text: Our cybersecurity risk management processes and policies include the following: • We seek to deploy best practice cybersecurity standards promulgated by the National Institute of Standards and Technology Cybersecurity (NIST), the International Organization for Standardization and the Center for Internet Security. • We employ a dedicated cybersecurity team who routinely conduct specific risk assessments and endeavor to mitigate identified risks. This team is responsible for implementing measures to detect, prevent and respond to threats and malicious activity. We also maintain a Security Operations Center (SOC) that provides a mechanism for addressing cyberthreats before they comprise data security. • The cybersecurity team operates, maintains and monitors an integrated eco-system of security tools designed to detect, prevent and respond to threats and malicious activity. These tools include, but are not limited to, next generation firewalls, anti-malware, IPS / IDS, end point protection, encryption, email and cloud app security, privileged access management, vulnerability scanning / patching. These are a blend of on-premise, cloud and network hosted tools. Monitoring activities include threat hunting and use of multiple intelligence sources to manage and respond to events. • Access to information is subject to authorization, review, classification and substantially controlled through multi-factor authentication. • All employees and contractors who are issued a Tronox user account for our IT system must complete and pass cybersecurity training before being provided full system access. • All employees and contractors with access to our IT systems must complete and pass a mandatory annual cybersecurity awareness training and acknowledgement of Tronox's Acceptable Use Policy. Failure to complete the training successfully may result in further system access restrictions and HR escalation. • We periodically orchestrate simulated phishing attacks on all IT system users and those who fall victim to the simulated attacks are required to take additional mandatory cybersecurity training. • To reduce the risk of phishing attacks, we have identified groups of Tronox employees and contractors who do not require access to external emails in order to perform their work responsibilities and begun a process of blocking their external emails. • We have a written Incident Response Plan that encompasses a range of activities to detect, respond to and recover from cybersecurity incidents, including compliance with applicable legal obligations and mitigation damage. • We work closely with a number of regional and international bodies from which we draw intelligence and contribute to cybersecurity initiatives such as incident simulation exercises and development working groups. • We regularly evaluate the appropriateness of cyber insurance coverage in light of the cyber risks we face and we do not currently carry cyber insurance.


text: Additionally, in connection with our cybersecurity risk management processes, we engage third-party subject matter experts to supplement our dedicated internal resources and to provide independent review of the Tronox-specific threat landscape as well as our mitigation efforts to counter known threats. These activities include: • External penetration testing by certified third parties. • Independent review of the Tronox Information Security Management System (ISMS). • Participating in industry and government cyber incident exercises run by the National Cyber Security Center (UK Security Services). • Utilizing a third party (KnowBe4) for the cybersecurity training and phishing tests described above. • Regularly engaging with statutory auditors in support of specific activities such as SOX 404 audits. • Engaging outside counsel with expertise in the field to advise on critical IT contracts as well as reporting and disclosure requirements.

companyName: Tronox Holdings plc

ticker: TROX

secItem: Item 1C


text: Our cybersecurity risk management policies and processes extend to cyber risks posed by our third-party service providers. To manage that risk we have implemented a process to identify critical vendors and perform a reasonable level of due diligence on the adequacy of their cybersecurity policies, processes and capabilities.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. Like most major corporations we have been the target of cyberattacks from time to time and we expect to be the target of such attacks in the future. In the past three years, however, we have not experienced a material information security breach. As such, we have not incurred any material expenses from cybersecurity breaches or any expenses from fines, penalties or settlements related to a cybersecurity breach. See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for more information on risks from cybersecurity threats that are reasonably likely to materially affect our business strategy, results of operations and financial condition.


text: Our entire Board of Directors provides oversight of the Company's cybersecurity policies, processes and capabilities as part of their overall oversight of risk management. Once a year, our Vice President, Cyber Security reports to the Audit Committee providing a detailed update on the threat landscape, emerging trends and the Company's mitigation efforts. This report also includes Tronox's performance as measured by the NIST Cybersecurity Framework Scorecard. As needed on a periodic basis, our Vice President, Cyber Security updates the Audit Committee on specific cybersecurity events and newly emerging risks and the actions taken by the Company in response to those events and risks. The Audit Committee updates the full board on these matters as necessary. The full Board reviews and assesses cybersecurity risks in connection with its annual Enterprise Risk Management review.


text: In 2020, Tronox established an IT Security Council to help set corporate risk tolerance and related policy. The council meets quarterly, is chaired by the General Counsel and managed by our Vice President, Cyber Security with senior level representation from key functions and business units. On an annual basis, the Tronox Cybersecurity team reviews and updates the core governance documents, including the Acceptable Use Policy, the Information Security Policy, and the Incident Response Plan. These are then subject to review and approval by the Tronox Security Council with a summary provided to the Audit Committee as a component of the annual cybersecurity Enterprise Risk Management.


text: Day to day cybersecurity risk oversight governance is the responsibility of our Vice President, Cyber Security who has been with Tronox since 2017 and reports to our Senior Vice President, Integrated Supply Chain and Digital Transformation. Tronox's Vice President, Cyber Security has over 30 years of IT experience, 20 years of security experience and was awarded a Member of the British Empire honor with respect to his work in the field. Previous roles include Interim Chief Information Security Office for Pacnet (Hong Kong) and Director of Security for Level 3 Communications along with multiple engagements for the UK government. He oversees a dedicated security team distributed globally with more than 15 members and over 100 years of aggregate cyber security experience.


text: Risk Management and Strategy As part of our overall risk management system we maintain comprehensive policies and processes for assessing, identifying and managing material risks from cybersecurity threats, including risks relating to production, safety, reputation, intellectual property, procurement and business continuity. Cybersecurity risk management is included as part of our overall annual Enterprise Risk Management program. As part of this program, our enterprise risk professionals consult with internal cybersecurity subject matter experts to identify cyber risks and evaluate their severity and the efficacy of our mitigation efforts, with the results being reported to the executive leadership team and the Board of Directors.


text: Our cybersecurity risk management processes and policies include the following: • We seek to deploy best practice cybersecurity standards promulgated by the National Institute of Standards and Technology Cybersecurity (NIST), the International Organization for Standardization and the Center for Internet Security. • We employ a dedicated cybersecurity team who routinely conduct specific risk assessments and endeavor to mitigate identified risks. This team is responsible for implementing measures to detect, prevent and respond to threats and malicious activity. We also maintain a Security Operations Center (SOC) that provides a mechanism for addressing cyberthreats before they comprise data security. • The cybersecurity team operates, maintains and monitors an integrated eco-system of security tools designed to detect, prevent and respond to threats and malicious activity. These tools include, but are not limited to, firewalls, anti-malware, IPS / IDS, end point protection, encryption, email and cloud app security, privileged access management, vulnerability scanning / patching. These are a blend of on-premise, cloud and network hosted tools. Monitoring activities include threat hunting and use of multiple intelligence sources to manage and respond to events. • Access to information is subject to authorization, review, classification and substantially controlled through multi-factor authentication. • All employees and contractors who are issued a Tronox user account for our IT system must complete and pass cybersecurity training before being provided full system access. • All employees and contractors with access to our IT systems must complete and pass a mandatory annual cybersecurity awareness training and acknowledgement of Tronox's Acceptable Use Policy. Failure to complete the training successfully may result in further system access restrictions and HR escalation. • We periodically orchestrate simulated phishing attacks on all IT system users and those who fall victim to the simulated attacks are required to take additional mandatory cybersecurity training. • To reduce the risk of phishing attacks, we have identified groups of Tronox employees and contractors who do not require access to external emails in order to perform their work responsibilities and begun a process of blocking their external emails. • We have a written Incident Response Plan that encompasses a range of activities to detect, respond to and recover from cybersecurity incidents, including compliance with applicable legal obligations and mitigation damage. • We work closely with a number of regional and international bodies from which we draw intelligence and contribute to cybersecurity initiatives such as incident simulation exercises and development working groups. • We regularly evaluate the appropriateness of cyber insurance coverage in light of the cyber risks we face and we do not currently carry cyber insurance.


text: Additionally, in connection with our cybersecurity risk management processes, we engage third-party subject matter experts to supplement our dedicated internal resources and to provide independent review of the Tronox-specific threat landscape as well as our mitigation efforts to counter known threats. These activities include: • External penetration testing by certified third parties. • Independent review of the Tronox Information Security Management System (ISMS). • Participating in industry and government cyber incident exercises run by the National Cyber Security Center (UK Security Services). • Utilizing a third party (KnowBe4) for the cybersecurity training and phishing tests described above. • Regularly engaging with statutory auditors in support of specific activities such as SOX 404 audits. • Engaging outside counsel with expertise in the field to advise on critical IT contracts as well as reporting and disclosure requirements. • Membership in a United Kingdom industry cybersecurity group to facilitate intelligence sharing and develop incident response capabilities. • Utilizing a third party vendor for detect and response services who provides 24x7 monitoring and incident response capabilities across the various Tronox technology platforms.


text: Given our decentralized and adaptive operating model, each of our businesses is responsible for implementing and managing its own cybersecurity program, following our established enterprise-wide standards and strategy and using the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), which outlines industry-wide best practices addressing the components of a cybersecurity program. We utilize a third party to routinely assess the alignment of the cybersecurity programs across our organization with the NIST CSF and the program maturity in each of the included objectives. The results of these assessments are used to develop a risk-informed approach to our prioritization and allocation of resources and investment.

companyName: Post Holdings, Inc.

ticker: POST


text: We employ industry standard security controls and technologies to protect our information technology ("IT") environment and to monitor for and detect anomalous activity. Our IT security controls and technologies are designed to protect the confidentiality, integrity and availability of our processes and systems. Across our organization, our IT security architecture and controls are designed using a risk-based approach that takes into account the effectiveness of the controls, the likelihood and severity of the risk, the current threat landscape, known industry-specific threats and the likely impact of a breach with and without the respective controls. Our controls and technologies are evaluated regularly for their relevancy to the current threat landscape. We retain a risk register to catalog known risks and assess their potential impact on our organization, enabling our proactive management of such risks and the development and implementation of mitigation strategies. We also utilize independent third parties to perform annual penetration tests at each of our businesses, allowing us to internally and externally test the controls in our facilities, networks, devices and cloud environments. In addition, we maintain and test backup and recovery systems and disaster recovery of our critical systems that are required to support our core business operations.


text: Our Company depends on third-party technology providers that are critical to our business operations through software, services, solutions and hosting. We utilize programs to assess the controls of these providers in an effort to reduce the likelihood of potential impacts to the confidentiality, integrity and availability of our systems. We also design our systems and the ways such providers may access our systems to limit their ability to impact our operations or systems beyond what they require. In addition, for third parties that may hold our information on their own systems, we implement processes to gather information about how such third parties secure their systems, which may include obtaining and reviewing attestations and reports from the third parties.


text: To help raise employee awareness of current cybersecurity threats and tactics, in particular social engineering, we provide training to our employees so that they can help identify risks and protect our organization. Through annual training, monthly phishing simulation tests, newsletters and other information postings, we educate our employees and reinforce our processes to report any suspicious activity.


text: In the event of a cybersecurity incident, our businesses maintain incident response plans meeting certain enterprise-established standards. Such incident response plans address the roles and responsibilities of personnel across our enterprise, required steps to take in response to an incident, incident communications plans, designated contacts for outlined response activities and playbooks to guide responses to certain common types of threats that we face. These incident response plans are reviewed and updated at least annually, with table-top exercises performed at least annually. We also have established relationships with various third-party experts and advisors to provide support in the event of a cybersecurity incident. In addition, we maintain insurance coverage that, subject to its terms and conditions, is intended to address costs associated with certain aspects of cybersecurity incidents. In conjunction with our incident response plans, we also have a process to assess whether a cybersecurity incident triggers applicable regulatory reporting obligations.


text: We (or third parties we rely upon) may not be able to fully, continuously and effectively implement security controls as intended, or the controls we implement may be inadequate or fail to address a particular risk. For further discussion of these risks, see "Risk Factors – Business and Operating Risks – Technology failures or cybersecurity incidents could disrupt our operations and negatively impact our businesses" in Item 1A of this report. While we are regularly targeted by cybersecurity threats, including cybersecurity attacks, ransomware and other cybersecurity breaches, and we expect them to continue in the future, during the year ended September 30, 2024, we did not identify any risks from cybersecurity threats that materially impacted or are reasonably likely to materially impact us.


text: Various individuals and teams throughout our organization are responsible for the oversight and management of cybersecurity risk for our organization.


text: Board of Directors Oversight The Audit Committee of our Board of Directors has overall responsibility for the oversight of cybersecurity risk. The Audit Committee receives updates, on at least a quarterly basis, from our Chief Information Officer (the "CIO") and our Chief Information Security Officer (the "CISO") regarding our enterprise-wide cybersecurity program, which may address a range of topics, including the health, efficacy and maturity of our cybersecurity programs, the results of various assessments periodically performed on our IT environment, emerging threats and trends and cybersecurity events.


text: Management Oversight Our CISO, who reports to our CIO, has overall responsibility for our enterprise-wide cybersecurity activities. The CISO is responsible for establishing the strategy, architecture, policies, procedures and standards related to cybersecurity across our organization. Each business then has a Security Lead, who reports to that business's IT leadership, responsible for the strategy, implementation and operation of that business's cybersecurity program (collectively, our CISO, CIO and the Security Leads are referred to as our "Security Team"). Our CISO holds a master's degree in information systems and has over twenty-two years of IT experience, including eight years of experience dedicated to cybersecurity and IT risk management. Having spent over twelve years at Post in various IT capacities, including approximately four years as the head of cybersecurity, his extensive knowledge of our IT systems and controls is instrumental in safeguarding our digital infrastructure. Our CIO's background encompasses approximately twenty-six years of IT experience, including approximately six years of cybersecurity and risk management oversight, and approximately six years in supply chain and business transformation leadership. This includes over thirty years in various roles of increasing responsibility at Bob Evans, which Post acquired in 2018, ultimately serving as the CIO of Bob Evans for approximately four years before becoming our CIO in 2022. His broad knowledge and significant experience enable him to have a holistic risk management view across our organization. In addition, members of our Security Team participate in industry specific organizations that allow us to share information about threats and risks facing our industry, share best practices across our industry and work together to find opportunities to strengthen our industry. Members of our Security Team also have established and maintain relationships with governmental entities, which have helped inform our cybersecurity incident response planning and the protection of our IT environment.


text: Our Security Council, comprised of the Security Leads from each business and led by our CISO, meets on a monthly basis to discuss emerging trends and threats, share cybersecurity practices across our organization and discuss potential issues. Our Enterprise Security Risk Group (the "ESRG"), which is comprised of a cross functional group of leaders from our organization representing legal, finance, human resources, compliance and internal audit and is led by the CISO, meets at least quarterly to review cybersecurity program performance, cybersecurity risks, progress on projects and risk remediation activities. In addition, the Security Leads report on their cybersecurity programs to the CISO and the ESRG on a quarterly basis.


text: We (or third parties we rely upon) may not be able to fully, continuously and effectively implement security controls as intended, or the controls we implement may be inadequate or fail to address a particular risk. For further discussion of these risks, see "Business and Operating Risks – Technology failures or cybersecurity incidents could disrupt our operations and negatively impact our businesses" within "Risk Factors" in Item 1A of this report. While we are regularly targeted by cybersecurity threats, including cybersecurity attacks, ransomware and other cybersecurity breaches, and we expect them to continue in the future, during the year ended September 30, 2025, we did not identify any risks from cybersecurity threats that materially impacted or are reasonably likely to materially impact us.


text: Board of Directors Oversight The Audit Committee of our Board of Directors has overall responsibility for the oversight of cybersecurity and other technology risks. The Audit Committee receives updates, on at least a quarterly basis, from our Chief Information Officer (the "CIO") and our Chief Information Security Officer (the "CISO") regarding our enterprise-wide cybersecurity program, which may address a range of topics, including the health, efficacy and maturity of our cybersecurity programs, the results of various assessments periodically performed on our IT environment, emerging threats and trends, including regarding AI, and cybersecurity events.


text: Management Oversight Our CISO, who reports to our CIO, has overall responsibility for our enterprise-wide cybersecurity activities. The CISO is responsible for establishing the strategy, architecture, policies, procedures and standards related to cybersecurity across our organization. Each business then has a Security Lead, who reports to that business's IT leadership, responsible for the strategy, implementation and operation of that business's cybersecurity program (collectively, our CISO, CIO and the Security Leads are referred to as our "Security Team"). Our CISO holds a master's degree in information systems and has over twenty years of IT experience, including significant experience dedicated to cybersecurity and IT risk management. Having been with Post in various IT capacities since 2012, including approximately five years as the head of cybersecurity, his extensive knowledge of our IT systems and controls is instrumental in safeguarding our digital infrastructure. Our CIO's background encompasses over twenty-five years of IT experience, including many years of cybersecurity and risk management oversight, and numerous years of experience in supply chain and business transformation leadership. This experience includes approximately thirty years in various roles of increasing responsibility at Bob Evans, which Post acquired in 2018, ultimately serving as the CIO of Bob Evans for approximately four years before becoming our CIO in 2022. His broad knowledge and significant experience enable him to have a holistic risk management view across our organization. In addition, members of our Security Team participate in industry specific organizations that allow us to share information about threats and risks facing our industry, share best practices across our industry and work together to find opportunities to strengthen our industry. Members of our Security Team also have established and maintain relationships with governmental entities, which have helped inform our cybersecurity incident response planning and the protection of our IT environment.


text: Cybersecurity Risk Management and Strategy In the normal course of business, we collect and store personal information and other sensitive information on our information systems. To protect our information, our existing cybersecurity policies require continuous monitoring and detection programs and network security precautions.

companyName: Inari Medical, Inc.


text: Our cybersecurity processes, technologies, and controls aid in our efforts to assess, identify, and manage material risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risks and reputational risks.


text: Our enterprise risk management program incorporates risks related to cybersecurity threats alongside other company risks as part of our overall risk assessment process. We also employ a cybersecurity-specific risk assessment process. Our IT professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to inform our professionals of risk identification and assessment. We also engage experts to attempt to infiltrate our information systems.


text: Additionally, we undertake the following activities as part of our processes to assess, identify and manage material risks from cybersecurity threats: • monitor emerging data protection laws and implement changes to our processes as needed; • conduct periodic cybersecurity management and incident training as well as social engineering training for employees and consultants involved in our systems and processes that handle sensitive data; • require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • perform tabletop exercises to simulate a response to a cybersecurity incident and use the findings to inform our processes and technologies; and • leverage the NIST incident handling framework to help us respond, and recover when there is an actual or potential cybersecurity incident; • carry information security risk insurance to provide protection against certain potential losses arising from a cybersecurity incident.


text: We also maintain an incident response plan, which outlines our procedures for detecting, responding to and recovering from cybersecurity incidents. The incident response plan includes processes to triage, assess severity for, escalate, contain, investigate, and remediate the cybersecurity threats and incidents, as well as to assist in complying with potentially applicable legal obligations and mitigating brand and reputational damage.


text: As part of the above processes, we engage with assessors, consultants, auditors, and other third-parties to review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.


text: We are continuing to build processes to address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. Additionally, we generally require those third parties that have greater access to sensitive information to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: We do not believe risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, we can give no assurance that we have detected or protected against all cybersecurity threats or incidents. Please refer to the risk factor titled "Failure to protect our information technology infrastructure against cyberattacks, security breaches, service interruptions, or data corruption could materially disrupt our operations and adversely affect our business and operating results", included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, for additional information about risks related to cybersecurity matters.


text: Cybersecurity Governance Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are overseen by our cybersecurity committee, which is led by our Vice President, IT and is comprised of a cross-functional team which includes our Chief Financial Officer and General Counsel, along with other members of our IT, legal, finance and internal audit departments. To facilitate our cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Our cybersecurity committee meets on a regular basis and is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above.


text: Through ongoing communications with these teams, our Vice President, IT, and the cybersecurity committee monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the audit committee on a quarterly basis and as otherwise necessary, and annually to the full Board and as the cybersecurity committee otherwise deems appropriate. Our Vice President, IT has over 20 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, managing data centers, designing networks and infrastructure. Our Vice President of IT oversees a team of experienced and certified individuals who holds various certificates relevant to information security.


text: The audit committee of our board of directors has oversight responsibility for our data security practices and cybersecurity threats, periodically reviewing and discussing with management our policies, practices and risks related to information systems, information security, data privacy and cybersecurity. At least annually, the entire board of directors receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks, and information security considerations arising with respect to our peers and other third parties. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters such as enterprise risk management, operational budgeting, mergers and acquisitions, and other relevant matters.


text: Cyber Risk Management and Strategy At BJ's, we recognize the importance of information security practices designed to protect the confidentiality, integrity, and availability of company information and the personal information that our members share with us. We have implemented a cybersecurity program in accordance with our risk profile and business that is informed by recognized industry standards and frameworks, and incorporates elements of the same, including elements of the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), International Organization for Standardization ("ISO") 27001 and Payment Card Industry Data Security Standard ("PCI DSS") standards.

companyName: BJ's Wholesale Club Holdings, Inc.

ticker: BJ


text: Our cybersecurity risk assessment program includes a number of components, including information security program assessments, audits and maturity assessments, that are conducted periodically by both internal and external resources. Our internal audit function also conducts regular assessments of different systems to provide the audit committee with information on our cybersecurity risk management processes.


text: As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third-party vendors, and apply mitigations and processes based on our evaluation of the sensitivity of the data accessed by the vendor and the maturity of the vendor's programs. Our vendor evaluation procedures include, as appropriate, the completion of a vendor security questionnaire and our implementation of vendor monitoring programs. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats and security incidents that could affect our information or systems.


text: Governance Related to Cybersecurity Risks Our Chief Information Officer ("CIO") is responsible for the strategic leadership and direction of the Company's information technology organization. Prior to joining BJ's in 2023, our current CIO served as global chief information officer at a public healthcare company, where she led information technology, privacy assurance, cyber, digital and data security across key business units. She has also held various chief information officer and technology leadership roles at several other healthcare companies and a multinational pharmaceutical corporation, along with other senior management positions during her career.


text: The CIO and the VP of IT Security and Compliance regularly report to senior management and the board on the governance aspects of our data security program. The CIO and the VP of IT Security and Compliance are also members of our information security steering committee, which is comprised of executives throughout the Company who oversee areas such as finance, operations, legal, human resources, strategy and development, digital, and commercial. This committee meets regularly to, as relevant, discuss oversight of the Company's cybersecurity program, program enhancements and new risks or threats that the Company might be facing.


text: The board of directors has overall responsibility for risk oversight, including, as part of regular board meetings, general oversight of executives' management of risks relevant to the Company. The VP of IT Security and Compliance provides an annual cybersecurity update to the board. While the full board has overall responsibility for risk oversight, it is supported in this function by various committees, including principally its audit committee.


text: The audit committee, pursuant to its charter, is responsible for overseeing risk management processes related to cybersecurity. The audit committee assists the board in fulfilling its risk oversight responsibilities by periodically reviewing our enterprise risk management program. Through its meetings with management, including the compliance and information technology functions, the audit committee reviews and discusses significant areas of our business and summarizes the key areas of risk and relevant mitigating factors for the board.


text: Our cybersecurity risk assessment program includes a number of components, including information security program assessments, audits and maturity assessments, that are conducted periodically by both internal and external resources. Additionally, we partner with multiple third-party managed security service providers for enhanced monitoring of our information technology and data security environment and to perform proactive detection and investigation of malicious activity within our network. Our internal audit function also conducts regular assessments of different systems to provide the audit committee with information on our cybersecurity risk management processes, which processes are integrated into our overall enterprise risk management program.


text: As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third-party vendors, and apply mitigations and processes based on our evaluation of the sensitivity of the data accessed by the vendor and the maturity of the vendor's programs. Our vendor evaluation procedures include, as appropriate, the completion of a vendor security questionnaire and our implementation of vendor monitoring programs. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats and security incidents that could affect our information or systems. See "Item 1A. Risk Factors" for additional information on the Company's cybersecurity-related risks.


text: Risk Management and Strategy Identifying, assessing, and managing cybersecurity risks is an important component of our overall enterprise risk management program. Our cybersecurity programs have been developed based on the National Institute of Standards and Technology Cybersecurity Framework and seek to protect the Company against cybersecurity risks. Among other things, these programs generally involve maturity evaluations and assessments by third parties, vulnerability scanning, employee testing and training, technical and business team-focused tabletop exercises, business continuity planning, incident response planning and data security assessments of third-party service providers as a part of vendor management.

companyName: Nine Energy Service, Inc.


text: Identified Risks As of the date of this Annual Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, may, among other things, cause material disruptions to our operations, which may materially affect us, including our business strategy, results of operations and/or financial condition. For more information about these risks, see the risk factor titled "Our operations are subject to cybersecurity risks that could have a material adverse effect on our results of operations and financial condition" under Item 1A of Part I of this Annual Report.


text: Board Oversight and Management's Role Our Board considers cybersecurity risk as part of its risk oversight function and has assigned oversight of cybersecurity risk management to the Audit Committee. The Audit Committee regularly receives reports from our management, including the SC (defined below) and our senior IT leadership, and third parties on cybersecurity matters. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. In addition, the Board receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed therein, in regular business updates.


text: We have established a Security Committee (the "SC"), comprised of senior departmental leadership including our Chief Financial Officer, Senior Vice President and General Counsel, Vice President – IT, Vice President – Internal Audit, and Vice President – Corporate Operations, each of whom has between 10 to 20 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats. The SC meets quarterly to discuss and review cybersecurity concerns that arise during the year. The SC also identifies areas that should be addressed and reviews and updates security policies, as necessary. The SC has primary management oversight responsibility for assessing and managing risks from cybersecurity threats.


text: Our senior IT leadership is responsible for the day-to-day management and development of appropriate cybersecurity programs, including as may be required by applicable law or regulation. Our senior IT leadership monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents as part of the cybersecurity programs described above, works closely with the SC, and reports regular updates to the Audit Committee. Our IT team is led by our Vice President – IT, who has over 12 years of experience managing global IT operations, including strategy, applications, infrastructure, information security, support, and execution.


text: Risk Management and Strategy Identifying, assessing, and managing cybersecurity risk s is an important component of our overall enterprise risk management program. Our cybersecurity programs have been developed based on the National Institute of Standards and Technology Cybersecurity Framework and seek to protect us against cybersecurity risks. Among other things, these programs generally involve maturity evaluations and assessments by third parties, vulnerability scanning, employee testing and training, technical and business team-focused tabletop exercises, business continuity planning, incident response planning, and d ata security assessments of third-party service providers as a part of vendor management.


text: Board Oversight and Management's Role Our Board of Directors (the "Board") considers cybersecurity risk as part of its risk oversight function and has assigned oversight of cybersecurity risk management to the Audit Committee. The Audit Committee regularly receives reports from our management, including the SC (defined below) and our senior IT leadership and third parties on cybersecurity matters. The Audit Committee reports to the Board regarding its activities, including those related to cybersecurity. In addition, the Board receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed therein, in regular business updates.


text: We have established a Security Committee (the "SC"), comprised of senior departmental leadership including our Chief Financial Officer, Executive Vice President and General Counsel, Senior Vice President – Strategic Development and Investor Relations, Vice President – IT, Vice President – Internal Audit, and Vice President – Corporate Operations, each of whom has between 10 to 20 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats. The SC meets quarterly to discuss and review cybersecurity concerns that arise during the year. The SC also identifies areas that should be addressed and reviews and updates security policies, as necessary. The SC has primary management oversight responsibility for assessing and managing risks from cybersecurity threats.


text: Our senior IT leadership is responsible for the day-to-day management and development of appropriate cybersecurity programs, including as may be required by applicable law or regulation. Our senior IT leadership monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents as part of the cybersecurity programs described above, works closely with the SC, and reports regular updates to the Audit Committee. Our IT team is led by our Vice President – IT, who has over 13 years of experience managing global IT operations, including strategy, applications, infrastructure, information security, support, and execution.


text: We recognize the importance of assessing, identifying, reviewing and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational and legal risks including intellectual property theft or loss, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), although this does not imply that we meet all technical standards, specifications or requirements under NIST CSF.

companyName: Hughes Satellite Systems Corp


text: We have an enterprise-wide information security program designed to identify, protect against, detect, respond to, and recover from cybersecurity risks, threats, and events. Our cyber risk management system contributes significantly to the overall resilience and integrity of our business by, among other things, integrating the risk identification process in all major company initiatives and deployment processes, implementing a unified approach to managing both digital and traditional business risks, making continuous improvements and regularly reporting to management and the Board of Directors as a whole to ensure accountability.


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We and certain third parties conduct regular reviews and tests of our information security program and also leverage, among other things, audits, tabletop exercises, penetration and vulnerability testing, red team exercises, simulations and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. In addition, we evaluate third-party risks and perform third-party risk management to assess, identify and mitigate risks from third parties such as vendors, suppliers and other business partners.


text: We have not experienced cyber-attacks or other malicious activities that materially disrupted our business. Any future failure or disruption of our information technology infrastructure and communications systems or those of third parties that we use in our operations, could harm our business. We describe whether and how risks from identified cybersecurity threats, including, but not limited to, as a result of any previous cyber-security incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Our Senior Director of Cybersecurity Infrastructure and Threat Hunting, Corporate Cybersecurity leads our information security organization responsible for overseeing our information security program. This individual has over 20 years of experience in various roles involving security, including risk management and security leadership. Team members who support our information security program have relevant educational and industry experience, including, but not limited to, holding similar positions at large technology companies. The team provides regular reports to senior management and other relevant teams, including, but not limited to, the Chief Executive Officer ("CEO"), Chief Operating Officer ("COO"), and Chief Legal Officer ("CLO").


text: Preparation for and, where possible prevention of cybersecurity incidents involves regular and structured briefings to key management on risk remediation measures that should be taken to decrease, among other things, the likelihood and severity of incidents and to mitigate and manage their effects. The CEO, COO, CLO and other members of management receive detailed updates on cybersecurity risks on a regular basis, no less frequently than monthly, or when significant risks or incidents are identified. These briefings enable the management team to, among other things, stay informed of the latest threats, assess the effectiveness of current security measures and make timely decisions on strategic security initiatives. In addition, the Board of Directors is regularly briefed, no less frequently than quarterly, on cybersecurity risks as part of its oversight functions and to ensure that cybersecurity practices align with the company's overall risk management framework and business objectives. In connection with the Integration, we anticipate that we will continue to evaluate and address as needed our cyber security risk management, policies, structure, strategies and governance to meet our needs.


text: Cybersecurity risk management and strategy Our cybersecurity risk management program is managed by our Chief Information Officer ("CIO") who reports to our Chief Financial Officer and provides regular updates to the Board. Our CIO establishes our overall Information Technology ("IT") security strategy, oversees our information, cyber, and technology security and manages our IT department, which includes our Cybersecurity team. His responsibilities include developing, implementing, and enforcing security policies to protect critical data. The head of our Cybersecurity team, our Director of Information Security, who reports to our CIO, runs the day-to-day management of our cybersecurity risks. Our IT department overall assists in implementing cybersecurity strategies and policies under the direction of the Cybersecurity team, as applicable.

companyName: PBF Energy Inc.

ticker: PBF


text: Our cybersecurity risk management program aligns with the National Institute of Standards and Technology Cyber Security Framework, which establishes five areas of focus: identify, protect, detect, respond and recover. Our cybersecurity risk management program is designed to manage industry-specific threats, as well as threats arising from the overall evolving cybersecurity landscape and consists of two principal areas of focus: (i) enterprise systems, which consists of all business systems used in our daily operations and (ii) operational technology, which consists of all process control, supervisory control and data acquisition systems. Key elements of our cybersecurity management program include: • identifying, monitoring and mitigating the cybersecurity risks to our systems, assets, data and capabilities; • a critical response process for cybersecurity incidents, including the process for detection, investigation, containment and remediation of any such incidents; • establishment of disaster recovery plans; • testing, at least bi-annually, of select critical systems for disaster recovery and periodic walk-throughs of procedures for disaster recovery; • identity access policies that aim to identify and monitor for potential cyber intrusions; • periodic security tests, including monthly internal vulnerability scans, weekly external vulnerability scans, monthly phishing campaigns and recurring penetration testing by third-party cybersecurity firms; • table-top exercises, at least quarterly, for incident response preparedness for the Cybersecurity team and Information Technology department; and • annual drills for potential threats on various aspects of our technology assets based on the then-existing IT threat landscape for our industry. Pursuant to our incident response plan, the Cybersecurity team has defined roles in responding to all cybersecurity incidents to provide an efficient and organized approach to handling cybersecurity threats, with the CIO receiving all reports and status updates regarding cybersecurity threats. The incident response plan provides a documented framework for when and how the CIO informs and updates our Board, the executive officers and other internal parties and when external parties are notified or consulted about a cybersecurity threat and the status thereof.


text: We also utilize third-party cybersecurity vendors to assist us with various aspects of our cybersecurity risk management program. For example, in order to support our cybersecurity incident response procedures, we have retained several third-party cybersecurity firms to monitor the IT threat landscape for our industry. As part of our efforts to manage the risk of cybersecurity threats associated with the use of third parties, we monitor and evaluate the cybersecurity risk profiles of third-party technology providers and consider such risk profiles when selecting third-party technology providers. Any third-party service provider that is granted access to our network is required to comply with our policies regarding information technology and cybersecurity. We also engage several third-party cybersecurity firms to perform independent assessments of the effectiveness of our cybersecurity risk management program and assist us in the continued review of our cybersecurity risk management program in order to reflect the evolving landscape of cybersecurity.


text: To date, there have been no significant risks from cybersecurity threats, including as a result of any significant cybersecurity breaches or attacks that have materially affected our business, results of operations or financial condition. However, if we were to be subject to a material successful cyber intrusion, it could result in remediation or service restoration costs, increased cybersecurity protection costs, lost revenues, litigation or regulatory actions by governmental authorities, increased insurance premiums, reputational damage and damage to our competitiveness, financial condition, results of operations and cash flows. See "Item 1A. Risk Factors-Risks Relating to Our Business and Industry-A cyber-attack on, or other failure of, our technology infrastructure could affect our business and assets, and have a material adverse effect on our financial condition, results of operations and cash flows."


text: Cybersecurity governance Our CIO has 30 years of experience in highly regulated industries managing information security in complex, matrixed environments, seven of which are in his current role with the Company. He has created and maintained enterprise-level information security programs for our Company and other US and international companies in the refining industry.


text: The CIO, along with the head of our Cybersecurity team, periodically reports, no less than quarterly, to our Board and our executive officers regarding the state of our cybersecurity risk management program, including information on the status of ongoing efforts to manage and mitigate cybersecurity risks, as well as recent cybersecurity trends and events and any updates to cybersecurity matters.


text: The Audit Committee reviews our disclosures with respect to cybersecurity and information technology risks. The Audit Committee also reviews with management guidelines and policies to govern the process by which risk assessment and risk management is undertaken, including but not limited to cybersecurity and information technology risks. As part of the Company's enterprise-wide risk management program, our Internal Audit team also reports to our Audit Committee regarding assessments of our cybersecurity and information technology risks, at least annually, based on regular updates by our CIO regarding such risks. Our Internal Audit team periodically reports to our executive officers and the Audit Committee regarding such risks.


text: Cybersecurity risk management and strategy Our cybersecurity risk management program is managed by our current Chief Information Officer ("CIO") who reports to our Chief Financial Officer and provides regular updates to the Board. Our CIO establishes our overall Information Technology ("IT") security strategy, oversees our information, cyber, and technology security and manages our IT department, which includes our Cybersecurity team. His responsibilities include developing, implementing, and enforcing security policies to protect critical data. The head of our Cybersecurity team, our Director of Information Security, who reports to our CIO, runs the day-to-day management of our cybersecurity risks. Our IT department overall assists in implementing cybersecurity strategies and policies under the direction of the Cybersecurity team, as applicable.


text: To date, there have been no significant threats, including as a result of any significant cybersecurity breaches or attacks, that have materially affected our business, results of operations or financial condition. However, if we were to be subject to a material successful cyber intrusion, it could result in remediation or service restoration costs, increased cybersecurity protection costs, lost revenues, litigation or regulatory actions by governmental authorities, increased insurance premiums, reputational damage and damage to our competitiveness, financial condition, results of operations and cash flows. See "Item 1A. Risk Factors-Risks Relating to Our Business and Industry-A cyber-attack on, or other failure of, our technology infrastructure could affect our business and assets, and have a material adverse effect on our financial condition, results of operations and cash flows."


text: Cybersecurity governance Our CIO assumed his position effective June 1, 2024, following the retirement of his predecessor. He previously served as the head of our Cybersecurity team. Our CIO has 28 years of experience in highly regulated industries managing information security in complex, matrixed environments. He has created and maintained enterprise-level information security programs for our Company and other US and international companies in the refining industry.


text: Our CIO, along with the head of our Cybersecurity team, periodically reports, no less than quarterly, to our Board and our executive officers regarding the state of our cybersecurity risk management program, including information on the status of ongoing efforts to manage and mitigate cybersecurity risks, as well as recent cybersecurity trends and events and any updates to cybersecurity matters.


text: Management has implemented a comprehensive cybersecurity program that is designed to protect our information, and that of our customers and suppliers, against cybersecurity threats that may materially and adversely affect the confidentiality, integrity, and availability of our information systems. Our cybersecurity program includes processes and standards that leverage recognized cybersecurity frameworks, industry best practices and guidance from U.S. Government security directives that focus on cybersecurity and critical infrastructure.

companyName: Phillips 66

ticker: PSX


text: Board of Directors The Audit and Finance Committee of the Board of Directors (the Audit and Finance Committee) is responsible for overseeing the company's Enterprise Risk Management (ERM) program, including oversight of the processes management has implemented to assess, identify and manage risks associated with cybersecurity and information technology. In carrying out this responsibility, the Audit and Finance Committee regularly receives written reports from the company's Chief Information Security Officer (CISO) and periodic briefings from the CISO. These presentations may address a wide range of topics, such as the results of recent vulnerability assessments and third-party independent reviews, changes to the threat environment, technological trends and other recent developments, and peer and other third-party benchmarking. The Audit and Finance Committee makes regular reports to the Board of Directors on data protection and cybersecurity matters. The company maintains an Enterprise Cybersecurity Incident Response Plan (ECIRP) which provides the framework for management's response to cyber-related incidents and escalation protocols, including, when appropriate, prompt reporting to the Board of Directors.


text: At the management level, our CISO has extensive cybersecurity knowledge and skills gained from work experience at the company and with a law enforcement agency, as well as from obtaining advanced professional certifications. The CISO is responsible for the assessment and management of risks from cybersecurity threats and leads a team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across the company. The individuals who report directly to our CISO possess relevant educational and industry experience in the areas of cyber threat hunting and intelligence, digital standards, data privacy, cyber training, and cybersecurity operations center management. In addition to our internal cybersecurity capabilities, we also regularly engage consultants, or other third parties to assist with assessing, identifying, and managing cybersecurity risks. The CISO receives reports on cybersecurity threats on an ongoing basis, and in conjunction with management, regularly reviews risk management measures implemented by the company to identify, assess and mitigate data protection and cybersecurity risks. Our CISO works closely with the company's Senior Counsel, Intellectual Property and Data Protection, to oversee compliance with legal, regulatory and contractual security requirements.


text: Risk Management and Strategy On an annual basis, we conduct an evaluation of our cybersecurity risks as part of the ERM program. Through the ERM program, the CISO and other internal subject matter experts review potential cybersecurity threat scenarios, such as data theft, cash theft, widespread outages and business disruptions, and the potential consequences of such scenarios. The results of the risk assessment are shared with management and the Audit and Finance Committee.


text: We have a continuous monitoring program to detect and respond to potential cybersecurity threats in real-time. Log data from our technical controls are collected, aggregated, and correlated in a Security Information and Event Management (SIEM) system that identifies and categorizes events, as well as analyzes them. If the SIEM system identifies a potential security event, it can direct other controls to stop the activity and also generate alerts for detection and response. These alerts are monitored by a managed security service provider that augments a dedicated internal Security Operations Center team.


text: In addition, we utilize a third-party risk management (TPRM) program to identify, assess, monitor, and mitigate risks associated with third-party relationships, including cybersecurity risks. The TPRM program is designed to help ensure proper controls and measures are in place to manage the potential risks and vulnerabilities associated with third parties. Our policies and procedures aid in the governance from initial due diligence, selection, and contracting to termination.


text: With respect to cybersecurity incident response, our ECIRP provides a standardized framework for responding to cybersecurity incidents. The ECIRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate.


text: Internal audit performs audits of our cybersecurity program. Each year, we conduct audits across the company's information technology and operation technology infrastructure, networks, systems, applications, and operational processes and procedures to evaluate compliance with our information security policies and standards. Process control network assurance audits are conducted on a rotating schedule that is risk-based and provides coverage across each operational business area no greater than five years. In addition to the internal audits, we also engage external cybersecurity experts and auditors to conduct assessments, penetration testing, and cybersecurity maturity assessments. Although we have experienced actual and attempted cybersecurity events and incidents on our networks and systems in the past, we do not believe that the risks from any of these events or incidents, individually or in the aggregate, have materially affected our business, operations, or financial condition, or are reasonably likely to have such an effect. For more information concerning cybersecurity risks we face, see the discussion in "Item 1A. Risk Factors" in this report.


text: Board of Directors The Audit and Finance Committee of the Board of Directors (the Audit and Finance Committee) is responsible for overseeing the company's Enterprise Risk Management (ERM) program, including oversight of the processes management has implemented to assess, identify and manage risks associated with cybersecurity and information technology.


text: In carrying out this responsibility, the Audit and Finance Committee regularly receives written reports from the company's Chief Information Security Officer (CISO) and periodic briefings from the CISO. These presentations may address a wide range of topics, such as the results of recent vulnerability assessments and third-party independent reviews, changes to the threat environment, technological trends and other recent developments, and peer and other third-party benchmarking.


text: The Audit and Finance Committee makes regular reports to the Board of Directors on data protection and cybersecurity matters. The company maintains an Enterprise Cybersecurity Incident Response Plan (ECIRP) which provides the framework for management's response to cyber-related incidents and escalation protocols, including, when appropriate, prompt reporting to the Board of Directors.


text: At the management level, our CISO has extensive cybersecurity knowledge and skills gained from work experience at the company and with a law enforcement agency, as well as from obtaining advanced professional certifications. The CISO is responsible for the assessment and management of risks from cybersecurity threats and leads a team responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across the company. The individuals who report directly to our CISO possess relevant educational and industry experience in the areas of cyber threat hunting and intelligence, digital standards, data privacy, cyber training, and cybersecurity operations center management. In addition to our internal cybersecurity capabilities, we also regularly engage consultants, or other third parties to assist with assessing, identifying, and managing cybersecurity risks. The CISO receives reports on cybersecurity threats on an ongoing basis, and in conjunction with management, regularly reviews risk management measures implemented by the company to identify, assess and mitigate data protection and cybersecurity risks. Our CISO works closely with the company's Senior Counsel, Intellectual Property and Data Protection, to oversee compliance with legal, regulatory and contractual security requirements.


text: We have a continuous monitoring program to detect and respond to potential cybersecurity threats in real-time. Log data from our technical controls are collected, aggregated, and correlated in a Security Information and Event Management (SIEM) system that identifies and categorizes events, as well as analyzes them. If the SIEM system identifies a potential security event, it can direct other controls to stop the activity and also generate alerts for detection and response. These alerts are monitored by a managed security service provider that augments our dedicated internal Security Operations Center team.


text: With respect to cybersecurity incident response, our ECIRP provides a documented framework for responding to cybersecurity incidents. The ECIRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate.


text: Our Internal Audit organization performs audits of our cybersecurity program. Each year, we conduct audits across the company's information technology and operation technology infrastructure, networks, systems, applications, and operational processes and procedures to evaluate compliance with our information security policies and standards. Process control network assurance audits are conducted on a rotating schedule that is risk-based and provides coverage across each major operational business area no greater than five years. In addition to the internal audits, we also engage external cybersecurity experts and auditors to conduct assessments, penetration testing, and cybersecurity maturity assessments. Although we have experienced actual and attempted cybersecurity events and incidents on our networks and systems in the past, we do not believe that the risks from any of these events or incidents, individually or in the aggregate, have materially affected our business, operations, or financial condition, or are reasonably likely to have such an effect. For more information concerning cybersecurity risks we face, see the discussion in "Item 1A. Risk Factors" in this report.


text: We recognize the critical importance of maintaining the trust and confidence of stakeholders toward our business and are committed to protecting the confidentiality, integrity, and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or NIST, and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive approach that is focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: SERA PROGNOSTICS, INC.

ticker: SERA


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including third-party real-time risk assessments of cyber assets and mitigation of security risks, data loss prevention, regular air-gapped backups, continuous monitoring and threat response, advanced firewall systems, and security information and event management. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Information Officer.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection best practices and laws and implement changes to our processes that are designed to comply with such; • annual HIPAA security and privacy risk assessments performed with third party provider, as well as annual HIPAA compliance audits; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including advanced firewall systems, endpoint detection and response, data loss prevention, regular air-gapped backups, and security information and event management, which are evaluated and improved through third-party real-time risk assessments and mitigation of security risks; • provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools, information and education to recognize and address cybersecurity threats; • conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; • carry and maintain information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; and • document internal policies and procedures for cybersecurity incident response and recovery.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: Our policies and processes also address cybersecurity threat risks associated with our use of third-party service providers. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our data to ensure they have adequate cybersecurity safeguards in place and continually monitor cybersecurity threat risks identified through such diligence.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security breaches, losses of data, and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and reputation," which disclosures are incorporated by reference herein.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. The audit committee of our board of directors is responsible for the oversight of risks from cybersecurity threats.


text: At least annually, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security, results from third-party assessments, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our audit committee generally receives materials that include a cybersecurity scorecard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, and information security considerations arising with respect to our peers and third parties. The audit committee discusses such matters with our Chief Information Officer.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer and the information technology team. Such individuals have extensive experience in various roles, including in other publicly traded companies, involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. These management team members monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually.


text: Cybersecurity Risk Management and Strategy As a provider of cybersecurity solutions, we are passionate about cybersecurity risk management. At CrowdStrike, cybersecurity risk management is an integral part of our overall enterprise risk management program.

companyName: CrowdStrike Holdings, Inc.

ticker: CRWD


text: Our cybersecurity risk management program, which includes data privacy, product security, and information security, is designed to align with our industry's best practices. Our program provides a framework for identifying, monitoring, evaluating, and responding to cybersecurity threats and incidents, including those associated with our use of software, applications, services, and cloud infrastructure developed or provided by third-party vendors and service providers. This framework includes steps for identifying the source of a cybersecurity threat or incident, including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider, assessing the severity and risk of a cybersecurity threat or incident, implementing cybersecurity countermeasures and mitigation or remediation strategies, and informing management and the audit committee of our Board of Directors (the "Audit Committee") of material cybersecurity threats and incidents.


text: Our cybersecurity team is responsible for assessing our cybersecurity risk management program and our incident response plan, which we regularly test through table-top exercises, and testing of our security protocols through additional techniques, such as penetration testing. In addition, we regularly engage independent third-party auditors to evaluate our compliance with various security compliance standards. We also conduct internal annual assessments of our cybersecurity risk management program. We review or update our cybersecurity policies, standards and procedures annually, or more frequently as needed, to account for changes in the threat landscape, as well as in response to legal and regulatory developments. Our cybersecurity efforts also include mandatory training for all employees and contractors on CrowdStrike's security and privacy policies. We also have a clearly defined acceptable use policy, and we require employees to certify to it. We also require employees to certify their adherence to our code of conduct. We also periodically send our employees simulated phishing emails to test their compliance with our policies. Although we have continued to invest in our diligence, onboarding, and monitoring capabilities over our critical third parties, including our third-party vendors and service providers, our control over the security posture of our critical third parties is limited, and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information assets owned or controlled by such third parties.


text: A cross-functional incident response team, comprised of representatives from information technology, information security, product security, engineering, privacy and legal, is responsible for the monitoring and disposition of potential occurrences such as data breaches, intrusions, and other security incidents and implementing our detailed incident response plan. Our incident response plan includes processes and procedures for assessing potential internal and external threats, activation and notification, crisis management, and post-incident recovery designed to safeguard the confidentiality, availability, and integrity of our information assets.


text: In fiscal 2024, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors— Risks Related to Our Business and Industry" in this annual report on Form 10-K.


text: Cybersecurity Governance Our Board of Directors has oversight responsibility for our overall enterprise risk management, and has delegated cybersecurity risk management oversight to the Audit Committee. The Audit Committee is responsible for ensuring that management (i) has policies, processes, and procedures designed to identify, monitor, evaluate, and respond to cybersecurity risks to which the company is exposed and (ii) takes steps to mitigate or remediate cybersecurity risks, threats and incidents, including monitoring the activities of the cybersecurity team and reviewing and updating our cybersecurity policies, processes and procedures. The Audit Committee also reports material cybersecurity incidents to our full Board of Directors.


text: Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Information Security Officer ("CISO"). Our CISO and dedicated personnel are certified and experienced information systems security professionals and information security managers with many years of experience across a variety of technology sub-specialties.


text: Our CISO receives reports from our cybersecurity team and monitors the prevention, detection, and mitigation or remediation of cybersecurity risks. Management, including the CISO, regularly updates the Audit Committee and the Board of Directors on the Company's cybersecurity programs, material cybersecurity risks, and mitigation or remediation strategies.


text: In fiscal 2025, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors— Risks Related to Our Business and Industry" in this annual report on Form 10-K.


text: Main Street and our Adviser maintain, and routinely review and evaluate their and the Company's information technology ("IT") and cybersecurity policies, practices and procedures (the "Cybersecurity Program"). The Cybersecurity Program has various policies and procedures including a Cyber Incident Response Plan as part of Main Street's Crisis Management Plan. The Cybersecurity Program is administered by Main Street's IT Manager, who is managed on a day to day basis by Main Street's General Counsel and Chief Compliance Officer and overseen by Main Street's IT Steering Committee consisting of Main Street's Chief Executive Officer, Main Street's Chief Financial Officer and Chief Operating Officer and Main Street's General Counsel and Chief Compliance Officer. Main Street's General Counsel and Chief Compliance Officer also serves as the crisis response team leader in connection with any material cybersecurity incident under the Cyber Incident Response Plan. Main Street and our Adviser also utilize the services of IT and cybersecurity advisers, consultants and experts in the evaluation and periodic testing of IT and cybersecurity systems, to recommend improvements to the Cybersecurity Program and in connection with any cybersecurity incident. We believe that the individuals involved in the Cybersecurity Program possess the necessary skills, experience and backgrounds that, when combined with the resources of the external IT and cybersecurity advisers, consultants and experts, are sufficient to manage the Cybersecurity Program.

companyName: MSC INCOME FUND, INC.

ticker: MSIF


text: As part of our overall risk management process, our management engages at least annually in an enterprise risk management review and evaluation, during which management reviews the principal risks relating to our business and operations. Included in this process is a review and evaluation of our risks relating to the Cybersecurity Program. Additionally, as part of our Rule 38a-1 compliance program, we review at least annually the compliance policies and procedures of our key service providers, including our Adviser and Main Street, including documentation discussing each service providers' information security and privacy controls. Any failure in our or our key service providers' cybersecurity systems could have a material impact on our operating results. See Item 1A. Risk Factors — General Risk Factors — The failure in cybersecurity systems, as well as the occurrence of events unanticipated in our and our Adviser's disaster recovery systems and management continuity planning could impair our ability to conduct business effectively.


text: Our Board as a whole has responsibility for the Company's risk oversight, with reviews of certain areas being conducted by the relevant Board committees that report on their deliberations to the full Board. The oversight responsibility of the Board and its committees is enabled by management reporting processes that are designed to provide visibility to the Board about the identification, assessment and management of critical risks and management's risk mitigation strategies. Areas of focus include competitive, economic, operational, financial (accounting, credit, liquidity and tax), legal, regulatory, compliance and other risks.


text: Oversight of risks relating to IT and cybersecurity has been delegated by our Board to its Audit Committee. The Audit Committee includes members of the Board who, in addition to each being designated as an "audit committee financial expert," possess backgrounds and experience which we believe enable them to provide effective oversight of our IT and cybersecurity risks. Our management routinely reports to the Audit Committee on the status of the Cybersecurity Program at the Audit Committee's quarterly meetings. Routine reports generally detail any testing, observations or developments concerning the Cybersecurity Program that occurred during the prior quarter. The results of periodic testing related to the Cybersecurity Program are also described in the Chief Compliance Officer's annual report to the Board, provided pursuant to Rule 38a-1 under the 1940 Act. The crisis response team leader also collaborates with the Audit Committee chair to ensure that the Board is apprised of any material cybersecurity incident and consults with the Audit Committee chair in connection with any material decisions or actions related thereto.


text: Main Street and our Adviser maintain, and routinely review and evaluate their and the Company's information technology ("IT") and cybersecurity policies, practices and procedures (the "Cybersecurity Program"), which includes processes for assessing, identifying and managing material risks from cybersecurity threats. The Cybersecurity Program has various policies and procedures including a Cyber Incident Response Plan as part of Main Street's Crisis Management Plan. The Cybersecurity Program is administered by Main Street's IT Manager, who is managed on a day-to-day basis by Main Street's General Counsel and overseen by Main Street's IT Steering Committee consisting of Main Street's Chief Executive Officer, Main Street's Chief Operating Officer and Main Street's General Counsel. Main Street's General Counsel also serves as the crisis response team leader in connection with any material cybersecurity incident under the Cyber Incident Response Plan, with Main Street's Chief Operating Officer and Main Street's IT Manager also included on the crisis response team. Main Street and our Adviser also utilize the services of IT and cybersecurity advisers, consultants and experts in the evaluation and periodic testing of Main Street's IT and cybersecurity systems, to recommend improvements to the Cybersecurity Program and in connection with any cybersecurity incident. Main Street's IT Manager has over 10 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity systems, policies and procedures. Main Street's General Counsel has served in his oversight function as General Counsel for over 16 years and previously as Main Street's Chief Compliance Officer for over 12 years, during which time he has gained expertise in assessing and managing risk applicable to the Company. Similarly, each of Main Street's Chief Executive Officer and our Main Street's Chief Operating Officer have served in various executive management roles at the Company and, in the case of our Main Street's Chief Operating Officer, other publicly traded organizations, involving extensive oversight and management of risks, including cybersecurity related risks, for over 20 years.


text: Our Board as a whole has responsibility for the Company's risk oversight, with reviews of certain areas being conducted by the relevant Board committees that report on their deliberations to the full Board. The oversight responsibility of the Board and its committees is enabled by management reporting processes that are designed to provide visibility to the Board about the identification, assessment and management of critical risks and management's risk mitigation strategies.


text: Oversight of risks relating to IT and cybersecurity has been delegated by our Board to its Audit Committee. The Audit Committee includes members of the Board who, in addition to each being designated as an "audit committee financial expert," possess backgrounds and experience which we believe enable them to provide effective oversight of our IT and cybersecurity risks. Our management routinely reports to the Audit Committee on the status of the Cybersecurity Program and material risks from cybersecurity threats at the Audit Committee's quarterly meetings. Such reports generally detail any testing, observations or developments concerning the Cybersecurity Program that occurred during the prior quarter. The results of periodic testing related to the Cybersecurity Program are also described in the Chief Compliance Officer's annual report to the Board, provided pursuant to Rule 38a-1 under the 1940 Act. The crisis response team leader also collaborates with the Audit Committee chair to ensure that the Board is apprised of any material cybersecurity incident.


text: During the reporting period, the Company has not identified any impacts from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results and financial condition.


text: Cybersecurity Risk Management and Strategy We maintain an information security program that seeks to comply with applicable regulatory requirements. The information security team, led by the Chief Information Security Officer ("CISO"), implements appropriate measures designed to safeguard sensitive information and protect our operations and systems against cyber threats. The information security team carries out continuous monitoring and evaluation of Voya's technology and digital infrastructure with the goal of identifying and assessing threats and proactively mitigating potential risks. The CISO and the information security team provide regular updates to Voya's senior management, as further described under Cybersecurity Governance below.

companyName: Voya Financial, Inc.

ticker: VOYA


text: In addition, as part of its risk management strategy, Voya has an established and integrated cybersecurity incident response plan that focuses on incident detection, management and response. The information security team periodically reviews and updates the plan and tests playbooks within the plan through tabletop exercises.


text: Voya's information security team is responsible for identifying, assessing, and managing cyber risk, with support from Voya's operational risk management team. Information security control tasks are performed under the direction and guidance of the CISO, who is designated under Voya's risk management principles and policies to oversee the evaluation and mitigation of information security risks. Information security management is integrated into Voya's overall risk management framework, which provides for a coordinated approach to addressing cybersecurity risk.


text: As part of Voya's overall information security program, we may engage and retain external assessors and consultants to help improve our security, stay aligned with industry best practices, evaluate external threats and, on an as-needed basis, perform forensic reviews of cybersecurity-related incidents or independent security assessments.


text: With regard to risks posed by third-party vendors and service providers, Voya has a dedicated team that is responsible for evaluating, assessing, and addressing those risks, with the ultimate goal of protecting sensitive information and the security of our operations and systems supported by those vendors and providers using a risk-based approach. This team conducts due diligence on third-party vendors and service providers, including evaluating their information security controls and related measures, to identify potential risks and implement appropriate controls.


text: Technology risks, including cybersecurity threats, undergo a thorough risk management assessment. We evaluate risks quantitatively and qualitatively to determine both the probability and potential severity of such risks and whether any such risks could materially affect Voya. We have experienced and may continue to experience cybersecurity incidents and threats that could materially affect our business strategy, results of operations or financial condition. There have been no known cybersecurity incidents that have materially affected us in the past three years. For more information about the cybersecurity related risks that we face, see Interruption or other operational failures in telecommunication, cybersecurity, information technology and other operational systems, including as a result of human and process error or a failure to maintain the security, integrity, confidentiality, or privacy of such systems, could harm our business in Risk Factors in Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance As detailed above, the CISO and the information security team regularly assess and manage cybersecurity risks. Voya's information security leadership team has extensive information technology and information security experience, and the full team comprises over 100 employees with over 150 certifications from leading information security certification organizations. Additional management of cybersecurity risks is conducted by Voya's Technology and Operational Risk Committee ("TORC"), which has been delegated authority by Voya's Management Risk Committee to provide oversight of operational risk, including information and technology risk, as well as related legal, compliance and regulatory risks. Members of the TORC include senior management with relevant expertise in operations, technology, information security, legal, compliance, data privacy and operational risk management. The information security team participates in the TORC meetings to discuss cybersecurity risks and mitigation treatment. The TORC provides guidance and direction in assessing, addressing, mitigating and monitoring cybersecurity risks within Voya.


text: Voya's Board committees include the Technology, Innovation and Operations ("TIO") Committee, which provides support to the Board in its oversight of information technology, including cybersecurity risks. In addition, the TIO Committee supports the Audit Committee in reviewing cybersecurity risks and disclosures thereof, and collaborates with both the Audit Committee and the Risk, Investment and Finance ("RIF") Committee of the Board to oversee material risks. Management, including the CISO, regularly updates the TIO Committee on cybersecurity-related matters.