversee and identify risks from cybersecurity threats associated with the Company's use of third-party service providers, we also have a third-party risk management program designed to help protect against the misuse of information technology by third parties and business partners, which includes certification of our major technology suppliers and any outsourced services through accepted security certification standards.


text: While we are regularly subject to cybersecurity attacks, ransomware and other security breaches, the Company has not experienced any material cybersecurity incidents or a series of related unauthorized occurrences for the year ended December 31, 2023. The Company does not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect the Company or its business strategy, results of operations or financial condition. However, as discussed under " Item 1A. Risk Factors," specifically the risks titled "Disruptions, failures or security breaches of our information technology infrastructure could have a negative impact on our operations," the sophistication of cyber, ransomware and other security threats continues to increase, and the preventative actions we take to reduce the risk of these incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all cybersecurity attacks, ransomware and other security breaches and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Cybersecurity Governance and Oversight The Company's Board of Directors has a mix of experiences, skills, qualifications and backgrounds to support strategy and risk oversight, including expertise in cybersecurity and oversight of cybersecurity matters. This oversight is achieved through the Company's Finance and Risk Management ("F&RM") Committee, which is comprised of five members of our Board of Directors, and one Board member who serves in an ex-officio capacity. The F&RM Committee is responsible for reviewing key enterprise risks identified through our Enterprise Risk Management and Resiliency process, which includes information security strategies and risks, as well as data privacy and protection risks and mitigation strategies (collectively, "Information Security"). At each regularly scheduled F&RM Committee meeting, management, through the Company's Chief Information Security Officer ("CISO"), reports on Information Security controls, audits, guidelines and developments and the F&RM Committee is notified between such updates regarding significant new cybersecurity threats or incidents.


text: The CISO, who reports to the Chief Technology Officer ("CTO"), oversees a dedicated Information Security team that is supported by the Privacy Center of Excellence, and works in partnership with internal audit to review certain information technology-related internal controls with our independent auditors as part of the overall internal controls process. Our CTO, who reports to the Chief Executive Officer, has oversight of our Information Security team and leads the company's global technology strategy, architecting and deploying digital capabilities that are innovative, flexible and prepared to meet the changing needs of our consumers, retail partners and employees.


text: The CISO's cybersecurity experience includes over thirty years of Information Technology experience, including twenty years within the Information Security field. The CISO's Information Security roles have included security engineering, security architecture, strategy development and execution, risk and compliance management and identity and access management and incident response. The Company's CTO has over twenty years of experience, including deep expertise in developing cutting-edge automated systems, supply chain planning, optimization and simulation, artificial intelligence and predictive analytics. Additional experience held by the CTO is described further under Information about Our Executive Officers.


text: To ensure our employees are educated on potential cybersecurity threats or actions, we train our executive officers and global workforce on an ongoing basis in the event of a potential cyber threat or cybersecurity incident. Our Company-wide Information Security training program includes security awareness training, including regular phishing simulations, acceptable use training, cyber wellness trainings and other targeted trainings throughout the year. These trainings provide employees the opportunity to gain an understanding of the various forms of cybersecurity incidents and enable our employees to handle and report any suspicious activity or threat.


text: Cybersecurity Risk Management and Strategy Information technology is important to our business operations, and we are committed to protecting the privacy, security and integrity of our data, as well as our employee and customer data. The Company has a comprehensive cybersecurity program in place for assessing, identifying and managing cybersecurity risks that is designed to protect its systems and data from unauthorized access, use or other security impact, that is aligned with the National Institute of Standards and Technology ("NIST"). This program is integrated into the Company's overall Enterprise Risk Management and Resiliency process.


text: While we are regularly subject to cybersecurity attacks, ransomware and other security breaches, the Company has not experienced any material cybersecurity incidents or a series of related unauthorized occurrences for the year ended December 31, 2024. The Company does not believe that there are currently any known risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company or its business strategy, results of operations or financial condition. However, as discussed under " Item 1A. Risk Factors," specifically the risks titled "Disruptions, failures or security breaches of our information technology infrastructure could have a negative impact on our operations," the sophistication of cyber, ransomware and other security threats continues to increase, and the preventative actions we take to reduce the risk of these incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all cybersecurity attacks, ransomware and other security breaches and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: The CISO, who reports to the Chief Technology Officer ("CTO"), oversees a dedicated Information Security team that is supported by the Privacy Center of Excellence, and works in partnership with internal audit to review certain information technology-related internal controls with our independent auditors as part of the overall internal controls process. The Chief Information Officer ("CIO"), who also reports to the CTO, focuses on our technology modernization priorities, integrating innovative technology solutions to support our business goals, and leading enterprise-wide IT transformation initiatives. Our CTO, who reports to the Chief Executive Officer, has oversight of our Information Security team and leads the company's global technology strategy, architecting and deploying digital capabilities that are innovative, flexible and prepared to meet the changing needs of our consumers, retail partners and employees.


text: The CISO's cybersecurity experience includes over thirty years of Information Technology experience, including twenty years within the Information Security field. The CISO's Information Security roles have included security engineering, security architecture, strategy development and execution, risk and compliance management and identity and access management and incident response. The Company's CIO has over twenty years of experience, including leading digital transformation and global information technology governance. The Company's CTO has over twenty years of experience, including deep expertise in developing cutting-edge automated systems, supply chain planning, optimization and simulation, artificial intelligence and predictive analytics. Additional experience held by the CTO is described further under Information about Our Executive Officers.


text: To ensure our employees are educated on potential cybersecurity threats or actions, we train our executive officers and global workforce on an ongoing basis in the event of a potential cyber threat or cybersecurity incident. Our Company-wide Information Security training program includes security awareness training, including regular phishing simulations, acceptable use training, cyber wellness trainings and other targeted trainings throughout the year. Additional training mechanisms we may use to assess, identify, and manage risks from cybersecurity threats, include simulations, tabletop exercises and response readiness tests to test our preparedness and incident response process. These trainings provide employees the opportunity to gain an understanding of the various forms of cybersecurity incidents and enable our employees to handle and report any suspicious activity or threat.


text: HP's work to defend against cybersecurity threats is occurring against the backdrop of an evolving global threat landscape. Like other Fortune 500 companies, we face a substantial number of cybersecurity threats—ranging from common cyberattacks such as phishing to more evolved threats that incorporate the use of AI. Our products and processes pose an attractive challenge for the most advanced of threat actors—including but not limited to those who are state-sponsored. As a global corporation with a wide range of systems and networks in place, and with customers who threat actors might also wish to target, we could face attacks not only on our own structures, but also on those of our many third-party providers and partners. In response to this threat environment, we have implemented a comprehensive cybersecurity program to assess, identify, and manage risks from cybersecurity threats. Our holistic approach is designed to integrate cybersecurity across the value chain, including in the design, development, and delivery of our products, services, solutions, and operations.

companyName: HP INC

ticker: HPQ


text: Our Chief Information Security Officer ("CISO") has responsibility for HP's global cybersecurity program, including infrastructure and technology platforms, overseeing governance, regulatory and compliance, operations, strategy, and architecture. The CISO reports to our Chief Financial Officer. This role is responsible for building out a cybersecurity organization that is designed to enable robust security coupled with productivity for more than 70,000 global employees, contractors, and partners. The CISO supports HP's business acceleration and transformation by identifying and managing cybersecurity risks, balancing them with business priorities, and using a contemporary security posture to support HP's position as an industry leader. As part of this, the CISO receives reports on cybersecurity threats from a number of experienced information security officers responsible for various parts of the business on an ongoing basis and in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.


text: Our cybersecurity organization collaborates heavily with technology, business and legal stakeholders to enable secure business strategy, maintain, and grow proper security oversight, enhance security monitoring and response, and quantify and reduce risks and compliance gaps. There are six key focus areas within the cybersecurity organization: enterprise security operations, architecture and security engineering, identity access management, IT risk management and compliance, governance, risk and compliance, and strategy and program delivery. Additionally, we aim to incorporate a broad range of industry-standard cybersecurity best practices throughout our cybersecurity organization. These include, among other things: • an insider threat program that coordinates resources to discourage, identify, and mitigate cybersecurity threats; • regular audits of HP cybersecurity systems and annual risk assessments of related HP systems and processes, including our information security management systems; • an incident response plan that sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate; • annual and ongoing security awareness training for employees; • a cybersecurity/information security policy, as well as an acceptable use policy that defines the permitted usage of company-provided technology and contains consequences for noncompliance; • company-wide privacy policies as well as a physical security program that secures our offices and data center facilities; • systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use; and • engagement with industry peers and participation in cybersecurity forums to share knowledge and learn from best practices.


text: On an annual basis, the cybersecurity organization also enlists the aid of an independent third party to assess our alignment with the National Institute of Standards & Technology's Cyber Security Framework. The assessment examines our information/cybersecurity program and its associated controls and delivers a report that documents assessment results and provides recommendations for further enhancements. The cybersecurity organization is responsible for presenting an overview of the Cybersecurity Risk Assessment Report to the Board of Directors on at least an annual basis, and the HP executive leadership team is heavily involved in implementing and resolving recommendations. From time to time, we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: Our cybersecurity risks are evaluated by senior leadership, including as part of our enterprise risk assessments that are reviewed by the Audit Committee and our Board of Directors, and our Internal Audit function, which is an objective, independent assurance and advisory organization that helps HP achieve business objectives and conducts regular assessments, audits, and testing of the cybersecurity program and its associated controls.


text: As of the date of this Form 10-K, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. However, there can be no guarantee that we will not experience such an event moving forward and if realized, these risks are reasonably likely to materially affect us. Additional information on cybersecurity risks we face can be found in "Risk Factors" in Item 1A of Part I of this report under the heading "System security risks, data protection breaches, cyberattacks, system outages and systems integration issues could disrupt our internal operations or services provided to customers, and could reduce our revenue, increase our expenses, damage our reputation and adversely affect our cash flows and stock price," which should be read in conjunction with the foregoing information.


text: Our Board, in coordination with the Audit Committee, oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Board and Audit Committee regularly review the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Board and Audit Committee regularly receive reports and presentations from management regarding our information and technology security program, including the CISO, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported promptly to the Board and Audit Committee, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our Chief Information Security Officer ("CISO"), who has extensive cybersecurity knowledge and skills gained from over 20 years of experience as a CISO at the Company and elsewhere, has responsibility for HP's global cybersecurity program, including infrastructure and technology platforms, overseeing governance, regulatory and compliance, operations, strategy, and architecture. The CISO reports to our Chief Financial Officer. This role is responsible for building out a cybersecurity organization that is designed to enable robust security coupled with productivity for more than 70,000 global employees, contractors, and partners. The CISO supports HP's business acceleration and transformation by identifying and managing cybersecurity risks, balancing them with business priorities, and using a contemporary security posture to support HP's position as an industry leader. As part of this, the CISO receives reports on cybersecurity threats from a number of experienced information security officers responsible for various parts of the business on an ongoing basis and in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.


text: Risk Management and Strategy. Cybersecurity risk management is an integral part of the Corporation's enterprise risk management program. The cybersecurity risk management program is designed to align with industry best practices, is generally based on the framework established by the National Institute of Standards and Technology (NIST), provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of applications and services provided by third parties, and facilitates coordination across different departments of the Corporation. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a threat, including whether the threat is associated with a third-party service provider, implementing countermeasures and mitigation strategies, and informing management and the Board of Directors of material cybersecurity threats, incidents, and impact.

companyName: HNI CORP

ticker: HNI


text: The cybersecurity team under the direction of the Corporation's Chief Information and Digital Officer ("CIDO"), is responsible for assessing, deploying, and managing the cybersecurity risk management program. Recognizing the complexity and evolving nature of cybersecurity threats, the cybersecurity team engages with a range of external experts, including cybersecurity assessors and consultants in evaluating and testing the Corporation's risk management systems. The collaboration with these independent third-parties includes regular threat assessments, such as penetration tests and table-top exercises, and consultation on security enhancements. In addition, the cybersecurity team provides training to applicable members annually and ongoing cybersecurity education. Additionally, the Corporation maintains cyber risk insurance.


text: Depending on the products and services provided and the potential for data exchange and technology risk, suppliers and other third-party service providers are evaluated by the cybersecurity organization to assess their security and data protection capabilities. Additionally, security and data-focused contract provisions are incorporated where necessary in supplier and other service provider agreements to include industry-standard security and resiliency requirements that include timely reporting of cybersecurity incidents. The Corporation periodically reviews independent assessments of major service providers.


text: Governance. The Board of Directors has overall oversight responsibility for risk management. Oversight of cybersecurity risks has been delegated to the Audit Committee of the Board of Directors. The Audit Committee also reports material cybersecurity risk to the full Board of Directors.


text: The Audit Committee is responsible for ensuring management has processes in place designed to identify and evaluate cybersecurity risks to which the Corporation is exposed and implement programs to manage cybersecurity risks and mitigate cybersecurity incidents.


text: Management under the CIDO is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential risk exposures are monitored, implementing appropriate mitigation measures and maintaining cybersecurity programs. The CIDO and cybersecurity team members are certified and/or experienced information systems security professionals and information security managers with many years of experience.


text: The CIDO receives reports from the cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Appropriate procedures for communication to the Audit Committee are also built into the incident response plan.


text: The CIDO regularly updates the Audit Committee and the full Board of Directors on the Corporation's cybersecurity risk management program, material cybersecurity risks, and mitigation strategies. Management provides the Audit Committee with quarterly cybersecurity reports that cover, among other topics, third-party assessments of the Corporation's cybersecurity risk management program, developments in cybersecurity, and updates to the Company's cybersecurity risk management program and mitigation strategies.


text: Cybersecurity Threats. The Corporation has not identified cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect the Corporation. There can be no assurance that this will continue to be the case. Notwithstanding the Corporation's investment in cybersecurity, it may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on its business, results of operations or financial condition. For a discussion of cybersecurity risks affecting the Corporation's business, see "Item 1A. Risk Factors - STRATEGIC AND OPERATIONAL RISKS - The Corporation relies on information technology systems to manage numerous aspects of the business and a disruption or failure of these systems could adversely affect business, operating results, and financial condition." which is incorporated by reference into this Item 1C.


text: Risk Management and Strategy Cybersecurity risk management is an integral part of the Corporation's enterprise risk management program. The cybersecurity risk management program is designed to align with industry best practices, is generally based on the framework established by the National Institute of Standards and Technology (NIST), provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of applications and services provided by third parties, and facilitates coordination across different departments of the Corporation. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a threat, including whether the threat is associated with a third-party service provider, implementing countermeasures and mitigation strategies, and informing management and the Board of Directors of material cybersecurity threats, incidents, and impact.


text: The Board of Directors has overall oversight responsibility for risk management. Oversight of cybersecurity risks has been delegated to the Audit Committee of the Board of Directors. The Audit Committee also reports material cybersecurity risk to the full Board of Directors.


text: Cybersecurity Threats The Corporation has not identified cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect the Corporation. There can be no assurance that this will continue to be the case. Notwithstanding the Corporation's investment in cybersecurity, it may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on its business, results of operations or financial condition. For a discussion of cybersecurity risks affecting the Corporation's business, see "Item 1A. Risk Factors - Strategic and Operational Risks - The Corporation's information technology systems, processes, and sites may suffer interruptions, security incidents, or failures that may affects its ability to conduct its business and cause significant damage to its reputation." which is incorporated by reference into this Item 1C.


text: Risk Management and Strategy As a global organization, the Company's information systems are subject to various risks, including, but not limited to risks associated with ransomware, system disruption, data theft, unauthorized access to information, and misuse of data. To identify, address, and mitigate these risks, the Company has developed and maintains a cybersecurity program. The Company's cybersecurity program is informed by the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the Company's Enterprise Risk Management (ERM) process and relies on internal and external expertise.

companyName: HORMEL FOODS CORP /DE/

ticker: HRL


text: Integration with ERM Processes The Company maintains an ERM program with a governance structure that is designed to identify, assess, prioritize, and mitigate risks across the organization. The ERM Executive Committee, comprised of the Company's senior leadership team, has the ultimate responsibility for overseeing the identification of the key risks facing the Company and meets regularly to discuss the Company's approach to mitigating those risks. Through the ERM process, cybersecurity has been identified as an important risk facing the Company. As a result, the cybersecurity program is an important component of the Company's ERM processes. In addition to discussing the cybersecurity program at ERM Executive Committee meetings, members of the ERM Executive Committee participate in the cybersecurity incident response process. This process includes a governance model and procedures for identifying, categorizing, containing, and responding to cybersecurity incidents. As a component of the cybersecurity incident response process, the Company conducts attack simulations and exercises and has used third parties to support this work. The Company also maintains business continuity and disaster recovery plans to prepare for potential technology disruptions and to better position the Company to recover from any cybersecurity incident. The Company's Disclosure Committee also includes a member of the ERM Executive Committee, helping to ensure timely analysis of disclosure obligations relating to cybersecurity events.


text: Cybersecurity Program Components The Company's cybersecurity program includes a focus on governance, processes, technology, and people. Components of the program include the following: • Investments in security technology, such as vulnerability management tools, malicious software protection, email security, and around-the-clock monitoring; • Regular monitoring and updating of the Company's IT infrastructure, to respond to the dynamic cybersecurity threat environment; • Use of third parties to assess, test, validate, and strengthen the cybersecurity program, including penetration testing and the periodic use of a third party to assess the quality and maturity of the program against the NIST Cybersecurity Framework; and • Assessing and managing cybersecurity risks associated with the Company's relationships with third parties, including technology and service providers, through due diligence efforts and the imposition of contractual obligations.


text: The Company's cybersecurity program also includes employee training and education. Frequent employee training topics include social engineering, phishing, password protection, confidential data protection, asset use, and mobile security. Training emphasizes the importance of reporting incidents promptly to the Company's security operations team. The Company also conducts periodic phishing tests with employees and provides employees with easy-to-use tools to report potential phishing emails.


text: The Company's management is responsible for identifying, assessing, and managing the Company's exposure to cybersecurity risk. The Company has an internal team that is supported by security technologies, third-party experts, and threat intelligence resources in support of cybersecurity risk reduction. The Company's internal cybersecurity team is led by the Company's Director of Information Security and Compliance, who acts in the capacity of a chief information security officer and is responsible for overseeing the execution of cybersecurity strategy and maturing the Company's cybersecurity posture. The Director of Information Security and Compliance reports to the Company's Vice President of IT Services and has education, training, and experience pertinent to cybersecurity, including more than 25 years of IT experience with over 15 years in Information Security and holds the Certified Information Security Systems Professional (CISSP) certification.


text: Board of Directors The Company's Board of Directors (Board) and its Audit Committee exercise oversight of the Company's ERM program, including the cybersecurity program. Management, led by the Director of Information Security and Compliance, provides at least three updates per year to the Audit Committee on cybersecurity topics, and the Audit Committee regularly reports to the Board on these presentations. In addition, the Director of Information Security and Compliance provides an annual cybersecurity update to the full Board. Management's updates cover relevant cybersecurity topics, both ongoing and unique in nature, including risk exposures and management's actions to monitor and mitigate such risks, emerging threats or regulations, and status updates on projects to strengthen and mature the Company's systems and cybersecurity programs. Management's escalation protocol includes reporting of certain cybersecurity threats or incidents to the Audit Committee in a prompt and timely manner.


text: Impact of Cybersecurity Risks and Threats While some of the Company's third-party service providers have experienced cybersecurity incidents and the Company has experienced threats to its data and systems, as of the date of this report, the Company's management is not aware of any cybersecurity threats or incidents that have materially affected its business strategy, results of operations, or financial condition. This does not guarantee that future incidents or threats will not have a material impact by interrupting operations, causing reputational harm, increasing operating costs, or exposing the Company to litigation. For additional commentary on cybersecurity risks, see Part 1, Item 1A. Risk Factors under the heading "The Company may be adversely impacted if the Company is affected by cybersecurity attacks, security breaches, or other IT interruptions, involving its own systems or those with whom it does business."


text: Integration with ERM Processes The Company maintains an ERM program with a governance structure that is designed to identify, assess, prioritize, and mitigate risks across the organization. The ERM Executive Committee, comprised of the Company's senior leadership team, has the ultimate responsibility for managing the identification of the key risks facing the Company and meets regularly to discuss the Company's approach to mitigating those risks. Through the ERM process, cybersecurity has been identified as an important risk facing the Company. As a result, the cybersecurity program is an important component of the Company's ERM processes. In addition to discussing the cybersecurity program at ERM Executive Committee meetings, members of the ERM Executive Committee participate in the cybersecurity incident response process. This process includes a governance model and procedures for identifying, categorizing, containing, and responding to cybersecurity incidents. As a component of the cybersecurity incident response process, the Company periodically conducts attack simulations and exercises and has used third parties to support this work. The Company also maintains business continuity and disaster recovery plans to prepare for potential technology disruptions and to better position the Company to recover from any cybersecurity incident. The Company's Disclosure Committee also includes members of the ERM Executive Committee, helping to ensure timely analysis of potential disclosure obligations relating to cybersecurity events.


text: Cybersecurity Program Components The Company's cybersecurity program includes a focus on governance, processes, technology, and people. Components of the program include the following: • Investments in security technology, such as vulnerability management tools, malicious software protection, email security, and around-the-clock monitoring; • Regular monitoring and updating of the Company's IT infrastructure, to respond to the dynamic cybersecurity threat environment; • Use of internal resources and third parties to assess, test, validate, and strengthen the cybersecurity program, and the periodic use of third parties to perform penetration testing and to assess the quality and maturity of the program against the NIST Cybersecurity Framework; and • Assessing and managing cybersecurity risks associated with the Company's relationships with third parties, including technology and service providers, through due diligence efforts and the imposition of contractual obligations.


text: Board of Directors The Company's Board of Directors ( Board) and its Audit Committee exercise oversight of the Company's ERM program, including the cybersecurity program. Management, led by the Director of Information Security and Compliance, provides at least three updates per year to the Audit Committee on cybersecurity topics, and the Audit Committee regularly reports to the Board on these presentations. In addition, the Director of Information Security and Compliance provides an annual cybersecurity update to the full Board. Management's updates cover relevant cybersecurity topics, both ongoing and unique in nature, including risk exposures and management's actions to monitor and mitigate such risks, emerging threats or regulations, and status updates on projects to strengthen and mature the Company's systems and cybersecurity programs. Management's escalation protocol includes reporting of certain cybersecurity threats or incidents to the Audit Committee in a prompt and timely manner.


text: Impact of Cybersecurity Risks and Threats While some of the Company's third-party service providers have experienced cybersecurity incidents and the Company has experienced threats to its data and systems, as of the date of this report, the Company's management is not aware of any cybersecurity threats or incidents that have materially affected its business strategy, results of operations, or financial condition. This does not guarantee that future incidents or threats will not have a material impact by interrupting operations, causing reputational harm, increasing operating costs, or exposing the Company to litigation. For additional commentary on cybersecurity risks, see Part 1, Item 1A. Risk Factors under the heading "The Company may be adversely impacted if the Company is affected by cybersecurity attacks or other security breaches."


text: Risk Management and Strategy In the ordinary course of our business, we process, store and transmit large amounts of data, and rely on third-party service providers to do the same, including sensitive personal information as well as proprietary or confidential information relating to our business or a third-party. The protection of information and business processes is an integrated component in our overall risk management program, and reflected in our Code of Ethics, security standards, and privacy policies. We employ processes to safeguard information and protect our members' data, including by deploying both proactive and defensive practices against the evolving cyber threat landscape. Examples of these processes include: a. Employing a qualified Chief Information Security Officer. b. Maintaining tools to identify malicious cyber activity. c. Monitoring risks posed by threat actors, including through partnerships with industry groups and government agencies. d. Providing annual cybersecurity training to our associates. e. Testing our associates' knowledge through internal phishing simulations.

companyName: HUMANA INC

ticker: HUM


text: f. Engaging an independent third-party audit firm to perform an Annual Service Organizational Controls (SOC) 2 audit of enterprise claims platforms.


text: g. Reporting data breaches, as required by law, to the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), and various state agencies; our reports are publicly available, free of charge, and can be obtained through the OCR Portal at https://ocrportal.hhs.gov/ocr/breach.


text: h. Maintaining a program to identify cybersecurity risks associated with certain third party vendors, which is one component of an overall vendor risk management program.


text: We also enhance our information technology infrastructure and security protocols to assess, identify, protect against, and manage material risks from cybersecurity threats following a risk-based approach. In addition, we conduct cybersecurity risk assessments at least annually, and periodically engage an independent auditor or other external assessors to aid in pro-active risk identification, prevention, detection, mitigation, and remediation. Our efforts to manage against cybersecurity threats are further guided by Federal and state laws, as well as contractual commitments with third parties, which regulate our collection, use and disclosure of confidential information such as protected health information and personally identifiable information.


text: Although we have been subject to breaches of our information technology systems, including breaches of the information technology systems of third-party service providers, the impact of such attacks has not been material to our business strategy, operations or results of operations, financial position, or cash flows through December 31, 2023. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect the Company. For additional information on the risks we face from cybersecurity threats, please refer to Part I, Item 1A, "Risk Factors" of this Form 10-K.


text: As part of its overall responsibility for oversight of our enterprise risk management, our Board of Directors reviews material risks to our Company, including risks from cybersecurity threats. The Board has designated our Audit Committee and Technology Committee with joint oversight over our information technology internal controls, cybersecurity, business continuity and disaster recovery programs.


text: Management is responsible for designing and implementing our governance framework and controls for managing our material risks from cybersecurity threats, under the oversight of our Board of Directors. Our Chief Information Security Officer is responsible for assessing and managing identified cybersecurity risks, and evaluating and remediating cybersecurity incidents, and sharing information directly with the Audit Committee and Technology Committee, or full Board of Directors, when appropriate. Our Chief Information Security Officer reports to our Chief Information Officer, who is in turn responsible for the management of Humana's data and information technology risks more generally. Our Chief Information Officer is a senior executive and industry leader in risk management practices in highly regulated fields. Our Chief Information Security Officer is an experienced cybersecurity executive and leader in the field, with many years of relevant experience working in highly regulated industries.


text: Among our cybersecurity and risk teams, we utilize established governance mechanisms to enable a transparent and holistic approach to cybersecurity risk management, and the evaluation and remediation of cybersecurity incidents. These processes enable cross-functional engagement from our enterprise information protection, enterprise risk management, enterprise compliance, information technology, legal, privacy, and data governance teams.


text: As a key component of this governance framework, the Audit Committee and Technology Committee also receive regular updates regarding our cybersecurity program and cybersecurity incidents from our Chief Information Security Officer.


text: Risk Management and Strategy In the ordinary course of our business, we process, store and transmit large amounts of data, and rely on third-party service providers to do the same, including sensitive personal information as well as proprietary or confidential information relating to our business or a third-party with which we do business. The protection of information and business processes is an integrated component in our overall risk management program, and reflected in our Code of Ethics, security standards, and privacy policies. We employ processes to safeguard information and protect our customers' data, including by deploying both proactive and defensive practices against the evolving cyber threat landscape. Examples of these processes include: a. Employing a qualified Chief Information Security Officer. b. Maintaining tools to identify malicious cyber activity. c. Monitoring risks posed by threat actors, including through partnerships with industry groups and government agencies. d. Providing annual cybersecurity training to our associates. e. Testing our associates' knowledge through internal phishing simulations.


text: h. Maintaining a program to identify cybersecurity risks associated with certain third-party vendors, which is one component of an overall vendor risk management program.


text: Although we have been subject to breaches of our information technology systems, including breaches of the information technology systems of third-party service providers, the impact of such attacks has not been material to our business strategy, operations or results of operations, financial position, or cash flows through December 31, 2024. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect the Company. For additional information on the risks we face from cybersecurity threats, please refer to Part I, Item 1A, "Risk Factors" of this Form 10-K.


text: Management is responsible for designing and implementing our governance framework and controls for managing our material risks from cybersecurity threats, under the oversight of our Board of Directors. Our Chief Information Security Officer is responsible for assessing and managing identified cybersecurity risks, evaluating and remediating cybersecurity incidents, and sharing information directly with the Audit Committee and Technology Committee, or full Board of Directors, when appropriate. Our Chief Information Security Officer reports to our Chief Information Officer, who is in turn responsible for the management of Humana's data and information technology risks more generally. Our Chief Information Officer is a senior executive with more than two decades of experience leading technology teams in large, regulated industries. Our Chief Information Security Officer is an experienced cybersecurity executive and leader in the field, with many years of relevant experience working in highly regulated industries.


text: Cyber Risk Management and Strategy EastGroup incorporates cybersecurity processes, which include periodic tests of its information security processes and systems by external firms, into the Company's overall risk management program. EastGroup has processes and policies regarding incident response, identity and access management, employee training on cybersecurity matters, device management, and patch and vulnerability management, among others. We also maintain processes regarding third-party vendor risk management, including, as appropriate, conducting a review of security ratings of and System and Organization Controls ("SOC") reports provided by potential vendors. Additionally, EastGroup works with cybersecurity consulting firms to help manage the Company's cybersecurity risks. The cyber consulting firms currently conduct testing of EastGroup's controls and environment, including penetration testing, to identify and remediate cybersecurity risks. They also currently provide EastGroup with advice on technology, infrastructure, management, and productivity in relation to its information technology capabilities, including conducting phishing exercises with the Company's employees.

companyName: EASTGROUP PROPERTIES INC

ticker: EGP


text: Additionally, EastGroup has information technology general controls in place in support of internal control over financial reporting. These controls are tested by the Company's internal audit function and control deficiencies, if any, would be reported to senior management and the Audit Committee of the Board of Directors.


text: Governance Related to Cybersecurity Risks EastGroup's cybersecurity risk management process is assessed and managed by a cyber risk committee ("Cyber Risk Committee"), which includes the Company's Chief Financial Officer ("CFO"), Chief Information Officer ("CIO") and members of management within the information technology, finance and accounting, legal and internal audit functions. The CIO is a Certified Public Accountant ("CPA"), a Certified Information Technology Professional with the American Institute of CPAs and has 20 years of experience in the areas of cybersecurity and information technology. Collectively, other members of the Cyber Risk Committee have technical expertise and experience in accounting, financial reporting and auditing, and law and compliance.


text: The Company's Board of Directors oversees EastGroup's risk management process. Specifically, the Board of Directors has delegated to the Audit Committee, as reflected in the charter of the Audit Committee, responsibility for periodic review and oversight of the Company's cybersecurity and other information technology risks, controls and procedures, including the Company's plans to mitigate cybersecurity risks and to respond to data breaches. The Audit Committee receives periodic updates from the Cyber Risk Committee regarding these topics. Both senior management, including members of the Cyber Risk Committee, and the Audit Committee Chairperson report periodically on cybersecurity risk management to the full Board of Directors. Additionally, management conducts comprehensive risk surveys annually and presents the results of these surveys to the Board of Directors for discussion.


text: Cyber Risk Management and Strategy Cybersecurity risk management policies and processes are integrated into EastGroup's enterprise risk management program. These policies and processes include incident response, identity and access management, employee training on cybersecurity matters, device management, patch management and vulnerability assessment. The Company also maintains processes regarding third-party vendor risk management, including, as appropriate, conducting a review of security ratings of and System and Organization Controls ("SOC") reports provided by potential vendors. Additionally, EastGroup works with cybersecurity consulting firms to help manage the Company's cybersecurity risks. The cyber consulting firms currently conduct testing of EastGroup's controls and environment, including network penetration testing, to identify and remediate cybersecurity risks. They also currently provide EastGroup with advice on technology, infrastructure, management, and productivity in relation to its information technology capabilities, including training for all employees. This training supports information security awareness and adherence to Company policies and guidance through regular, mandatory training and random simulated phishing tests.


text: As of the date of this report, the Company has not identified breaches from any cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to affect operations, business strategy or financial condition. For additional information regarding our cybersecurity risks, see "Item 1A. Risk Factors - We rely on information technology in our operations, and any material failure, inadequacy, interruption or cyber-attack of that technology could harm our business."


text: Governance Related to Cybersecurity Risks EastGroup's cybersecurity risk management process is assessed and managed by a cyber risk committee ("Cyber Risk Committee"), which includes the Company's Chief Financial Officer ("CFO"), Chief Information Officer ("CIO") and members of management within the information technology, finance and accounting, legal and internal audit functions. The CIO is a Certified Public Accountant ("CPA"), a Certified Information Technology Professional with the American Institute of CPAs and has over 20 years of experience in the areas of cybersecurity and information technology. Collectively, other members of the Cyber Risk Committee have technical expertise and experience in accounting, financial reporting and auditing, and law and compliance.


text: Risk Management and Strategy The Company utilizes information systems to support a variety of business processes and activities in its decentralized operations. These systems may be subject to cyber-based attacks or breaches. For additional information related to the risks associated with cybersecurity threats, refer to the Business and Operational Risks section of Item 1A. Risk Factors.

companyName: ILLINOIS TOOL WORKS INC

ticker: ITW


text: Cybersecurity risk management is part of the Company's global enterprise risk management program. In order to manage the risks associated with cybersecurity threats, the Company has implemented a robust risk-based cybersecurity program consisting of processes, technologies, and controls to assess, identify and manage material risks from cybersecurity threats.


text: A key part of the Company's cybersecurity program is the ITW Cybersecurity Framework, which is based on the National Institute of Standards and Technology's Cybersecurity Framework ("CSF") and is designed to protect the Company's data through rapid identification of and effective response to cybersecurity incidents. The Company's framework includes detailed processes and controls related to backup and recovery, response planning, awareness, vulnerability management and endpoint protection as well as cybersecurity requirements for third-party service providers. The framework is regularly reviewed, assessed, and updated based on input from third party specialists, threat intelligence firms and CSF standard updates.


text: The ITW Cybersecurity Framework includes a number of activities designed to enhance the Company's resiliency related to cyber-related risks and ensure that the Company's information systems are secure from material cybersecurity threats. These activities include the following, among others: • Annual cybersecurity training; • Quarterly phish simulation testing; • Ongoing response planning and tabletop exercises; • Network and endpoint monitoring; • Vulnerability management and testing; and • Backup and recovery testing.


text: While the Company's information systems are exposed to cybersecurity threats and risks, the Company has not experienced any material cybersecurity incidents during 2023, 2022 or 2021, and any costs or operational impacts related to cybersecurity incidents were immaterial during this period.


text: ITW's Board of Directors is responsible for providing oversight and strategic guidance to management to support the long-term interests of the Company's stakeholders. As part of this responsibility, the Board of Directors annually reviews and evaluates the Company's cybersecurity policies and practices with respect to risk management as well as steps taken by management to monitor and control such exposures. In addition to oversight by the Board of Directors, several cross-functional management teams focus on cybersecurity risk and report any identified cybersecurity incidents. Each of the Company's divisions has a Division Cyber Incident Response Team and protocols in place to communicate cybersecurity incidents to a central Cyber Incident Response Team. The Cyber Incident Response Team is led by the Chief Information Security Officer and is responsible for the initial assessment of cybersecurity incidents and oversight of any incident response.


text: On a quarterly basis, or sooner if appropriate, cybersecurity incidents are summarized and reported to the Cybersecurity Governance Committee comprised of senior executives. Additionally, the Audit Committee of the Board of Directors receives quarterly cybersecurity reports from senior management which cover any identified cybersecurity incidents, results of third party vulnerability testing, and key developments in policies and practices during the quarter.


text: Cybersecurity risk management is part of the Company's global enterprise risk management program. In order to manage the risks associated with cybersecurity threats, the Company has implemented a risk-based cybersecurity program consisting of processes, technologies, and controls to assess, identify and manage material risks from cybersecurity threats.


text: The ITW Cybersecurity Framework includes a number of activities designed to enhance the Company's resiliency related to cyber-related risks and ensure that the Company's information systems are secure from material cybersecurity threats. These activities include the following, among others: • Annual cybersecurity training; • Quarterly phish simulation testing; • Ongoing response planning and tabletop exercises; • Network/endpoint protection, monitoring and response; • Vulnerability management and • Backup and recovery testing.


text: While the Company's information systems are exposed to cybersecurity threats and risks, the Company has not experienced any material cybersecurity incidents during 2024, 2023 or 2022, and any costs or operational impacts related to cybersecurity incidents were immaterial during this period.


text: ITW's Board of Directors is responsible for providing oversight and strategic guidance to management to support the long-term interests of the Company's stakeholders. As part of this responsibility, the Board of Directors annually reviews and evaluates the Company's cybersecurity policies and practices with respect to risk management as well as steps taken by management to monitor and control such exposures. In addition to oversight by the Board of Directors, several cross-functional management teams focus on cybersecurity risk and report any identified cybersecurity incidents. Each of the Company's divisions has a Division Cyber Incident Response Team and protocols in place to communicate cybersecurity incidents to a central Cyber Incident Response Team. The Cyber Incident Response Team is led by the Chief Information Security Officer ("CISO") and is responsible for the initial assessment of cybersecurity incidents and oversight of any incident response.


text: The Company's cybersecurity program is overseen by a dedicated global team of cybersecurity professionals, led by the CISO who brings over 20 years of information technology and cybersecurity leadership experience and holds the Certified Information Security Manager ("CISM") designation. The CISO reports directly to the Chief Information Officer ("CIO") and is responsible for leading the execution of the Company's cybersecurity strategy.


text: Imperial recognizes the importance of cybersecurity in achieving its business objectives, safeguarding its assets, and managing its daily operations. Accordingly, the company integrates cybersecurity risks into its overall enterprise risk management system. The board of directors oversees the company's risk management approach and structure, which includes an annual review of the company's cybersecurity program.

companyName: IMPERIAL OIL LTD

ticker: IMO


text: The company's cybersecurity program is managed by the Canada IT Manager, with support from cross-functional teams led by information technology (IT) and operational technology cybersecurity operations managers in the company and in Exxon Mobil Corporation and its affiliates (collectively, Cybersecurity Operations Managers). The Cybersecurity Operations Managers are responsible for the day-to-day management and effective functioning of the cybersecurity program, including the prevention, detection, investigation, and response to cybersecurity threats and incidents. The Cybersecurity Operations Managers collectively have many years of experience in cybersecurity operations.


text: IT management provides updates to the company's senior management throughout the year, covering, as appropriate, the company's cybersecurity strategy, initiatives, key security metrics, penetration testing and benchmarking learnings, and business response plans, as well as the evolving cybersecurity threat landscape.