text: The effectiveness of our cybersecurity operations is regularly examined and tested by third-party vendors who specialize in cybersecurity risk management. We regularly employ such vendors to test the effectiveness of our security controls, including penetration testing. External vendors are engaged at least on an annual basis to facilitate incident response exercises and training. We use external risk management services to assess and monitor cybersecurity risk associated with third-party service providers. Finally, we review the maturity of our program's design and control environment's effectiveness through regular internal assessments and examinations.


text: Our Board of Directors oversees the company's cybersecurity risk-management program. Management reports at least quarterly to the Board on matters related to CFC's security operations, potential threats, industry-wide trends and any other related information requested by the Board. The reports include information on material cybersecurity incidents, if any, and management actions to protect CFC. Upon the occurrence of a material cybersecurity incident, the Board of Directors will be promptly notified so it may properly evaluate such cybersecurity incident, including management's remediation plan. In addition to the regular cybersecurity program reports, the Board monitors cybersecurity risk and program effectiveness through internal audit and our enterprise risk management reporting framework. On an annual basis, our Chief Information Officer ("CIO") and Director, Information Security, provide the Board an overview of the company's technology strategy and planned activities to continually improve the cybersecurity program, as well as threats and cybersecurity incidents. Further, on at least an annual basis, the Board of Directors reviews management reports concerning the disclosure controls and procedures in place to enable CFC to make accurate and timely disclosures about any material cybersecurity incidents.

companyName: NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP /DC/

ticker: NRUC

secItem: Item 1C


text: Role of Management Management is directly involved in steering the company's cybersecurity program employing a multi-disciplinary approach that operates through a three lines of defense model. Management's approach helps ensure the organization works collaboratively to monitor, assess and respond to cybersecurity incidents at all levels and functions consistent with our incident response procedures and corporate practices.


text: Our first line of defense includes our CIO and Director, Information Security, who work to ensure that the day-to-day execution of the company's technology and security operations are in alignment with corporate policies and procedures. Our CIO, who reports to our Chief Operating Officer ("COO"), has over two decades of experience managing technology risk. Our Director, Information Security, who dually reports to the COO and CIO, has over a decade of information security management experience and as a Certified Information Systems Security Professional. Collectively, they are also responsible for information security policies, organizational readiness and the escalation of certain cybersecurity incidents from our cybersecurity personnel to senior management based on our incident response procedures.


text: Our second line of defense includes our Cybersecurity Committee and the enterprise risk-management framework under the direction of the Chief Risk Officer to monitor cybersecurity functions and risk management. In addition to the COO, CIO and Director, Information Security, our Cybersecurity Committee is composed of members of management including, but not limited to, the Chief Risk Officer, General Counsel and Vice President, Internal Audit. The Cybersecurity Committee helps ensure corporate policy compliance and reports directly to the Board of Directors regarding material cybersecurity incidents and emerging threats.


text: Our third line of defense is the internal audit function led by our Vice President, Internal Audit, which plays a crucial role by providing independent and objective assurances on the design and operating effectiveness of our cybersecurity risk management and internal controls through the performance of audits and reviews. Internal audit engages external consultants and subject matter experts as appropriate to assist in the assessment of management's cybersecurity program and reports the results directly to the Board.


text: We have not experienced any material cybersecurity incidents that have impacted our business, results of operations or financial condition to date. See "Item 1A. Risk Factors" for a discussion of our risks related to cybersecurity.


text: Cybersecurity risk management is a core component of our enterprise risk-management framework. Cybersecurity incidents and threats pose a risk to the disruption of our business operations, including the confidentiality, integrity and availability of data and information. CFC's cybersecurity program is designed to manage operational risks associated with the ever-evolving nature of cybersecurity threats. Because these risks could have a material adverse impact on our operations and reputation, both management and the CFC Board of Directors are actively engaged in the oversight of the cybersecurity program and our continuous efforts in monitoring, measuring and managing the risks.


text: Risk Management and Strategy The primary goal of CFC's cybersecurity operations is to prevent, identify, mitigate and respond on a timely basis to cybersecurity threats in order to reduce operational risk and business impact. Our strategy encompasses technology, process and people. The technology components are designed to provide multiple layers of system security, controls and monitors for our infrastructure, data and applications. Our security infrastructure and resources are focused on the monitoring of threats and the defense of our external and internal networks, endpoints, data resources and identity management.


text: We use risk-based processes to prioritize the resources that manage vulnerabilities, threats, incident responses and operational changes. The risk-based approach ensures we are taking action on the threats, events and incidents that have the highest likelihood of impacting our business and members. We maintain cybersecurity incident procedures that identify the activities, responses and escalation procedures to be executed upon detection of a potential cybersecurity incident. These procedures are a critical component of CFC's Crisis Management Plan and business continuity efforts.


text: We continue to invest in our cybersecurity program to help ensure that we have the necessary resources to execute our business operations and that our workforce is prepared to work in an active cyber-threat environment. These resources also include external service providers with experience in third-party risk monitoring and cybersecurity threat intelligence, detection and response. Mandatory training is required on a quarterly basis for all CFC employees to promote leading practices in protecting information, data and operations in a continually changing environment. We established requirements regarding the use of company-approved generative artificial intelligence tools to ensure that all employees utilize such tools in a manner that safeguards sensitive information and aligns with legal requirements and CFC's ethical standards.


text: Our board of directors oversees the company's cybersecurity risk-management program. Management reports at least quarterly to the board on matters related to CFC's security operations, potential threats, industry-wide trends and any other related information requested by the board. The reports include information on significant cybersecurity incidents, if any, and management actions to protect CFC. We promptly notify the board of directors upon the occurrence of a significant cybersecurity incident so it may properly evaluate the incident, including management's remediation plan. In addition to the regular cybersecurity program reports, the board monitors cybersecurity risk and program effectiveness through internal audit and our enterprise risk management reporting framework. On an annual basis, members of our staff responsible for cybersecurity provide the board an overview of the company's technology strategy and planned activities to continually improve the cybersecurity program, as well as threats and cybersecurity incidents. Further, on at least an annual basis, the board of directors reviews management reports concerning the disclosure controls and procedures in place to enable CFC to make accurate and timely disclosures about any material cybersecurity incidents.


text: Role of Management Management is directly involved in steering the company's cybersecurity program employing a multi-disciplinary approach that operates through a "three lines of defense" model. Management's approach helps ensure the organization works collaboratively to monitor, assess and respond to cybersecurity incidents at all levels and functions consistent with our incident response procedures and corporate practices.


text: Our first line of defense includes our cybersecurity team lead by our Director, Information Security, who work to ensure that the day-to-day execution of the company's technology and security operations are in alignment with corporate policies and procedures. Our Director, Information Security, who reports to our Chief Operating Officer ( " COO"), has over a decade of information security management experience and is a Certified Information Systems Security Professional. Our COO and Director, Information Security are also responsible for information security policies, organizational readiness and the escalation of certain cybersecurity incidents from our cybersecurity personnel to senior management based on our incident response procedures.


text: Our second line of defense includes our Cybersecurity Committee and the enterprise risk-management framework under the direction of the Chief Risk Officer to monitor cybersecurity functions and risk management. Our Cybersecurity Committee is composed of members of management including, but not limited to, the COO, Chief Risk Officer, General Counsel and Vice President, Internal Audit. The Cybersecurity Committee helps ensure corporate policy compliance and reports directly to the board of directors regarding material cybersecurity incidents and emerging threats.


text: Our third line of defense is the internal audit function led by our Vice President, Internal Audit, which plays a crucial role by providing independent and objective assurances on the design and operating effectiveness of our cybersecurity risk management and internal controls through the performance of audits and reviews. Internal Audit engages external consultants and subject matter experts as appropriate to assist in the assessment of management's cybersecurity program and reports the results directly to the b oard.


text: The Company recognizes the importance of maintaining cybersecurity measures that are designed to safeguard our information systems and to protect the confidentiality and integrity of data gathered on our people, partners, customers, and business assets.

companyName: NCR Voyix Corp

ticker: VYX


text: Our information security program is enterprise-wide and includes cross-functional coordination between various departments across the Company including Information Security, Technology, Privacy, Enterprise Risk Management, and Internal Audit. The structure of our information security program is informed by the National Institute of Standards and Technology (NIST) Cybersecurity Framework to organize processes and tools to identify, protect, detect, respond, and recover from threats and events.


text: Our information security program employs various information technology and protection methods designed to promote data security including firewalls, intrusion prevention systems, denial of service detection, anomaly-based detection, anti-virus/anti-malware, endpoint encryption and detection and response software, Security Information and Event Management system, identity management technology, security analytics, encryption and multi-factor authentication. Further, we recognize the risks associated with the use of third-party service providers and have processes designed to identify material risks related to third parties.


text: We conduct periodic reviews and tests of our information security program and also leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and attempt to improve our security measures and planning. We collaborate with external experts, including consultants and auditors, in evaluating and testing our information security program. Our employees and certain of our contractors are required to participate in security awareness training at least annually.


text: The information security program is under the responsibility of the Chief Information Officer (CIO). The CIO is responsible for leading and implementing, with a cross functional team, our cybersecurity strategy, standards, and risk management policies and procedures.


text: The Company's cybersecurity risk management policies and procedures include internal notification procedures which, depending on the level of severity assigned to the event, may include direct notice to, among others, the Company's General Counsel and Chief Privacy Officer. Members of the Company's legal department support efforts to evaluate the materiality of any incidents, determine whether notice to third parties such as regulators, customers or vendors is required, determine whether any prohibition on insider trading is appropriate, and assess whether disclosure to stockholders or governmental filings, including with the SEC, are required. Our internal notification procedures also include notifying various Company Information Technology Services managers, subject matter experts in the Company's software department and other senior executives, depending on the level of severity assigned to the event.


text: Our CIO attends regular meetings of the executive officer team, including our Chief Executive Officer, Chief Financial Officer and other senior executive officers, and reports on cybersecurity matters as appropriate.


text: Our Board of Directors exercises oversight over our risk management process directly, as well as through its various standing committees that address risks inherent in their respective areas of oversight. In particular, our Board of Directors delegates cybersecurity risk management oversight to the Risk Committee of the Board of Directors. The Risk Committee oversees our cybersecurity processes and policies on risk identification, management, and assessment. The Risk Committee also reviews the adequacy and effectiveness of such policies, as well as the steps taken by management to mitigate or otherwise control these cybersecurity exposures and to identify future risks. Our CIO reports regularly to the Risk Committee on cybersecurity and information security and the full Board reviews significant cybersecurity matters as appropriate.


text: For a description of risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition, see the risk factor "Data protection, cybersecurity and data privacy issues could negatively impact our business" in Item 1A of Part I of this Report.


text: Our Chief Technology Officer (CTO) is responsible for oversight of our information security strategy, program, and operations. The CTO has over 25 years of information technology experience, including leadership experience managing global information security, IT infrastructure and engineering. He holds a doctorate in Business Administration, Master of Business Administration, and Bachelor of Engineering in Electrical and Electronics Engineering / Information Systems. In previous roles at large scale fintech and cybersecurity companies, the CTO has designed comprehensive cybersecurity programs and managed and mitigated high profile cybersecurity incidents to ensure business continuity.


text: Our Chief Information Security Officer (CISO), who reports directly to the CTO, is responsible for day-to-day assessment and management of cybersecurity risk. Our CISO has over 20 years of experience in various roles related to information security and related technology, including previously serving as Vice President of Information Technology and Senior Vice President of Information Technology at other companies, and holds a Bachelor of Science in Math and a Master of Business Administration in Computer Information Systems and Information Technology. The CISO's responsibilities in prior roles at large, global fintech and healthcare companies has included initiatives to identify and reduce cybersecurity vulnerabilities.


text: The Company's cybersecurity risk management policies and procedures include internal notification procedures which, depending on the level of severity assigned to the event, may include direct notice to, among others, the Company's General Counsel and Chief Privacy Officer. Members of the Company's legal department support efforts to evaluate the materiality of any incidents, determine whether notice to third parties such as regulators, customers or vendors is required, determine whether any prohibition on insider trading is appropriate, and assess whether disclosure to stockholders or governmental filings, including with the SEC, are required. Our internal notification procedures also include notifying various Company information technology services managers, subject matter experts in the Company's software department and other senior executives, depending on the level of severity assigned to the event.


text: Our CTO attends regular meetings of the executive officer team, including our Chief Executive Officer, Chief Financial Officer and other senior executive officers, and reports on cybersecurity matters as appropriate.


text: Our Board of Directors exercises oversight over our risk management process directly, as well as through its various standing committees that address risks inherent in their respective areas of oversight. In particular, our Board of Directors delegates cybersecurity risk management oversight to the Risk Committee of the Board of Directors. The Risk Committee oversees our cybersecurity processes and policies on risk identification, management, and assessment. The Risk Committee also reviews the adequacy and effectiveness of such policies, as well as the steps taken by management to mitigate or otherwise control these cybersecurity exposures and to identify future risks. Our CTO reports regularly to the Risk Committee on cybersecurity and information security and the full Board reviews significant cybersecurity matters as appropriate.


text: For a description of risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition, see the risk factor "Our inability to protect our systems and data from cybersecurity threats or other technological risks could adversely affect our business operations, or stock price and damage our brand and reputation" in Item 1A of Part I of this Report.


text: Trust underpins our mission and values and we believe that cybersecurity is important to our success. We are susceptible to a number of cybersecurity threats, including those common to most industries as well as those we face as a global media organization whose systems store and process subscriber, user, employee and other personal and Company data. We, and third parties with which we work and on which we rely, regularly face attempts by malicious actors to breach our security and compromise our information technology systems, and a cybersecurity incident impacting us or any such third party could harm our reputation; require us to expend resources to respond to and recover from such a security incident or defend against further attacks; divert management's attention; subject us to liability; or otherwise adversely affect our business. Because of these risks, we take cybersecurity seriously.

companyName: NEW YORK TIMES CO

ticker: NYT


text: Under the oversight of our Board of Directors, and the Audit Committee of the Board, we have developed and maintain an information security program that includes technical, administrative and physical measures designed to safeguard our information and information systems. Cybersecurity risk management is integrated into our broader risk management framework. Our approach includes elements that are proactive and adaptive, using security assessments, employee training and continuous improvement of our cybersecurity infrastructure. We work to align our practices with industry and regulatory standards. Our information security program includes response procedures to be followed in the event of a cybersecurity incident that outline steps to be followed from detection to assessment to notification and recovery, including internal notifications to management, the Audit Committee and the Board, as appropriate. Business continuity and disaster recovery plans are used to prepare for the potential for a disruption to systems or processes we rely on.


text: Our Board of Directors recognizes the importance of managing risks associated with cybersecurity threats and provides oversight of the Company's information security program. Risk is an integral part of the Board's deliberations throughout the year and the Board exercises its oversight responsibility both directly and through its committees. In particular, the Audit Committee oversees risks relating to information security, including cybersecurity risks. Members of management, including the Company's Chief Information Security Officer ("CISO"), provide the Audit Committee with updates on cybersecurity and information technology matters at least twice a year, and the Audit Committee and management also provide updates to the Board. In addition to reporting to the Audit Committee and Board, the CISO provides periodic reports to our Chief Executive Officer and other members of our senior management as appropriate. The Audit Committee, or the Board, is notified by the CISO of cybersecurity incidents, as appropriate, in accordance with the Company's incident response processes.


text: The Board's risk oversight is enabled by an enterprise risk management program designed to identify, prioritize and assess a broad range of risks, including risks related to cybersecurity, that may affect the Company's ability to execute its corporate strategy and fulfill its business objectives, and to formulate plans to mitigate their effects.


text: Our cybersecurity department, led by our CISO, has primary responsibility for our enterprise-wide information security program and our risk management team works closely with our cybersecurity department to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs on an ongoing basis. Our current CISO has been in that position since October 2022 and has broad information technology experience as a result of that role and past work experience. Our CISO manages a team with broad cybersecurity experience, including in cybersecurity threat management, cybersecurity training and education, incident response, cyber forensics, insider threats, business continuity and disaster recovery, and regulatory compliance. The cybersecurity department receives support to maintain the information security program from other functions, such as information technology, corporate security, internal audit and legal. Our CISO is informed about and monitors prevention, detection, mitigation and remediation efforts through regular communication and reporting from the internal team. We also engage and rely on third parties to support our information security program, such as assessors, consultants, contractors, auditors and other third-party service providers. In addition, we maintain policies and processes to assess and manage risks relating to third-party service providers, based on the nature of the engagement with the third party and based on the information and information systems to which the third party will have access. We maintain policies to conduct due diligence before onboarding new service providers and maintain ongoing evaluations to ensure compliance with our security standards.


text: THE NEW YORK TIMES COMPANY – P. 25 As of the date of this report, no cybersecurity incidents have had a material adverse effect on our business, financial condition or results of operations. Notwithstanding our ongoing investments in our cybersecurity program, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cyber risk insurance, the costs relating to certain kinds of security incidents could be substantial, and our insurance may not be sufficient to cover all losses related to any future incidents involving our data or systems.


text: See Item 1A. "Risk Factors — Risks Related to our Data Platform, Information Systems and Other Technology — Security incidents and other network and information systems disruptions could affect our ability to conduct our business effectively and damage our reputation" and "— Failure to comply with laws and regulations with respect to privacy, data protection and consumer marketing and subscriptions practices could adversely affect our business" for a discussion of cybersecurity risks that may impact us.


text: Trust underpins our mission and values and we believe that cybersecurity is important to our success. We are susceptible to a number of cybersecurity threats, including those common to most industries as well as those we face as a global media organization whose systems store and process confidential subscriber, user, employee and other personal and Company data. We, and third parties with which we work and on which we rely, regularly face attempts to breach our security and compromise our information technology systems from a broad range of actors. A cybersecurity incident impacting us or any such third party could disrupt our services, result in the compromise of confidential information; result in theft or misuse of our intellectual property; divert management's attention; require us to expend resources to mitigate the effects of such a security incident; subject us to litigation, regulatory or other government inquiries or investigations and/or liability; harm our reputation; or otherwise adversely affect our business, financial condition or results of operations.


text: Our cybersecurity department, led by our CISO, has primary responsibility for our enterprise-wide information security program, and our risk management team works closely with our cybersecurity department to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs on an ongoing basis. Our current CISO has held that position since 2022 and has broad information technology experience as a result of that role and past work experience. Our CISO manages a team with broad cybersecurity experience, including in cybersecurity threat management, cybersecurity training and education, incident response, cyber forensics, insider threats and regulatory compliance. The cybersecurity department receives support to maintain the information security program from other functions, such as information technology, corporate security, internal audit and legal. Our CISO is informed about and monitors prevention, detection, mitigation and remediation efforts through regular communication and reporting from the internal team. We also engage and rely on third parties to support our information security program, such as assessors, consultants, contractors, auditors and other third-party service providers. In addition, we maintain policies and processes to assess and manage risks relating to third-party service providers, based on the nature of the engagement with the third party and based on the information and information


text: P. 24 – THE NEW YORK TIMES COMPANY systems to which the third party will have access. We maintain policies to conduct due diligence before onboarding new service providers and maintain ongoing evaluations to ensure compliance with our security standards.


text: From time to time, we experience security incidents. As of the date of this report, no cybersecurity incidents have had a material adverse effect on our business, financial condition or results of operations. Notwithstanding our ongoing investments in our cybersecurity program, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cyber risk insurance, the costs relating to certain kinds of security incidents could be substantial, and our insurance may not be sufficient to cover losses related to any future incidents involving our data or systems.


text: See Item 1A. "Risk Factors — Risks Related to our Data Platform, Information Systems and Other Technology — Security incidents and other network and information systems disruptions could affect our ability to conduct our business effectively, cause us to incur significant costs, subject us to significant liability and/or damage our reputation" and "— Failure to comply with laws and regulations with respect to privacy, data protection and consumer marketing and subscriptions practices could adversely affect our business" for a discussion of cybersecurity risks that may impact us.


text: We believe that cybersecurity is a critical component of our enterprise risk management process, and as such, we have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: NPK International Inc.

ticker: NPKI


text: Our Board of Directors oversees management's enterprise risk management process, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our Chief Information Officer (CIO), regularly briefs the Board of Directors on our cybersecurity and information security, and we have processes by which certain cybersecurity incidents are escalated to the Board of Directors.


text: Our CIO, who reports to our Senior VP & Chief Financial Officer, oversees our cybersecurity function. The Cybersecurity Manager reports to the CIO, and the CIO and Cybersecurity Manager are responsible for assessing and managing risks from cybersecurity threats, as well as our overall information security strategy, policy, security engineering, operations, and cybersecurity threat detection and response, and reporting on cybersecurity matters to the Board and executive management.


text: Our CIO has a Master of Science in Information Systems and has served in various roles in information technology for over 25 years. Our Cybersecurity Manager has served in various roles in information technology and information security for over 25 years, with 10 of those years as the leader responsible for enterprise cybersecurity, including serving as the Information Security Officer at another larger publicly traded company.


text: Our CIO receives reports on cybersecurity threats from experienced information security personnel and third-party consultants and resources, and regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our processes and systems include automated tools and technical safeguards managed and monitored by our cybersecurity team. Additionally, we have a set of Company-wide policies and procedures regarding cybersecurity matters, which include an Information Security best practices intranet site, as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to email usage, remote network access, internet usage, passphrase usage, information technology acceptable use, data governance and privacy, and information security. These policies go through an internal review process and are approved by appropriate members of management. We periodically conduct penetration and vulnerability testing, data recovery testing, and security audits. We also conduct regular employee training on cybersecurity. With respect to our incident response, we have adopted a plan that applies in the event of a cybersecurity threat or incident to provide a framework for responding to such threats and incidents. Our plan sets out a coordinated approach to investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. We also employ processes designed to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an affect.


text: The Board's Oversight of Cybersecurity Risk Our Board of Directors oversees management's enterprise risk management process, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our Chief Information Officer (CIO), regularly briefs the Board of Directors on our cybersecurity and information security, and we have processes by which certain cybersecurity incidents are escalated to the Board of Directors.


text: Management's Involvement in the Oversight of Cybersecurity Risk Our CIO, who reports to our Senior Vice President & Chief Financial Officer, oversees our cybersecurity function. The Cybersecurity Manager reports to the CIO, and the CIO and Cybersecurity Manager are responsible for assessing and managing risks from cybersecurity threats, as well as our overall information security strategy, policy, security engineering, operations, and cybersecurity threat detection and response, and reporting on cybersecurity matters to the Board and executive management.


text: Risk Management and Strategy Our CIO receives reports on cybersecurity threats from experienced information security personnel and third-party consultants and resources, and regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our processes and systems include automated tools and technical safeguards managed and monitored by our cybersecurity team. Additionally, we have a set of Company-wide policies and procedures regarding cybersecurity matters, which include an Information Security best practices intranet site, as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to email usage, remote network access, internet usage, passphrase usage, information technology acceptable use, data governance and privacy, and information security. These policies go through an internal review process and are approved by appropriate members of management. We periodically conduct penetration and vulnerability testing, data recovery testing, and security audits. We also conduct regular employee training on cybersecurity.


text: With respect to our incident response, we have adopted a plan that applies in the event of a cybersecurity threat or incident to provide a framework for responding to such threats and incidents. Our plan sets out a coordinated approach to investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. We also employ processes designed to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers.


text: We also maintain what we believe are appropriate levels of cybersecurity insurance that covers settlements, judgments and defense costs arising out of a failure of network security, a privacy breach, media liability, business income loss resulting from a cyber event and for cyber extortion coverage. This cybersecurity insurance coverage also provides for certain breach response services in connection with incidents involving the theft, loss or unauthorized disclosure of third-party information, and computer system security breaches.


text: Cybersecurity Risk Management and Strategy Nordson Corporation manages cybersecurity risks by implementing processes for assessment, identification, and mitigation of cybersecurity threats. Nordson's cybersecurity program is designed to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, enabling us to develop policies regarding information access, asset protection and personal data security. However, this does not mean that we meet any particular technical standards, specifications or requirements, but rather that we use the NIST Cybersecurity Framework as a guide to help us identify, assess and manage cybersecurity risks and threats relevant to our business. We strive to protect our information assets through key cybersecurity measures, such as the implementation of multifactor authentication and advanced malware defenses, and we collaborate with internal stakeholders to establish layered cybersecurity defenses and restricted access based on business needs. We conduct regular continuous education sessions for our employees on cybersecurity awareness, including confidential information protection and simulated phishing attacks.

companyName: NORDSON CORP

ticker: NDSN


text: We engage with experts to assist with regular third-party penetration testing to evaluate our program against industry standards. We also have standing engagements with incident response experts and external counsel to enhance our cybersecurity resilience. We frequently collaborate with cybersecurity experts to share insights on threats, best practices and emerging trends.


text: Our cybersecurity risk management is a critical component of our comprehensive business continuity and enterprise risk management programs. Our information security team regularly collaborates with cross-functional subject matter experts and leaders to assess and enhance our cybersecurity risk posture and preparedness. Management employs the following defense mechanisms throughout the enterprise: employee training program to increase cybersecurity awareness, vulnerability management to identify and address potential weaknesses, multifactor authentication for secure access, tabletop exercises to simulate and prepare for potential incidents, and evaluation of third-party service providers, business partners and cloud suppliers, including through assessments of their cybersecurity practices prior to service utilization.


text: To date, management has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Nordson Corporation, including its business strategy, results of operations or financial condition. See "Item 1A. Risk Factors, Increased information technology threats and cybersecurity incidents and threats could pose a risk to our systems, networks, products, solutions and services and those of our business partners." above for more information. While we are committed to safeguarding our information and the proprietary and confidential information they contain, we note that no security measures can guarantee complete protection against cybersecurity incidents.


text: The Board of Directors, as a whole, has overarching responsibility for overseeing our strategic and operational risks. The Audit Committee specifically monitors risk management, including cybersecurity threats. Management, led by the Vice President, Information Systems and Technology, regularly reports to the Board of Directors, primarily through the Audit Committee, providing an annual report on specific risks, mitigation efforts, and a review of Nordson's cybersecurity maturity.


text: Management is responsible for day-to-day assessment and management of cybersecurity threats and risks. Nordson's Senior Director of Security and Compliance, primarily leads these efforts. The Vice President, Information Systems and Technology is responsible for oversight of Nordson's entire global IT operations, including the cybersecurity program and brings more than 25 years of experience and leadership across various information technology engineering, business and management roles, including direct oversight of strategic direction, program execution and operational excellence of technology initiatives.


text: Nordson Corporation 18 The Senior Director of Security and Compliance assesses cybersecurity readiness using a variety of tools, including internal assessment tools as well as third-party control tests, vulnerability assessments, audits and evaluation against industry standards. Our security and compliance organization elevates issues relating to cybersecurity to our Chief Executive Officer and Board of Directors, such as potential threats or vulnerabilities. We also seek to prevent, detect, mitigate and remediate cybersecurity incidents by employing various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards.


text: Our Vice President, Information Systems and Technology meets regularly with the Audit Committee to review our information technology systems and discuss key cybersecurity risks. Additionally, the Director, Internal Audit and Chief Financial Officer presents an overview of our global enterprise risk management program, including cybersecurity risks, to the Audit Committee, which is subsequently reported to the Board of Directors.


text: The Board of Directors, as a whole, has overarching responsibility for overseeing our strategic and operational risks. The Audit Committee specifically monitors risk management, including cybersecurity threats. Management, led by the Vice President, Information Systems and Technology, regularly reports to the Board of Directors, primarily through the Audit Committee, providing regular reports on specific risks, mitigation efforts, and a review of Nordson's cybersecurity maturity.


text: Management is responsible for day-to-day assessment and management of cybersecurity threats and risks. Nordson's Chief Information Security Officer ("CISO"), primarily leads these efforts. The Vice President, Information Systems and Technology is responsible for oversight of Nordson's entire global IT operations, including the cybersecurity program and brings more than 25 years of experience and leadership across various information technology engineering, business and management roles, including direct oversight of strategic direction, program execution and operational excellence of technology initiatives.


text: Nordson Corporation 18 The CISO assesses cybersecurity readiness using a variety of tools, including internal assessment tools as well as third-party control tests, vulnerability assessments, audits and evaluation against industry standards. Our security and compliance organization elevates issues relating to cybersecurity to our Chief Executive Officer and Board of Directors, such as potential threats or vulnerabilities. We also seek to prevent, detect, mitigate and remediate cybersecurity incidents by employing various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards.


text: Nordstrom understands that establishing, executing and sustaining effective cybersecurity measures to secure our information systems and preserve the confidentiality, integrity and availability of our data is critical to the success of the business.

companyName: NORDSTROM INC


text: Management of Material Risks and Integrated Overall Risk Management Our comprehensive risk management framework is intended to strategically incorporate cybersecurity risk management across the company, with the objective of ensuring that cybersecurity considerations underpin the decision-making processes at all organizational levels. Our risk management team collaborates closely across various Enterprise-wide business units to continually assess and address identified cybersecurity risks in alignment with business objectives. The CISO regularly updates the CTIO, Chief Financial Officer and Chief Executive Officer on material cybersecurity risks and events.


text: Engagement with Third Parties on Management of Cybersecurity Risk Recognizing the dynamic nature of cybersecurity threats, Nordstrom collaborates with external experts, including assessors, consultants and examiners, to evaluate and test our cybersecurity risk preparedness. Regular exams, threat assessments and consultation on security enhancements with these third parties ensure that our cybersecurity strategies align with industry best practices.


text: Oversight of Third-party Risk In the course of our business, we regularly exchange data and information with certain third parties in various ways, exposing us to risk related to the cybersecurity posture of and information management practices of those third parties. To try to mitigate this risk, we have implemented processes that may, depending upon the nature of the relationship with the third party, require security assessments and data integration design reviews prior to allowing our systems to connect with theirs. In addition, we seek to require these third parties to adhere to pre-established cybersecurity standards. Where applicable, we try to obtain contractual commitments with those third parties to ensure these security requirements are met.


text: Risks from Cybersecurity Threats Nordstrom has not experienced any cybersecurity incident that has materially impacted, or that is reasonably likely to materially impact, our operations, financial condition and cash flows.


text: Cybersecurity Risk Management Personnel Primary responsibility for assessing, monitoring, mitigating and managing our cybersecurity risks rests with our information security organization, led by our CISO and supported by our CTIO. The CISO, who has over 20 years of cybersecurity and technology expertise, supports a skilled information security organization that brings expertise in vulnerability management, incident response, penetration testing, regulatory compliance and other critical information security domains. Our information security team maintains certifications from recognized external security authorities such as ISC2, CompTIA, ISACA, GIAC, SANS, PCI and OffSec. The security program is assessed annually by a reputable third party to provide guidance for continuous improvement.


text: Monitoring and Responding to Cybersecurity Incidents The security organization stays informed about the latest developments in cybersecurity, implements processes for regular monitoring of information systems and deploys relevant security measures. In the event of a cybersecurity incident, a formal incident response plan is in place for immediate actions and long-term strategies.


text: Board of Directors Oversight The Board of Directors has oversight responsibilities regarding cybersecurity risk. At regularly scheduled meetings (at least quarterly), in addition to such additional interactions as may be necessary in specific circumstances, our Chief Executive Officer, CTIO and CISO update the Board on emerging cybersecurity risks and developments impacting Nordstrom.


text: Management of Material Risks and Integrated Overall Risk Management Our comprehensive risk management framework is intended to strategically incorporate cybersecurity risk management across the company, with the objective of ensuring that cybersecurity considerations underpin the decision-making processes at all organizational levels. Our risk management team collaborates closely across various Enterprise-wide business units to continually assess and address identified cybersecurity risks in alignment with business objectives. The CTIO regularly updates the Chief Financial Officer and Chief Executive Officer on material cybersecurity risks and events.


text: Risks from Cybersecurity Threats Nordstrom has not experienced any cybersecurity incident that has materially impacted, or that is reasonably likely to materially impact, our operations, financial condition or cash flows.


text: Cybersecurity Risk Management Personnel Primary responsibility for assessing, monitoring, mitigating and managing our cybersecurity risks rests with our information security organization, currently led by our CTIO. The CTIO has over 25 years of experience leading technology teams in retail and in many highly regulated industries including Healthcare, Pharmaceuticals and Financial Services. Our CTIO supports a skilled information security organization that brings expertise in vulnerability management, incident response, penetration testing, regulatory compliance and other critical information security domains. Our information security team maintains certifications from recognized external security authorities such as ISC2, CompTIA, ISACA, GIAC, SANS, PCI and OffSec. The security program is assessed annually by a reputable third party to provide guidance for continuous improvement.


text: Board of Directors Oversight The Board of Directors has oversight responsibilities regarding cybersecurity risk. At regularly scheduled meetings (at least quarterly), in addition to such additional interactions as may be necessary in specific circumstances, our Chief Executive Officer and CTIO update the Board on emerging cybersecurity risks and developments impacting Nordstrom.


text: The Trust is a grantor trust, conducts no active operations, has no customers, and maintains no personal or credit data. The Trust's from cybersecurity threats are tailored to its specific circumstances.

companyName: NORTH EUROPEAN OIL ROYALTY TRUST

ticker: NRT


text: The Trust's cybersecurity protocols include, but are not limited to, and intrusions, and isolated computer workstations. The Trust's personnel are aware of the potential of a cybersecurity incident and exercise caution to ensure no such incident occurs. The primary entities with which the Trust conducts business are banks, outside service providers, and vendors, which have their own cybersecurity protocols. Interactions between the Trust's information facilities passwords, passphrases, and two-factor or independent authorizations.


text: There have been no known cybersecurity incidents that have had a material impact, have materially affected or are reasonably likely to materially affect the Trust, including its business strategy, results of operations, or financial condition.


text: The Managing Director oversees the Trust's cybersecurity protocols and conducts regular discussions and reviews of such protocols with the Trust's Board of Trustees.


text: The Company's policies, practices and technologies allow it to protect its information systems and operational assets from threats. The Board of Trustees and its Finance and Audit Committees continue to provide substantial and focused attention to cyber and system security. The Finance Committee of the Board of Trustees is responsible for oversight of the Company's enterprise-wide risks, including risks associated with cyber and physical security, and the Company's programs and practices to monitor and mitigate these risks.

companyName: NSTAR ELECTRIC CO

ticker: NSARO


text: Management prepares comprehensive cyber security reports that are discussed at each meeting of the Finance Committee. The reports focus on the changing threat landscape and the risks to the Company, describe Eversource's cyber security drills and exercises, attempted and actual breaches on our systems, cyber incidents within the utility industry and around the world, and mitigation strategies. In addition, third-party experts of cyber security risks provide periodic assessments to the utility industry and the Company in particular to the Finance Committee. The Company regularly reviews and updates its cyber and system security programs, and the Finance Committee continues to enhance its robust oversight activities, including meetings with financial, information technology, legal and accounting management, other members of the Board, representatives of the Company's independent registered public accounting firm, and outside advisors and experts in cyber security risks, at which cyber and system security programs and issues that might affect the Company's financial statements and operational systems are discussed.


text: The Company has a robust Enterprise Risk Management Program which has identified cyber security as a top enterprise risk. The managing and monitoring of risks are the responsibility of the Company's Risk Committee, which meets quarterly and is chaired by the Chief Financial Officer.


text: The Company is committed to continuous monitoring and assessment of cyber security controls. The Chief Information Security Officer is responsible for developing, implementing, and enforcing our cyber security program and information security policies to protect the Company's information systems and operational assets. The Chief Information Security Officer position requires at least 15 years of relevant information security experience and relevant security certifications. The Chief Information Security Officer reports directly to the Chief Information Officer and provides regular updates to the executive management team. Our Chief Information Security Officer has over 20 years of relevant experience.


text: The Company created a Cyber Governance Committee, which includes the Chief Information Security Officer, Chief Information Technology Officer, Chief Accounting Officer, members of the executive management team, and other assurance functions such as Corporate Compliance, Enterprise Risk Management, and Internal Audit.


text: To assess, identify and manage material risks from cybersecurity threats and to prevent, detect, mitigate and remediate a cyber security or ransomware incident, the following key processes and programs have been implemented and are performed by the Company's Cyber Security Group, which is overseen by the Chief Information Security Officer: • Implementation of security solutions and standards based on industry best practices to prevent unauthorized access. The Company's cyber program has been modeled after the National Institute of Standards and Technology framework; a widely accepted framework utilized by critical infrastructure industries. • Periodic external assessments, including outside system access testing, are performed. Rigorous auditing of all safeguards is performed on a regular basis. Risk assessments are held to identify and address new and changing risks to protect systems and sensitive data. Identified areas are monitored and improvements are implemented. • Eversource participates in information sharing programs both within and outside the utility industry, including with the U.S. government and industry organizations, to be able to identify and respond to emerging threats. • The Company maintains current incident response and business continuity plans, which are periodically updated and tested. • Network activity is monitored on an ongoing basis. • Anti-phishing and malware tools are utilized and assessed. • Employees are trained to recognize phishing attempts and are periodically tested. Results of phishing testing are benchmarked against other companies both within and outside the utility industry.


text: Specific to third parties, Eversource has implemented formal screening processes for any applicable vendors by the Company's Cyber Security Group as part of the Procurement process. The vendors are risk ranked based on the type of work being performed. Periodic rescreening is performed on critical vendors. Vendors are required to attest to their business continuity programs and provide evidence of appropriate insurance and indemnification agreements. The Company bars sourcing from countries included on the Department of Homeland Security's list of Prohibited Nations to further protect the Company's supply chain. The Company maintains cyber insurance which covers breaches of networks and operational technology. Our existing insurance limits may be inadequate to cover a material cyber incident. This could expose us to potentially significant claims and damages.


text: As of December 31, 2023, there were no risks from cybersecurity threats, including due to any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operations, or financial condition.


text: The Company's policies, practices and technologies allow it to protect its information systems and operational assets from threats. The Board of Trustees and its Finance and Audit Committees continue to provide substantial and focused attention to cyber and system security. The Finance Committee of the Board of Trustees is responsible for oversight of the Company's enterprise-wide risk s, including risks associated with cyber and physical security, and the Company's programs and practices to monitor and mitigate these risks.


text: The Company has a robust Enterprise Risk Management Program that has identified cyber security as a top enterprise risk. The managing and monitoring of risks are the responsibility of the Company's Risk Committee, which meets quarterly and is chaired by the Chief Financial Officer. Members include key leaders of the Company, including the Chief Information Officer.


text: To assess, identify and manage material risks from cybersecurity threats and to prevent, detect, mitigate and remediate a cyber security incident, the following key processes and programs have been implemented and are performed by the Company's Cyber Security Group, which is overseen by the Chief Information Security Officer: • Implementation of security solutions and standards based on industry best practices to prevent unauthorized access. The Company's cyber program has been modeled after the Department of Energy's Cyber Capability Maturity Model and the National Institute of Standards and Technology framework; both widely accepted frameworks utilized by utilities and other critical infrastructure industries. • Periodic external assessments, including outside system access testing, are performed. Rigorous auditing of all safeguards is performed on a regular basis. Risk assessments are held to identify and address new and changing risks to protect systems and sensitive data. Identified areas are monitored and improvements are implemented. • Eversource participates in information sharing programs both within and outside the utility industry, including with the U.S. government and industry organizations, to be able to identify and respond to emerging threats. • Established an Artificial Intelligence Executive Working Committee to ensure a "Secure by Design" approach to implementations of artificial intelligence. • The Company maintains current incident response and business continuity plans, which are periodically updated and tested. • Network activity is monitored on an ongoing basis. • Anti-phishing and malware tools are utilized and assessed. • Employees are trained to recognize phishing attempts and are periodically tested. Results of phishing testing are benchmarked against other companies both within and outside the utility industry.


text: As of December 31, 2024, there were no cyber incidents that have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operations, or financial condition.


text: As described in Item 1A – Risk Factors, Xcel Energy operates in an industry that requires the continued operation of sophisticated information technology, control systems and network infrastructure, as such, our business is subject to the risk of interruption by cybersecurity incidents that range from attacks common to most industries, such as phishing and denial-of-service, to attacks from more sophisticated adversaries, including nation state actors, that target the critical infrastructure used in the operation of our business.

companyName: XCEL ENERGY INC

ticker: XEL


text: The Company has a security risk program in place to identify, assess, manage and report material risks from cybersecurity incidents. As a utility provider, Xcel Energy complies with reliability standards imposed by NERC, including critical infrastructure protection standards related to both cybersecurity and physical security. These standards imposed by NERC, in alignment with the NIST Cybersecurity Framework, are the basis for which Xcel Energy has designed the cybersecurity control framework within its security risk program.


text: Annually, as part of Xcel Energy's enterprise risk program, an integrated cybersecurity risk identification and assessment is completed across Xcel Energy's business, including generation, transmission, distribution and fuel storage facilities, information technology systems and other infrastructure or physical assets as well as information processed in our systems (including systems hosted by third parties) that could be affected by cybersecurity incidents. This analysis includes the impact, likelihood, timeframe and controllability of cybersecurity risks and is presented to the Board of Directors. Management monitors and reviews the results of this analysis, integrating them into the enterprise risk assessment processes and implements appropriate mitigating actions as needed.


text: Xcel Energy's cybersecurity policies, standards, practices and readiness are regularly assessed by third-party consultants. These partners are engaged to perform independent penetration testing and other security related services to assist in the prevention, detection, monitoring, mitigation and remediation of cybersecurity incidents and risks. The results of these assessments are communicated to management and the Board of Directors by the Chief Security Officer.


text: Xcel Energy employs a comprehensive risk based approach to assess the magnitude and significance of a vendor's risk to the Company. Certain third-party service providers are subject to vendor security risk assessments at the time of integration, contract execution/renewal, and upon detection of any increase in risk profile. Xcel Energy uses a variety of inputs in such risk assessments, including information supplied by providers and third parties (including information analysis centers that share daily threat intelligence and improve organizational agility associated with management of cybersecurity risks). In addition, the Company requires certain third-party service providers to meet appropriate security requirements, controls and responsibilities. The Company deploys periodic monitoring activities to assess compliance with our cybersecurity control framework and investigates security incidents that have impacted our third-party service providers as appropriate.


text: Management has assigned responsibility for the security risk program to the Chief Security Officer who has extensive experience in critical infrastructure protection, including multiple years of experience with the Department of Defense. The Chief Security Officer is informed about and monitors prevention, detection, mitigation and remediation efforts through a team of security professionals, many of whom are Certified Information Systems Security Professionals, Certified Information Security Managers or have received other cybersecurity certifications. The team has extensive experience selecting, deploying and operating cybersecurity technologies, initiatives and processes that aid in preventing, remediating and mitigating known and unknown cybersecurity threats.


text: The Chief Security Officer or members of management brief the Board on routine and regular cybersecurity risk and threat updates, typically on a quarterly basis. In the event of a significant threat or incident, management and the Chief Security Officer leverage Xcel Energy's incident response processes to assess impacts and resolve incidents. When a significant cybersecurity incident occurs, management communicates with the Board of Directors and relevant committees.


text: The Board of Directors oversees the risks associated with cybersecurity and the physical security of our assets, with information security matters being discussed at each regular board meeting as well as at the ONES and Audit Committee meetings throughout the year.


text: While the ONES Committee has primary committee responsibility for cybersecurity due to the operational issues involved, the Board of Directors has determined that the topic is of sufficient importance to warrant this comprehensive oversight approach. Augmenting such oversight efforts, the Board of Directors conducts drills to practice its response in a possible emergency situation to ensure it is well prepared and positioned to perform in a possible crisis.


text: Cybersecurity risks are a part of Xcel Energy's normal course of business. To date, no cybersecurity incident or attack has had a material impact on our business or results of operations. As of Feb. 21, 2024 there have been no material cybersecurity incidents to report.


text: Xcel Energy's cybersecurity policies, standards, practices, annual cybersecurity training content and readiness are regularly assessed by third-party consultants. These partners are engaged to perform independent penetration testing and other security related services to assist in the prevention, detection, monitoring, mitigation and remediation of cybersecurity incidents and risks. The results of these assessments are communicated to management and the Board of Directors by the Chief Security Officer.


text: Management has assigned responsibility for the security risk program to the Chief Security Officer who has multiple years of experience in the Defense Industrial Base. The Chief Security Officer is informed about and monitors prevention, detection, mitigation and remediation efforts through a team of security professionals, many of whom are Certified Information Systems Security Professionals, Certified Information Security Managers or have received other cybersecurity certifications. The team has extensive experience selecting, deploying and operating cybersecurity technologies, initiatives and processes that aid in preventing, remediating and mitigating known and unknown security threats.


text: The Chief Security Officer or members of management brief the Board on routine and regular cybersecurity risk and threat updates, typically on an annual basis. In the event of a significant threat or incident, management and the Chief Security Officer leverage Xcel Energy's incident response processes to assess impacts and resolve incidents. When a significant cybersecurity incident occurs, management communicates with the Board of Directors and relevant committees.


text: The Board of Directors oversees the risks associated with cybersecurity and the physical security of our assets, with information security matters being discussed at board meetings as well as at the ONES and Audit Committee meetings throughout the year.


text: While the ONES Committee has primary committee responsibility for cybersecurity due to the operational issues involved, the Board of Directors has determined that the topic is of sufficient importance to warrant this comprehensive oversight approach. Augmenting such oversight efforts, the enterprise has the ability to notify and update the Board of Directors in the event of a possible crisis situation.


text: Cybersecurity risks are a part of Xcel Energy's normal course of business. To date, no cybersecurity incident or attack affecting us or our vendors has had a material impact on our business or results of operations. As of Feb. 27, 2025 there have been no material cybersecurity incidents to report.


text: NSP-Wisconsin is a wholly owned subsidiary of Xcel Energy. As such, its cybersecurity processes are maintained by Xcel Energy management and governed by its Board of Directors. As described in Item 1A – Risk Factors, Xcel Energy operates in an industry that requires the continued operation of sophisticated information technology, control systems and network infrastructure, as such, our business is subject to the risk of interruption by cybersecurity incidents that range from attacks common to most industries, such as phishing and denial-of-service, to attacks from more sophisticated adversaries, including nation state actors, that target the critical infrastructure used in the operation of our business.

companyName: NORTHERN STATES POWER CO /WI/


text: Xcel Energy has a security risk program in place to identify, assess, manage and report material risks from cybersecurity incidents. As a utility provider, Xcel Energy complies with reliability standards imposed by NERC, including critical infrastructure protection standards related to both cybersecurity and physical security. These standards imposed by NERC, in alignment with the NIST Cybersecurity Framework, are the basis for which Xcel Energy has designed the cybersecurity control framework within its security risk program.


text: Xcel Energy employs a comprehensive risk based approach to assess the magnitude and significance of a vendor's risk to Xcel Energy. Certain third-party service providers are subject to vendor security risk assessments at the time of integration, contract execution/renewal, and upon detection of any increase in risk profile. Xcel Energy uses a variety of inputs in such risk assessments, including information supplied by providers and third parties (including information analysis centers that share daily threat intelligence and improve organizational agility associated with management of cybersecurity risks). In addition, Xcel Energy requires certain third-party service providers to meet appropriate security requirements, controls and responsibilities. Xcel Energy deploys periodic monitoring activities to assess compliance with our cybersecurity control framework and investigates security incidents that have impacted our third-party service providers as appropriate.


text: While the ONES Committee has primary committee responsibility for cybersecurity due to the operational issues involved, the Board of Directors has determined that the topic is of sufficient importance to warrant this comprehensive oversight approach. Augmenting such oversight efforts, the Board conducts drills to practice its response in a possible emergency situation to ensure it is well prepared and positioned to perform in a possible crisis.


text: The Company has a security risk program in place to identify, assess, manage and report material risks from cybersecurity incidents. As a utility provider, Xcel Energy complies with reliability standards imposed by NERC, including critical infrastructure protection standards related to both cybersecurity and physical security. These standards imposed by NERC, in alignment with the NIST Cybersecurity Framework, are the basis for which Xcel Energy has designed the cybersecurity control framework within its security risk program.


text: Annually, as part of Xcel Energy's enterprise risk program, an integrated cybersecurity risk identification and assessment is completed across Xcel Energy's business, including generation, transmission, distribution and fuel storage facilities, information technology systems and other infrastructure or physical assets as well as information processed in our systems (including systems hosted by third parties) that could be affected by cybersecurity incidents. This analysis includes the impact, likelihood, timeframe and controllability of cybersecurity risks and is presented to the Board of Directors. Management monitors and reviews the results of this analysis, integrating them into the enterprise risk assessment processes and implements appropriate mitigating actions as needed.


text: Xcel Energy employs a comprehensive risk based approach to assess the magnitude and significance of a vendor's risk to the Company. Certain third-party service providers are subject to vendor security risk assessments at the time of integration, contract execution/renewal, and upon detection of any increase in risk profile. Xcel Energy uses a variety of inputs in such risk assessments, including information supplied by providers and third parties (including information analysis centers that share daily threat intelligence and improve organizational agility associated with management of cybersecurity risks). In addition, the Company requires certain third-party service providers to meet appropriate security requirements, controls and responsibilities. The Company deploys periodic monitoring activities to assess compliance with our cybersecurity control framework and investigates security incidents that have impacted our third-party service providers as appropriate.


text: Cybersecurity risks are a part of Xcel Energy's normal course of business. To date, no cybersecurity incident or attack affecting us or our vendors has had a material impact on our business or results of operations. As of Feb. 27, 2025, there have been no material cybersecurity incidents to report.


text: Northern Trust understands the importance of managing cybersecurity risk to ensure the safety and security of our data and systems. The Business Risk Committee of the Board of Directors (Business Risk Committee), which reports regularly to the Board, oversees management's actions to identify, assess, mitigate and remediate material issues related to cybersecurity and technology risk as part of our enterprise risk management program and processes. The Cybersecurity Risk Oversight Subcommittee, chaired by the former chief information officer and chief transformation officer of a Fortune 50 company, assists the Business Risk Committee in discharging its oversight duties with respect to cybersecurity risk and meets on a regular basis to provide for an even deeper focus on, and governance framework around, cybersecurity risks inherent in the Corporation's business. The Business Risk Committee, Cybersecurity Risk Oversight Subcommittee, and the Board are regularly briefed on the organization's cybersecurity posture by senior management, including the Chief Executive Officer, Chief Information Officer (CIO), Chief Risk Officer, Head of Non-Financial Risk and Chief Information Risk Officer (CIRO), and Chief Information Security Officer (CISO). The CISO, a Certified Information Systems Security Professional (CISSP) with nearly 30 years of relevant experience, reports to the CIO and is responsible for identifying, managing, and, if necessary, remediating cybersecurity risk to ensure the protection of our data, network, and systems. The primary management-level committees responsible for assessing and managing cybersecurity risk are the Information Technology Oversight Committee, chaired by the CIO, who has over 20 years of experience in technology leadership roles, and the Information Technology Risk Committee, chaired by the CIRO, who has over 20 years of cybersecurity and risk management experience.

companyName: NORTHERN TRUST CORP

ticker: NTRS


text: Effective management of risks related to the confidentiality, integrity, and availability of information is crucial in an environment of increasing cybersecurity threats and requires a structured approach to establish and communicate expectations and required practices. Northern Trust's cybersecurity and technology risk management program provides the overall structure for managing the respective risks in a sustainable manner supported by an organizational structure that reflects support from executive management and includes risk committees comprised of members from across the business. The program is supported by the Cyber and Technology Risk Management Policy and Framework approved by the Business Risk Committee. The Cyber and Technology Risk Management Policy and Framework are based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework and provide a comprehensive overview of cybersecurity and technology risk management governance activities pertaining to the confidentiality of information, integrity of systems, data and processes, and the availability of business functions that may be adversely impacted. These governance processes, internal controls, and risk management practices, which are part of our enterprise risk management program and processes, are designed to keep risk at levels appropriate to Northern Trust's overall risk appetite and the inherent risk in the markets in which Northern Trust operates. Northern Trust employees are responsible for promoting cybersecurity as well as adhering to applicable policies and standards to safeguard data and business systems. In cases where Northern Trust relies on vendors to perform services, controls are routinely reviewed for alignment with industry standards and their ability to protect information. Any findings identified are remediated following a risk-based approach. In addition to the cybersecurity controls managed and monitored within the organization, Northern Trust uses external third-party security teams on a regular basis to assess effectiveness of our cybersecurity program and controls. These teams perform program maturity assessments, penetration tests, security assessments, and reviews of Northern Trust's vulnerability to cyber-attacks. Northern Trust also operates a global security operations center for threat identification and response. This center aggregates security threat information from systems and platforms across the business and alerts the organization in accordance with its documented Cybersecurity Incident Response Plan.


text: The Cybersecurity Incident Response Plan was developed to respond to cybersecurity incidents. A cybersecurity incident can include, but is not limited to, disruptions of service, denials-of-service, compromises of information systems, data exfiltration or data corruption. The plan provides a streamlined approach that can be invoked rapidly to address matters that raise enterprise concern and to communicate impact, actions, and status to senior management, including the CISO, CIRO, and appropriate stakeholders. The plan design includes enterprise-level response plans, including escalation to appropriate Board-level governance committees, and is reviewed, tested, and updated regularly.


text: Northern Trust's disclosure procedures and controls also address cybersecurity incidents and include elements to ensure an analysis of potential disclosure obligations arising from any such incidents. Northern Trust maintains compliance programs to address the applicability of restrictions on securities trading while in possession of material, nonpublic information, including instances in which such information may relate to cybersecurity incidents.


text: Northern Trust also maintains a comprehensive Information and Cyber Security Training and Awareness practice providing baseline and targeted education and awareness for employees and contractors. This program includes at least one required annual online training class for all employees and contractors, supplemental refresher training throughout the year, targeted training based on roles and risk levels, multiple simulated phishing and vishing attacks with associated training, the distribution of regular cybersecurity awareness materials, and the designation of individuals as Information Security and Privacy champions within the businesses.


text: To date, Northern Trust has not identified any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity threat or incident. For more information about these risks, see, "Breaches of our security measures, including, but not limited to, those resulting from cyber-attacks or other information security incidents, may result in losses," in Item 1A, "Risk Factors."


text: Risk management and strategy Northern Trust understands the importance of managing cybersecurity risk to ensure the safety and security of our data, network and systems. Our cybersecurity program is regularly assessed by Audit Services through various assurance activities, with the results reported to the Audit Committee of the Board of Directors (Audit Committee), and by the Non-Financial Risk team, with the results reported to the Business Risk Committee of the Board of Directors (Business Risk Committee). Northern Trust also operates a global security operations center for threat identification and response. The center aggregates security threat information from systems and platforms across the business and alerts the organization in accordance with its documented Cybersecurity Incident Response Plan. In addition to the cybersecurity controls managed and monitored within the organization, Northern Trust uses external third-party security teams on a regular basis to assess the effectiveness of our cybersecurity program and controls. These teams perform program maturity assessments, penetration tests, security assessments, and reviews of Northern Trust's vulnerability to cyber-attacks. Annually, certain elements of the cybersecurity program are subject to an audit by an independent consultant, as well as an assessment by a separate, independent third party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the Board. Our cybersecurity program is also examined regularly by the Corporation's prudential and conduct regulators within the scope of their jurisdiction.


text: The Cybersecurity Incident Response Plan was developed to respond to cybersecurity incidents. A cybersecurity incident starts with malicious intent and can include, but is not limited to, disruptions of service, denials-of-service, compromises of information systems, data exfiltration or data corruption. The plan provides a streamlined approach that includes enterprise-level response plans. The plans can be invoked rapidly to address matters that raise enterprise concern and to communicate impact, actions, and status to senior management, including the Chief Information Security Officer (CISO), and appropriate stakeholders, including escalation to appropriate Board-level governance committees, and is reviewed, tested, and updated regularly.


text: The Business Risk Committee, which reports regularly to the Board, oversees management's actions to identify, assess, mitigate and remediate material issues related to cybersecurity and technology risk as part of our enterprise risk management program and processes. The Cybersecurity Risk Oversight Subcommittee of the Business Risk Committee, chaired by the former chief information officer and chief transformation officer of a Fortune 50 company, assists the Business Risk Committee in discharging its oversight duties with respect to cybersecurity risk and meets on a regular basis to provide for an even deeper focus on, and governance framework around, cybersecurity risks inherent in the Corporation's business. The Business Risk Committee, Cybersecurity Risk Oversight Subcommittee, and the Board are regularly briefed on the organization's cybersecurity posture by senior management, including the Chief Executive Officer, Chief Information Officer (CIO), Chief Risk Officer, Head of Non-Financial Risk, Head of Cyber and Technology Risk, and CISO. The CISO has over 20 years of experience leading teams at financial institutions, including in the areas of risk management and information security, reports to the CIO and is responsible for identifying, managing, and, if necessary, remediating cybersecurity risk to ensure the protection of our data, network, and systems. The primary management-level committees responsible for assessing and managing cybersecurity risk are the Information Technology Oversight Committee, chaired by the CIO, who has over 20 years of experience in technology leadership roles, and the Information Technology Risk Committee, chaired by the Head of Cyber and Technology Risk, who has over 20 years of cybersecurity and risk management experience.


text: Effective management of risks related to the confidentiality, integrity, and availability of information is crucial in an environment of increasing cybersecurity threats and requires a structured approach to establish and communicate expectations and required practices. Northern Trust's cybersecurity and technology risk management program provides the overall structure for identifying, assessing and managing the respective risks in a sustainable manner supported by an organizational structure that reflects support from executive management and includes risk committees comprised of members from across the business. The program is supported by the Cyber and Technology Risk Management Policy approved by the Business Risk Committee. The Cyber and Technology Risk Management Policy and Framework are based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework and Cyber Risk Institute (CRI) Profile and provide a comprehensive overview of cybersecurity and technology risk management governance activities pertaining to the confidentiality of information, integrity of systems, data and processes, and the availability of business functions that may be adversely impacted. These governance processes, internal controls, and risk management practices, which are part of our enterprise risk management program and processes, are designed to keep risk at levels appropriate to Northern Trust's overall cyber risk appetite and the inherent risk in the markets in which Northern Trust operates. Northern Trust employees are responsible for promoting cybersecurity best practices as well as adhering to applicable policies and standards to safeguard data and business systems. In cases where Northern Trust relies on third-party vendors to perform services, controls are routinely reviewed for alignment with industry standards and their ability to protect information in accordance with Northern Trust's Third-Party Risk Management Program.


text: To date, Northern Trust has not identified any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity threat or incident. For more information about these risks, see "Breaches of our security measures, including, but not limited to, those resulting from cyber-attacks or other information security incidents, may result in losses," in Item 1A, "Risk Factors."


text: Risk Management and Strategy Oceaneering continues to make cybersecurity a priority as the threat landscape evolves and becomes increasingly complex and sophisticated.

companyName: OCEANEERING INTERNATIONAL INC

ticker: OII


text: Managing Material Risks & Integrated Overall Risk Management The Company has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cyber risk awareness. Our Chief Information Technology Officer ("CITO") and Chief Information Security Officer ("CISO") work closely with our Enterprise Risk Committee, which oversees—in part—cybersecurity, to continuously evaluate and address cyber risks in alignment with business objectives, operational needs and industry-accepted standards, such as the National Institute of Standards and Technology ("NIST") and the Cybersecurity Maturity Model Certification ("CMMC") frameworks.


text: The Company has processes and procedures in place to monitor the prevention, detection, mitigation and remediation of cybersecurity risks. These include but are not limited to: • Maintaining a defined and practiced incident response plan with dedicated Cybersecurity Event Response and Corporate Crisis Management Teams, including maintaining a 24/7 security operations center ("SOC"); • Maintaining cyber insurance coverage; • Employing appropriate incident prevention and detection safeguards; • Maintaining a defined disaster recovery policy and employing disaster recovery software, where appropriate; • Educating, training and testing our user community on information security practices and identification of potential cybersecurity risks and threats; and • Reviewing and evaluating new developments in the cyber threat landscape.


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity risk, Oceaneering engages with a range of external support, including cybersecurity consultants, in evaluating, monitoring and testing our cyber management systems and related cyber risks. The Company's collaboration with these third parties includes audits, threat and vulnerability assessments, incident response plan testing, company-wide monitoring of cybersecurity risks and consultation on security enhancements.


text: Managing Third Party Risk Oceaneering recognizes the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough risk-weighted security assessments of various third-parties and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes both annual assessments and assessments on an ongoing basis.


text: Risks from Cybersecurity Incidents To our knowledge, Oceaneering has not been subject to cybersecurity incidents that have materially affected, or are reasonably likely to materially affect the Company, its operations or financial standing.


text: Risk Management Personnel Oceaneering's cybersecurity risk management program is overseen by management at multiple levels. The CITO and the Director of IT Security play key roles in assessing, monitoring and managing the Company's cybersecurity risks with support of the Enterprise Risk Committee, as well as dedicated information technology and security personnel. Our CITO has over 18 years of experience as an information technology executive, and earned a Bachelor's and Master's degrees in Management Information Systems. Our Director of IT Security has almost 25 years of experience managing global information technology security and has served as Oceaneering's CISO since 2018. Our Director of IT Security earned a Bachelor's degree in Business and has several relevant certifications including Risk and Information Systems Control ("CRISC"), Information Systems Auditor ("CISA"), Information Systems Security Architecture ("ISSAP"), Security Certified Network ("SCNP"), Information Systems Security ("CISSP") and Cisco Certified Network Associate ("CCNA").


text: Monitor Cybersecurity Incidents Our CITO and Director of IT Security are continually informed and updated about the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. They implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Company is equipped with a defined and practiced incident response plan managed by a dedicated Cybersecurity Event Response Team and Corporate Crisis Management Team. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Board of Director Oversight The Audit Committee of the Company's Board of Directors is responsible for overseeing the Company's cyber risk. The Audit Committee receives regular updates that encompass a broad range of topics, including: • Current cybersecurity threat landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from unique cybersecurity events, including those of other companies; • Compliance status and efforts with regulatory requirements and industry standards; • Regulatory updates; • Vulnerability developments; and • Other cyber risk topics as requested by the Board.


text: Our Chairman of the Board, Mr. M. Kevin McEvoy, has earned a National Association of Corporate Directors ("NACD") Cybersecurity Oversight certification and a Computer Early Response Team ("CERT") Cybersecurity Oversight Certification from Software Engineering Institute, and our Board is composed of directors with diverse qualifications, skills and expertise, including risk management, technology and finance, that we believe equip them to oversee cybersecurity risks effectively.


text: Managing Material Risks & Integrated Overall Risk Management The Company has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cyber risk awareness. Our Chief Information Technology Officer ("CITO") and Chief Information Security Officer ("CISO") work closely with our Enterprise Risk Committee to continuously evaluate and address cyber risks in alignment with business objectives, operational needs and industry-accepted standards, such as the National Institute of Standards and Technology ("NIST") and the Cybersecurity Maturity Model Certification ("CMMC") frameworks.


text: Managing Third Party Risk Oceaneering recognizes the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough risk-weighted security assessments of various third parties and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes both annual assessments and assessments on an ongoing basis.


text: Risk Management Personnel Oceaneering's cybersecurity risk management program is overseen by management at multiple levels. The CITO and the Director of IT Security play key roles in assessing, monitoring and managing the Company's cybersecurity risks with support of the Enterprise Risk Committee, as well as dedicated information technology and security personnel. Our CITO has 20 years of experience as an information technology executive, and earned a Bachelor's and Master's degrees in Management Information Systems. Our Director of IT Security has 25 years of experience managing global information technology security and has served as Oceaneering's CISO since 2018. Our Director of IT Security earned a Bachelor's degree in Business and has several relevant certifications including Risk and Information Systems Control ("CRISC"), Information Systems Auditor ("CISA"), Information Systems Security Architecture ("ISSAP"), Security Certified Network ("SCNP"), Information Systems Security ("CISSP") and Cisco Certified Network Associate ("CCNA").


text: Monitor Cybersecurity Incidents Our CITO and the Director of IT Security are continually informed and updated about the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. They implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Company is equipped with a defined and practiced incident response plan managed by a dedicated Cybersecurity Event Response Team and Corporate Crisis Management Team. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: In addition, our Board receives regular presentations from management about cyber risks and controls and has received formal cyber risk training from external advisors. Our Chairman of the Board, Mr. M. Kevin McEvoy, and Ms. Reema Poddar, member of the Board, have each earned a National Association of Corporate Directors ("NACD") Cybersecurity Oversight certification and a Computer Early Response Team ("CERT") Cybersecurity Oversight Certification from Software Engineering Institute, and our Board is composed of directors with diverse qualifications, skills and expertise, including risk management, technology and finance, that we believe equip them to oversee cybersecurity risks effectively.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: Oil-Dri Corp of America

ticker: ODC