text: The cybersecurity risk management process also includes the evaluation of risks from cybersecurity threats associated with the use of third-party service providers, such as vendors engaged by the Company to provide the IT systems used in its operations. As a part of the overall risk management process, the Company evaluates new vendors for security risks before onboarding and regularly monitors third-party vendor performance to identify potential cybersecurity risks. The Company periodically engages with third-party consultants, legal advisors, and audit firms in evaluating and testing the Company's risk management processes.


text: The Company continues to invest in cybersecurity and the resiliency of its networks and to enhance its processes and procedures, which are designed to help protect its systems and infrastructure, and the information they contain. For example, the Company is in the process of further developing its cybersecurity incident response processes and procedures to enhance its ability to identify, assess, and respond to potential cybersecurity threats. Although the Company faces cybersecurity risks in connection with its business, as of the date of this Report, such risks, including as a result of any previous cybersecurity incidents, have not materially affected (and are not reasonably likely to materially affect) the Company, including its business strategy, results of operations or financial condition. However, we can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition.

companyName: Crimson Wine Group, Ltd

ticker: CWGL

secItem: Item 1C


text: Board of Directors The Audit Committee of the Company's Board of Directors oversees the effectiveness of the Company's internal controls, including controls designed to identify, mitigate, and assess potentially material cybersecurity threats and incidents. The Audit Committee is informed of the status of the cybersecurity risk management processes by management during regular Audit Committee meetings. Reports from management include existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), and status on key information security initiatives.


text: The Company's IT department, under the direction of its Chief Financial Officer, is responsible for the assessment and management of material cybersecurity risks. The IT department has over 70 years of combined work experience in information technology, including security, auditing, compliance, systems, and programming. The IT department is informed about and monitors the prevention, mitigation, detection and remediation of cybersecurity incidents through management of and participation in the cybersecurity risk management process described above, and regularly reports to the Audit Committee.


text: Risk Management and Strategy The Company has a structured risk management process for identifying, reviewing, and assessing material risks from cybersecurity threats. These processes are included in the Company's overall risk management process, which is overseen by the Audit Committee of the Company's Board of Directors. As part of the cybersecurity risk management process the Company uses various methods to monitor and evaluate its threat environment and its risk profile. These methods include using manual and automated tools such as vulnerability scanning software; monitoring current and emerging cybersecurity threats; studying reports of threats and threat actors; performing scans of the threat environment; assessing our industry's risk profile; conducting internal and external audits and assessments; and carrying out threat and vulnerability assessments. To manage and mitigate material risks from cybersecurity threats to our information systems and data, the Company implements and maintains a variety of technical, physical, procedural, and organizational measures. These measures include access controls for networks, devices, and applications; firewalls and antivirus/antimalware software; management of network and user device configurations; encryption of data; monitoring of networks, devices, applications, and accounts; penetration testing; asset management procedures; risk assessments; incident detection and response plans; vulnerability management processes; business continuity and disaster recovery plans; internal IT controls; and employee cybersecurity awareness training.


text: The Company continues to invest in cybersecurity and the resiliency of its networks and to enhance its processes and procedures, which are designed to help protect its systems and infrastructure, and the information they contain. For example, the Company is in the process of further developing its cybersecurity incident response processes and procedures to enhance its ability to identify, assess, and respond to potential cybersecurity threats. Although the Company faces cybersecurity risks in connection with its business, as of the date of this Report, such risks, including as a result of any previous cybersecurity incidents such as the cybersecurity incident described below, have not materially affected (and are not reasonably likely to materially affect) the Company, including its business strategy, results of operations or financial condition. However, we can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition.


text: Despite the systems and processes the Company has in place to monitor, detect, mitigate and remediate potential vulnerabilities, on June 30, 2024, the Company detected a cybersecurity incident in which an unauthorized third party gained access to certain information systems of the Company, which resulted in the Company incurring expenses, including expenses to retain external cybersecurity experts to assist with an investigation into such incident. For additional information, see Note 14 "Commitments and Contingencies" included in Part IV, Item 15 of this Report.


text: We believe that having a strong cybersecurity program, including robust risk management and oversight procedures, is critical to our business success. We are committed to implementing leading data protection standards, and have a comprehensive set of written policies and standards that follow the guidance of the industry standard cybersecurity frameworks.

companyName: American Homes 4 Rent

ticker: AMH


text: Management and Board Oversight We have a dedicated cybersecurity team led by our Vice President of Information Security ("CISO"), who reports directly to our Chief Technology Officer ("CTO"). Our CISO has more than 10 years of experience in cybersecurity and IT compliance, is a member of InfraGard, a national non-profit organization serving as a public-partnership between U.S. businesses and the Federal Bureau of Investigation, and is a member of the Cal Poly Pomona Cyber Security Advisory Council. He has also obtained the following certifications: Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), Certified Cloud Security Professional (CCSP), and Certified Chief Information Security Professional (CCISO). Our CTO has over two decades of experience in establishing, administering, and enhancing effective cybersecurity programs for multiple publicly-traded companies. Our CTO and CISO conduct quarterly cybersecurity reviews for our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), and Chief Legal Officer ("CLO"). Our CISO reports to our CTO, who reports to our CFO.


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems we use, including systems provided by third party service providers, we utilize a regularly updated incident response plan that was developed taking into account a recognized third party cybersecurity framework. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the team is generally led by the CISO or another member of the dedicated cybersecurity team, and will include other information technology and legal personnel. The incident response team regularly reports to senior management, including the CEO, CFO, COO and CLO in the event of a potentially significant cybersecurity incident. The CISO or another member of the incident response team also reports to the Company's Disclosure Committee, which makes determinations regarding SEC reporting obligations related to the cybersecurity incident and consists of senior officers in the operations, finance, and legal functions. The Disclosure Committee also consults with the chair of the Audit Committee of the board of trustees in making determinations regarding applicable SEC reporting requirements.


text: The board of trustees considers cybersecurity as part of its broader consideration of business strategy and risk management. Our board of trustees has delegated to the Audit Committee the responsibility of overseeing the Company's risk management program, including the company's risk assessment, risk management and risk mitigation policies and programs. A key part of this responsibility is overseeing the Company's cybersecurity program. The Audit Committee, which consists solely of independent trustees and whose chair has information security experience, receives quarterly updates with respect to the cybersecurity program, addressing topics such as current threat levels, program enhancements and vulnerability testing. The Audit Committee oversees our compliance with industry standard cybersecurity frameworks, our cybersecurity insurance coverage, cybersecurity-related internal controls, cybersecurity training provided to company personnel, penetration testing, incident response plan updates, and our business continuity plan. The Audit Committee also periodically evaluates our cyber strategy to ensure its effectiveness, including benchmarking against our peers. The Audit Committee provides regular briefings to the full board of trustees with respect to the Company's cybersecurity program. Additionally, we provide an annual update on the cybersecurity program to the full board of trustees, which has included our CTO and third-party cybersecurity experts in recent years.


text: As part of our board refreshment efforts in recent years we have focused on adding trustees with cybersecurity risk management experience. Currently four members of our board of trustees have information security experience.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our cybersecurity program has four components: (1) prevention and preparation, (2) detection and analysis, (3) containment, eradication, recovery, and reporting, and (4) post-incident analysis and program enhancements.


text: Prevention and Preparation We undertake regular internal and external security audits and vulnerability assessments to reduce the risk of a cybersecurity incident and we implement business continuity, contingency and recovery plans to mitigate the impact of an incident. As part of these efforts we engage a third-party to conduct an external review of our vulnerabilities at least annually. We continue to strengthen our authentication mechanisms including broad adoption of multi-factor authentication and geolocation-based blocking. To support our preparedness, we perform a tabletop exercise at least once a year to test our incident response procedures.


text: We recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of our prevention efforts is employee training on our data privacy and cyber security procedures. For example, all new hires receive mandatory privacy and information security training. In addition, current employees must complete mandatory annual cybersecurity and data trainings, which are supplemented by regular phishing and other cyber-related testing that we conduct throughout the year.


text: We also recognize that third-parties that provide information systems we use can be subject to cybersecurity incidents that could impact us. To mitigate third party risk, we maintain a Vendor Integrity Code, which is designed to require our third-party vendors to comply with our requirements for maintenance of passwords, as well as other confidentiality, security, and privacy procedures. Third-party IT vendors are also subject to additional diligence such as questionnaires, inquiries, and review of System and Organization Controls (SOC) 1 and 2 reports, when relevant.


text: Detection and Analysis We have implemented controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect the integrity of our information assets. Our cybersecurity team, with the assistance of an outside cybersecurity firm, continuously monitors for threats to keep our systems secure. Cybersecurity incidents may also be detected through a variety of means, which may include, but are not limited to, employee notification to our IT service center, notification from external parties (e.g., customers, vendors, or service providers), and automated event-detection notifications. Once a potential cybersecurity incident is identified, including a third-party cybersecurity event, the incident response team designated pursuant to the incident response plan follows the procedures set forth in the plan to investigate the potential incident, including classifying the nature of the event (e.g. ransomware, personal data breach, intellectual property breach, theft or fraud) and assessing the severity of the event and sensitivity of any compromised data according to preset criteria. Potentially significant cybersecurity incidents are escalated to the Disclosure Committee, which makes determinations regarding SEC reporting obligations related to the cybersecurity incident.


text: Containment, Eradication, Recovery, and Reporting With every cybersecurity incident, the highest priority of the incident response team is to contain the cybersecurity incident as quickly as possible. A cybersecurity incident is considered contained when no additional harm can be caused and the focus shifts to remediation. The incident response team executes our incident response plan to respond to the cybersecurity incident and coordinate resources and communication protocols.


text: The incident response team also directs and coordinates eradication and recovery efforts. Eradication and recovery activities depend on the nature of the cybersecurity incident and may include rebuilding systems and/or hosts, replacing compromised files with clean versions, validation of files or data that may have been affected, increased network monitoring or logging to identify recurring attacks, or employee re-training, among other things. We have also retained an outside cybersecurity firm which would assist with containment, eradication, and recovery efforts, as needed.


text: Further, the Company also maintains cyber risk insurance to provide some coverage for certain risks arising out of data and network breaches, and the Audit Committee annually reviews such coverage.


text: The Company's incident response plan provides clear communication protocols, including with respect to members of senior management, including the CEO, CFO, COO and CLO, the Audit Committee, internal and external counsel, particularly with respect to legal obligations to report the incident to tenants, regulators and law enforcements, and to the Disclosure Committee and external counsel with respect to the Company's SEC reporting obligations.


text: Post-Incident Activity After recovery, the Company performs a review of the incident to identify and implement enhancements to the cybersecurity program that can mitigate the risk or severity of future incidents. The CISO generally oversees the implementation of enhancements identified through these reviews with oversight by senior management and the Audit Committee as appropriate.


text: Cybersecurity Risks As of December 31, 2023, we are not aware of any material cybersecurity incidents. However, we routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachment to emails, phishing attempts, extortion or other scams that we are able to prevent or sufficiently mitigate harm from. Although we make efforts to maintain the security and integrity of our networks and systems, and the proprietary, confidential and personal information that resides on or is transmitted through them, and we have implemented various cybersecurity policies and procedures to manage the risk of a security incident or disruption, there can be no assurance that our security efforts and measures will be effective or that attempted security incidents or disruptions would not be successful or damaging. In addition, although the Company maintains cyber risk insurance to provide some coverage for certain risks arising out of data and network breaches, there can be no assurance that our cyber risk insurance coverage will be sufficient in the event of a cyber-attack. See "Risk Factors–Risks Related to our Business–If our confidential information is compromised or corrupted, including as a result of a cybersecurity incident, our business operations and reputation could be damaged, which could adversely affect our financial condition and operating results."


text: We believe that having a strong cybersecurity program, including robust risk management and oversight procedures, is critical to our business success. Our cybersecurity program includes written policies and standards that follow the guidance of well-recognized industry cybersecurity frameworks.


text: Management and Board Oversight We have a dedicated cybersecurity team led by our Vice President of Information Security ("CISO"), who reports on cybersecurity directly to our Chief Technology Officer ("CTO"), who reports to our Chief Financial Officer ("CFO"). Our CISO has significant experience in cybersecurity and IT compliance, is a member of InfraGard, a national non-profit organization serving as a public-partnership between U.S. businesses and the Federal Bureau of Investigation, and is a member of the Cal Poly Pomona Cyber Security Advisory Council. He has also obtained the following certifications: Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), Certified Cloud Security Professional (CCSP), and Certified Chief Information Security Professional (CCISO). Our CTO has over two decades of experience in establishing, administering, and enhancing effective cybersecurity programs for multiple publicly-traded companies. Our CTO and CISO conduct quarterly cybersecurity reviews for our Chief Executive Officer ("CEO"), CFO, and Chief Legal Officer ("CLO").


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems we use, including systems provided by third party service providers, we utilize a regularly updated incident response plan that was developed taking into account a recognized third-party cybersecurity framework. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the team is generally led by the CISO or another member of the dedicated cybersecurity team, and will include other information technology and legal personnel. The incident response team regularly reports to senior management, including the CEO, CFO, COO and CLO in the event of a potentially significant cybersecurity incident. The CISO or another member of the incident response team also reports to the Company's Disclosure Committee, which makes determinations regarding SEC reporting obligations related to the cybersecurity incident and consists of senior officers in the operations, finance, and legal functions. The Disclosure Committee also consults with the chair of the Audit Committee of the board of trustees in making determinations regarding applicable SEC reporting requirements.


text: The board of trustees considers cybersecurity as part of its broader consideration of business strategy and enterprise risk management. Our board of trustees has delegated to the Audit Committee the responsibility of overseeing the Company's risk management program, including the cybersecurity program. The Audit Committee, which consists solely of independent trustees and whose chair has information security experience, receives quarterly updates with respect to the cybersecurity program. As part of its oversight, the Audit Committee may, for example, receive updates regarding assessments of our alignment with certain industry cybersecurity frameworks, our cybersecurity insurance coverage, cybersecurity-related internal controls, cybersecurity training provided to company personnel, results of penetration testing, and revisions to the incident response plan and business continuity plan. The Audit Committee provides regular briefings to the full board of trustees with respect to the Company's cybersecurity program. Additionally, we provide an annual update on the cybersecurity program to the full board of trustees, which has included our CTO and third-party cybersecurity experts in recent years.


text: Prevention and Preparation We undertake regular internal and external security audits and vulnerability assessments to reduce the risk of a cybersecurity incident and we implement business continuity, contingency and recovery plans to mitigate the impact of an incident. As part of these efforts, we engage a third-party to conduct an external review of our vulnerabilities at least annually. We continue to strengthen our authentication mechanisms including broad adoption of multi-factor authentication and geolocation-based blocking. To support our preparedness, we perform a tabletop exercise at least once a year to test our incident response procedures.


text: We recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of our prevention efforts is training employees on our data privacy and cyber security procedures. For example, new hires receive mandatory privacy and information security training. In addition, current employees must complete mandatory annual cybersecurity and data trainings, which are supplemented by regular phishing and other cyber-related awareness activities that we conduct throughout the year.


text: We also recognize that third-parties that provide information systems we use can be subject to cybersecurity incidents that could impact us. To mitigate third party risk, we maintain a Vendor Integrity Code, which is designed to require our third-party vendors to comply with our requirements for maintenance of passwords, as well as other confidentiality, security, and privacy procedures. Third-party IT vendors determined to present a higher risk are also subject to additional diligence such as questionnaires, inquiries, and review of System and Organization Controls (SOC) 1 and 2 reports, when relevant.


text: Detection and Analysis We have implemented controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect the integrity of our information assets. Our cybersecurity team, with the assistance of an outside cybersecurity firm, continuously monitors for threats to keep our systems secure. Cybersecurity incidents may also be detected through a variety of means, which may include, but are not limited to, employee notification to our IT service center, notification from external parties (e.g., customers, vendors, or service providers), and automated event-detection notifications. Once a potential cybersecurity incident is identified, including a third-party cybersecurity event, the incident response team designated pursuant to the incident response plan follows the procedures set forth in the plan to investigate the potential incident, including classifying the nature and severity of the event. Potentially significant cybersecurity incidents are escalated to the Disclosure Committee, which makes determinations regarding SEC reporting obligations related to the cybersecurity incident.


text: Containment, Eradication, Recovery, and Reporting The incident response team executes our incident response plan to respond to the cybersecurity incident and coordinate resources and communication protocols.


text: The incident response team also directs and coordinates eradication and recovery efforts. Eradication and recovery activities depend on the nature of the cybersecurity incident and may include rebuilding systems and/or hosts, replacing compromised files with clean versions or validation of files or data that may have been affected. We have also retained an outside cybersecurity firm which would assist with containment, eradication, and recovery efforts, as needed.


text: The Company's incident response plan provides clear communication protocols, including with respect to members of senior management, which may include, depending on the incident's classification and other circumstances, the CEO, CFO, COO and CLO, the Audit Committee, the Disclosure Committee, and internal and external counsel. In addition, the incident response plan considers communications and reporting to tenants, regulators and law enforcement.


text: Post-Incident Activity After recovery, the Company performs a review of the incident to identify potential enhancements to the cybersecurity program that can mitigate the risk or severity of future incidents. The results of these reviews are shared with management and the Audit Committee.


text: Cybersecurity Risks As of December 31, 2024, we have not had any known instances of material cybersecurity incidents. However, there can be no assurance that our security efforts and measures will be effective or that attempted security incidents or disruptions would not be successful or damaging. In addition, although the Company maintains cyber risk insurance to provide some coverage for certain risks arising out of data and network breaches, there can be no assurance that our cyber risk insurance coverage will be sufficient in the event of a cyber-attack. See "Risk Factors—Risks Related to our Business—If our confidential information is compromised or corrupted, including as a result of a cybersecurity incident, our business operations and reputation could be damaged, which could adversely affect our financial condition and operating results."


text: We believe that cybersecurity and the protection of data and customer information in our possession, custody or control is of paramount importance to our business. We have therefore designed and implemented a framework of policies, programs and procedures (the "Information Security Program") intended to protect the confidentiality, integrity, and availability of our critical systems and information, including customer information. The Information Security Program is informed by interagency guidance issued by banking regulators as well as the FFIEC Information Security Booklet and Cybersecurity Assessment Tool. This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the guidance to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: First Internet Bancorp

ticker: INBK


text: Cybersecurity Risk Management and Strategy Our Information Security Program is aligned to the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our Information Security Program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • internal testing of our security controls and our response to cybersecurity incidents; • the use of external service providers, to assess, test or otherwise assist with aspects of our security controls; • training and awareness programs for all employees that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • maintenance and regular testing of a Business Continuity Plan that includes redundant back-up systems for all critical functions; • a physical security program that is tested regularly; • obtaining and maintaining appropriate insurance and indemnification for cybersecurity incidents; including insurance to cover cybersecurity incidents affecting third party vendors and service providers: and • a third-party risk management program for service providers, suppliers, and vendors, that provides for the assessment, monitoring and management of cybersecurity risk presented by the Company's use of such third parties.


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A.


text: Cybersecurity Governance Our Board of Directors keeps apprised of and oversees technology risk and cybersecurity of the Company, and receives updates from the Company's Information Security Officer ("ISO") on a quarterly basis. However, the Board has delegated certain specific responsibility for overseeing cybersecurity threats, among other things, to its Audit and Risk Committee. Our ISO and Chief Risk Officer provide the Audit and Risk Committee and the Company's internal Enterprise Risk Management Committee periodic reports on our cybersecurity risks and cybersecurity incidents, if any. The Board, and the Audit and Risk Committee, have appropriate expertise in planning for and dealing with cybersecurity threats. Specifically, and without limitation, David Becker, Ann Dee and Justin Christian all possess specific expertise in this area.


text: The Audit and Risk Committee and the entire Board review and approve the Company's Information Security Policy, Incident Response Policy, Third Party Risk Management Policy, Risk Appetite Statement and other relevant policies on at least an annual basis. Our ISO, who has over twenty-five years of experience in the system, network, and cybersecurity space, is responsible for implementing the Information Security Program alongside our Chief Information Officer. The ISO and Chief Information Officer both serve on the Enterprise Risk Management Committee, which is chaired by our Chief Risk Officer. They are supported by our team of technology professionals, who are responsible for information technology security monitoring and for managing the controls designed to identify, detect, protect against, respond to and recover from cybersecurity threats and cybersecurity incidents. The Company engages in a continuous risk monitoring process that seeks to identify the likelihood and impact of internal and external threats to our information security systems and data, and assesses the sufficiency of the controls in place to mitigate these threats to acceptable levels on a risk-based basis. Incidents are reported to and handled under our Incident Response Policy, which designates an incident response team and includes procedures and processes to identify, assess, respond to, mitigate and report on cybersecurity incidents.


text: We believe that cybersecurity and the protection of data and customer information in our possession, custody or control is of paramount importance to our business. The Company's information security program is designed to protect the confidentiality, integrity, and availability of our critical systems and information, including customer information. The program is comprised of policies, procedures, and programs, and is informed by and intended to align with the interagency guidance issued by banking regulators as well as the FFIEC Information Security Booklet and Cybersecurity Assessment Tool (the "Information Security Program"). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the guidance to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Cybersecurity Risk Management and Strategy Our Information Security Program is integrated into our risk management program and is aligned to the Company's business strategy and Enterprise Risk Management program. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our Information Security Program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment are conducted on at least an annual basis; • internal testing of our security controls and our response to cybersecurity incidents; • the use of external service providers, to assess, test or otherwise assist with aspects of our security controls; • training and awareness programs for all employees that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • maintenance and regular testing of a Business Continuity Plan that includes redundant back-up systems for critical functions; • a physical security program that is tested regularly; • obtaining and maintaining cyber insurance; and • a third-party risk management program for service providers, suppliers, and vendors, that provides for the assessment, monitoring and management of cybersecurity risk presented by the Company's use of such third parties, as well as contractual protections related to cybersecurity incidents affecting third party vendors and service providers.


text: The Company engages in a continuous risk monitoring process that seeks to identify the likelihood and impact of internal and external threats to our information security systems and data, and assesses the sufficiency of the controls in place to mitigate these threats to acceptable levels on a risk-based basis. Incidents are reported to and handled under our Incident Response Policy, which designates an incident response team and includes procedures and processes to identify, assess, respond to, mitigate and report on cybersecurity incidents.


text: The risk and evolving nature of cybersecurity threats, and not a previous cybersecurity incident, has led to the Company to devote significant time and resources to the development and implementation of the Information Security Program described above. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures will be fully implemented, complied with, or effective in protecting our systems and information. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, result of operations or financial condition. Please see Part I, Item 1A Risk Factors for further discussion of the risks associated with an interruption or breach in our information systems or infrastructure.


text: Cybersecurity Governance Our Board of Directors keeps apprised of and oversees technology risk and cybersecurity of the Company. The Board receives updates from the Company's Information Security Officer ("ISO") on a quarterly basis and receives cybersecurity training on at least an annual basis. While the entire Board receives reporting and receives training, the Board has delegated certain specific responsibility for overseeing cybersecurity threats, among other things, to its Risk Committee. Our ISO and Chief Risk Officer provide the Risk Committee and the Company's internal Enterprise Risk Management Committee periodic and as needed reports on our cybersecurity risks and cybersecurity incidents, if any.


text: The Risk Committee and the entire Board review and approve the Company's information security policies and certain other relevant policies on at least an annual basis. Our ISO, who has over twenty-five years of experience in the system, network, and cybersecurity space, is responsible for overseeing and managing the Information Security Program alongside our Chief Information Officer. The Chief Information Officer serves on the Enterprise Risk Management Committee, which is chaired by our Chief Risk Officer. They are supported by our team of technology professionals, who are responsible for information technology security monitoring and for managing the controls designed to identify, detect, protect against, respond to and recover from cybersecurity threats and cybersecurity incidents.


text: Management and Board Oversight Our Board oversees risk management for the Company including through its approval of the investment policy and other policies of the Company and its oversight of the Advisor. For certain risks, the Board has delegated oversight responsibilities to committees of the Board. For example, the Compensation Committee oversees and reports to the Board on the assessment and mitigation of risks associated with the Company's and the Advisor's compensation policies and practices, and the Nominating and Corporate Governance Committee assists our Board with assessing risks associated with conflicts of interest and with ESG matters. Cybersecurity risk management is integrated into this broader risk management framework. The Board has delegated to the Audit Committee oversight of management's programs and policies to identify, assess, manage, mitigate and monitor significant business risks of the Company, including privacy, information technology and cybersecurity risks.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: Information Technology and Cybersecurity Risks We have no employees and rely on the Advisor, a wholly-owned subsidiary of Franklin Templeton, to manage our day-to-day operations pursuant to the Advisory Agreement. Therefore, we rely heavily on Franklin Templeton's information systems and their program for defending against and responding to cybersecurity threats and incidents. Franklin Templeton maintains a robust cybersecurity defense program, including a dedicated cybersecurity team led by its Chief Security Officer ("CISO"). The CISO, who reports directly to the Franklin Templeton Executive Vice President, Chief Risk and Transformation Officer, has 28 years of experience in the information technology and cybersecurity field and has been at Franklin Templeton for 12 years. The CISO provides regular briefings for our senior management team on cybersecurity matters, including threats, events, and program enhancements.


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems the Advisor uses to provide services to us pursuant to the Advisory Agreement, Franklin Templeton's cybersecurity team utilizes a regularly updated cybersecurity incident response plan that was developed based on, and is periodically benchmarked to, applicable third-party cybersecurity standards and frameworks. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the response team is led by the CISO or his delegee. In addition, the Audit Committee approved a Company policy that supplements the Franklin Templeton incident response plan with respect to cybersecurity incidents that have or are expected to impact the Company, including by impacting the Advisor's ability to provide services to the Company pursuant to the Advisory Agreement. Pursuant to this policy the Advisor and Franklin Templeton are required to notify and brief Company senior management and the Audit Committee with respect to certain matters related to applicable cybersecurity incidents. The policy also designates responsibility to specified members of our senior management for Company disclosure determinations related to the incident.


text: The Audit Committee oversees, on behalf of the Board, the Company's privacy, information technology and security and cybersecurity risk exposures, including (i) the potential impact of those exposures on the Company's business, financial results, operations and reputation, (ii) the programs and steps implemented by management to monitor and mitigate any exposures, (iii) the Company's information governance and information security policies and programs, and (iv) major legislative and regulatory developments that could materially impact the Company's privacy, data security and cybersecurity risk exposure. Some members of the Audit Committee have completed certifications in cybersecurity, including one from the National Association of Corporate Directors (NACD) in Cyber-Risk Oversight. On a quarterly basis, the CISO or its delegee report to the Board or Audit Committee on information technology and cybersecurity matters, including a detailed threat assessment relating to information technology risks.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats The Franklin Templeton cybersecurity program focuses on (1) preventing and preparing for cybersecurity incidents, (2) detecting and analyzing cybersecurity incidents, and (3) containing, eradicating, recovering from and reporting cybersecurity events. The Company has a policy that supplements the Franklin Templeton cybersecurity incident response plan and addresses reporting and disclosure considerations related to a cybersecurity incident.


text: Prevention and Preparation Franklin Templeton undertakes regular internal and external security audits and vulnerability assessments to reduce the risk of a cybersecurity incident and they implement business continuity, contingency and recovery plans to mitigate the impact of an incident. As part of these efforts, Franklin Templeton periodically engages consultants (e.g., Cobalt, Crowdstrike and EY) to conduct external reviews of its vulnerabilities, including penetration testing and compromise assessments. Franklin Templeton employs best practice identity and access management including broad adoption of multifactor authentication, geo-location blocking, behavior analytics and controls aligned to a zero trust model.


text: Franklin Templeton and the Advisor recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of their prevention efforts is employee training on their data privacy and cyber security procedures. For example, all new hires receive mandatory privacy and information security training. In addition, current employees of the Advisor must complete mandatory annual cybersecurity and data trainings, which are supplemented by regular phishing and other cyber-related testing and trainings that we conduct throughout the year.


text: We recognize that third parties that provide information systems used by the Advisor to provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To mitigate third party risk, Franklin Templeton maintains a vendor code of conduct, which is designed to require third party vendors to comply with our requirements for maintenance of passwords, as well as other confidentiality, security, and privacy procedures. Third-party IT vendors are also subject to additional diligence such as questionnaires and inquiries.


text: As discussed above, to support its preparedness Franklin Templeton has an incident response plan that it regularly updates. In addition, Franklin Templeton performs regularly scheduled tabletop exercises and periodic drills at least once a year to test its incident response procedures, identify improvement opportunities and exercise team preparedness. Franklin Templeton also maintains cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity-related incidents that interrupt our network or networks of our vendors, in all cases up to specified limits and subject to certain exclusions.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications or similar technologies which are monitored by the Franklin Templeton cyber defense team, notifications from employees, borrowers or service providers, and notifications from third party information technology system providers. Franklin Templeton also has a comprehensive threat intelligence program that performs proactive analyses leveraging internal, government and third party provided intelligence to identify and mitigate risks to the firm. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to the Franklin Templeton incident response plan follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event (e.g. ransomware or personal data breach) and assessing the severity of the event and sensitivity of any compromised data.


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, the Franklin Templeton incident response team is initially focused on containing the cybersecurity incident as quickly as possible consistent with the procedures in the incident response plan. Containment procedures may include off-lining systems, including by disconnecting network cable, utilizing network-management tools to isolate the host, altering the DNS entry of impact hosts, and coordinating with service providers.


text: Once a cybersecurity incident is contained the focus shifts to remediation. Eradication and recovery activities depend on the nature of the cybersecurity incident and may include rebuilding systems and/or hosts, replacing compromised files with clean versions, validation of files or data that may have been affected, and increased network monitoring or logging to identify recurring attacks.


text: Franklin Templeton has relationships with a number of third party service providers to assist with cybersecurity containment and remediation efforts, including a forensic investigation firm, a ransomware recovery vendor, a communications firm, and various law firms.


text: Following the conclusion of an incident, the Franklin Templeton incident response team will generally reassess the effectiveness of the cybersecurity program and incident response plan, make adjustments as appropriate and report to our senior management and Audit Committee on these matters.


text: Cybersecurity Risks As of December 31, 2023, we are not aware of any material cybersecurity incidents that impacted the Company in the last three years. We and our Advisor routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachment to emails, phishing attempts, extortion or other scams; however, we have been able to prevent or sufficiently mitigate harm from such risks. Although the Advisor and Franklin Templeton, on our behalf, make efforts to maintain the security and integrity of the information technology systems the Advisor uses on our behalf, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them are subject to the risk of a security incident or disruption, and there can be no assurances regarding our security efforts and measures or those of our third party providers. See "Item 1A–Risk Factors– Our business could suffer in the event our Advisor or any other party that provides us with services essential to our operations experiences system failures or cyber-incidents or a deficiency in cybersecurity."


text: Information Technology and Cybersecurity Risks We have no employees and rely on the Advisor, a wholly-owned subsidiary of Franklin Templeton, to manage our day-to-day operations pursuant to the Advisory Agreement. Therefore, we rely heavily on Franklin Templeton's information systems and their program for defending against and responding to cybersecurity threats and incidents. Franklin Templeton maintains a robust cybersecurity defense program, including a dedicated cybersecurity team led by its Chief Security Officer ("CISO"). The CISO, who reports directly to the Franklin Templeton Executive Vice President, Chief Risk and Transformation Officer, has 30 years of experience in the information technology and cybersecurity field and has been at Franklin Templeton for 13 years. The CISO provides regular briefings for our senior management team on cybersecurity matters, including threats, events, and program enhancements.


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems the Advisor uses to provide services to us pursuant to the Advisory Agreement, Franklin Templeton's cybersecurity team utilizes a regularly updated cybersecurity incident response plan that was developed based on, and is periodically benchmarked to, applicable third-party cybersecurity standards and frameworks. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the response team is led by the CISO or his delegee. In addition, the Audit Committee approved a Company policy that supplements the Franklin Templeton incident response plan with respect to cybersecurity incidents that have impacted or are expected to impact the Company, including by impacting the Advisor's ability to provide services to the Company pursuant to the Advisory Agreement. Pursuant to this policy the Advisor and Franklin Templeton are required to notify and brief Company senior management and the Audit Committee with respect to certain matters related to applicable cybersecurity incidents. The policy also designates responsibility to specified members of our senior management for Company disclosure determinations related to the incident.


text: The Audit Committee oversees, on behalf of the Board, the Company's privacy, information technology and security and cybersecurity risk exposures, including (i) the potential impact of those exposures on the Company's business, financial results, operations and reputation, (ii) the programs and steps implemented by management to monitor and mitigate any exposures, (iii) the Company's information governance and information security policies and programs, and (iv) major legislative and regulatory developments that could materially impact the Company's privacy, data security and cybersecurity risk exposure.


text: Some members of the Audit Committee have completed certifications in cybersecurity, including one from the National Association of Corporate Directors (NACD) in Cyber-Risk Oversight. On a quarterly basis, the CISO or its delegee report to the Board or Audit Committee on information technology and cybersecurity matters, including a detailed threat assessment relating to information technology risks.


text: Prevention and Preparation Franklin Templeton undertakes regular internal and external security audits and vulnerability assessments to reduce the risk of a cybersecurity incident and they implement business continuity, contingency and recovery plans to mitigate the impact of an incident. As part of these efforts, Franklin Templeton periodically engages consultants to conduct external reviews of its vulnerabilities, including penetration testing and compromise assessments. Franklin Templeton employs identity and access management including broad adoption of multifactor authentication, geo-location blocking, behavior analytics and controls aligned to a zero trust model.


text: Franklin Templeton and the Advisor recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of their prevention efforts is employee training on their data privacy and cyber security procedures. For example, new hires receive mandatory privacy and information security training. In addition, current employees of the Advisor must complete mandatory annual cybersecurity and data trainings, which are supplemented by regular phishing and other cyber-related awareness activities and trainings that we conduct throughout the year.


text: We recognize that third parties that provide information systems used by the Advisor to provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To mitigate third party risk, Franklin Templeton requires third party vendors to comply with our confidentiality, security, and privacy requirements. Third-party IT vendors are also subject to additional diligence such as questionnaires and inquiries.


text: As discussed above, to support its preparedness Franklin Templeton has an incident response plan that it periodically updates. In addition, Franklin Templeton performs regularly scheduled tabletop exercises and periodic drills at least once a year to test its incident response procedures, identify improvement opportunities and exercise team preparedness. Franklin Templeton also maintains cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity-related incidents that interrupt our network or networks of our vendors, in all cases up to specified limits and subject to certain exclusions.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications or similar technologies which are monitored by the Franklin Templeton cyber defense team, notifications from employees, borrowers or service providers, and notifications from third party information technology system providers. Franklin Templeton also has a threat intelligence program that performs proactive analyses leveraging internal, government and third party provided intelligence to identify and mitigate risks to the firm. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to the Franklin Templeton incident response plan follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event and assessing the severity of the event..


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, the Franklin Templeton incident response team is responsible for deciding on a containment strategy to respond to the cybersecurity incident consistent with the procedures in the incident response plan.


text: Once a cybersecurity incident is contained the focus shifts to remediation. Eradication and recovery activities depend on the nature of the cybersecurity incident and may include rebuilding systems and/or hosts, replacing compromised files with clean versions or validation of files or data that may have been affected.


text: Franklin Templeton has relationships with a number of third party service providers to assist with cybersecurity containment and remediation efforts.


text: Following the conclusion of an incident, the Franklin Templeton incident response team will generally reassess the effectiveness of the cybersecurity program and incident response plan, identify potential adjustments as appropriate and report to our senior management and Audit Committee on these matters.


text: Cybersecurity Risks As of December 31, 2024, we are not aware of any instances of material cybersecurity incidents that impacted the Company in the last three years. We and our Advisor routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachment to emails, phishing attempts, extortion or other scams; however, we have been able to prevent or sufficiently mitigate harm from such risks. See "Item 1A–Risk Factors–Our business could suffer in the event our Advisor or any other party that provides us with services essential to our operations experiences system failures or cyber-incidents or a deficiency in cybersecurity."


text: Cybersecurity Risk Management and Strategy As a global company, we are regularly subject to cyberattacks and other cybersecurity incidents. In response, we have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage cybersecurity risks. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process. Our enterprise risk management team collaborates with our Information Security function, led by our Chief Information Security Officer ("CISO") and our Chief Customer and Technology Officer ("CCTO"), to gather insights for assessing, identifying and managing cybersecurity threat risks, their severity, and potential mitigations. We also are a member of an industry cybersecurity intelligence and risk sharing organization to stay abreast of changes in the cybersecurity environment.

companyName: CHIPOTLE MEXICAN GRILL INC

ticker: CMG


text: We assess Chipotle's Information Security program using an industry cybersecurity framework from the National Institute of Standards and Technology. This program includes policies, processes and procedures that help assess and identify our cybersecurity risks and inform how security measures and controls are developed, implemented and maintained. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls and impact of controls on operations.


text: We maintain internal resources to perform penetration testing designed to simulate evolving tactics and techniques of real-world threat actors, engage with industry partners and law enforcement and intelligence communities and conduct tabletop exercises and periodic risk interviews across our business. We also engage an independent third party to perform internal and external penetration testing of Chipotle's information security environment periodically and engage other third parties to periodically conduct assessments of our cybersecurity capabilities. In addition, we continue to expand training and awareness practices to mitigate risk from human error, including mandatory computer-based training and internal communications for employees. Our employees undergo cybersecurity awareness training and regular phishing awareness campaigns that are based upon and designed to emulate real-world contemporary threats. We provide prompt feedback (and, if necessary, additional training or remedial action) based on the results of such exercises.


text: Our processes also address cybersecurity risks associated with our use of third-party service providers including suppliers, software and cloud-based service providers, as well as third-party security firms used in different capacities to provide or operate some of our cybersecurity controls and technology systems. We proactively evaluate the cybersecurity risk of a third party by utilizing a repository of risk assessments, external monitoring sources, threat intelligence and predictive analytics to better inform Chipotle during contracting and vendor selection processes. Additionally, when third party risks are identified, we require those third parties to agree by contract to implement appropriate security controls. Security issues are documented and tracked, and periodic monitoring of third parties is conducted in an effort to mitigate risk. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a material cybersecurity incident (or series of related cybersecurity incidents), Chipotle has a written incident response plan outlining how to address cybersecurity events that occur. The plan sets forth the steps for coordination among various corporate functions and governance groups and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan is designed to help us coordinate actions to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to assess the need for disclosure, comply with applicable legal obligations and mitigate the impact to our brand and reputation and on impacted parties. We also maintain insurance coverage that, subject to its terms and conditions, is intended to help us cover certain costs associated with cybersecurity incidents and information system failures. In addition to our cybersecurity incident response plan, we conduct tabletop exercises to enhance our incident response preparedness. We maintain business continuity and disaster recovery plans to prepare for and respond to the potential for a disruption in the technology we rely on.


text: Chipotle (or the third parties it relies on) may not be able to fully, continuously, or effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine whether and how to implement certain security controls and it is possible that we may not implement the necessary controls if we are unable to recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate cybersecurity risks. Cybersecurity events, when detected by security tools or third parties, may not always be identified immediately or addressed in the manner intended by our cybersecurity incident response plan.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition Based on the information available as of the date of this Annual Report, we have no reason to believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, see "Risks Related to Cybersecurity, Data Privacy and IT Systems," in Item 1A, "Risk Factors" in this Annual Report.


text: Cybersecurity Governance Our cybersecurity risk management and strategy processes are led by our CISO and our CCTO. These individuals have collectively over 50 years of professional experience in various roles across multiple industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing multiple industry and regulatory compliance environments. Both individuals previously held positions similar to their current roles at other large publicly traded organizations.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors (the "Board") and management. Although cybersecurity risk oversight continues to remain a top priority for the Board, the Audit and Risk Committee of our Board has primary oversight responsibility for the Company's cybersecurity and other technology risks. The Committee regularly reviews and discusses with our CISO and our CCTO the Company's cybersecurity, privacy and data security programs, the status of projects to strengthen internal cybersecurity, results from third-party assessments, and any significant cybersecurity incidents, including recent incidents at other companies and the emerging threat landscape. The Committee also reviews with management the implementation and effectiveness of the Company's controls to monitor and mitigate cybersecurity risks. In addition, our Board receives an annual report and quarterly written updates regarding our cybersecurity program.


text: We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats, including potential unauthorized occurrences on or through both, our physical systems and electronic information systems, that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data include confidential, proprietary, and business and personal information that we collect, process and store as part of our business, including on behalf of third parties. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including: technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support; and other functions.

companyName: GLOBUS MEDICAL INC

ticker: GMED


text: As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs at least annually.


text: We have a unified and centrally-coordinated team, led by our Senior Vice President of Corporate Quality and IT, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at Globus in close coordination with senior leadership and other teams across Globus. Reporting to our Senior Vice president of Corporate Quality and IT are a number of trained information security professionals. In addition to our extensive in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying and managing cybersecurity risks.


text: Our cybersecurity risks and associated mitigations are evaluated by senior leadership, including as part of our risk assessments that are reviewed by the Audit Committee and our Board of Directors. Additional information about cybersecurity threats we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "We are subject to data privacy laws and our failure to comply with them could subject us to substantial liabilities," which should be read in conjunction with the information above.


text: The Board of Directors, which is comprised of independent directors, oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks. They receive reports regarding such risks from management, including our Senior Vice President of Corporate Quality and IT. They also oversee the response to any significant cybersecurity incidents. Our Senior Vice President of Corporate Quality and IT, who has extensive cybersecurity knowledge and skills gained from over 20 years of work experience, heads the team responsible for implementing and maintaining cybersecurity and data protection practices at Globus and reports directly to the Chief Operating Officer.


text: Risk management and strategy We have established processes designed to identify, assess and manage material risks associated with cybersecurity threats. Our information technology, networks, and infrastructure may be subject to damage, disruptions, or shutdowns due to cyber-attacks, malware, employee or third-party error or malfeasance, power outages, communication or utility failures, systems failures, natural disasters or other catastrophic events. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risks, and reputational risks.

companyName: Frontier Communications Parent, Inc.


text: Cybersecurity risk management is embedded in the annual enterprise risk management ("ERM") process, which is jointly administered by the Chief Financial Officer and head of Internal Audit and overseen by the Board of Directors, primarily through the Audit Committee. As part of the ERM process, senior management annually, or more frequently as necessary, identifies, assesses and evaluates enterprise level risks using a range of tools and services.


text: In order to manage identified cybersecurity risks, we evaluate a range of remediation options and determine the appropriate course of action for effective monitoring, mitigation and treatment. Areas that have a higher level of likelihood and potentially higher level of impact are prioritized. Periodic monitoring, self-assessment and reporting to the Audit Committee are performed by senior management to evaluate, among other things, the effectiveness of mitigation strategies in minimizing or managing identified risks. In addition to critical risk management, we work to upgrade our existing technology systems, enhance our overall security posture and provide employee training around cyber risks, which are constantly evolving.


text: Our processes also address cybersecurity risks associated with our use of third-party service providers and other external parties and circumstances. External risks to our network and information systems may arise from third parties and other parties we may not fully control. For example, we use vendors for encryption and authentication technology and cloud storage, and have adopted controls around, among other things, vendor risk assessment, access and acceptable use and backup and recovery. We engage outside providers to monitor our network and conduct periodic internal and external security testing and to assist in the ongoing evaluation and enhancement of our cyber security preparedness and protocols. We use the NIST Cybersecurity Framework to audit our cybersecurity controls.


text: As of the date of this report, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in our risk factor disclosures under the heading "We rely on network and information systems and other technology, and a disruption or failure of such networks, systems or technology as a result of cyber-attacks, malware, misappropriation of data or other malfeasance, as well as outages, accidental releases of information or similar events, may disrupt our business and materially impact our results of operations, financial condition and cash flows" in Item 1A of this Annual Report on Form 10-K.


text: Frontier's management is primarily responsible for governing and overseeing cybersecurity risks. Operational responsibility for ensuring the adequacy and effectiveness of the Company's cybersecurity risk management, control and governance processes is assigned to the SVP, Cyber Security (CISO). Our CISO has over 20 years of experience in IT, cyber security and data privacy and data management and reports directly to the EVP, Chief Data and Information Officer (CDIO). Our CDIO has over 25 years of experience, having previously held senior leadership positions in technology, IT and operations at large public companies prior to joining Frontier.


text: To assist with management oversight, the CDIO chairs a security council which supports risk management by providing input into cyber security strategy and helps prioritize monitoring, mitigation and remediation across operational groups. This security council is comprised of senior leaders from a cross-functional group of departments including Legal and Regulatory, Corporate Security, Network Engineering, Internal Audit, Finance & Accounting and Risk and IT Infrastructure. In addition, we have established processes and response teams that are responsible for monitoring and making determinations regarding the materiality of cybersecurity incidents. The members of these teams have extensive expertise in evaluating the potential impact and materiality of events in the context of Frontier's business and financial position, reputational and industry risk, and legal and regulatory environment, and there are procedures in place to escalate material incidents for consideration by the Audit Committee.


text: While material risks are generally overseen by the full Board, the Audit Committee has a key role in cybersecurity risk monitoring and oversight as set forth in its charter. In establishing Audit Committee membership, the Nominating & Corporate Governance Committee identifies directors with relevant IT, network and cyber expertise to serve on the Committee. The CDIO and CISO provide periodic reports to the Audit Committee on the Company's data privacy and information and infrastructure security programs, including cybersecurity risks. In addition, senior management reports to the Board at least annually on cybersecurity risks.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our security approach is aligned with applicable security and/or technical requirements and best practices established by National Institute of Standards and Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that our information security team uses the NIST CSF as the framework for helping us to identify, assess, and manage cybersecurity risks relevant to our business.

companyName: TKO Group Holdings, Inc.

ticker: TKO


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and is designed to share common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. We have a cross-functional team composed of senior IT, cybersecurity and compliance leadership from both TKO and Endeavor that typically meets on a monthly basis to discuss efforts to identify new or prospective risks, mitigate previously identified risks, and discuss recent cybersecurity events. This cross-functional team reports into an executive steering committee comprised of senior enterprise leadership which meets, at a minimum, quarterly.


text: We use a defense-in-depth strategy across our business applications and systems, including database encryption, encryption for laptops/desktops, endpoint-security solutions including network filtering, anti-virus, endpoint firewalls, endpoint detection/response, patch and security configuration management and monitoring through our use of a Security Information and Event Management ("SIEM") system. The SIEM is monitored by our Security Operations Center ("SOC"). Our network and applications require multi-factor authentication, and logins are monitored for unusual activity by our SOC function. The enterprise network is protected by stateful firewalls, which are also monitored via our SOC. Our dedicated cybersecurity team engages third parties to conduct periodic infrastructure, application, compliance, and security operations testing, and threats/findings are managed through our risk-register and governance processes.


text: Separately, employees are trained to promptly report any suspicious behavior or events to the Company's Core Security Incident Response team. This team includes IT, cybersecurity, compliance, and risk management team members from both TKO and Endeavor. The core team oversees the investigation and handling of all reported incidents (which incidents are tracked in real time). If the core team determines that the reported event could potentially impact personally identifiable information processed by the Company, confidential/proprietary information or cause a financial loss, the core team reports the matter to TKO's Cybersecurity Executive Steering Committee, which includes TKO's Chief Administrative Officer, General Counsels, Chief Financial Officer, Chief Accounting Officer, Chief Product & Technology Officer, Corporate Secretary and Head of Investor Relations, as well as Endeavor's Chief Financial Officer, Chief Accounting Officer, General Counsel, Chief Compliance Officer, Chief Information Officer, SVP, Internal Audit, SVP, Privacy & Cybersecurity, SVP, Cybersecurity, SVP, Head of Corporate Security and Chief Communications Officer. Reported events that may cause a financial loss are also reported to the legal department's fraud investigation team. The Cybersecurity Executive Steering Committee is charged with managing the Core Security Incident Response Team and determining whether any disclosures may be required as a result of the reported event.


text: Our cybersecurity risk management program, thus, includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; a written cybersecurity incident response plan;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;


text: cybersecurity awareness training of our employees, incident response personnel, and senior management not less often than once per calendar year;


text: phishing simulations at regular intervals (not less than quarterly) to all users of the Company's email system; and a third-party risk management process for service providers, suppliers, and vendors which connect to our IT systems or process data on our behalf. This risk management process is designed to review the cybersecurity protocols, policies and preparedness of any vendor that processes personally identifiable information for the Company or the Company's confidential or proprietary information or otherwise is connected to any Company IT infrastructure before entering an agreement with such vendor and/or at least every 18 months thereafter. Such reviews consist of reviewing SOC2 Type II reports for vendors which maintain them or, for those that don't, a review of the vendor's responses to a detailed questionnaire. Upon a review of such responses, the Company's cybersecurity team may propose contractual remediation obligations to be agreed upon by the vendor.


text: Our continually evolving cybersecurity strategies are informed by multiple threat intelligence resources, the status of ongoing remediation plans, and technical developments. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I, Item 1A. "Risk Factors – Risks Related to Our Business — Failure to protect our IT Systems and Confidential Information against breakdowns, security breaches, and other cybersecurity risks could result in financial penalties, legal liability, and/or reputational harm, which would adversely affect our business, results of operations, and financial condition."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee of the Board (the "Audit Committee") oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks, and also receives, at least annually, a detailed briefing from management on our cyber risk management program's status including all strategic initiatives. In addition, management updates the Audit Committee, as necessary, regarding potentially significant cybersecurity incidents consistent with written escalation protocols, as well as incidents with lesser impact potential. The Audit Committee members also receive presentations on cybersecurity topics from Endeavor's Chief Compliance Officer, Chief Information Officer, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. The full Board receives regular updates regarding the Audit Committee's activities.


text: Our management team, including Endeavor's Chief Compliance Officer, Chief Information Officer, SVP, Privacy & Cybersecurity, and SVP, Cybersecurity, is responsible for assessing and managing our material risks from cybersecurity threats. The Chief Information Officer is responsible for implementation and enforcement of written information security policies. The Chief Information Officer has designated leaders, including the SVP, Cybersecurity, to be responsible for overall management of the information security management program, including developing and operating within the defined global information security controls to protect our IT systems, selecting and supervising retained cybersecurity consultants, and working with Legal, Compliance, and Human Resources personnel to develop and launch appropriate information security training of our workforce. Our management team has decades of experience leading and managing cybersecurity teams as well as professional credentials in cybersecurity and data privacy. Our SVP, Privacy & Cybersecurity, leads a team of five dedicated privacy professionals in the Legal department.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Risk Assessment, Identification and Management Processes We have implemented a cybersecurity risk management strategy to assess, identify and manage material risks from cybersecurity threats. This strategy is designed to protect our systems, data, and operations from potential cyber threats and to ensure the continuity of our business operations.

companyName: Frontdoor, Inc.

ticker: FTDR


text: We conduct regular risk assessments to identify potential cybersecurity threats. These assessments involve evaluating our systems, networks and data for vulnerabilities that could be exploited by cyber threats, through, among other things, vulnerability scanning and penetration testing. Once risks are identified, we implement measures to manage and mitigate these risks. This includes updating and patching our systems, implementing security controls and monitoring our networks for suspicious activity. We have a process in place to respond to any identified threats, which includes containment, eradication and recovery measures. We also monitor and update our cybersecurity risk management strategy to respond to the evolving cyber threat landscape. This includes staying abreast of the latest cybersecurity threats and trends and updating our systems and processes accordingly.


text: Integration with Overall Risk Management. Our cybersecurity processes are integrated into our overall enterprise risk management program and business continuity processes. In this regard, we address cybersecurity risks through a comprehensive, cross-functional approach across our technology, legal, compliance, finance, and other teams aimed at preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. This integration helps ensure that the breadth of potential impacts from cybersecurity risks are considered and that our approach to managing these risks is consistent and coordinated across teams within our business. Through our enterprise risk management program, our cybersecurity risk is regularly evaluated, and we regularly report this assessment of our cybersecurity risk to management and to the audit committee of our board of directors. We also periodically review our cybersecurity risk with our entire board of directors.


text: Engaging Third Parties in Risk Management. We use a combination of internal resources and external assessors, consultants and auditors to conduct our cybersecurity risk assessments and identification. We periodically examine our cybersecurity program with these third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology (NIST), as guidelines, along with compliance with our internal cybersecurity controls. We also work with third parties to assess our incident response preparedness and to manage and track our risks.


text: Overseeing Risks Associated with Third-Party Service Providers. We have established a third-party risk management program to evaluate new and existing third-party service providers for their security controls and processes; identify cyber risks associated to the third-party service providers requiring remediation tracking; and continuously monitor the cyber risk posture of third-party service providers. Where appropriate, our contracts with third-party service providers require agreement and adherence to security and privacy requirements, including: the proper access, use, retention and deletion of data; security awareness training; security incident response and breach notification; our rights to security assessment, testing and audits; compliance with laws and industry standards; and system and services requirements. For example, we require our business process outsourcers, which are providers that support certain customer services operations and other services, to complete security awareness training and payment card industry data security standards training.


text: Risks from Cybersecurity Threats As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition; however, see Item IA. Risk Factors in Part I of this Annual Report on Form 10-K for a discussion of effects that a cybersecurity threat or incident could have on our business strategy, results of operations or financial condition. We also maintain an incident response plan to respond to any cybersecurity incident. This plan outlines the steps we will take to respond to an incident, including identifying and containing the incident, eradicating the threat, recovering our systems and communicating with relevant stakeholders.


text: Board of Directors Oversight of Cybersecurity Risk Our board of directors is responsible for oversight of our enterprise risk management program, which incorporates cybersecurity risk. The audit committee undertakes primary responsibility for assisting the board of directors in overseeing cybersecurity risk, including policies and procedures for assessing, managing and responding to cybersecurity risk. The audit committee meets with appropriate members of our management team at least quarterly—and third-party assessors, consultants and auditors as needed—to review and discuss cybersecurity risk.


text: The full board of directors receives quarterly updates from the audit committee on its oversight of cybersecurity risk and engages in further review for the full board of directors from time to time as appropriate.


text: Management's Role in Assessing and Managing Material Risks Our technology team, and particularly our information security team, are actively involved in the development and implementation of policies and tools to assess risk and identify emergent risks, with cross-functional support from enterprise risk management, legal, compliance and finance, among other teams. We have established governance structures to increase the maturity of our cybersecurity program with a governance, risk and compliance approach. This includes the identification of internal weaknesses and the mitigation of IT risks through training programs or new policies and internal controls.


text: Management is also responsible for the testing of the overall security posture and the documentation of risk management and security for regulatory examinations and for regular review of security and privacy requirements. In addition to our internal cybersecurity team, our company has retained a third-party security firm to aid in the identification, containment, eradication and recovery of systems, data or both in the event of a material security incident.


text: Risk Management Personnel. Among management, our Chief Technology Officer ("CTO") and our Chief Information Security Officer ("CISO") are responsible for leading efforts to assess and manage cybersecurity risks. Our CTO has over 20 years of experience leading technology teams and developing applications and other digital solutions for commerce, incorporating the assessment and management of cybersecurity risk, a Master's degree in Engineering Management and a Bachelor's degree in Computer Science. Our CISO has over 20 years of experience assessing and managing cybersecurity risk, including leading information security teams at complex web-based businesses, and has a Master's degree in Computer Information Systems and multiple professional, cybersecurity and certifications, including CISM, CDPSE, CIPM, CIPT, and PMP.


text: Monitoring Cybersecurity Incidents. On a daily basis, our information security team monitors, identifies and classifies potential cybersecurity events and is responsible for notifying the CTO and CISO of such events as appropriate based on risk to our organization. Our CTO and CISO are responsible for notifying executive leadership, other functional teams and our audit committee, as appropriate.


text: Reporting to the Board of Directors. Our CTO and CISO report to the audit committee at least quarterly about the detection, prevention, mitigation and remediation of cybersecurity events, including information about the latest cybersecurity threats, the status of our prevention and detection measures and the effectiveness of our mitigation and remediation efforts, as well as any other cybersecurity risk management activities and the progress of related projects. These briefings include updates on the formalized incident response plan, communications and escalation procedures. Management will apprise the board of directors of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us.


text: The Company treats cybersecurity risk seriously and is focused on maintaining and regularly updating the security of our systems, networks, technologies and data.

companyName: CHEMED CORP

ticker: CHE


text: The number and sophistication of attempts to disrupt or penetrate our systems continues to grow, specifically including the rapid increase of attempts against healthcare companies that was observed in early 2022. To combat the ever-increasing sophistication of cyberattacks, we continuously work to improve methods for detecting and preventing attacks. We have implemented policies and procedures and developed specific training for our employees, including regular updates and reminders, to help prevent and mitigate any issues that may be caused by any attacks. Further, we regularly engage independent third-party cyber experts to test for vulnerabilities in our environment. We also conduct our own internal simulations to help assess and strengthen our defenses.


text: We acknowledge that cyberattack risk may occur with our third-party technology service providers. High-profile cyberattacks have occurred at healthcare companies, credit bureaus, financial institutions, and other businesses for the purpose of acquiring the confidential information of individuals, including potential customers and patients. We take significant measures to prevent and mitigate issues caused by any such attacks, including outreach to our providers and other third-parties that we engage with, in order to ascertain any potential downstream implications of known breaches.


text: The Company has integrated our cybersecurity prevention and mitigation processes into our overall risk management system and processes. The Chief Technology Officer of Roto-Rooter and the Chief Technology Officer and Chief Information Officer of VITAS are senior executives, with decades of experience in preventing, assessing and managing cybersecurity threats in the private sector as well as government. Both Roto-Rooter and VITAS employ teams of experienced cybersecurity professionals who report to the respective Chief Technology Officer and Chief Information Officer. Both businesses have security incident response plans, pursuant to which they report on the cybersecurity status of the businesses to the Company's Chief Financial Officer and Controller and Chief Legal Officer both regularly as a matter of course, as well as in the event of any potentially material incident. Additionally, Company senior management reports to the Audit Committee on cybersecurity issues on a regular basis, multiple times a year. The Audit Committee's reports to the board after these sessions, include the discussions of the cybersecurity risk management process.


text: The reports include information on any attacks or potential breaches within the Company as well as security events at third-party providers when the breach or potential breach may affect the Company. This process allows the Company to involve both senior management and third-party service providers, including forensic analysts, other cyber experts, and outside counsel, as necessary in order to combat potential threats and help ensure appropriate and timely responses to threats, and mitigation and remediation of any incidents.


text: To date, the increase in cyberattacks has not resulted in any material disruption of our operations or material harm to our customers or patients. However, while we have significant internal resources, policies and procedures designed to prevent or limit the effect of the possible failure, interruption or security breach of our information systems, there can be no assurance that any such failure, interruption or security breach will not occur in the future, or if they do occur, that they will be adequately addressed. Please also reference additional disclosures about cybersecurity in Item 1A Risk Factors, under both Roto-Rooter and VITAS sections.