text: Our board of directors oversees consideration of strategic risks to the Company as well as management's actions to address and mitigate those risks and delegate oversight of specific risk topics to relevant board committees. The Company's CISO, Chief Information Officer ("CIO"), Chief Risk and Privacy Officer, General Counsel, Chief Financial Officer ("CFO"), Chief Executive Officer ("CEO"), and other officers review the Company's cybersecurity metrics on access controls, asset management, response and recovery activities, training and awareness programs, cybersecurity threats and certain incident information quarterly, and on an ad hoc basis when necessary. The Company's Chief Risk and Privacy Officer, CISO, Vice President of Internal Audit and certain members of this management team and select members from their teams convene monthly to manage cybersecurity and privacy governance. The Chief Risk and Privacy Officer holds similar quarterly reviews with the Audit Committee Chair of the Company's Board of Directors, each committee chair, and other directors including the CEO, CFO, and General Counsel. During these reviews, topics include: • implementation and third-party evaluation of the Company's cybersecurity program, including applicable policies, procedures, governance, and adopted risk management framework; • the impact of cybersecurity and privacy risks on the Company's services, employees, customers, suppliers, vendors and the staffing industry; and • information on global regulatory changes and best practices. In addition to the reports submitted quarterly by the Company's Chief Risk and Privacy Officer and CISO, the Vice President of Internal Audit independently assesses the Company's risk management process and separately reports on the effectiveness of the Company's risk identification, prioritization, and mitigation processes to the Audit Committee. All board members are kept apprised of its committees' risk oversight activities through reports from the committee chairs presented at regular Board meetings. The Company utilizes a multi-layered approach to prevent and detect cyber threats and has standard operating procedures relating to the identification, incident response and notification and management escalations for security incidents. In line with those procedures, the Company activates an emergency management team ("EMT"), empowered to make decisions, and respond to critical events including cyber incident mitigation and remediation activities. EMT members for information security incidents would include the CISO, CIO, and Chief Risk and Privacy Officer, additional member from the information technology and ERM teams as well as representation from the General Counsel Office, Finance, Communications and Business Operations as appropriate. While active, the EMT provides regular reports to the CEO, General Counsel and other members of the senior leadership team.


text: The Company's Chief Information Security Officer is responsible for the assessment and management of material risks related to cybersecurity. Our CISO has over 20 years of experience in information security and security engineering at various technology and staffing companies. The CISO reports directly to the CIO, who has over 30 years of experience serving as Chief Information Officer, Director of IT, and other roles in corporate information technology at staffing and technology companies. In addition, the Company's Management Team and Cybersecurity and Privacy Governance Team is composed of individuals with collective decades of experience in information technology, data protection, threat response, emergency management, business continuity, and disaster recovery.

companyName: KELLY SERVICES INC

ticker: KELYA

secItem: Item 1C


text: Risk Management and Strategy We assess, identify and manage cybersecurity risks through a structured process. We rely on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to guide our approach; covering risk identification, analysis, prioritization and treatment. We continuously monitor and mitigate identified risks, particularly those deemed significant to the Company, including, but not limited to: operational risk (i.e., disruption of business operations); intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk, which are tracked through our enterprise risk management program.

companyName: KENNAMETAL INC

ticker: KMT


text: We closely oversee risks associated with using third-party service providers. This involves evaluating their adherence to our security requirements, conducting technical assessments, monitoring their operational performance and establishing incident reporting protocols when our information is impacted by cyber incidents.


text: Despite our efforts, we acknowledge the potential impact of cyber threats on our operations and business. While the Company has not experienced any significant risks from cyber threats to date, we recognize the potential consequences, including operational disruptions, legal costs, damage to our reputation and financial impacts. We remain vigilant and proactive in managing these risks. We deploy state-of-the-art technologies and services to help us identify and respond to security incidents, manage a 24/7 Security Operations Center and regularly test our preparedness for cyber incidents. These efforts enable us to effectively recognize and respond to low-impact incidents, avoiding their escalation to more problematic situations.


text: The Board of Directors of the Company maintains oversight of cybersecurity risks, ensuring the effectiveness of our risk management processes. The Audit Committee is specifically tasked with monitoring cybersecurity risks, evaluating our approach to cybersecurity, assessing emerging threats and ensuring appropriate measures are in place to mitigate risks.


text: Management, led by the Chief Information Security Officer (the "CISO"), plays a crucial role in assessing and managing cybersecurity risks. The CISO holds a Master of Science in Information Security and Assurance along with other technical certifications, has over 20 years of experience in cybersecurity and has extensive experience managing cybersecurity programs in multinational manufacturing companies. The IT Risk Management Committee, under guidance of the CISO, oversees the assessment and mitigation of identified risk. Regular reporting mechanisms keep the Board of Directors of the Company informed about our cybersecurity posture and emerging risks; enabling informed decision-making regarding cybersecurity strategy and resource allocation.


text: Risk Management and Strategy. We assess, identify and manage cybersecurity risks through a structured process. We rely on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to guide our approach; covering risk identification, analysis, prioritization and treatment. We continuously monitor and mitigate identified risks, particularly those deemed significant to the Company, including, but not limited to: operational risk (i.e., disruption of business operations); intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk, which are tracked through our enterprise risk management program.


text: Governance. The Board of Directors of the Company maintains oversight of cybersecurity risks, ensuring the effectiveness of our risk management processes. The Audit Committee is specifically tasked with monitoring cybersecurity risks, evaluating our approach to cybersecurity, assessing emerging threats and ensuring appropriate measures are in place to mitigate risks.


text: Risk Management and Strategy The Company's cybersecurity risk management program is integrated into the overall risk management framework, including risk identification, assessment, and mitigation across all business areas. We have collaborated with external consultants and built a cybersecurity program designed to protect and safeguard the integrity of our information systems, which aligns with industry best practices and regulatory requirements. Our cybersecurity program includes systems and processes for assessing, identifying, and managing material risks from cybersecurity threats and include maintenance and monitoring of information security policies aligned with information technology controls, information systems configuration management and infrastructure security systems. We also have implemented processes to oversee and identify such risks from cybersecurity threats associated with the use of third-party service providers. We conduct periodic testing of these controls and systems, including vulnerability scanning and penetration testing. We strive to foster a shared responsibility for the Company's cybersecurity with all of our employees, conducting periodic phishing simulation campaigns and providing regular, mandatory cybersecurity training. Additionally, we maintain cyber insurance coverage, including protection against social engineering fraud, to further mitigate potential financial losses from cybersecurity incidents.

companyName: KEWAUNEE SCIENTIFIC CORP /DE/

ticker: KEQU


text: We currently do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial conditions. While we do not believe that any such risks have yet to materially affect the Company, the Company cannot guarantee that its ongoing and robust approach towards cybersecurity will be able to prevent all cybersecurity incidents that could have a material effect on the Company in the future. See Item 1A, Risk Factors, for more information on our cybersecurity-related risks.


text: On behalf of the Board of Directors, the Audit Committee provides oversight of the Company's management of cybersecurity risk. They periodically review and discuss with management, including the Company's Vice President of Information Technology and Engineering, the Company's significant financial risk exposures for matters related to cybersecurity risk, including the steps management has taken to monitor and manage such exposures. The Board of Directors also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: The Company's Vice President of Information Technology and Engineering leads the overall cybersecurity strategy and risk management program. This includes overseeing risk assessments, developing security policies and procedures, and managing the IT security team. See Item 10, Directors, Executive Officers and Corporate Governance, for more detail on his education and experience. Senior executives, including the Company's CEO and CFO, integrate cybersecurity risks into the overall business strategy and financial planning.


text: Risk Management and Strategy We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats. Our efforts are designed to maintain the confidentiality, integrity, and availability of our information and operational technology systems and the data stored on those systems. The program includes: • periodic risk assessments to identify and assess cybersecurity risks and vulnerabilities in our information technology systems; • security event monitoring, management, and incident response; • third party engagements to perform periodic penetration testing and reviews of program maturity based on the National Institute of Standards and Technology ("NIST") cybersecurity framework; • reviews by our internal audit team of the effectiveness of information technology-related internal controls; • cybersecurity risk assessments of our third-party vendors; and • employee training, including regular phishing simulations. The program is continually adapting to the evolving threat landscape and technology developments.

companyName: KIMBERLY CLARK CORP

ticker: KMB


text: Cybersecurity risk management is included within our overall enterprise risk management program which is overseen by our Global Risk Oversight Committee ("GROC"). The GROC is composed of executive officers and other senior leaders and coordinates with other risk assurance functions, including internal audit and compliance. The GROC receives regular briefings concerning cybersecurity risks and risk management processes.


text: Additional information on cybersecurity risks we face is discussed in Item 1A, "Risk Factors," which should be read in conjunction with the information in this section.


text: Internal Cybersecurity Team Our Chief Information Security Officer ("CISO") oversees a team with extensive cybersecurity knowledge and experience. The team is responsible for: • leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes; • incident response and operational activities, including identifying and initiating updates to systems which require patching, vulnerability management strategy, red teaming, network security configurations and security architecture;


text: KIMBERLY-CLARK CORPORATION - 2023 Annual Report • oversight of third parties engaged to assist in our cybersecurity risk management, along with third parties' vendors; and • legal and regulatory compliance.


text: Our CISO reports to our Chief Digital and Technology Officer ("CDTO"), an executive officer, who provides management of cybersecurity risks, reviews operational metrics and performs other relevant activities related to the cybersecurity function.


text: Security Policy and Requirements As part of our overall risk management program, we have adopted our Information Security Policy which details the overall risk-based framework and governance for the management and security of our information technology assets and information. The policy applies to everyone who accesses our data or information resources and all of our information systems and resources, including third parties we engage. Our program aligns with the NIST cybersecurity framework.


text: Material Cyber Risks, Threats and Incidents We actively monitor the evolving cybersecurity and geopolitical landscapes that could result in new or increased cybersecurity threat including geopolitical events such as the Russia invasion of Ukraine in March 2022.


text: As a global company serving consumers in more than 175 countries and territories, we routinely experience a wide variety of cybersecurity incidents. However, we have not experienced a cybersecurity incident that has materially affected or is reasonably likely to materially affect our business strategy, results of operation or financial condition. For a more detailed discussion of the risks we face, see Item 1A, "Risk Factors."


text: Incident Response We have adopted a cybersecurity incident response plan that is designed to provide a framework across all functions for a coordinated identification and response to security incidents. The plan specifies the process for identifying, validating, classifying, documenting, and responding to cybersecurity events as well as determining whether reporting of an event is appropriate under regulatory standards. The plan also includes a materiality assessment framework that sets forth procedures to support our assessment of whether a security incident is "material" under the federal securities laws. Internal reporting and escalation protocols are in place to ensure the involvement of the CISO, other senior leaders, and the Audit Committee, as appropriate. Under the plan, we regularly conduct tabletop exercises to test our preparedness and our incident response process, and we provide ongoing training.


text: Our Board of Directors has delegated to the Audit Committee oversight responsibility of our risk management program, including cybersecurity, business continuity, IT operational resilience, and data privacy. The Audit Committee receives quarterly reports from our CDTO and our CISO covering cybersecurity risks, strategic programs for managing cybersecurity risk, emerging trends and operational and policy compliance metrics.


text: At the management level, our cybersecurity program is led by our CDTO and our CISO. Our CDTO has served in various information technology roles for over 26 years, including as Chief Digital and Technology Officer of Kimberly-Clark and as Executive Vice President and Chief Digital Officer of Toyota Motors North America, Inc. Our CISO has served as a chief information security officer or equivalent role at large public and private companies for over 16 years. Our CISO also has several information technology-related certifications, including the Certified Information Systems Security Professional ("CISSP") certification. Our CISO reports to our CDTO, who in turn regularly reports to our Chairman of the Board and Chief Executive Officer. We have protocols by which certain cybersecurity incidents are reported promptly to the Chairman of the Board and Chief Executive Officer, or the Audit Committee, as appropriate.


text: Risk Management and Strategy We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats. Our efforts are designed to maintain the confidentiality, integrity, and availability of our information and operational technology systems and the data stored on those systems. The program includes: • periodic risk assessments to identify and assess cybersecurity risks and vulnerabilities in our information technology systems; • security event monitoring, management, and incident response; • deployment of best in-class solutions to enhance our security posture; • penetration testing performed by a dedicated specialized team that is supplemented with periodic third-party engagements; • periodic third-party reviews of program maturity are conducted based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework; • reviews by our internal audit team of the effectiveness of information technology-related internal controls; • cybersecurity risk assessments of our third-party vendors; and • employee training, including regular phishing simulations. The program is continually adapting to the evolving threat landscape and technology developments.


text: KIMBERLY-CLARK CORPORATION - 2024 Annual Report Cybersecurity risk management is included within our overall enterprise risk management program which is overseen by our Global Risk Oversight Committee ("GROC"). The GROC is composed of executive officers and other senior leaders and coordinates with other risk assurance functions, including internal audit and compliance. The GROC receives regular briefings concerning cybersecurity risks and risk management processes.


text: Internal Cybersecurity Team Our interim Chief Information Security Officer ("CISO") oversees a team with extensive cybersecurity knowledge and experience. The team is responsible for: • leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes; • incident response and operational activities, including identifying and initiating updates to systems which require patching, vulnerability management strategy, red teaming, network security configurations and security architecture; • oversight of third parties engaged to assist in our cybersecurity risk management, along with third parties' vendors; and • legal and regulatory compliance.


text: Our interim CISO reports to our Chief Digital and Technology Officer ("CDTO"), an executive officer, who provides management of cybersecurity risks, reviews operational metrics and performs other relevant activities related to the cybersecurity function.


text: Material Cyber Risks, Threats and Incidents We actively monitor the evolving cybersecurity and geopolitical landscapes that could result in new or increased cybersecurity threat including geopolitical events such as the war in Ukraine.


text: At the management level, our cybersecurity program is led by our CDTO and our CISO. Our CDTO has served in various information technology roles for over 27 years, including as Chief Digital and Technology Officer of Kimberly-Clark and as Executive Vice President and Chief Digital Officer of Toyota Motors North America, Inc. Our interim CISO has served in various information technology roles for over 20 years. Our interim CISO also has several information technology-related certifications, including the Certified Information Systems Security Professional ("CISSP") certification. Our interim CISO reports to our CDTO, who in turn regularly reports to our Chairman of the Board and Chief Executive Officer. We have protocols by which certain cybersecurity incidents are reported promptly to the Chairman of the Board and Chief Executive Officer, or the Audit Committee, as appropriate.


text: Risk Management and Strategy The Company maintains policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and has integrated these processes into the overall risk management processes. The Company has programs in place intended to address and mitigate the cybersecurity risks that could adversely impact customers and/or reputation and lead to financial losses from remediation actions, loss of business, production downtimes and operational delays. These programs include regular monitoring of outside threats, continuous updating of software to mitigate risk, education of employees to the risks of external threats, a simplification of infrastructure to minimize servers and migration of business-critical systems, including the Company's ERP system, to Tier-1 cloud service providers.

companyName: KOSS CORP

ticker: KOSS


text: Annual vulnerability assessments and penetration testing, as well as periodic web application scanning, is performed by third party service providers as directed by the Company's Managed Service Provider ("MSP"). The results of these tests are shared with the CFO by the MSP. We have processes in place to evaluate the potential risks from cybersecurity threats associated with our use of third-party service providers that have access to our data, including a review process for such providers' cybersecurity practices, risk assessments, contractual requirement and system monitoring. The Company also recently partnered with a breach protection platform to provide security and phishing training to its employees.


text: The Company has not been impacted by any previous cybersecurity incidents that would materially affect business operations or financial conditions.


text: The Company's MSP is responsible for identifying and assessing risks on an ongoing basis to ensure that the Company's policies and procedures are functioning as designed to protect the Company's information systems from potential cybersecurity threats. Management is provided regular updates on the Company's cybersecurity programs and material cybersecurity risk and mitigation strategies, along with any necessary enhancements to those programs. Cybersecurity policies and processes are reviewed annually with the Board of Directors, which serves in an oversight role as a whole. In addition, the Audit Committee and the Board consider risk-related matters on an ongoing basis in connection with deliberations regarding specific transactions and issues and would be notified immediately of any cybersecurity incidents.


text: Risk Management and Strategy The Company maintains policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and has integrated these processes into the overall risk management processes. The Company has programs in place intended to address and mitigate the cybersecurity risks that could adversely impact customers and/or reputation and lead to financial losses from remediation actions, loss of business, production downtimes and operational delays. These programs include regular monitoring of outside threats, continuous updating of software to mitigate risk, implementation of a formal policy related to employees that access corporate systems from personal devices, a simplification of infrastructure to minimize servers and migration of business-critical systems, including the Company's ERP system, to Tier-1 cloud service providers. Enhancements have also been made to endpoint protection and remote access protocols, including enhanced encryption, two-factor authentication (2FA) and real-time threat monitoring.


text: Annual vulnerability assessments and penetration testing, as well as periodic web application and internal network scanning, are performed by third party service providers as directed by the Company's Managed Service Provider ("MSP"). The results of these tests are shared with the CFO by the MSP. We have processes in place to evaluate the potential risks from cybersecurity threats associated with our use of third-party service providers that have access to our data, including a review process for such providers' cybersecurity practices, risk assessments, contractual requirement and system monitoring. The Company also partners with a breach protection platform to provide ongoing, self-guided cybersecurity training to its employees to reduce risk from phishing, social engineering and password-related attacks.


text: The Company has not been impacted by any previous cybersecurity incidents that would materially affect business operations, customer relationships or financial conditions.


text: Cybersecurity remains a critical component of corporate governance at the Company. The Company's MSP is responsible for identifying and assessing risks on an ongoing basis to ensure that the Company's policies and procedures are functioning as designed to protect the Company's information systems from potential cybersecurity threats. Management is provided regular updates on the Company's cybersecurity programs, training metrics, system health status and material cybersecurity risk and mitigation strategies, along with any necessary enhancements to those programs. Cybersecurity policies and processes are reviewed annually with the Board of Directors, which serves in an oversight role as a whole. In addition, the Audit Committee and the Board consider risk-related matters on an ongoing basis in connection with deliberations regarding specific transactions and issues and would be notified immediately of any cybersecurity incidents.


text: Cybersecurity Risk Management and Strategy We rely on information systems and the data stored on them to conduct our operations. We have adopted and maintain a cybersecurity risk management program, as a subset of our broader enterprise risk management program, which is designed in accordance with our risk profile and business. Our cybersecurity risk management program has been informed by industry standards, including the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF").

companyName: KULICKE & SOFFA INDUSTRIES INC

ticker: KLIC


text: Our cybersecurity risk management program incorporates multiple components, including, but not limited to, policies, guidelines, procedures, infrastructure, and systems that are designed to protect the confidentiality, integrity and availability of our critical systems and information.


text: Elements of our cybersecurity risk management process include, but are not limited to, the following: • Annual cybersecurity risk assessments of critical infrastructure and systems; • Annual vulnerability scans and penetration testing; • Mandatory, bi-annual cybersecurity awareness training for all employees, including phishing exercises; and • An overarching written information security policy and written cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We leverage IT service providers to perform penetration testing and support our cybersecurity awareness training program. We oversee cybersecurity risks related to third-party IT cloud service providers who have access to our systems and data. We require certain IT cloud service providers to complete cloud-based cybersecurity assessments.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced cybersecurity threats and other security incidents that have affected our information or systems. We have experienced, and expect to continue to be subject to, cybersecurity threats and incidents, ranging from employee error or misuse to individual attempts to gain unauthorized access to information systems, to sophisticated and targeted measures known as advanced persistent threats, none of which have been material to the Company to date.


text: For additional information on certain risks associated with cybersecurity, including with respect to prior cybersecurity incidents, please refer to "We may be subject to disruptions or failures in our information technology systems and network infrastructures that could have a material adverse effect on us" in Item 1A: Risk Factors.


text: Cybersecurity Governance Our Board of Directors (the "Board") has delegated responsibility for enterprise risk management, including cybersecurity risk oversight, to our Audit Committee (the "Committee"). The Committee receives quarterly information security updates from our Chief Financial Officer and Vice President of Information Technology ("VP of IT"). The Committee in turn reports to the full Board regarding its activities, including those related to cybersecurity, on at least a bi-annual basis.


text: The VP of IT has twenty seven years of experience in information technology, fifteen of which have involved IT leadership for various organizations. Our Director, IT Governance and Security (the "Director, IT") reports to our VP of IT and is responsible for the day-to-day management of our cybersecurity risk management program. The Director, IT has eighteen years of experience in information technology. The Director, IT receives support from our operational team which comprises cybersecurity, IT, controllership, and legal professionals who regularly review cybersecurity matters and evaluate emerging threats, as well as act as first responders to triage any cybersecurity incidents. In the event of a cybersecurity incident, the Committee and Board receive updates from this team on an ad-hoc basis, if appropriate, under our tiered escalation support framework.


text: Cybersecurity Risk Management and Strategy We rely on information systems and the data stored on them to conduct our operations. We have adopted and maintain a cybersecurity risk management program, as a subset of our broader enterprise risk management program, which is designed in accordance with our risk profile and business. Our cybersecurity practices are aligned with standard industry frameworks such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, International Organization for Standardization (ISO) 27001, Center for Internet Security Critical Security Controls and other industry standards.


text: Cybersecurity Governance Our Board of Directors (the "Board") has delegated responsibility for enterprise risk management, including cybersecurity risk oversight, to our Audit Committee (the "Committee"). The Committee receives quarterly information security updates from our Chief Financial Officer and Senior Director of Governance & Information Security (the "Senior Director, GIS"). The Committee in turn reports to the full Board regarding its activities, including those related to cybersecurity, on at least a bi-annual basis.


text: The Senior Director, GIS, who has been a head of information security for close to 15 years and has more than 27 years of overall experience in IT and cyber security industry, holds a Bachelor of Science in Information Technology from Bina Nusantara University and Master of Business Administration from University of Liverpool.


text: He receives support from our operational team which comprises cybersecurity, IT, controllership, and legal professionals who regularly review cybersecurity matters and evaluate emerging threats, as well as act as first responders to triage any cybersecurity incidents. In the event of a cybersecurity incident, the Committee and Board receive updates from this team on an ad-hoc basis, if appropriate, under our tiered escalation support framework.


text: Risk Management and Strategy The Company has developed an information security program to address risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. A risk assessment is conducted annually. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Specific controls that are used to some extent by the Company include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.

companyName: LA-Z-BOY INC

ticker: LZB


text: Third-party security firms are used by the Company in different capacities to provide or operate some of these controls and technology systems. Third parties are also used to conduct assessments, such as vulnerability scans and penetration testing of the Company and its systems. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services.


text: The Company has a written incident response plan ("IRP") and conducts tabletop exercises to enhance incident response preparedness. Business continuity and disaster recovery plans are used to prepare for the potential for a disruption in technology we rely on. The Company is a member of an industry cybersecurity intelligence and risk sharing organization. Certain employees, including those with access to Company-provided e-mail accounts, undergo security awareness training when hired and annually.


text: The Company has an enterprise risk management committee comprised of key business and functional leaders to address enterprise risks, and cybersecurity is a risk category addressed by that group. In addition to assessing major risks, management identifies and monitors such risks. At least annually, the Company's executive leadership reviews with the Board of Directors the major risks identified in the enterprise risk management process, as well as the steps identified to mitigate such risks. Each of the business and functional leaders responsible for the management of these identified risks also regularly discuss with the Board changes in assessment of these risks and mitigation plans.


text: The Company (or third parties it relies on) may not be able to fully, continuously, and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: The Company is not aware of any cybersecurity threat or any material cybersecurity incident to date, including as a result of any previous cybersecurity incidents, that has materially affected or is reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Additionally, in Item 1A Risk Factors under the heading of "Operational Risk Factors," forward-looking cybersecurity threats that could have a material impact on the Company are discussed. Those sections of Item 1A should be read in conjunction with this Item 1C.


text: The Chief Information Officer ("CIO") is the management position with primary oversight responsibility for the team responsible for the development, operation, and maintenance of our information security program. Pursuant to the Company's written IRP, the CIO is a member of the executive incident response team and severity classifications in the IRP are used to escalate matters to the executive incident response team. The CIO has more than 20 years of comprehensive IT experience across a breadth of technologies. The CIO is also a member of the Company's executive leadership team and meets regularly with the CEO, CFO and other members of the executive leadership team. The CIO reports directly to the Board, at least twice a year, on cybersecurity risks and strategy and attends Board meetings to be available to discuss cybersecurity matters with the Board. Oversight of the information security program at the Board level sits with the Audit Committee. The CIO reports to the Audit Committee on risks and internal controls related to cybersecurity and information technology and systems at least annually and attends quarterly Committee meetings to be available to discuss such matters with the Audit Committee.


text: Risk Management and Strategy The Company has developed an information security program to address risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. A risk assessment is conducted annually. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on the Company's operations and others. Specific controls that are used to some extent by the Company include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.


text: We incorporate third-party expertise in various aspects of our cybersecurity program. One or more third-party security firms are used by the Company in different capacities to provide or operate some of these controls and technology systems. Third parties are also used to conduct assessments, such as vulnerability scans and penetration testing of the Company and its systems. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services.


text: The Company has a written incident response plan ("IRP") and conducts annual tabletop exercises to enhance incident response preparedness. Business continuity and disaster recovery plans are used to prepare for the potential for a disruption in the technology we rely on. The Company is a member of an industry cybersecurity intelligence and risk sharing organization. Certain employees, including those with access to Company-provided e-mail accounts, undergo security awareness training when hired and at least annually thereafter.


text: The Company has an enterprise risk management committee comprised of key business and functional leaders to address enterprise risks, and cybersecurity is a risk category addressed by that group. In addition to assessing major risks, management identifies and monitors such risks. At least annually, the Company's executive leadership reviews with the Board of Directors the major risks identified in the enterprise risk management process, as well as the steps identified to mitigate such risks. Each of the business and functional leaders responsible for the management of these identified risks also regularly discusses with the Board changes in assessment of these risks and mitigation plans.


text: The Chief Information Officer ("CIO") is the management position with primary oversight responsibility for the team responsible for the development, operation, and maintenance of our information security program. Pursuant to the Company's written IRP, the CIO is a member of the executive incident response team and severity classifications in the IRP are used to escalate matters to the executive incident response team. The CIO has more than 20 years of comprehensive IT experience across a breadth of technologies. The CIO is also a member of the Company's executive leadership team and meets regularly with the CEO, CFO, and other members of the executive leadership team. The CIO reports directly to the Board, at least twice a year, on cybersecurity risks and strategy and attends Board meetings to be available to discuss cybersecurity matters with the Board. Oversight of the information security program at the Board level sits with the Audit Committee. The CIO reports to the Audit Committee on risks and internal controls related to cybersecurity and information technology and systems at least annually and attends quarterly Committee meetings to be available to discuss such matters with the Audit Committee.


text: RISK MANAGEMENT AND STRATEGY We have processes to identify, assess, monitor, and manage material risks related to information technology, including cybersecurity threats, vulnerability management, incident management, data protection and retention, and fraud prevention. Our Enterprise Risk Management process evaluates and mitigates cybersecurity risks in alignment with our business objectives and operational needs. We periodically engage third-party security firms and consultants to oversee and identify cybersecurity risks; the results of these assessments are reported to our Audit Committee.

companyName: MARZETTI CO

ticker: MZTI


text: Our service providers, and third-party hardware or software applications on our networks and company-issued devices, may pose cybersecurity risks. As a result, we assess these parties for cybersecurity risks using information supplied by our counterparty and/or third parties. Internal or external audits are conducted based upon the level of risk presented. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways.


text: As part of the cybersecurity program, our information systems are monitored by automated tools and the Information Technology team. We have adopted an Incident Response Policy, which outlines the procedures we believe are necessary to identify, investigate, contain, communicate, respond, remediate and recover from a security incident. This Incident Response Policy is overseen by our Vice President of Infrastructure and Security ("VP Infrastructure") along with the Incident Response team, which may consist of members from legal, human resources, finance or other functions, if necessary. The Incident Response Policy provides organizational and operational structure, processes, and procedures to our personnel so that employees can respond to incidents that may affect the function and security of our IT assets, information resources, and business operations. We conduct periodic information security awareness training for employees and provide related educational materials.


text: While we have been subject to cyber attacks, the expenses (including penalties and settlements, of which there were none) related to such incidents were immaterial, and the risks related thereto have not been and are not reasonably likely to be material to our business strategy, results of operations or financial condition. Any significant disruption to our ability to transact business could adversely affect our business performance as well as our reputation. We describe whether and how risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in Item 1A Risk Factors – "Risks Related to Cybersecurity and Information Technology," which is incorporated by reference herein.


text: Our Audit Committee of the Board of Directors is responsible for oversight of risks from cybersecurity threats. Our Audit Committee receives quarterly reports from our Enterprise Risk Management Committee ("ERM Committee"), as well as directly from our Chief Information Officer ("CIO") or VP Infrastructure, periodically, as appropriate. These reports cover various cybersecurity matters, including risk assessments, risk prevention and mitigation activities, and incident reports along with remediating actions, areas of emerging risks, industry trends, and other areas of importance. Furthermore, our Audit Committee oversees our annual enterprise risk assessment. This assessment encompasses key risks associated with security, technology, and cybersecurity threats in the same manner as other key risks.


text: Our cybersecurity risk management processes are led by our CIO and our VP Infrastructure. Our CIO has served our company in that capacity since 2018 and held CIO or other IT and cybersecurity leadership roles at other companies for more than 10 years prior to that. He has a master's degree in computer systems from the Naval Postgraduate School. Our VP Infrastructure, who is responsible for our information technology infrastructure and our information security strategy and operations, has more than 30 years of experience in information technology, serving in senior IT leadership roles with responsibility for cybersecurity at our company since 2007. His IT expertise was established prior to that through education and work experience in a variety of technical positions in the consumer goods, health care, and aerospace industries. They are supported by a team of skilled information security professionals within our Information Technology function. This team provides periodic updates to our ERM Committee, composed of our Chief Executive Officer, Chief Financial Officer, General Counsel, and other members of our senior leadership.


text: RISK MANAGEMENT AND STRATEGY We have processes to identify, assess, monitor, and manage material risks related to information technology, including, but not limited to: cybersecurity threats, vulnerability management, incident management, data protection and retention, recoverability, and fraud prevention. Our Enterprise Risk Management process evaluates and mitigates cybersecurity risks in alignment with our business objectives and operational needs. We periodically engage third-party security firms and consultants to oversee and identify cybersecurity risks; the results of these assessments are reported to our Audit Committee.


text: Our service providers, and third-party hardware or software applications on our networks, may pose cybersecurity risks. As a result, we assess these parties for cybersecurity risks using information supplied by our counterparty and/or third parties. Internal or external audits are conducted based upon the level of risk presented. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways.


text: As part of the cybersecurity program, our information systems are monitored by automated tools and the Information Technology team. We have adopted an Incident Response Policy, which outlines the procedures we believe are necessary to identify, investigate, contain, communicate, respond, remediate and recover from a security incident. This Incident Response Policy is overseen by our Vice President of Infrastructure and Security ("VP Infrastructure") along with the Incident Response team, which may consist of members from legal, human resources, finance or other functions, if necessary. The Incident Response Policy provides organizational and operational structure, processes, and procedures to our personnel so employees can respond to incidents that may affect the function and security of our IT assets, information resources, and business operations. We conduct periodic information security awareness training for employees and provide related educational materials.


text: While we have been subject to cyber incidents, the expenses (including penalties and legal settlements, of which there were none) related to such incidents were immaterial. The risks related thereto have not been and are not reasonably likely to be material to our business strategy, results of operations or financial condition. Any significant disruption to our ability to transact business could adversely affect our business performance as well as our reputation. We describe whether and how risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in Item 1A Risk Factors – "Risks Related to Cybersecurity and Information Technology," which is incorporated by reference herein.


text: RISK MANAGEMENT AND STRATEGY Processes for Assessing, Identifying, and Managing Cybersecurity Risks The Company has established processes to assess, identify, and manage material risks arising from cybersecurity threats (as defined in Item 106(a) of Regulation S-K). These processes are integrated into the Company's' overall risk management system. Specifically: • The addition of an experienced Chief Information Security Officer ("CISO") with over 25 years of experience to lead the IT Cybersecurity and Compliance team. • Yearly risk assessment designed to help identify material cybersecurity risks to our information systems (as defined in Item 106(a) of Regulation S-K) and data. • A security incident response team that is responsible for managing our cybersecurity risk, security controls, response, and reporting cybersecurity incidents (as defined in Item 106(a) of Regulation S-K). • A cyber and data security incident response plan with policies and procedures for identifying, managing, and recovering from cybersecurity incidents, including escalating tiers of notification and reporting depending on an incident's nature and severity. • The use of third-party service providers, where appropriate, to manage, assess, test, and assist with aspects of our security controls, such as:

companyName: LEE ENTERPRISES, Inc

ticker: LEE


text: 24/7 Security Operations Center Managed Services ("SOC") to monitor our cyber environment, correlate logs from all technology assets to identify potential signs of compromise and perform threat hunt exercises. Enterprise-grade email security system managed services. Perform penetration tests, vulnerability assessments, and vulnerability scans of our customer-facing sites, among others.


text: Prevention of denial-of-service attacks • Cybersecurity insurance designed to reduce the risk of loss resulting from cybersecurity incidents. • Policies and procedures related to cybersecurity matters, including but not limited to Acceptable Standards of Use of Technology Systems, Confidential/Sensitive Information and Credit Card Handling Policy, encryption standards, antivirus protection, wireless and remote access, multi-factor authentication, access and change control, and physical security. • Employee cybersecurity awareness by performing ongoing phishing exercises, and mandatory privacy and cybersecurity training (including spear phishing and other awareness training) for employees.


text: Material Effects of Cybersecurity Threats On February 3, 2025, we experienced a systems outage caused by a cybersecurity attack by threat actors who unlawfully accessed our network, encrypted critical applications, and exfiltrated certain files (herein defined as the "Cyber Incident"). Upon discovery, we promptly activated our incident response plan, engaging both internal teams and third-party cybersecurity experts.


text: During the year ended September 28, 2025, we incurred $10.5 million loss of cash flows related to the Cyber Incident. Approximately $3.7 million of this was incurred expenses that are recognized in "Restructuring and Other" in the Consolidated Statements of (Loss) Income and Comprehensive (Loss) Income. We have filed insurance claims for the remaining $6.8 million to cover business interruption and other costs. The Cyber Incident remains under legal and forensic investigation, including evaluation of the extent and potential risk related to unauthorized access to sensitive data.


text: The incident had a significant negative impact on our 2025 operating results. Various revenue lines were impacted, certain operating expenses were higher than they were prior to the incident, and many projects underway were significantly delayed.


text: For a description of the risks related to cybersecurity that may materially affect us and how they may do so, see the "Risk Factors—Risks Related to Cybersecurity" section of this Report.


text: Board of Directors Oversight The Board of Directors plays a crucial role in overseeing our management of cybersecurity risks. The Audit and Risk Management Committee is specifically tasked with this responsibility, and it regularly reports to our Board regarding its activities, including those related to cybersecurity risk management. Our Board also receives periodic briefings from management on our cybersecurity risk management program, including presentations on cybersecurity topics from our Chief Information Officer, internal information security team, and third-party experts. These briefings cover the current threat landscape, ongoing cybersecurity initiatives, and our response to significant incidents.


text: Management's Role in Cybersecurity Risk Management Management is actively involved in assessing and managing material risks from cybersecurity threats. The following processes are in place: • Responsible Positions/Committees: The Chief Information Officer, and Chief Information Security Officer are responsible for assessing and managing cybersecurity risks. The individuals in these roles possess extensive expertise in cybersecurity. Specifically, the Chief Information Officer has over 25 years in Information Technology across multiple industries, and the Chief Information Security Officer has over 25 years in Security, Risk, Audit, and Compliance across various sectors, including both public and private. • Monitoring and Response Processes: We have established processes to inform and monitor cybersecurity incidents for prevention, detection, and resolution using a 24/7 third-party SOC Managed Service. The SOC is responsible for providing alerts, updates, and remediation services as needed by monitoring all technology assets for potential signs of compromise and conducting threat hunt exercises. • Reporting to the Board: Information about cybersecurity risks is regularly reported to the Board of Directors or its relevant committee. This reporting includes updates on our cybersecurity risk profile, significant incidents, and the effectiveness of mitigation strategies.


text: We rely on information systems to obtain, process, analyze, and manage data, as well as to facilitate the manufacture and distribution of inventory to and from our facilities. We receive, process, and ship orders, manage the billing of and collections from our customers, and manage the accounting for and payment to our vendors. We also manage our production processes with certain industrial control systems. Consequently, we are subject to cybersecurity risk.

companyName: LEGGETT & PLATT INC

ticker: LEG


text: From time to time, we have experienced immaterial cybersecurity threats and incidents. When these threats and incidents have occurred, we have taken appropriate remediation steps and, through investigation, determined that the threats or incidents did not have a material effect on our business, results of operations, or financial results.


text: Cybersecurity Risk Management and Strategy We have a process in place for assessing, identifying, and managing material risks from cybersecurity threats and incidents, which is based on industry-recognized frameworks and takes a multifaceted approach to protecting our network, systems, and data, including personal information. To prevent cybersecurity incidents, we deploy a wide range of protective security technologies and tools, including, but not limited to, encryption, firewalls, endpoint detection and response, security information and event management, multi-factor authentication, and threat intelligence feeds. To maintain the effectiveness of this framework, we conduct periodic real-world simulation exercises to test, educate, promote awareness, and identify any refinements needed.


text: Cybersecurity threats are identified, assessed, and monitored by our security operations center, which is staffed with cybersecurity professionals who report to the Company's Chief Information Security Officer (CISO), and includes resources provided by external vendors. When a cybersecurity threat or incident meets certain categorized thresholds as determined by our Cybersecurity Incident Response Plan, we follow an escalation review process which can result in our CISO forwarding the threat or incident to our cybersecurity crisis response team consisting of our Chief Executive Officer (CEO), Chief Financial Officer, Chief Human Resources Officer, Chief Information Officer, and General Counsel (the "Crisis Response Team"). Our CISO and the Crisis Response Team, pursuant to guidance from our CISO, assess and manage our response to cybersecurity threats and incidents. Our CISO follows a risk-based escalation process to notify our General Counsel of certain cybersecurity threats and incidents, and our General Counsel analyzes our obligation to report any incident publicly. If the General Counsel determines disclosure is warranted, she reports this conclusion to the CISO, the Crisis Response Team, and the Company's Public Disclosure Committee for consideration and disclosure.


text: We have integrated cybersecurity risk into our overall enterprise risk management (ERM) process. Pursuant to the ERM process, cybersecurity risk is evaluated for likelihood, significance, and velocity on a semiannual basis by designated risk owners. The risk owners consist of a cross-functional group of leaders, led by our CISO. Based on the ERM analysis, we adjust, if necessary, our process for the identification, assessment, and monitoring of cybersecurity threats and incidents.


text: We engage third parties in connection with our cybersecurity identification, assessment, and response processes, including to periodically benchmark our cybersecurity program against the National Institute of Standards and Technology's Cybersecurity Framework. We also maintain active retainers with certain third parties that can be engaged in the event of a cybersecurity threat or incident. We have established a process to oversee and identify risks and cybersecurity threats associated with our third-party service providers, which includes the use of monitoring technology. We also survey certain third-party providers regarding their security controls.


text: Although we have not experienced any material cybersecurity incidents, because of past immaterial cybersecurity threats and incidents, and what we have learned in responding to those threats, we have accelerated multiple cybersecurity program enhancement efforts, including expansion of resources, increased visibility, and stronger protective controls. In 2024, we expect to spend roughly $9 million in maintaining and enhancing our cybersecurity protection efforts. As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations, or financial condition. However, for a discussion of risks from cybersecurity threats that could materially affect our business strategy, results of operations, or financial condition, see Item 1A. Risk Factors - "Information technology failures, cybersecurity incidents, or new technology disruptions could have a material adverse effect on our operations" on page 24, which is incorporated by reference into this Item 1C.


text: Cybersecurity Governance Our Board has oversight of all cybersecurity threats and incidents. On a quarterly basis, and more often if warranted, the CISO, or the CEO in coordination with the CISO, reports to the full Board any potentially material cybersecurity threat or incident and our activities regarding the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents.


text: Our CISO and the Crisis Response Team, pursuant to guidance from our CISO, assess, identify, and manage material risks from cybersecurity threats and incidents, as described above under "Cybersecurity Risk Management and Strategy." The CISO has served in this role since 2022, and has over 20 years of professional experience in identifying, evaluating, and responding to cybersecurity threats and incidents. The CISO holds a bachelor's degree in electrical engineering from Arizona State University and is a Certified CISO under the Carnegie Mellon University CISO Certification Program, a Certified Information Systems Auditor (CISA), and a Certified Information Systems Security Professional (CISSP). Members of the Crisis Response Team have extensive work experience in systems and programming, auditing, compliance and privacy laws, financial controls and procedures, and operations management. With the assistance of the CISO, along with our internal cybersecurity and information technology professionals and our third-party cybersecurity consultants and advisors, the Crisis Response Team is charged with the responsibility of preventing, detecting, mitigating, and remediating cybersecurity threats and incidents.


text: Although we have purchased broad form cyber insurance coverage and believe that our cybersecurity protection systems are adequate, cybersecurity risk has increased due to remote access, remote work conditions, and increased sophistication of cybersecurity adversaries, as well as the increased frequency of malware attacks. As such, information technology failures or cybersecurity breaches could still create system disruptions or unauthorized disclosure or alterations of confidential information and disruptions to the systems of our third-party suppliers and providers. We cannot be certain that the attacker's capabilities will not compromise our technology protecting information systems, including those resulting from ransomware attached to our industrial control systems. If these systems are interrupted or damaged by any incident or fail for any extended period of time, then our results of operations could be adversely affected. We may incur remediation costs, increased cybersecurity protection costs, ransom payments, lost revenues resulting from unauthorized use of proprietary information, litigation and legal costs, increased insurance premiums, reputational damage, damage to our competitiveness, and negative impact on our stock price and long-term shareholder value. For more information regarding cybersecurity risks, refer to Information Technology and Cybersecurity Risk Factors on page 24.


text: Cybersecurity Risk Management and Strategy We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats and incidents, which is based on industry-recognized frameworks and takes a multifaceted approach to protecting our network, systems, and data, including personal information. To prevent cybersecurity incidents, we deploy a wide range of protective security technologies and tools, including, but not limited to, encryption, firewalls, endpoint detection and response, security information and event management, multi-factor authentication, and threat intelligence feeds. To maintain the effectiveness of this framework, we conduct periodic real-world simulation exercises to test, educate, promote awareness, and identify any refinements needed.


text: Cybersecurity threats are identified, assessed, and monitored by our Security Operations Center, which is staffed with cybersecurity professionals who report to the Company's Chief Information Security Officer (CISO), and includes resources provided by external vendors to cover continuous monitoring. When a cybersecurity threat or incident meets certain categorized thresholds, as determined by our Cybersecurity Incident Response Plan, we follow an escalation review process which can result in our CISO forwarding the threat or incident to our cybersecurity crisis response team consisting of our CEO, CFO, CHRO, CIO, and General Counsel (the "Crisis Response Team"). Our CISO and the Crisis Response Team, pursuant to guidance from our CISO, assess and manage our response to cybersecurity threats and incidents. Our CISO follows a risk-based escalation process to notify our General Counsel of certain cybersecurity threats and incidents, and our General Counsel analyzes our obligation to report any incident publicly. If the General Counsel determines disclosure is warranted, she reports this conclusion to the CISO, the Crisis Response Team, and the Company's Public Disclosure Committee for consideration and disclosure.


text: Although we have not experienced any material cybersecurity incidents, because of past immaterial cybersecurity threats and incidents, and what we have learned in responding to those threats, we have increased our cybersecurity program enhancement efforts, including stronger protective controls. As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations, or financial condition. However, for a discussion of risks from cybersecurity threats that could materially affect our business strategy, results of operations, or financial condition, see Item 1A. Risk Factors - "Information technology failures, cybersecurity incidents, or new technology disruptions could have a material adverse effect on our operations" on page 23, which is incorporated by reference into this Item 1C.


text: Cybersecurity Governance Our Board has oversight of all cybersecurity threats and incidents. On a quarterly basis, and more often if warranted, the Company's CIO, or the CFO in coordination with the CIO, each after consultation with the CISO, reports to the full Board any potentially material cybersecurity threat or incident and our activities monitoring the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents.


text: Our CISO and the Crisis Response Team, pursuant to guidance from our CISO, assess, identify, and manage material risks from cybersecurity threats and incidents, as described above under "Cybersecurity Risk Management and Strategy." The CISO has served in this role since October 2024, and has over 20 years of professional experience in identifying, evaluating, and responding to cybersecurity threats and incidents. Our CISO holds a Bachelor of Science degree from DeVry University, Addison, Illinois, a Masters in Business Administration from Western Governors University, is a Certified Information Systems Security Professional (CISSP), a GIAC Certified Incident Handler (GCIH), and holds a GIAC Certification in Strategic Planning, Policy and Leadership. Members of the Crisis Response Team have extensive work experience in systems and programming, auditing, compliance and privacy laws, financial controls and procedures, and operations management. With the assistance of the CISO, along with our internal cybersecurity and information technology professionals and our third-party cybersecurity consultants and advisors, the Crisis Response Team is charged with the responsibility of preventing, detecting, mitigating, and remediating cybersecurity threats and incidents.


text: Although we have purchased broad form cyber insurance coverage and strive to provide a balanced level of cybersecurity protections, cybersecurity risk has increased due to remote access and increased sophistication of cybersecurity adversaries, as well as the increased frequency of cybersecurity attacks, including malware. As such, information technology failures or cybersecurity breaches could still create system disruptions or unauthorized disclosure or alterations of confidential information and disruptions to the systems of our third-party suppliers and providers. We cannot be certain that the attacker's capabilities will not compromise our technology protecting information systems or bypass our detection capabilities, including those resulting from ransomware attached to our industrial control systems. If these systems are materially interrupted or damaged by any incident or fail for any extended period of time, then our results of operations could be adversely affected. We may incur remediation costs, increased cybersecurity protection costs, ransom payments, lost revenues resulting from unauthorized use of proprietary information, litigation and legal costs, increased insurance premiums, reputational damage, damage to our competitiveness, and negative impact on our stock price and long-term shareholder value. We may also be required to devote significant management resources and expend significant additional resources to address problems created by any such interruption, damage, or failure. For more information regarding cybersecurity risks, refer to Item 1A. Risk Factors - Information Technology and Cybersecurity Risk Factors on page 23.


text: We have a comprehensive approach to identifying and managing cybersecurity risks that involves our information technology security personnel, senior management, Audit Committee and Board of Directors. Our cybersecurity risk management function is integrated into our overall risk management system and processes.

companyName: VECTOR GROUP LTD


text: Governance. The Board of Directors has formally tasked the Audit Committee with oversight responsibility to review cybersecurity and data privacy risks. The Audit Committee receives regular reports from management about cybersecurity matters. In addition to regular reporting, we have procedures by which potential cybersecurity incidents are reported in a timely manner to the Chief Technology Officer, who then notifies the Chief Operating Officer and General Counsel of cybersecurity incidents and they collectively determine if a specific incident warrants escalation to the Audit Committee and the Board of Directors. Our CTO, who has more than 25 years of information security and cybersecurity experience, manages cybersecurity at the corporate and real estate segments and oversees a team of dedicated cybersecurity personnel employed in our tobacco segment. Our governance procedures are generally designed to identify, assess, mitigate, prevent and, where required, respond to cybersecurity security incidents and threats in a timely manner to minimize the loss or compromise of information and assets and to facilitate incident resolution.


text: Cybersecurity incident identification and response. We use a number of processes and procedures to protect our data, systems and employees from cyber incidents, to reduce our overall cybersecurity risk profile, and to identify and respond to cybersecurity incidents in a timely manner. These processes and procedures leverage a variety of tools, including a security incident and event manager interface that uses behavioral analytics and provides live metrics and reports of attempted breaches and logs of firewalls, authentication attempts, emails, anti-malware, attempted intrusions and applications. We also conduct periodic tests to assess our processes and procedures and the threat landscape, which include, among other things, the engagement of third-party experts for external and internal penetration testing and system security assessments.


text: We have adopted an incident response plan that applies in the event of a cybersecurity incident involving a breach of our own information technology systems and applications. Pursuant to this response plan, in the event of an incident, a multi-disciplinary team is assembled that includes our CTO and General Counsel and, if appropriate, our COO and CFO, which in turn may leverage the expertise of third-party consultants, external legal counsel and other resources. The plan includes procedures designed to facilitate containment of, and responses to, a cybersecurity incident, which are based on the type of incident, the location of the incident and the breadth of the incident. The plan also establishes procedures for notifying any impacted parties, including our customers, law enforcement and regulatory authorities, third-party vendors and insurance providers. Our CTO will provide periodic updates to the Audit Committee and, when appropriate, the Board of Directors during this process.


text: After an incident, we would review and document the causes and effects of the incident, evaluate the remediation plan, and consider post-incident improvements. Where applicable, the CTO reports these findings to the Audit Committee and, when appropriate, the Board of Directors.


text: Processes to identify material risks associated with the use of third-party service providers. In addition to internal resources, we utilize third-party service providers to supplement and maintain our information technology systems. We have procedures to oversee and identify cybersecurity risks associated with our use of these third-party service providers, including procedures that apply in the event of a cybersecurity incident at a third-party service provider that results in our systems or data or our customers' data being compromised. These processes and procedures include, among others, a diligence review conducted by our information technology team of substantially all of our external business partners and a focused review of any such third parties' cybersecurity audit attestations, such as Service Organization Controls, NIST 800 alignments, ISO certifications, PCI DSS compliance or other recognized external reviews. In the case of a cybersecurity incident affecting a third party, these procedures also govern interactions with personnel of the impacted third-party to determine the date, scope and effects of the cybersecurity incident, review the response and remediation measures taken by the third-party and conduct an inventory of potentially compromised data. Our notification process for a cybersecurity incident affecting a third party is the same as the notification process that applies to a cybersecurity incident that affects our own information technology systems and applications.


text: Cybersecurity risks and threats. We and certain of our third-party service providers have experienced, and may continue to experience, internal and external cybersecurity threats, which can result in impacts to critical data and confidential or proprietary information and the disruption of certain business operations. Nonetheless, we have not been subject to cybersecurity incidents that, individually or in aggregate, have been material to our operations or financial condition, and we cannot provide assurance that cybersecurity incidents will not have a material impact in the future. See Item 1A. "Risk Factors".


text: Risk Management and Strategy We manage cybersecurity threats as part of our oversight, evaluation, and mitigation of enterprise-level risks. We have based our cybersecurity program on industry frameworks with the goal of building enterprise resilience against an evolving landscape of cybersecurity threats and to respond to cybersecurity threats as they materialize. Our program includes monitoring, identification, assessment, and management components, as well as information and escalation components designed to inform management and the board of directors of prospective risks and developments.

companyName: ELI LILLY & Co

ticker: LLY


text: Our information security program encompasses functions dedicated to both proactive and reactive management of cybersecurity threats. We implement our cybersecurity program internally through established policies, standards, reference architectures, and the use of enterprise security services that focus on emerging and ongoing cybersecurity risks. Our proactive management of cybersecurity risks entails many actions, including the maintenance of system access restrictions, utilization of data security technology, employee education and training initiatives, and retention of cyber liability insurance, among other measures. We regularly engage third-party auditors and consultants and leverage our internal audit function to assess various facets of our cybersecurity program. These engagements include completion of industry-standard assessments or certifications, maturity model reviews, threat simulations, as well as internal reviews to assess the effectiveness of our cybersecurity processes. We also maintain enterprise-wide processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. As examples, we generally review current and prospective third-party service providers for unacceptable cybersecurity risks, negotiate contractual provisions that require the establishment of third-party cybersecurity controls, and deploy communications security measures to protect third-party communications.


text: We assess cybersecurity contingencies within our overall business continuity risk management planning process. Our Information Security team utilizes various tools to prevent, detect, monitor, and react to cybersecurity threats. Our Incident Response Playbook outlines processes, roles, responsibilities, engagements, escalations, notifications, and other communications applicable to the assessment, mitigation, and remediation of realized cybersecurity events. The nature and assessed risk of a realized cybersecurity event dictates the pace and extent of relevant processes, escalations, and communications, including an evaluation of any necessary or required disclosure. Roles and escalation paths range from within the Information Security team up to the Executive Committee, and the board of directors and its committees, as appropriate.


text: We describe risks faced by us from identified cybersecurity threats in Item 1A, "Risk Factors—Risks Related to Our Operations— Failure, inadequacy, breach of, or unauthorized access to, our IT systems or those of our third-party service providers, unauthorized access to our confidential information, or violations of data protection laws, could each result in material harm to our business and reputation", "Risk Factors—Risks Related to Our Operations—Manufacturing, quality, or supply chain difficulties, disruptions, or shortages could lead to product supply problems" and "Risk Factors—Risks Related to Our Operations—Reliance on third-party relationships and outsourcing arrangements could adversely affect our business."


text: Management, under the supervision of our Chief Information Security Officer (CISO), is directly responsible for assessing and managing cybersecurity risks and otherwise implementing our cybersecurity program, which includes our Incident Response Playbook. The CISO reports directly to our Chief Information and Digital Officer (CIDO), who is a member of our Executive Committee and leads our information technology, cybersecurity, digital health, and advanced analytics and data science functions. Our CIDO in turn regularly updates our Executive Committee on cybersecurity matters. Our CISO and CIDO have significant experience managing global cybersecurity threats across the pharmaceutical, technology, entertainment, and defense industries. In addition to providing regular updates to the CIDO and his staff, the CISO is a member of our Executive Information Security Governance function (EISG), which meets regularly and is also composed of executive and senior leadership from a variety of functions, including information security, legal, finance, audit, and ethics and compliance to assess and manage cybersecurity developments and risks and our internal programs. Each of the CIDO, the CISO and the EISG may call upon business and legal stakeholders across our company to manage cybersecurity threats and incidents.


text: The audit committee of our board of directors is responsible for oversight of the company's programs, policies, procedures, and risk management activities related to information security and data protection. The audit committee meets regularly with our CIDO and CISO to discuss threats, risks, and ongoing efforts to enhance cyber resiliency, as well as changes to the broader cybersecurity landscape. In addition, the ethics and compliance committee supports the audit committee and board in oversight of legal and regulatory compliance. Our board of directors also regularly participates in presentations on cybersecurity and information technology. In addition to regular presentations, management promptly updates our board of directors regarding significant threats and incidents as they arise.


text: Risk Management and Strategy We manage cybersecurity threats as part of our oversight, evaluation, and mitigation of enterprise-level risks. We have based our cybersecurity program on industry frameworks, including, among others, the U.S. National Institute of Standards and Technology Cybersecurity Framework, with the goal of building enterprise resilience against an evolving landscape of cybersecurity threats and responding to cybersecurity threats as they materialize. Our program includes monitoring, identification, assessment, and management components, as well as information sharing and escalation components designed to inform management and the board of directors of prospective risks and developments.


text: Our information security program encompasses functions dedicated to both proactive and reactive management of cybersecurity threats. We implement our cybersecurity program internally through established policies, standards, reference architectures, and the use of enterprise security services that focus on emerging and ongoing cybersecurity risks. Our proactive management of cybersecurity risks entails many actions, including the maintenance of system access restrictions, utilization of data security technology, employee education and training initiatives, and retention of cyber liability insurance, among other measures. We regularly engage third-party auditors and consultants and leverage our internal audit function to assess various facets of our cybersecurity program. These engagements include completion of industry-standard assessments or certifications, maturity model reviews, threat simulations, as well as internal reviews to assess the effectiveness of our cybersecurity processes. We also maintain enterprise-wide processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. As examples, we generally review current and prospective third-party service providers for unacceptable cybersecurity risks, negotiate contractual provisions that require the establishment of third-party cybersecurity controls, and deploy communications security measures to protect third-party communications. For companies we acquire, the integration process includes plans for alignment with relevant information security policies and procedures and timelines for implementation.


text: We describe risks faced by us from identified cybersecurity threats in Item 1A, "Risk Factors—Risks Related to Our Operations—Failure, inadequacy, breach of, or unauthorized access to, our IT systems or those of our third-party service providers, unauthorized access to our confidential information, or violations of data protection laws, could each result in material harm to our business and reputation", "Risk Factors—Risks Related to Our Operations—Manufacturing, quality, or supply chain difficulties, disruptions, or shortages could lead to product supply problems", "Risk Factors—Risks Related to Our Operations—Reliance on third-party relationships and outsourcing arrangements could adversely affect our business", and "Risk Factors—Risks Related to Our Operations—Our use of artificial intelligence (AI) or other emerging technologies could adversely impact our business and financial results."


text: Management, under the supervision of our Chief Information Security Officer (CISO), is directly responsible for assessing and managing cybersecurity risks and otherwise implementing our cybersecurity program, which includes our Incident Response Playbook. The CISO reports directly to our Chief Information and Digital Officer (CIDO), who is a member of our Executive Committee and leads our information technology, cybersecurity, digital health, and advanced analytics and data science functions. Our CIDO in turn regularly updates our Executive Committee on cybersecurity matters. Our CISO and CIDO have significant experience managing global cybersecurity threats across the pharmaceutical, technology, entertainment, and defense industries. In addition to providing regular updates to the CIDO and his staff, the CISO is a member of our Executive Information Security Governance function (EISG), which meets regularly and is composed of executive and senior leadership from a variety of functions, including information security, legal, finance, audit, and ethics and compliance to assess and manage cybersecurity developments and risks and our internal programs. Each of the CIDO, the CISO and the EISG may call upon business and legal stakeholders across our company to manage cybersecurity threats and incidents.


text: Operational Risk Management and Strategy Identifying, assessing and managing material risks from cybersecurity threats is a core component of our overall operational risk management. The Company's Information Security team is the primary group responsible for cybersecurity and consists of four divisions with specific mandates: • The security engineering division, which leads our "security by design" efforts to help ensure cybersecurity considerations are taken into account in our applications, cloud architecture and infrastructure; • The governance, risk and compliance division, which includes responsibility for developing cybersecurity-related policies and procedures, training and supplier security review; • The cybersecurity response and investigations ("CSRI") division; and • The identity access management division, which is responsible for managing access to our data and technology infrastructure.

companyName: LINCOLN NATIONAL CORP

ticker: LNC


text: The work done by each of these divisions is applied both tactically and strategically to operations, as well as to broader risk management activities.


text: The governance, risk and compliance division of our Information Security team includes a dedicated information technology ("IT") and Cyber operation risk assessment team. This team conducts assessments that are focused on the Company's most significant IT and cyber risks, the results of which are leveraged by the Company's IT leadership, among other inputs, to mitigate, reduce and/or manage against such risks. While it is not possible to be certain that all risks, threats and vulnerabilities to our information and systems have been identified, our cybersecurity risk management processes are designed to, using a risk-based approach, identify reasonably known risks from cybersecurity threats and ensure material risks are managed appropriately.


text: The work done by the Information Security team integrates into the Company's overall Enterprise Risk Management ("ERM") program. Data is contributed to the ERM team in support of our broader operational risk framework and processes through completion of the Risk and Control Self-Assessment for IT and cyber, which is aggregated into the larger operational risk program. Members of IT and Information Security senior leadership participate on the Company's Operational Risk Committee ("ORC"), which is a standing committee whose purpose is to review and monitor threats to our business operations and strategy that manifest from inadequate or failed internal processes, controls, people or systems or from external events. In addition, the Company's Internal Audit team performs an annual security audit that focuses on cybersecurity risks, the results of which are reported to the Company's IT leadership team and the Audit Committee of the Company's Board of Directors. This audit process provides an additional layer of support to help ensure that cybersecurity risks are managed and responded to appropriately.


text: While our Information Security team uses some third-party resources as part of its efforts to assess, identify and manage material risks from cybersecurity threats (e.g., certain third-party software tools, threat intelligence and periodic penetration testing), our cybersecurity efforts are predominantly conducted through our internal resources.


text: Monitoring and Incident Response The CSRI division of our Information Security team is responsible for the operation of our internal Security Operations Center ("SOC"), which performs monitoring and alerting for security events 24 hours a day, 7 days a week, 365 days a year. The CSRI division also actively seeks out cybersecurity threats that might affect the organization and/or our customers. The CSRI team is a component of Lincoln's formal security incident response team ("SIRT") and process. In addition to the Information Security team, the SIRT also includes representatives from the Company's legal and compliance teams (including Privacy), office of business resiliency, chief risk office, corporate communications, as well as the information technology team. While the CSRI division is responsible for cybersecurity responses generally, should a critical event arise, such an event would be raised to and addressed by the SIRT.


text: Our Privacy team, which is part of the Company's compliance function, has a dedicated incident response team responsible for assessing, identifying and managing risks from cybersecurity threats involving personal information. The team follows documented processes for investigation, research, assessment, notification, regulatory reporting and, if necessary, escalation to management, and such processes have been integrated into our Information Security incident response program. The Information Security team works closely with our Privacy team to respond to any cybersecurity incidents involving personal information. The Privacy team engages third parties to assist with incident assessment and notification.


text: Supplier Risk Management and Strategy Within the governance, risk and compliance division of our Information Security team, we operate a formal supplier security assessment program, with a team dedicated to evaluating the cybersecurity risk associated with third party suppliers with whom we have contracted and who we believe may pose a cybersecurity threat to the Company, our customers or our business partners due to the type of services they provide and/or confidential information they may be handling. This team assesses the security posture of the supplier, as well as the security of the systems and services provided. In addition, the team works closely with our procurement and legal teams to help ensure that appropriate security requirements are included in our contractual arrangements with the suppliers. The team conducts an assessment both at the outset of the engagement of a new supplier, and then periodically thereafter, based on assigned risk levels, as well as in the event of any new services or changes to the engagement. The Information Security team's process for conducting periodic security reviews of third parties is a component of our operational risk management team's broader periodic review of third parties.


text: Risks from Cybersecurity Threats Although our computer systems and the computer systems of third parties on which we rely have in the past been, and will likely in the future be, subject to or targets of unauthorized or fraudulent access, to date the Company, including our business strategy, results of operations or financial condition, has not been materially affected by a cybersecurity breach. There are risks from cybersecurity threats that if they were to occur could materially affect the Company, including its business strategy, results of operations or financial condition, as discussed in "Item 1A. Risk Factors – Operational Matters – Our information systems or the information systems of third parties on which we rely may experience interruptions, breaches in security and/or a failure of disaster recovery systems that could result in a loss or disclosure of confidential information, damage to our reputation, impairment of our ability to conduct business effectively and increased expenses" and 'Item 1A. Risk Factors – Legislative, Regulatory and Tax – Compliance with existing and emerging privacy laws and regulations could result in increased compliance costs and/or lead to changes in business practices and policies, and any failure to protect the confidentiality of personal information could adversely affect our reputation and have a material adverse effect on our business, financial condition and results of operations."


text: The Company's Board of Directors is responsible for regular oversight of the Company's overall risk management process. The Board reviews the most significant risks the Company faces and the manner in which our executives manage these risks. The Board has also delegated certain of its risk oversight efforts to its committees. Oversight of cybersecurity risk has been delegated to the Audit Committee of the Board of Directors.


text: The Company's senior management is primarily responsible for establishing policies and procedures designed to identify, assess and manage the Company's significant risks, with our Chief Information Security Officer ("CISO") having primary responsibility with respect to material risks from cybersecurity threats. We also have a Corporate Enterprise Risk and Capital Committee, made up of members of senior management and the Company's Chief Risk Officer, which provides oversight of our enterprise-wide risk structure and of our processes to identify, measure, monitor and manage significant risks, including, but not limited to, cybersecurity risk.


text: The Information Security organization is led by our CISO. The head of each of the four divisions of our Information Security team reports directly to the CISO. The CISO reports directly to the Company's Chief Information Officer and Head of IT ("CIO"), who is a member of the Company's Senior Management Committee. As a result, all information security personnel report into the CISO, and ultimately the CIO. The CISO also reports indirectly to the Audit Committee of the Board of Directors. Biannually, the CISO reports to the Audit Committee on the cybersecurity risks facing the Company and cybersecurity developments generally. In addition, as discussed above, the Company's Internal Audit team reports to the Audit Committee the results of its annual security audit focused on cybersecurity risks. The Company's Chief Compliance Officer reports key Privacy risk indicators and statistics (including those related to cybersecurity risks) to the Audit Committee on a quarterly basis.


text: Our current CISO has over 20 years of experience in the field of cybersecurity and holds a Certified Information Security Systems Professional designation. The CISO has a staff of more than 100 employees dedicated to protecting the data and systems belonging to the Company, our customers, business partners and consumers.