text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CIO who has held that role since 2019 and has been employed by the company since 2004. With almost 20 years of experience in cybersecurity, our CIO has extensive cybersecurity expertise and in-depth knowledge and experience instrumental in developing and executing our cybersecurity strategies. Our CIO oversees our cyber governance programs, evaluates our compliance with applicable standards and remediates known risks. Our CIO also oversees our internal phishing tests, leads our employee cyber training program and seeks to promote company-wide awareness of cybersecurity risk through broad-based communications and educational initiatives.


text: At the day-to-day operational level, our CIO manages an information security team tasked with executing our cybersecurity program. This team includes a director of network security, technical director of enterprise architecture, system architects and network security staff. Members of our information technology (IT) management group, led by our CIO, have extensive years of combined experience in defending large, complex corporate environments. Our CIO, IT management group, architects and network security team members receive briefings and annual training on cybersecurity threats and response methods that provide real world threat scenarios to measure the effectiveness of our programs and technologies in protecting our systems. Our team of professionals also monitors our compliance with laws governing privacy rights, data protection and cybersecurity.

companyName: POOL CORP

ticker: POOL

secItem: Item 1C


text: Our incident response policy outlines our protocols for assessing, managing and responding to cyber incidents. This policy guides the response of our global IT team, which, depending on the significance of the incident, includes activating response plans from third-party partners, escalating the issue to executive management, notifying one or more members of our Board, maintaining communication with users and notifying law enforcement and other agencies if warranted. We may also receive assistance from a third-party security operations center (SOC) and other industry-leading third-party providers.


text: Risk Management and Strategy Our cybersecurity program, which is primarily documented in our business interruption and incident response policy, is designed to assess, identify and manage material risks from cybersecurity threats. Our program leverages components from the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), which we use to help us identify, assess and manage cybersecurity risks relevant to our business. O ur cybersecurity program is a component of our overall enterprise risk program. We deploy multiple strategies and dedicate significant resources toward systems designed to identify, assess, manage, mitigate and respond to cybersecurity threats. We also consistently strive to improve the detection and response capabilities of our cybersecurity program. To do this, we monitor best practices across the cybersecurity space and endeavor to incorporate those in our own cybersecurity program.


text: Our cybersecurity policies and procedures include the controls and technology we use to identify, assess and respond to cybersecurity threats and incidents. These policies and procedures also focus on identifying vulnerabilities in our internal and external environments and remediating those vulnerabilities. To combat cybersecurity risk, we focus on proactive procedures such as patch management and emphasize the importance of cybersecurity across our organization through quarterly trainings, which include best practices and participation in simulated phishing exercises to strengthen employee vigilance.


text: We evaluate our controls and response protocols at least twice a year using external third-party assessors and consultants in both advisory and adversarial engagements. These third-party experts are familiar with our systems and could be retained in the event of a significant incident to assist us in evaluating and responding to such an incident. We also regularly test our environment as part of our focus on identifying and eliminating vulnerabilities. We incorporate the lessons learned from these engagements into our cybersecurity program. Recognizing the risks posed by external partners, we have implemented a third-party risk management program, which includes due diligence assessments, contractual safeguards, and regular monitoring of vendors and partners with access to our systems or data; however, we cannot ensure in all circumstances that their defensive efforts will be successful.


text: Like most large organizations, we face constant and dynamic risks related to cybersecurity. In recent years we have faced, and expect to continue to face, various attempted cyber-attacks of increasing sophistication. To date, we are not aware of any cybersecurity incident or threat that materially impacted or could reasonably be anticipated to materially affect our business, results of operations or financial condition. However, we cannot guarantee that we will not experience such an incident in the future. For a further description of these risks, see "Risk Factors – Risks Relating to Technology, Cybersecurity and Data Privacy," included in Item 1A of this Form 10-K, which should be read in conjunction with this Item 1C.


text: Our Board of Directors (Board) is responsible for oversight of our risk management programs and assisting management in addressing specific risks, including cybersecurity risks. The Audit Committee assists our Board in reviewing cybersecurity and other information technology risks, controls and procedures, including our plans to mitigate cybersecurity risks and to respond to data breaches. The Audit Committee also helps in reviewing with management any specific cybersecurity issues that could have a material impact on us. Our Chief Information Officer (CIO) provides the Board with updates on cybersecurity risks at regularly scheduled board meetings at least twice a year. These updates include the results of any third-party reviews and related remediation items.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CIO, who has held that role since 2019 and has been employed by the company since 2004. With almost 20 years of experience in cybersecurity, our CIO has extensive cybersecurity expertise and in-depth knowledge and experience instrumental in developing and executing our cybersecurity strategies. Our CIO oversees our cyber governance programs, evaluates our compliance with applicable standards and remediates known risks. Our CIO also oversees our internal phishing tests, leads our employee cyber training program and seeks to promote company-wide awareness of cybersecurity risk through broad-based communications and educational initiatives.


text: Our incident response policy outlines our protocols for assessing, managing and responding to cyber incidents. This policy guides the response of our global IT team, which, depending on the significance of the incident, may include escalating the issue to executive management, notifying one or more members of our Board, maintaining communication with users and notifying law enforcement and other agencies if warranted. We may also receive assistance from a third-party security operations center (SOC) and other industry-leading third-party providers.


text: Risk Management and Strategy Our cybersecurity risk management and strategy are integrated into our enterprise-wide risk management program, which leverages a "three lines of defense" model to manage risk within the organization. Technology risk (including cybersecurity risk) is identified as a key risk area for the Company, and Management measures inherent risk, mitigating controls, and residual risk on a quarterly basis.

companyName: BANNER CORP

ticker: BANR


text: The ability to mitigate cybersecurity risks is dependent upon an effective risk assessment process that identifies, measures, controls, and monitors material risks stemming from cybersecurity threats. These threats include any potential unauthorized activities occurring through the Company's information systems that could adversely affect the confidentiality, integrity, or availability of the Company's information systems or the data contained therein. The Company's Information Security Program includes a comprehensive information security risk assessment process that incorporates the following elements: • Identifying threats, measuring risk, defining information security requirements, and implementing controls to reduce risk. • Identifying reasonably foreseeable internal and external threats that may lead to unauthorized disclosure, misuse, alteration, or destruction of sensitive information or information systems. • Assessing the likelihood and potential damage posed by these threats, considering the degree of information sensitivity and the Company's operations, inclusive of substantive changes to people, processes and technology. • Aligning the Information Security Program with the Company's enterprise-wide risk management program, which identifies, measures, mitigates, and monitors risk. • Evaluating the adequacy of policies, procedures, information systems, and other arrangements designed to control identified risks, considering the Company's operations, inclusive of substantive changes to people, processes and technology. • Providing input for internal and external auditors and independent third-party engagements, including in relation to internal and external (i.e., third-party operated) penetration tests. • Exercising risk oversight to conduct appropriate, risk-based due diligence and monitoring to understand risks associated with our third-party vendors and outsourced services.


text: The risk assessment process is designed to identify assets requiring risk reduction strategies and includes an evaluation of the key factors applicable to the operation. The Company conducts a variety of information security assessments throughout the year, both internally and through third-party specialists.


text: In designing our Information Security Program, we refer to established industry frameworks – in particular, the Federal Financial Institutions Examination Council (FFIEC) and guidance from the International Organization for Standardization (ISO). The FFIEC framework offers a set of guidelines to help financial institutions effectively manage and mitigate cybersecurity risks. The framework focuses on ensuring the confidentiality, integrity, and availability of sensitive information and systems. ISO/IEC 27001 is an international standard developed by the ISO specifically for Information Security, Cybersecurity and Privacy Protection (ISCPP). The ISO/IEC 27001 requirements provide a systematic and risk-based approach to managing sensitive information, ensuring its confidentiality, integrity, and availability. The requirements reflect best practices that organizations can use to guide an information security program. The Company considers these frameworks to be aspirational benchmarks to help inform the design of our Information Security Program, including risk mitigation controls and processes. While we believe our information security program is well-designed and appropriate for our organization, the sophistication of cyber threats continues to increase and the Company's cybersecurity risk management and strategy may be insufficient and may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it may not be able to anticipate all cyber security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A, Risk Factors — Risks Related to Cybersecurity, Data and Fraud.


text: The Company uses a cross-functional approach to identify, prevent, and mitigate cybersecurity threats and incidents, and we have adopted controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. We have developed a formal cybersecurity incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident.


text: While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Company, including our business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors — Risks Related to Cybersecurity, Data and Fraud.


text: Our Board of Directors has adopted, and reviews annually, a Risk Appetite Statement that articulates the Company's attitude towards risk. The Company's Risk Appetite Statement identifies key risk categories and establishes a risk appetite for each, as well as specific associated risk metrics that are monitored quarterly by Management and reported to the Risk Committee. Management measures and reports inherent risk, mitigating controls, and residual risk for each key risk category and also identifies and regularly discusses emerging risks with the Risk Committee.


text: The Company's governance and oversight of cybersecurity risks are facilitated through our Information Security Program, which establishes administrative, technical, and physical safeguards designed to protect the confidential information and records of all the Bank's clients in accordance with FDIC regulations. Our Information Security Program, along with its associated policies and guidelines, takes into account FDIC and FFIEC regulations and guidance on sensitive information protection as well as information system and domain name security. It is tailored to align with the Company's size and complexity and the nature and scope of our activities.


text: We maintain relevant expertise within the Bank's management team to manage cybersecurity risks. In particular, the Bank's Chief Information Officer (CIO) provides direction and oversight for information technology and security across the Company, including existing and emerging initiatives. In this role, she leverages more than 25 years of information technology experience. In addition, the Bank's Chief Information Security Officer (CISO) has been with the Company for more than 12 years and has maintained various applicable cybersecurity and IT audit certifications. Prior to joining the Bank, he worked for a Fortune 500 company and had 15 years of information technology experience working in networking, information security and information technology auditing. The CIO and the CISO are supported by a team of information technology and information security specialists.


text: Our Information Technology (IT) Management team, among other things, is responsible for conducting risk assessments, designing the Information Security Program to manage identified risks based on information sensitivity and the Company's operational complexity, overseeing service provider arrangements, establishing risk-based response programs for incidents of unauthorized access, providing staff training, conducting testing of key controls, systems, and procedures, and adjusting the program in response to changes in people, processes, technology, sensitive information, threats, and the business environment (e.g., mergers, acquisitions, alliances, joint ventures, or outsourcing arrangements).


text: Our IT Management team reports annually to the Risk Committee regarding the overall status of the Information Security Program. This reporting encompasses various aspects, such as risk assessment, risk management and control decisions, service provider arrangements, results of independent testing, cybersecurity incidents or violations and Management's responses, and recommendations for changes to the Information Security Program. Quarterly status updates are also provided to the Risk Committee.


text: The Board of Directors plays a crucial role, annually reviewing and approving our Information Security Program. The Board oversees efforts to develop, implement, and maintain an effective Information Security Program, including reviewing Management's reporting on program effectiveness. Additionally, the Board of Directors' Corporate Governance/Nominating Committee considers information technology and cybersecurity expertise when assessing potential director candidates, to help ensure the Board of Directors has the capability to appropriately oversee Management's activities in these areas.


text: We maintain a Cybersecurity Incident Response Team (CIRT), which is responsible for addressing the technical aspects of the Company's response to cybersecurity events. Additionally, our cross-functional Executive Cybersecurity Event Evaluation Team (ECEET) is responsible for assessing the potential business impacts and disclosure requirements related to cybersecurity events. Both the CIRT and the ECEET may consult cybersecurity legal counsel and other external experts in connection with their respective activities. An escalation process has been established for engaging other governance groups, which may include the Company's Disclosure Committee and/or the Board of Directors' Audit Committee, each of which also receive a quarterly report from the chair of the ECEET.


text: Risk Management and Strategy Our cybersecurity risk management and strategy are integrated into our enterprise-wide risk management program, leveraging a "three lines of defense" model to manage risk within the organization. Technology risk (including cybersecurity risk) is considered to be a key risk area for the Company, with Management measuring inherent risk, mitigating controls, and residual risk on a quarterly basis.


text: The ability to mitigate cybersecurity risks depends on an effective risk assessment process that identifies, measures, controls, and monitors material risks from cybersecurity threats. These threats include any potential unauthorized activities that could compromise the confidentiality, integrity, or availability of the Company's information systems and data. Our Information Security Program includes a comprehensive information security risk assessment process that incorporates the following elements: • Identifying threats, measuring risk, defining information security requirements, and implementing controls to reduce risk. • Identifying reasonably foreseeable internal and external threats that may lead to unauthorized disclosure, misuse, alteration, or destruction of sensitive information or information systems. • Assessing the likelihood and potential damage posed by these threats, considering the degree of information sensitivity and the Company's operations, inclusive of substantive changes to people, processes and technology. • Aligning the Information Security Program with the Company's enterprise-wide risk management program, which identifies, measures, mitigates, and monitors risk. • Evaluating the adequacy of policies, procedures, information systems, and other arrangements designed to control identified risks, considering the Company's operations, inclusive of substantive changes to people, processes and technology. • Conducting internal and third-party security assessments, including penetration testing. • Overseeing third-party vendor risk through due diligence and monitoring.


text: In designing our Information Security Program, we refer to established industry frameworks – in particular, the Federal Financial Institutions Examination Council (FFIEC) and guidance from the International Organization for Standardization (ISO). The FFIEC framework offers a set of guidelines to help financial institutions effectively manage and mitigate cybersecurity risks. ISO/IEC 27001 is an international standard developed by the ISO specifically for Information Security, Cybersecurity and Privacy Protection (ISCPP). These frameworks provide best practices for managing cybersecurity risks and ensuring information security, and we consider them to be aspirational benchmarks to help inform the design of our Information Security Program. While our program is designed to be robust, the sophistication and evolving nature of cyber threats mean no system can fully eliminate risk. For more information on how cybersecurity risk may affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A, Risk Factors — Risks Related to Cybersecurity, Data and Fraud.


text: The Company uses a cross-functional approach to identify, prevent, and mitigate cybersecurity threats and incidents. We have established procedures for the timely escalation and, when required, disclosure of cybersecurity incidents, supported by a formal incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident. While cybersecurity risks could materially affect the Company, past incidents have not materially affected our business strategy, results of operations or financial condition. For further details on potential cybersecurity risks, see Item 1A, Risk Factors — Risks Related to Cybersecurity, Data and Fraud.


text: Our Board of Directors annually reviews and approves the Company's Risk Appetite Statement, which defines key risk categories and associated metrics that are monitored quarterly by Management and reported to the Risk Committee. Management measures and reports inherent risk, mitigating controls, and residual risk for each key risk category and identifies and regularly discusses emerging risks with the Risk Committee.


text: The Company's governance and oversight of cybersecurity risks are facilitated through our Information Security Program, which establishes administrative, technical, and physical safeguards designed to protect sensitive information in accordance with FDIC and FFIEC regulations. The program is tailored to align with the Company's size, complexity and operational scope.


text: Cybersecurity risk management is led by our Chief Information Officer (CIO) and Chief Information Security Officer (CISO), supported by our information technology and information security teams. The Bank's Chief Information Officer (CIO) provides direction and oversight for information technology and security across the Company, including existing and emerging initiatives. In this role, she leverages more than 26 years of information technology experience. The Bank's Chief Information Security Officer (CISO) has been with the Company for more than 13 years and has maintained various applicable cybersecurity and IT audit certifications. Prior to joining the Bank, he worked for a Fortune 500 company and had 15 years of information technology experience working in networking, information security and information technology auditing.


text: Our Information Technology (IT) Management team is responsible for conducting risk assessments, designing the Information Security Program, overseeing service provider arrangements, establishing risk-based response programs for incidents involving unauthorized data access, providing staff training, conducting testing of key controls, systems, and procedures, and adjusting the program to reflect changes in people, processes, technology, sensitive information, threats, and the business environment (e.g., mergers, acquisitions, alliances, joint ventures, or outsourcing arrangements).


text: Our IT Management team reports annually to the Risk Committee on the status of the Information Security Program, including risk assessment, risk management and control decisions, service provider arrangements, results of independent testing, cybersecurity incidents and recommendations for improvements. Quarterly status updates are also provided to the Risk Committee.


text: The Board of Directors plays a crucial role, annually reviewing and approving our Information Security Program. The Board oversees efforts to develop, implement, and maintain an effective Information Security Program, including reviewing Management's reporting on program effectiveness. The Board of Directors' Corporate Governance/Nominating Committee considers IT and cybersecurity expertise when assessing potential director candidates to help ensure effective oversight by the Board of Directors.


text: We maintain a Cybersecurity Incident Response Team (CIRT) to handle technical aspects of the Company's response to cybersecurity events and an Executive Cybersecurity Event Evaluation Team (ECEET) to assess potential business impacts and disclosure requirements related to cybersecurity events. Both teams may engage cybersecurity legal counsel and other external experts in connection with their respective activities. An escalation process facilitates updates to internal governance groups, including the Company's Disclosure Committee and/or the Board of Directors' Audit Committee, each of which also receives a quarterly report from the ECEET chair.


text: Risk management and strategy We prioritize the management of cybersecurity risk and the protection of information across our enterprise by embedding data protection and cybersecurity risk management in our operations. Our processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes. For example, to identify and assess risks from cybersecurity threats, our enterprise risk management program considers cybersecurity as part of the Company's risk assessment process, and our risk management framework requires risk owners to monitor key risks such as cybersecurity on a continuous basis. See Item 1, " Business—Enterprise Risk Management " for additional information.

companyName: ARCH CAPITAL GROUP LTD.

ticker: ACGL


text: As a foundation of our approach to cybersecurity risk, we have implemented processes at several levels across our enterprise to help assess, identify and manage cybersecurity risks. Our privacy and information security policies and standards govern our business lines and subsidiaries and encompass incident response, access control, and vendor management, among others. In order to develop these policies and procedures, we monitor the privacy and cybersecurity laws, regulations and guidance applicable to us in the regions where we do business. See Item 1, " Business—Regulation—Cybersecurity and Privacy " for additional details.


text: We annually undergo an external evaluation by a third party cybersecurity firm with a specialty in penetration testing. Our vendor management group performs information security risk assessments on our third party service providers with respect to their ability to protect data from unauthorized access, and on a risk weighted basis, we perform re-assessments routinely. The Company also requires these vendors to adhere to privacy and cybersecurity measures and has a third party service provider monitoring program in place that reviews changes to the security posture of certain higher risk third party service providers. In addition, the Company negotiates appropriately protective terms in its legal agreements with these providers.


text: Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, employee or vendor error or misconduct, and other external hazards could expose our information systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our ability to conduct our business. While we and third parties with which we do business have experienced cybersecurity incidents, to date, the Company does not believe that any previous cybersecurity incidents have materially affected the Company.


text: The sophistication of cybersecurity threats, including through the use of AI, continues to increase, and the controls and preventative actions that we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency such as AI may further expose our information systems to the risk of cybersecurity incidents. See Item 1A, " Risk Factors—Risk Relating to Our Industry, Business & Operations —Technology failures and cyber attacks, including, but not limited to, ransomware, exploitation in software or code with malicious intent, state-sponsored cyber attacks, as well as vulnerabilities relating to new technologies, such as generative AI, may impact us or our business partners and service providers, causing a disruption in service and operations which could materially and negatively impact our business and/or expose us to litigation."


text: As part of our overall risk management approach, we recognize the importance of identifying and managing cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Audit Committee, comprised of independent directors from our Board, oversees the Board's responsibilities relating to the operational (including information technology ("IT") risks, business continuity and data security) risk affairs of the Company. Our Audit Committee is informed of such risks through quarterly reports from our Chief Information Officer ("CIO") and Chief Operations Officer ("COO"), with input from our Chief Information Security Officer ("CISO").


text: Our cybersecurity and IT executives include our CIO, who has 33 years of experience in Information Technology, including 20 years in the financial services space. His responsibilities as the CIO include information security oversight, and board reporting. Our CISO, has 18 years of experience in Information Security. The CISO holds certifications from leading security associations. The CISO, reporting to the CIO, oversees the implementation and compliance of our information security standards and mitigation of related risks. We also have three management level committees and a team that supports our processes to assess and manage cybersecurity risk.


text: • The Privacy and Security Committee ("P&S Committee"), co-chaired by the CISO and our Deputy General Counsel, brings together Information Security, legal, compliance, human resources and other function leads. The P&S Committee provides a forum for these cross-functional members of management to: consider new laws and regulations relating to privacy and security; consider emerging risks relating to cybersecurity and data protection; approve, review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise. • The Operational Risk Committee ("ORC"), comprised of senior IT, operations, risk, legal and compliance leaders across business segments, manages risks from matters related to business continuity including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, the ORC reviews the Company's programs and processes related to business operations and resiliency, including crisis incident management and cyber risk response, third party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery. Key information reviewed by the ORC, including as it relates to cybersecurity, are included in the COO's quarterly report to the Audit Committee. • The Crisis Incident Management Team ("CIMT"), which includes senior executives across the Company, is alerted as appropriate to cybersecurity incidents, natural disasters and business outages. Each quarter, the CIMT exercises its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss the event and response options. • The IT Steering Committee ("IT Committee", which includes our CIO, CISO, COO and members of executive leadership, oversees IT initiatives while considering cybersecurity risk mitigation with respect to these initiatives.


text: The P&S Committee, ORC, CIMT and IT Committee are comprised of executives with reporting lines to the CIO and/or the COO.


text: At the employee level, we maintain an experienced IT security team tasked with ongoing reviews of our technology systems, implementation of our privacy and cybersecurity program and support for the CIO and CISO in carrying out their reporting, security and mitigation functions. We also hold employee training on privacy and cybersecurity, records and information management, conduct regular phishing tests and generally seek to promote awareness of cybersecurity risk through communication and education of our employee population.


text: As a foundation of our approach to cybersecurity risk, we have implemented processes at several levels across our enterprise to help assess, identify and manage cybersecurity risks and incidents. Our privacy and information security policies and standards cover topics such as information sharing, privacy, data handling and data management as well as more detailed information technology ("IT") processes encompassing incident response, access control, disaster recovery and testing, among other areas. These policies and standards are regularly reviewed and updated at least annually based on the risk and regulatory environment in which we operate. We monitor closely privacy and cybersecurity, AI and operational resilience laws, regulations and guidance applicable to us. See Item 1, " Business—Regulation—Cybersecurity and Privacy " for additional details.


text: We use many third parties for IT functions and our vendor management group performs information security risk assessments on our third-party service providers with respect to their ability to protect data from unauthorized access, and on a risk weighted basis, we perform re-assessments routinely. The Company also requires these vendors to adhere to privacy and cybersecurity measures and has a third-party service provider monitoring program in place that reviews changes to the security posture of certain higher risk third-party service providers.


text: Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, employee or vendor error or misconduct, and other external hazards could expose our information systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our ability to conduct our business. We annually undergo an external penetration testing by a third-party cybersecurity firm. These tests and our tabletop exercises enable us to incorporate recommendations and learnings in our program. While we and third parties with which we do business have experienced cybersecurity incidents, to date, the Company does not believe that any previous cybersecurity incidents have materially affected the Company.


text: As part of our overall risk management approach, we recognize the importance of identifying and managing cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Audit Committee, comprised of independent directors from our Board, oversees the Board's responsibilities relating to the operational (including IT risks, business continuity and data security) risk affairs of the Company. Our Audit Committee is informed of such risks through quarterly reports from our Chief Information Officer ("CIO") and Chief Operations Officer ("COO"), with input from our Chief Information Security Officer ("CISO").


text: Our cybersecurity and IT executives include our CIO, who has 34 years of experience in Information Technology, including 21 years in the financial services space. His responsibilities as the CIO include all areas of Information Technology and information security oversight. Our CISO, has 19 years of experience in information security. The CISO holds certifications from leading security associations. The information security personnel reporting to the CISO hold various leading security certifications. The CISO, reporting to the CIO, oversees the implementation and compliance of our information security standards and mitigation of related risks. We also have three management level committees and a team that supports our processes to assess and manage cybersecurity risk.


text: The P&S Committee, ORC, CIMT and IT Committee are comprised of executives with reporting lines to the CIO and/or the COO. We also have an enterprise Artificial Intelligence Governance and Oversight Committee focusing on the use and management of AI in our operations.


text: The Company's information security program is designed to protect the security of our computer systems, networks, software and information assets, including customer information. The program is comprised of technical controls, policies, guidelines, and procedures. These technical controls, policies, guidelines, and procedures are intended to align with regulatory guidance, and common industry standard security practices.

companyName: FIRST BANCSHARES INC /MS/


text: The board of directors and our executives appreciate the severity of cybersecurity-related risks and support the continuous development of and investment in the information security program.


text: Commitment to Security and Confidentiality At the Company, we expect each associate to be responsible for the security and confidentiality of customer information. We communicate this responsibility to associates during on-boarding and throughout their employment. Annually, training courses are assigned to each associate to complete on how to protect the confidentiality of customer information at the time of hire and during each year of employment.


text: We regularly provide associates with information security awareness training, including the recognition and appropriate handling of potential phishing emails, which can introduce malware to a bank's network, result in the theft of user credentials and, ultimately, place customer information at risk. We regularly use phishing campaigns to train associates to determine their ability to recognize phishing emails. For associates who fail a phishing campaign, the associates are assigned additional training courses.


text: Associates must also follow established procedures for the safe storage and handling and secure disposal of customer information. Old or obsolete computer assets are subject to defined procedures and processes to ensure safe destruction of information contained on those devices. For paper-based information or documents, we dispose of paper using shred bins for destruction.


text: Cybersecurity Incident Response Plan As part of our information security program, we have adopted an Information Security Incident Response Plan (Incident Response Plan), which is administered by the Company's Chief Information Security Officer (CISO). The Incident Response Plan describes the Company's processes, procedures, and responsibilities for responding to incidents including security and cybersecurity. The Incident Response Plan is intended to be followed in the event of a cybersecurity incident, including implementation of (i) forensic and containment, eradication, and remediation actions by information technology and security personnel and (ii) operational response actions by business units, communications, legal, and risk personnel. The Incident Response Plan includes an annual tabletop exercise to simulate responses to cybersecurity events. If applicable, each exercise may result in postmortem and discuss lessons learned to evaluate any improvements to the Incident Response Plan. The Incident Response Plan includes processes for escalation and reporting of cybersecurity incidents to the Incident Response Team.


text: Network and Device Security The Company employs a constantly evolving, defense-in-depth methodology to cybersecurity. Robust high-availability firewalls are in place at the perimeter. Remote workers are supported through the Company's secure VPN and uses multifactor authentication. The Company has a vulnerability management program in place that includes a managed detect and response platform to ensure monitoring of the Company's network, ensures the timely installation of software patches, and provides a risk-based approach to addresses vulnerabilities across the network. Network security controls are in place to prevent unauthorized access to the network or the Company's IT resources. The Company employs controls over its managed workstations, servers, and other endpoints to prevent inappropriate access or damage to physical, virtual, or data assets. Data loss prevention programs are in place to prevent the inappropriate transmission or exposure of sensitive data assets or customer information.


text: Cybersecurity training is provided to all employees as part of the overall cybersecurity program. The Company contracts with third party vendors to conduct internal and external penetration tests against the Company's networks and IT assets to ensure controls are operating in an appropriate manner.


text: Impacts of Cybersecurity Incidents To date, the Company has not experienced a cybersecurity incident that has materially impacted our business strategy, results of operations, or financial condition. Addressing cybersecurity risks is a priority for the Company, and the Company is committed to enhancing its systems of internal controls and business continuity and disaster recovery plans.


text: Third-Party Vendor Controls Before engaging third-party service providers, the Company carries out a due diligence process. This process is led by the Enterprise Risk Management team and Information Security performs due diligence through the process. Risk assessments are reviewed using Service Organization Controls (SOC) reports, self- attestation questionnaires, and other tools.


text: Any third-party service provider or vendor utilized as part of the Company's cybersecurity framework is required to comply with the Company's policies regarding non-public personal information and information security. Third parties processing sensitive customer data are contractually required to meet all legal and regulatory obligations to protect customer data against security threats or unauthorized access. After contract executions, vendors undergo ongoing monitoring to ensure they continue to meet their security obligations.


text: Our Board of Directors' Role in Oversight of Cybersecurity Threats Our Board of Directors is responsible for overseeing the Company's business and affairs, including risks associated with cybersecurity threats. The Board oversees the Company's corporate risk governance processes primarily through its committees, and oversight of cybersecurity threats is delegated primarily to our Board Risk Committee.


text: The Board Risk Committee has primary responsibility for overseeing the Company's comprehensive Enterprise Risk Management program. The Enterprise Risk Management program assists senior management in identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment. Cybersecurity matters and assessments are regularly included in Board Risk Committee meetings.


text: The Board's oversight of cybersecurity risk is supported by our CISO and Cybersecurity Manager. The CISO and the Cybersecurity Manager attend Board Risk Committee meetings, periodically provides cybersecurity and other information security updates to the Board Risk Committee. The CISO also provides an annual information security program summary report to the Board, outlining the overall status of our information security program and the Company's compliance with regulatory guidelines.


text: Our Management's Role in Assessing and Managing Cybersecurity Matters The Company's CISO directs the Company's information security program and our information technology risk management. The CISO and Cybersecurity Manager along with a team of dedicated security personnel examines risks to the Company's information systems and assets, designs and implements security solutions, monitors the environment, and provides immediate responses to threats.


text: Role of the Chief Information Security Officer and Cybersecurity Manager Our CISO is responsible for the Company's information security program. In this role, the CISO manages the Company's information security Program.


text: The CISO has experience with FDIC regulated financial institutions and holds the certification as a Certified Banking Chief Information Security Officer (CBISO) and participates in various Information Security peer groups and serves on the Mississippi Bankers Associations - Information Security Committee. The Company's Cybersecurity Manager oversees the day-to-day cybersecurity operations.


text: The CISO and Cybersecurity Manager support the information security risk oversight responsibilities of the Board and its committees. The CISO reports to our Chief Information Officer, who in turn reports to our Chief Executive Officer and President. The Cybersecurity Manager reports to the Information Technology Director, who in turn reports to the Chief Information Officer.


text: Our Cybersecurity Manager has experience spanning multiple OCC and FDIC regulated financial institutions across the nation. He holds various cybersecurity related certifications and is currently registered with the International Information Systems Security Certification Consortium as a Certified Information Systems Security Professional (CISSP) member in good standing.


text: Role of the Enterprise Risk Manager Our Enterprise Risk Manager is responsible for oversight of the Company's information technology governance and risk program. In this role, the Enterprise Risk Manager provides independent oversight of information technology risk, promotes effective challenge to the Company's information technology systems, and ensures that high level risks receive appropriate attention. The Enterprise Risk Manager is a member of the Company's Risk Management Group and reports to the Chief Risk Officer, who in turn reports to the Board Risk Committee.


text: Role of the IT Risk Governance Subcommittee Governance of the information security program begins with the IT Risk Governance Subcommittee, a management level subcommittee, whose objective is to protect the integrity, security, safety and resiliency of corporate information systems and assets. Together, our CISO leads the Company's IT Risk Governance Committee. The IT Risk Governance Committee meets regularly to review the development of the program and develop recommendations and provides regular reports to management, and, ultimately, the Board Risk Committee through the CISO.


text: Role of Enterprise Risk Management Enterprise Risk Management (ERM) is a holistic process to identify, assess/measure, mitigate/control, and aggregate/escalate/report organizational risks, both internal and external, in order to make decisions aimed at maximizing shareholder value and achieving strategic goals. The overarching ERM program shapes information security strategy and development. ERM works with information security management to facilitate performance of Risk Assessments, the results of which are used to identify opportunities to strengthen the program.


text: The Company's information security program is designed to protect the security of our computer systems, networks, software and information assets, including customer information. The program is comprised of technical controls, policies, guidelines, and procedures. These technical controls, policies, guidelines, and procedures are intended to align with regulatory guidance, and common industry standard security practices.


text: The Board and our executives appreciate the severity of cybersecurity-related risks and support the continuous development of and investment in the information security program.


text: Commitment to Security and Confidentiality At the Company, we expect each associate to be responsible for the security and confidentiality of customer information. We communicate this responsibility to associates during on-boarding and throughout their employment. Annually, training courses are assigned to each associate to complete on how to protect the confidentiality of customer information at the time of hire and during each year of employment.


text: We regularly provide associates with information security awareness training, including the recognition and appropriate handling of potential phishing emails, which can introduce malware to a bank's network, result in the theft of user credentials and, ultimately, place customer information at risk. We regularly use phishing campaigns to train associates to determine their ability to recognize phishing emails. For associates who fail a phishing campaign, the associates are assigned additional training courses.


text: Associates must also follow established procedures for the safe storage and handling and secure disposal of customer information. Old or obsolete computer assets are subject to defined procedures and processes to ensure safe destruction of information contained on those devices. For paper-based information or documents, we dispose of paper using shred bins for destruction.


text: Cybersecurity Incident Response Plan As part of our information security program, we have adopted an Information Security Incident Response Plan (Incident Response Plan), which is administered by the Company's Chief Information Security Officer (CISO). The Incident Response Plan describes the Company's processes, procedures, and responsibilities for responding to incidents including security and cybersecurity. The Incident Response Plan is intended to be followed in the event of a cybersecurity incident, including implementation of (i) forensic and containment, eradication, and remediation actions by information technology and security personnel and (ii) operational response actions by business units, communications, legal, and risk personnel. The Incident Response Plan includes an annual tabletop exercise to simulate responses to cybersecurity events. If applicable, each exercise may result in postmortem and discuss lessons learned to evaluate any improvements to the Incident Response Plan. The Incident Response Plan includes processes for escalation and reporting of cybersecurity incidents to the Incident Response Team.


text: Network and Device Security The Company employs a constantly evolving, defense-in-depth methodology to cybersecurity. Robust high-availability firewalls are in place at the perimeter. Remote workers are supported through the Company's secure virtual private network (VPN) and uses multifactor authentication. The Company has a vulnerability management program in place that includes a managed detect and response platform to ensure monitoring of the Company's network, ensures the timely installation of software patches, and provides a risk-based approach to addresses vulnerabilities across the network. Network security controls are in place to prevent unauthorized access to the network or the Company's IT resources. The Company employs controls over its managed workstations, servers, and other endpoints to prevent inappropriate access or damage to physical, virtual, or data assets. Data loss prevention programs are in place to prevent the inappropriate transmission or exposure of sensitive data assets or customer information.


text: Cybersecurity training is provided to all employees as part of the overall cybersecurity program. The Company contracts with third party vendors to conduct internal and external penetration tests against the Company's networks and IT assets to ensure controls are operating in an appropriate manner.


text: Impacts of Cybersecurity Incidents To date, the Company has not experienced a cybersecurity incident that has materially impacted our business strategy, results of operations, or financial condition. Addressing cybersecurity risks is a priority for the Company, and the Company is committed to enhancing its systems of internal controls and business continuity and disaster recovery plans.


text: Third-Party Vendor Controls Before engaging third-party service providers, the Company carries out a due diligence process. This process is led by the Enterprise Risk Management team and Information Security performs due diligence through the process. Risk assessments are reviewed using Service Organization Controls (SOC) reports, self- attestation questionnaires, and other tools.


text: Any third-party service provider or vendor utilized as part of the Company's cybersecurity framework is required to comply with the Company's policies regarding non-public personal information and information security. Third parties processing sensitive customer data are contractually required to meet all legal and regulatory obligations to protect customer data against security threats or unauthorized access. After contract executions, vendors undergo ongoing monitoring to ensure they continue to meet their security obligations.


text: Our Board of Directors' Role in Oversight of Cybersecurity Threats Our Board of Directors is responsible for overseeing the Company's business and affairs, including risks associated with cybersecurity threats. The Board of Directors oversees the Company's corporate risk governance processes primarily through its committees, and oversight of cybersecurity threats is delegated primarily to our Board Risk Committee.


text: The Board of Directors' Risk Committee has primary responsibility for overseeing the Company's comprehensive Enterprise Risk Management program. The Enterprise Risk Management program assists senior management in identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment. Cybersecurity matters and assessments are regularly included in Board Risk Committee meetings.


text: The Board 's oversight of cybersecurity risk is supported by our CISO and Cybersecurity Manager. The CISO and the Cybersecurity Manager attend Board Risk Committee meetings, periodically provides cybersecurity and other information security updates to the Board Risk Committee. The CISO also provides an annual information security program summary report to the Board of Directors, outlining the overall status of our information security program and the Company's compliance with regulatory guidelines.


text: Our Management's Role in Assessing and Managing Cybersecurity Matters The Company's CISO directs the Company's information security program and our information technology risk management. The CISO and Cybersecurity Manager along with a team of dedicated security personnel examines risks to the Company's information systems and assets, designs and implements security solutions, monitors the environment, and provides immediate responses to threats.


text: Role of the Chief Information Security Officer and Cybersecurity Manager Our CISO is responsible for the Company's information security program. In this role, the CISO manages the Company's information security Program. The Company's Cybersecurity Manager oversees the day-to-day cybersecurity operations.


text: The CISO and Cybersecurity Manager support the information security risk oversight responsibilities of the Board of Directors and its committees. The CISO reports to our Chief Information Officer, who in turn reports to our Chief Executive Officer and President. The Cybersecurity Manager reports to the Information Technology Director, who in turn reports to the Chief Information Officer.


text: Our Cybersecurity Manager has experience spanning multiple OCC and FDIC regulated financial institutions across the nation. He holds various cybersecurity related certifications and is currently registered with the International Information Systems Security Certification Consortium as a Certified Information Systems Security Professional (CISSP) member in good standing.


text: Role of the Enterprise Risk Manager Our Enterprise Risk Manager is responsible for oversight of the Company's information technology governance and risk program. In this role, the Enterprise Risk Manager provides independent oversight of information technology risk, promotes effective challenge to the Company's information technology systems, and ensures that high-level risks receive appropriate attention. The Enterprise Risk Manager is a member of the Company's Risk Management Group and reports to the Chief Risk Officer, who in turn reports to the Board Risk Committee.


text: Role of the IT Risk Governance Subcommittee Governance of the information security program begins with the IT Risk Governance Subcommittee, a management level subcommittee, whose objective is to protect the integrity, security, safety and resiliency of corporate information systems and assets. Together, our CISO leads the Company's IT Risk Governance Committee. The IT Risk Governance Committee meets regularly to review the development of the program and develop recommendations and provides regular reports to management, and, ultimately, the Board Risk Committee through the CISO.


text: Role of Enterprise Risk Management Enterprise Risk Management (ERM) is a holistic process to identify, assess/measure, mitigate/control, and aggregate/escalate/report organizational risks, both internal and external, in order to make decisions aimed at maximizing shareholder value and achieving strategic goals. The overarching ERM program shapes information security strategy and development. ERM works with information security management to facilitate performance of Risk Assessments, the results of which are used to identify opportunities to strengthen the program.


text: Risk Management and Strategy In our business, we recognize the risk that cybersecurity threats pose to our operations, and as such, cybersecurity is an important component of our overall risk management strategy. We have adopted and implemented an approach to identify and mitigate cybersecurity risks utilizing the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF") as a guideline to help management identify, assess, reassess, and manage cybersecurity risks. We have developed and implemented cybersecurity programs and processes, including risk management and assessment programs, network segmentation, deployment of detection tools across our network, systems and databases, security and event monitoring capabilities, a detailed incident response plan and an incident response team. Our incident response team is led by our Chief Information Officer, who has over 22 years of experience in information technology leadership and information security, serving in roles of increasing responsibility within private and public companies, and also includes our General Counsel and our Chief Financial Officer.

companyName: SMITH MICRO SOFTWARE, INC.

ticker: SMSI


text: We conduct an initial assessment on the cybersecurity profile of our third party vendors as they are onboarded and evaluate their cyber security programs and safeguards before utilizing them in our environments. We utilize cyber intelligence to provide continuous monitoring and scanning of systems to provide awareness if any of our vendors have security incidents. Within our purchasing and third-party vendor management programs, we require all vendors who handle our data as well as vendors who provide technology and data services to maintain certain security protections including compliance with applicable data protection laws and implementation of administrative, physical, and technical safeguards to protect our data, including storage, transmission, and access.


text: We have implemented advanced detection, prevention and protection capabilities, including practices and tools to monitor and mitigate threats. We provide at least quarterly company-wide cybersecurity information training and routinely communicate with employees about the potential for cybersecurity threats. We additionally deploy technical safeguards that are designed to protect our information systems from cybersecurity threats including firewalls, intrusion penetration and detection systems, anti-malware functionality and access controls, vulnerability assessments and cybersecurity threat intelligence. We continuously monitor and assess our information technology and data assets to detect anomalies and to respond quickly to threats that may arise. In certain instances, we engage third parties to conduct or assist us with conducting cybersecurity risk assessments, information security program assessments and external threat environment reviews.


text: We perform periodic assessments and testing of our policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments are evaluated by management, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these evaluations.


text: Our incident response plan sets forth a process for detecting and responding to cybersecurity incidents, determining their scope and risk, developing an appropriate response to mitigate and remediate the incident, assessing materiality and communication or notification requirements, and reducing the likelihood of future incidents. In the event of a real or perceived cybersecurity incident the information technology team would, as soon as practicable, inform the incident response team, the members of which would then collaborate to assess a strategy and manage the risks.


text: Our risks of security breaches, improper access to or disclosure of our data, our customers' data or their end users' data, other hacking attacks on our systems or the third-party systems that we use, or other cyber incidents and privacy breaches could harm our reputation and adversely affect our business, are further disclosed in Item 1A. RISK FACTORS. To date, there have been no cybersecurity incidents which have materially affected, or have been reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Further, we have a cyber risk insurance policy designed to help us mitigate risk exposure by providing top-tier external cybersecurity firms, as needed, and offsetting certain costs that may be involved with response, recovery and remediation after a cybersecurity breach or similar event.


text: The audit committee of the Company's Board of Directors is responsible for overseeing management's risk assessment and risk management processes designed to monitor and mitigate cybersecurity threats by reviewing with management the cybersecurity and other information technology risks, controls and processes, including the processes used to prevent or mitigate cybersecurity risks and respond to cybersecurity events. The Chief Information Officer, a member of the Company's incident response team, provides reports at least annually to the entire Board of Directors and other members of our senior management team as appropriate. These reports include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our Chief Information Officer also regularly updates senior management on our cybersecurity risk governance and management and the status of ongoing efforts to strengthen cybersecurity effectiveness. We also actively engage with key vendors, customers, and industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: As dictated by the incident response plan, our audit committee also will receive prompt and timely information regarding cybersecurity threats or incidents that may be material in nature from the incident response team, as well as ongoing updates regarding any such threat or incident until it has been mitigated, resolved, or otherwise addressed.


text: Risk Management and Strategy In our business, we recognize the risk that cybersecurity threats pose to our operations, and as such, cybersecurity is an important component of our overall risk management strategy. We have adopted and implemented an approach to identify and mitigate cybersecurity risks utilizing the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF") as a guideline to help management identify, assess, reassess, and manage cybersecurity risks. We have developed and implemented cybersecurity programs and processes, including risk management and assessment programs, network segmentation, deployment of detection tools across our network, systems and databases, security and event monitoring capabilities, a detailed incident response plan and an incident response team. Our incident response team is led by our Chief Information Officer, who has over 23 years of experience in information technology leadership and information security, serving in roles of increasing responsibility within private and public companies, and also includes our General Counsel and our Chief Financial Officer. We conduct an initial assessment on the cybersecurity profile of our third party vendors as they are onboarded and evaluate their cyber security programs and safeguards before allowing them access in our environments. We utilize cyber intelligence to provide continuous monitoring and scanning of systems to provide awareness if any of our vendors have security incidents. Within our purchasing and third-party vendor management programs, we require all vendors who handle our data as well as vendors who provide technology and data services to maintain certain security protections including compliance with applicable data protection laws and implementation of administrative, physical, and technical safeguards to protect our data, including storage, transmission, and access. We have implemented advanced detection, prevention and protection capabilities, including practices and tools to monitor and mitigate threats. We provide at least quarterly company-wide cybersecurity information training and routinely communicate with employees about the potential for cybersecurity threats. We additionally deploy technical safeguards that are designed to protect our information systems from cybersecurity threats including firewalls, intrusion penetration and detection systems, anti-malware functionality and access controls, vulnerability assessments and cybersecurity threat intelligence. We continuously monitor and assess our information technology and data assets to detect anomalies and to respond quickly to threats that may arise. In certain instances, we engage third parties to conduct or assist us with conducting cybersecurity risk assessments, information security program assessments and external threat environment reviews.


text: Risk Management and Strategy Century recognizes the importance of developing, implementing, and maintaining appropriate cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. The Board is actively involved in oversight of Century's risk management program, and cybersecurity represents an important component of Century's overall approach to enterprise risk management ("ERM"). Century's cybersecurity policies, standards, processes and practices are based on recognized security frameworks and applicable industry standards. In general, Century seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that Century generates, collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: CENTURY ALUMINUM CO

ticker: CENX


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Company's Chief Information Officer, other members of Management and a dedicated Cybersecurity team. • Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, logical access controls, and endpoint protection, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that address the Company's response to a cybersecurity incident, and such plans are regularly evaluated and updated. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Network Penetration Testing: The Company performs an internal and external network penetration test led by its Internal Audit team and addresses any findings in a timely manner.


text: Risks from Cybersecurity Threats On February 16, 2022, we became aware of a cybersecurity intrusion that caused a network disruption and impacted certain of our systems. Upon detection, we took steps to address the incident, including engaging both internal resources and a team of third-party experts to investigate and respond to this intrusion. While the February 2022 cybersecurity intrusion did not materially and adversely affect our results of operations, such events have the potential to have a material adverse affect on our business strategy, results of operations and financial condition, including by damaging or interrupting access to our information systems or networks, compromising confidential or otherwise protected information, destroying or corrupting data, or otherwise disrupting our operations. Such events could also damage our reputation and our competitive position and could result in litigation with third parties, regulatory action, loss of business, potential liability and increased remediation costs, any of which could have a material adverse effect on our financial condition and results of operations. Such security breaches could also result in a violation of applicable U.S. and international privacy and other laws and could have a material adverse effect on our business, results of operations and financial position. See "Risk Factors - Risks Related to Cybersecurity - The failure of our information technology systems, network disruptions, cyber-attacks or other breaches in data security could have a material adverse effect on our business, results of operations and financial position."


text: Board of Directors Oversight The Board as a whole also oversees the Company's cybersecurity risks. Our Chief Information Officer updates the Board periodically regarding the actions management is taking to mitigate the Company's cybersecurity risks and enhance the Company's cybersecurity protection. Management routinely evaluates the Company's existing security processes, procedures and systems in order to determine whether additional enhancements are needed to further reduce the likelihood and impact of a future cybersecurity event. Some of the Company's current safeguards include multi-factor authentication for remote access to systems; performing email phishing test campaigns; email spam filtering; restricted internet firewall rules; limiting memory stick and external hard drive use; requiring timely application of security and software patches on servers; antivirus endpoint protection upgrades; performing 24-hour/7-day a week network monitoring; and improving our backup and recovery strategy, among others.


text: Management's Role Managing Risk The Chief Information Officer, as well as other members of Management, plays a pivotal role in informing the Board on cybersecurity risks by providing comprehensive briefings to the Board on a regular basis. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Overall security posture and layers of defense; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to regularly scheduled meetings, the Board and the Chief Information Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Board actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company. The Board conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Chief Information Officer. The Chief Information Officer extensive experience working in and leading the Company's information systems. In addition, a dedicated Cybersecurity team, including the Chief Technology Officer and Cybersecurity Manager, provide regular updates to the Chief Information Officer.


text: Monitor Cybersecurity Incidents The Chief Information Officer is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Chief Information Officer implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CIO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Board of Directors The Chief Information Officer, in his capacity, regularly informs the Chief Financial Officer (CFO) and Chief Executive Officer (CEO) of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Risk Management and Strategy Century recognizes the importance of developing, implementing, and maintaining appropriate cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. The Board is actively involved in oversight of Century's risk management program, and cybersecurity represents an important component of Century's overall approach to enterprise risk management ("ERM"). Century's cybersecurity policies, standards, processes and practices are based on recognized security frameworks and applicable industry standards. In general, Century seeks to address cybersecurity risks through a comprehensive approach that is focused on preserving the confidentiality, security and availability of the information that Century generates, collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Company's Chief Information Officer, other members of Management and a dedicated Cybersecurity team. • Collaborative Approach: The Company has implemented a comprehensive approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, logical access controls, and endpoint protection, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident. • Third-Party Risk Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Network Penetration Testing: The Company performs an internal and external network penetration test led by its Internal Audit team and addresses any findings in a timely manner.


text: Risks from Cybersecurity Threats On February 16, 2022, we became aware of a cybersecurity intrusion that caused a network disruption and impacted certain of our systems. Upon detection, we took steps to address the incident, including engaging both internal resources and a team of third-party experts to investigate and respond to this intrusion. While the February 2022 cybersecurity intrusion did not materially and adversely affect our results of operations, such events have the potential to have a material adverse effect on our business strategy, results of operations and financial condition, including by damaging or interrupting access to our information systems or networks, compromising confidential or otherwise protected information, destroying or corrupting data, or otherwise disrupting our operations. Such events could also damage our reputation and our competitive position and could result in litigation with third parties, regulatory action, loss of business, potential liability and increased remediation costs, any of which could have a material adverse effect on our financial condition and results of operations. Such security breaches could also result in a violation of applicable U.S. and international privacy and other laws and could have a material adverse effect on our business, results of operations and financial position. See "Risk Factors - Risks Related to Cybersecurity - The failure of our information technology systems, network disruptions, cyber-attacks or other breaches in data security could have a material adverse effect on our business, results of operations and financial position."


text: Board of Directors Oversight The Board as a whole also oversees the Company's cybersecurity risks. Our Chief Information Officer updates the Board periodically regarding the actions management is taking to mitigate the Company's cybersecurity risks and enhance the Company's cybersecurity protection. Management routinely evaluates the Company's existing security processes, procedures and systems in order to determine whether additional enhancements are needed to further reduce the likelihood and impact of a future cybersecurity event. Some of the Company's current safeguards include multi-factor authentication for remote access to systems; performing email phishing test campaigns; email spam filtering; restricted internet firewall rules; limiting memory stick and external hard drive use; requiring timely application of security and software patches on servers; antivirus endpoint protection; performing 24-hour/7-day a week network monitoring; and improving our backup and recovery strategy, among others.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Chief Information Officer. The Chief Information Officer has extensive experience working in and leading the Company's information systems. In addition, a dedicated Cybersecurity team, including the Chief Technology Officer and Cybersecurity Manager, provide regular updates to the Chief Information Officer.


text: SLB maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company’s enterprise risk management system and addresses both the corporate information technology environment and customer-facing products.

companyName: SLB LIMITED/NV

ticker: SLB


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (“CSF”) and the International Organization Standardization (“ISO”) 27001 Information Security Management System Requirements. SLB has an annual assessment, performed by a third party, of the Company’s cyber risk management program against the NIST CSF.


text: SLB has a Cyber Security Operations Center operating in three locations to provide 24/7 monitoring of its global cybersecurity environment and to coordinate the investigation and remediation of alerts. A program for staging incident response drills is in place to prepare support teams in the event of a significant incident.


text: Cyber partners are a key part of SLB’s cybersecurity infrastructure. SLB partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. SLB engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in SLB’s environment.


text: SLB’s Cyber Security Director reports to SLB’s Chief Information Officer and is the head of the Company’s cybersecurity team. The Cyber Security Director is responsible for assessing and managing SLB’s cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by SLB.


text: The Audit Committee of the Board of Directors oversees SLB’s cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity team briefs the Audit Committee on the effectiveness of SLB’s cyber risk management program, typically on a quarterly basis. In addition, cybersecurity risks are reviewed by the SLB Board of Directors, at least annually, as part of the Company’s corporate risk mapping exercise.


text: SLB faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. SLB has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on SLB’s business, financial condition, results of operations, or cash flows. See “Risk Factors – Business and Operational Risks – Our operations are subject to cyber incidents that could have a material adverse effect on our business, financial condition, results of operations, and cash flows.”


text: Risk management and strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Oruka Therapeutics, Inc.

ticker: ORKA


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an IT consultant who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Chief Financial Officer and Chief Operating Officer are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.


text: Our Chief Financial Officer and Chief Operating Officer oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.


text: Our Chief Financial Officer and IT consultant provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.


text: We believe Manhattan has appropriate processes for assessing, identifying, and managing material risks from cybersecurity threats. Those processes are embodied in our enterprise-wide Cyber Risk Management Program (the "Cyber Program"), which includes our cybersecurity governance structure and our cybersecurity strategy and processes.

companyName: MANHATTAN ASSOCIATES INC

ticker: MANH


text: Governance Structure Board Oversight. Our Board of Directors has delegated oversight of our Cyber Program to the Board Audit Committee. Despite that delegation, the full Board also remains informed, through quarterly presentations to the full Board by our Chief Financial Officer or their designee (or more frequently as necessary), followed by the opportunity for Q&A and discussion, on the status of the Cyber Program. The presentations cover, among other things, our cyber incident experience, ongoing cyber threats, material risks, deployment of cybersecurity controls and risk mitigants, engagement of third parties (e.g., consultants and auditors) and third-party tools, our cyber insurance coverages, and our employee-training programs. If further Board engagement on cybersecurity matters is required, management, through the CEO, CFO or CLO, communicate directly with the Audit Committee chair, who engages the Audit Committee as they deem appropriate.


text: Management's Assessment and Management of Cybersecurity Threats. Members of Manhattan's executive management team, along with others from Company senior management, and others with varying areas of expertise, are engaged as part of our Cyber Program: • Chief Financial Officer and Chief Information Officer – Direct management of our Cyber Program falls within our Information Technology department, which reports up through our CIO, who reports to our CFO. Both our CIO and CFO have familiarity and oversight experience, appropriate for their positions, regarding general cybersecurity matters and threats affecting business-to-business software and cloud services vendors such as Manhattan. The CFO is a member of our Disclosure Committee, which is responsible for determining whether a Cybersecurity Incident is "material" for purposes of publicly reporting cybersecurity incidents, and is a member of our "Core Response Team" under the Company's Crisis Response Program. Our CFO also chairs our management Cybersecurity Committee. • Chief Legal Officer – Our CLO has experience providing legal advice regarding cybersecurity-related programs as well as engaging with outside advisors and insurance brokers and underwriters on cybersecurity coverage, claims, and loss mitigation. Our CLO also is member of the Disclosure Committee and the Core Response Team. • Senior Director, Global Security – Our Senior Director, Global Security, has managed our Cyber Program for seven years. He manages its day-to-day operations, oversees our security analysts and engineers, and leads our Cybersecurity Committee meetings. He is trained in cybersecurity strategy, planning, and execution and holds industry recognized security certifications, including Certified Information Systems Security Professional (CISSP) from the International Information System Security Certification Consortium (ISC2) and Certified Information Security Manager (CISM) from the Information Systems Audit and Control Association (ISACA). • Cybersecurity Committee – Members include, in addition to the CFO and SD, Global Security, business representatives of Manhattan's material business lines and administrative departments, cyber-risk operational heads from our material business lines, and our VP, Contracts and Administration (or their designee). The Cybersecurity Committee's purpose is to review cybersecurity risks, discuss emerging threats, prioritize cybersecurity efforts, and make recommendations to leadership. • Crisis Response Team – Pursuant to our Crisis Response Program, our Crisis Response Team, which comprises the CLO, CFO, Chief People Officer and Chief Marketing Officer, and an expanded team from our material business lines and administrative departments, as well as outside advisors/experts (cyber forensics, external legal counsel, law enforcement, public relations), is charged with managing the Company through a cybersecurity incident (or other event or series of events) that rise to the level of a Company "crisis." The Program includes protocols by which the CLO, on behalf of the Team, will report to or engage the CEO and the Chairman of the Board if and when an incident becomes a crisis or potential crisis.


text: • Other Roles – The Cyber Program includes engagement of other Company management employees and outside service providers to oversee or perform specific roles in connection with cybersecurity risk assessment and management, and incident management. That includes risk and security heads from our material business lines who implement and administer policies specific to those business lines and independent auditors to certify compliance with the Company's internal control over financial reporting, the American Institute of Certified Public Accountants' Systems and Organization Controls (SOC 2) security framework, and the Federal Government's Federal Risk and Authorization and Management Program (FedRAMP) criteria for federal use of cloud services. We also conduct reviews for compliance with data protection regulation such as Europe's General Data Protection Regulation (GDPR) and regulation of various U.S. states such as the California Consumer Privacy Act (CCPA). Risk Management and Strategy Overview of Processes for Assessing, Identifying, and Managing Material Cyber Risks.


text: The principal objectives of our Cyber Program are to minimize the risks associated with cybersecurity threats to our business operations, financial performance and financial condition, and protect the confidential information, intellectual property, and other assets of Manhattan, and those of our customers, vendors, partners, employees, and consumers that can be at risk due to cybersecurity threats to Manhattan.


text: Manhattan has incorporated industry recognized cybersecurity frameworks and standards into its Cyber Program, including frameworks from the National Institute of Standards and Technology (NIST) and security control auditing protocols from the Center for Internet Security (CIS) and the International Organizations for Standardization (ISO). Recognizing that the nature of cybersecurity threats and the particular threat vectors we face continually change, we continue to invest in updating and enhancing our Cyber Program. Annually, as part of Manhattan's budgeting process, our Senior Director, Global Security, submits to our CIO their recommendations for Cyber Program enhancements, including the associated capital requests, for inclusion in the CIO's proposed IT budget. Those recommendations are then evaluated at the executive level, taking into account the projected return on investment and the anticipated enhancement of our cybersecurity risk profile.


text: Under our Cyber Program, our Senior Director, Global Security, and the staff. along with our management-led Cybersecurity Committee, with input where appropriate from our third-party advisors, work to identify our cybersecurity threats, assess the risks, and deploy appropriate technologies and processes to mitigate the risks. When cybersecurity incidents occur, these resources work to manage through the incident utilizing advanced security tools and playbooks, and in accordance with processes set out in various Company policies and practice documents, which include internal communications protocols to keep the executive team and, where appropriate, the Audit Committee and Board, informed. Pertinent policy and practice documents include, among others, Manhattan's Incident Response Policy, our Incident Escalation Matrix, our Materiality Determination Process for Cybersecurity Incidents (governing the Company's materiality determination for reporting purposes) and our Crisis Response Plan.


text: As an important cybersecurity risk mitigant, Manhattan provides mandatory training to its new hires and quarterly training of its employees, including phishing simulation tests and follow-up tests as needed, along with monthly cybersecurity newsletters and other cyber risk-related communications.