text: We have aligned our information security management system to the International Organization for Standardization ("ISO") 27001 standard and our privacy management system to the ISO 27701 standard. An outside auditor tests the effectiveness of our security and privacy controls against the ISO 27001 and 27701 standards on an annual basis. We also undergo client security audits and cybersecurity program assessments by outside consultants, and we regularly update our program and processes to incorporate recommendations from auditors, consultants and other experts. Finally, we maintain a third-party risk management process that includes screening and evaluation by the Information Security team of service providers who will have access to our systems or confidential information, in order to identify and manage cybersecurity risks associated with our use of such providers.


text: Our Board of Directors has an active role, as a whole and at the committee level, in overseeing management of our material risks from cybersecurity threats. The Board's Audit Committee oversees management of financial, regulatory, compliance and security risks and receives reports at least quarterly from our Chief Information Officer regarding our cybersecurity programs, vulnerabilities, threats and risks. The full Board is regularly informed about such risks through committee reports, attendance at committee meetings and other communications.

companyName: COMSCORE, INC.

ticker: SCOR

secItem: Item 1C

stage1Category: Board Governance

stage1Method: unanimous


text: We have experienced, and may in the future experience, cybersecurity incidents. While prior incidents have not materially affected our business strategy, results of operations or financial condition to date, and although our processes are designed to help prevent, detect and mitigate the impact of such incidents, we cannot guarantee that a future security incident would not materially affect our strategy, results of operations or financial condition. For more information on our cybersecurity related risks, see Item 1A, "Risk Factors" of this 10-K.

stage1Category: Strategy Integration


text: We maintain a comprehensive cybersecurity program and process for identifying, assessing and managing risks from cybersecurity threats as part of our broader risk management system. Our cybersecurity program is run by a dedicated team of cybersecurity professionals with deep expertise in incident prevention, detection and remediation, led by our Vice President, Information Security (a certified information systems security professional with a degree in computer science and more than 30 years of relevant work experience) and our Chief Operating Officer (a seasoned executive with a degree in industrial systems and decades of product and technology experience, including more than 19 years with the Company). The Information Security team is responsible for identifying, assessing and mitigating cybersecurity vulnerabilities, threats and risks; evaluating and deploying appropriate security tools; and operating a 24x7 security operations center to promptly detect, remediate and prevent security incidents. The team maintains a comprehensive incident response policy that includes prompt reporting of security incidents to a cross-functional working group (including our Chief Operating Officer, General Counsel, Chief Compliance Officer and other security and privacy personnel) in order to ensure that information required to be disclosed by the Company with respect to security incidents is timely identified and reported.

stage1Category: Management Role

stage1Method: majority


text: Our Board of Directors has an active role, as a whole and at the committee level, in overseeing management of our material risks from cybersecurity threats. The Board's Audit Committee oversees management of financial, regulatory, compliance and security risks and receives reports at least quarterly from our Chief Operating Officer regarding our cybersecurity programs, vulnerabilities, threats and risks. The full Board is regularly informed about such risks through committee reports, attendance at committee meetings and other communications.


text: Our executive leadership team is responsible for designing and implementing our enterprise risk management program, with input from our Chief Product Officer, Chief Operating Officer, General Counsel and other security and privacy personnel regarding material risks from cybersecurity threats. The executive leadership team regularly discusses security threat trends; incident trends, including any significant incidents that may arise; risk mitigation; and overall security strategy as part of our enterprise security governance process. We consult with outside counsel as appropriate, including on materiality analyses and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions. Our management apprises our independent public accounting firm of any relevant developments.

stage1Category: Risk Management Process


text: We have processes in place for assessing, identifying and managing significant risks from potential cyber threats and vulnerabilities. To protect our information systems from cyber threats, we use a wide variety of tools, controls, technologies, methods, systems and other processes that are designed to prevent, detect, escalate, investigate, mitigate and/or remediate data loss, theft, misuse, unauthorized access or other security incidents or vulnerabilities affecting information systems and data.

companyName: ADVANCE AUTO PARTS INC

ticker: AAP


text: Our Senior Vice President, Chief Information Security Officer ("CISO") and Senior Vice President, Internal Audit and Risk, who oversees our enterprise risk management ("ERM") framework, partner on definition and treatment of cyber risks. Cybersecurity is a component of our ERM framework and processes. We utilize a wide range of capabilities to help us identify and assess potential cyber threats and vulnerabilities, which feed into our development and regular updating of a risk treatment plan to help us manage our cybersecurity risk posture. We evaluate risks on an ongoing basis across several categories in terms of probability of the likelihood and magnitude of potential impact, using evaluation results to inform our areas of focus and prioritization.


text: We evaluate risks associated with use of third-party providers through a lifecycle-based approach, conducting risk-based due diligence before engagement, using contractual provisions to apportion risk, and for certain third-party providers, engaging in architectural review and validation at the beginning of engagement. We use third parties to assist with penetration testing, simulated attacks and survey and other threat intelligence reporting on third parties, as well as review and enhancement of associated response processes.

stage1Category: Third-Party Risk


text: Our cyber risk treatment plan is reviewed in a bimonthly cadence with a cross-functional Cyber Steering Committee, the managerial governing body that regularly reviews our top cyber risks and receives reports on progress on key cyber initiatives. Our CISO leads the Cyber Steering Committee, which also includes individuals with experience identifying and managing enterprise risks, including our President and Chief Executive Officer, Executive Vice President, Chief Financial Officer, Executive Vice President, General Counsel and Corporate Secretary and Senior Vice President, Internal Audit, as well as individuals with technical expertise in information technology, data and cyber matters and/or experience in managing cyber incident responses, including our Executive Vice President, Chief Technology Officer, Senior Vice President, Information Technology Operations and Senior Vice President, Deputy General Counsel and Chief Compliance Officer. Our CISO has over 15 years of Chief Information Security Officer experience leading security strategy and execution for large companies. He holds a Certificate in Secure Software and Information Engineering from Pace University and is a Certified Information Systems Security Professional.


text: The Internal Audit function assesses cyber security risks and audits components of cyber security on an annual basis. At least every three years, we use an external party to evaluate the maturity of our program against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.


text: The Audit Committee of our Board of Directors is charged with reviewing, discussing with management and overseeing the Company's information technology and cybersecurity risk. Our CISO and Senior Vice President, Internal Audit and Risk report regularly to the Audit Committee, and at least annually, to the full Board of Directors on cybersecurity risks and management thereof.


text: The Company has processes in place for assessing, identifying and managing risks from potential cyber threats and vulnerabilities. To protect the Company's information systems from cyber threats, the Company uses a variety of tools, controls, technologies, methods, systems and other processes that are designed to prevent, detect, escalate, investigate, mitigate and/or remediate data loss, theft, misuse, unauthorized access or other security incidents or vulnerabilities affecting information systems and data.


text: The Company's Chief Information Security Officer ("CISO") and Vice President, Chief Audit Executive, who oversees the Company's enterprise risk management ("ERM") framework, partner on definition and treatment of cyber risks. Cybersecurity is a component of the Company's ERM framework and processes. The Company utilizes a range of capabilities to help identify and assess potential cyber threats and vulnerabilities, which feed into the development and regular updating of a risk mitigation plan to help manage the Company's cybersecurity risk posture. The Company evaluates cyber security risks on an ongoing basis across several categories in terms of probability of the likelihood and magnitude of potential impact, using evaluation results to inform areas of focus and prioritization.


text: The Company evaluates risks associated with use of third-party providers through a lifecycle-based approach, conducting risk-based due diligence before engagement, using contractual provisions to apportion risk, and for certain third-party providers, engaging in architectural review and validation at the beginning of engagement. The Company uses third parties to assist with penetration testing, simulated attacks and survey and other threat intelligence reporting on third parties, as well as review and enhancement of associated response processes.


text: The Company's cyber risk mitigation plan is reviewed on a bimonthly cadence with a cross-functional Cyber Steering Committee, the managerial governing body that regularly reviews the top cyber risks and receives reports on progress on key cyber initiatives. T he Company's CISO leads the Cyber Steering Committee, which also includes individuals with experience identifying and managing enterprise risks, including the Company's President and Chief Executive Officer, Executive Vice President, Chief Financial Officer, Executive Vice President, General Counsel and Corporate Secretary and Vice President, Chief Audit Executive, as well as individuals with technical expertise in information technology, data governance and cyber matters and/or experience in managing cyber incident responses, including the Company's Executive Vice President, Chief Technology Officer, Vice President, Information Technology Operations and Senior Vice President, Deputy General Counsel and Chief Compliance Officer.


text: The Internal Audit function assesses cyber security risks and audits components of cyber security on an annual basis. At least every three years, the Company uses an external party to evaluate the maturity of the program against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.


text: The Audit Committee of the Company's Board of Directors is charged with reviewing, discussing with management and overseeing the Company's information technology and cybersecurity risk. The Audit Committee receives reports on cybersecurity risk and management thereof at least semi-annually, and the full Board of Directors receives such reports at least annually.


text: As of December 28, 2024, we are not aware of any instances of material cybersecurity incidents that impacted the Company in the last three years.


text: Our program is designed to protect the confidentiality, integrity, and availability of systems and data. The state of our program maturity and regulatory compliance is regularly assessed by external audits and reviews by third party cybersecurity auditors and assessors. Among the key features of our cybersecurity risk management processes are the following: • policies and procedures designed to comply with data security and privacy obligations; • security technology and tools deployed in our IT environment that help us to identify and manage critical cybersecurity risks, as well as to detect and respond to incidents; • security awareness training offered to our workforce, and specialized incident response training for our cybersecurity team in partnership with our Business Continuity and Emergency Response department; • a Security Operations Center that monitors and responds to incidents; and • a third-party risk management program that includes diligence and contracting processes for vendors and service providers based on their respective function and risk profile.

companyName: JETBLUE AIRWAYS CORP

ticker: JBLU


text: JetBlue management has an overall responsibility for assessing and managing risks from cybersecurity threats to the Company and has an established cyber risk committee that consists of the Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief Information Officer and Chief Information Security Officer. (CISO). Our CISO has primary responsibility for the design and execution of our cybersecurity risk management program, and helps the committee stay informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, including but not limited to briefings with internal security team members, threat intelligence obtained from public and private sources, and alerts and reports produced by security tools deployed in the IT environment. Our current CISO has nearly two decades of experience in IT risk and program management, threat intelligence, and cybersecurity governance; he also has several cybersecurity industry certifications and specialized training in cybersecurity.


text: The CISO regularly briefs the cyber risk committee to review and evaluate potential threats and cyber risks to the Company. A cyber risk update is provided on a quarterly basis to the Audit Committee, which has delegated authority from the Board for cybersecurity risk oversight, and reports are made to the full Board on an annual basis.


text: For the 2023 period, we reported no material cybersecurity incidents affecting the confidentiality, integrity, or availability of data or systems. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For further information, please see our risk factors titled "Our reputation and business may be harmed and we may be subject to legal claims if there is disruption to our information technology systems or loss, unlawful disclosure or misappropriation of, or unsanctioned access to, our customers', crewmembers', business partners' or our own information or other breaches of our information security" and "Data security compliance requirements could increase our costs, and any significant data breach could disrupt our operations and harm our reputation, business, results of operations and financial condition."


text: JetBlue places great importance on safety including cybersecurity, to protect against various threats. The Company's cybersecurity strategy prioritizes detection, analysis and response to cyber threats, effective management of cyber risks, and resilience against cyber incidents. Safety is the Company's #1 value, and the strength of our safety is supported by exercising vigilance in security, including cybersecurity.


text: We maintain a formal cybersecurity program with guidance drawn from the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and other industry standards. This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our program is designed to protect the confidentiality, integrity, and availability of information technology systems and data. The state of our program maturity and regulatory compliance is regularly reviewed by third-party cybersecurity auditors and assessors. Among the key features of our cybersecurity risk management processes are the following: • policies and procedures designed to comply with data security and privacy obligations; • security technology and tools deployed in our IT environment that help us to identify and manage critical cybersecurity risks, as well as to detect and respond to incidents; • security awareness training offered to our workforce, and specialized incident response training for our cybersecurity team; • a Security Operations Center that monitors and responds to incidents; and • a third-party risk management program that includes diligence and contracting processes for vendors and service providers based on their respective function and risk profile.


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to security incidents related to our and our third-party vendors' data and systems. For more information, please see the risk factor entitled "Cybersecurity risks could adversely affect our business and disrupt our operations" in Item 1A - Risk Factors.

companyName: IROBOT CORP

ticker: IRBTQ


text: JetBlue management has overall responsibility for assessing and managing risks from cybersecurity threats to the Company and has an established cyber risk committee that consists of the Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief Information Officer and Chief Information Security Officer (CISO). Our CISO has primary responsibility for the design and execution of our cybersecurity risk management program, and helps the committee stay informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, including but not limited to briefings with internal security team members, threat intelligence obtained from public and private sources, and alerts and reports produced by security tools deployed in the IT environment. Our current CISO has nearly two decades of experience in IT risk and program management, threat intelligence, and cybersecurity governance; he also has several cybersecurity industry certifications and specialized training in cybersecurity.


text: For 2024, we reported no material cybersecurity incidents affecting the confidentiality, integrity, or availability of data or information technology systems. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For further information, please see our risk factors titled "Our reputation and business may be harmed and we may be subject to legal claims if there is disruption to our information technology systems or loss, unlawful disclosure or misappropriation of, or unsanctioned access to, our customers', crewmembers', business partners' or our own information or other breaches of our information security" and "Data security compliance requirements could increase our costs, and any significant data breach could disrupt our operations and harm our reputation, business, results of operations and financial condition. "


text: Our information technology systems ("IT Systems") play a central role in running nearly all aspects of our business operations. Our IT Systems are used for a variety of critical business functions including, but not limited to, internal and external communications, managing our documents and records, supporting functional and enterprise business processes and providing shared work environments across various business functions. Therefore, responding efficiently and effectively to cybersecurity incidents and threats is an important component of our enterprise risk management strategy. In order to respond to such incidents and threats, we have implemented a carefully designed Incident Response Plan ("IRP").

companyName: HALOZYME THERAPEUTICS, INC.

ticker: HALO


text: Cybersecurity Risk Management and Strategy The IRP provides our management and information technology personnel with processes and procedures for assessing, identifying, managing and escalating material risks from cybersecurity threats which have been integrated into our overall risk management processes. For example, our enterprise risk management processes involve the identification of events that may arise in the course of operating our business and the potential impact of such events on our business. We have identified and prioritized cybersecurity events as requiring increased managerial focus and urgency in actions taken to mitigate cybersecurity risks due to the potential impact such events could have on our business. Although the risks from cybersecurity threats have not materially affected our business strategy, results of operations or financial condition, it is possible that a cybersecurity incident resulting in a serious compromise of our IT Systems or a demand for payment to restore our IT Systems, could have a material adverse effect on us by negatively impacting our ability to operate our business effectively and by diverting the attention of our management and other resources, including financial resources, to address the cybersecurity incident. Despite our efforts to mitigate the risks associated with cybersecurity threats, we cannot eliminate all such risks or provide assurance that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: In connection with our processes for assessing, identifying and managing risk from cybersecurity, we engage various third parties to assist in managing these processes including: • Outside cybersecurity legal counsel to assist in updating our IRP and for consultation and coordination with other third parties in the event of a cyber incident; • Cybersecurity vendors that would perform various investigation services in the event of a cyber incident including assisting in determining the type of attack and impact to our information technology network, maintaining cybersecurity vigilance and assisting with the recovery and restoration of any impacted IT System services; • Cybersecurity experts who would, in the event of a cybersecurity incident, assist with validation of the incident; and • Vendors that would provide breach response services such as communications, notification to third parties and credit monitoring. In addition to our IRP, we have also implemented processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. For example, where appropriate, we seek to negotiate contractual terms with certain third-party service providers that impose obligations on such service providers with the goal of protecting our confidential information.


text: To date, there have been no known material cybersecurity incidents that have significantly impacted the Funds' business strategies, results of operations, or financial condition. The Sponsor continues to monitor systems and processes to mitigate potential cybersecurity risks actively.

companyName: Amplify Commodity Trust

ticker: BDRY


text: Cybersecurity Governance Our Incident Response Team has the primary responsibility of assessing and managing risks from cybersecurity threats and implementing the various stages of our IRP set forth above. The Incident Response Team is comprised of the following IT Systems management personnel and members of senior management: • Chief Information Officer ("CIO") – Our CIO has over forty years of information technology experience across a wide range of industry sectors including insurance, financial and life sciences and forty years in life science research and development information security. For the past four years, our CIO has had oversight of our cybersecurity strategy and building out our cybersecurity capabilities and infrastructure in response to the growing threat from potential cyber security incidents on our IT Systems. Our CIO has also led the initiative to integrate our cybersecurity management into our overall enterprise risk management strategy. Our CIO has an NACD CERT certificate in cybersecurity oversight; • Associate Director, Information Technology ("IT Security Director") – Our IT Security Director has approximately twenty years of relevant information technology experience including at least fifteen years of hands-on experience working in various cybersecurity domains, including asset and network security and architecture, identity access management, disaster recovery and business continuity. Our IT Security Director's responsibilities include serving as the lead for cybersecurity under the direction of the CIO and maturing our cybersecurity program across all cybersecurity domains, including security and risk management. Our IT Security Director is a Certified Information Systems Security Professional and has an NACD CERT certificate in cybersecurity oversight; • Senior Vice President, Chief Legal Officer – Our Chief Legal Officer oversees our enterprise risk management strategy and serves as the executive management representative on our Incident Response Team; and • Vice President, Business Continuity & Sustainable Operations ("VP Business Continuity") – Our VP Business Continuity has responsibility for overseeing our Business Continuity Plan which incorporates our IRP. Our VP Business Continuity has over 15 years leading the business continuity programs for various companies and has training on ISO 22301 (the Business Continuity ISO Standard).


text: Under its committee charter, the Audit Committee of the Board of Directors (the "Audit Committee") is responsible for discussing with senior management our policies with respect to risk assessment and risk management and for discussing with management our financial risk exposures and the steps management has taken to monitor and control such exposures. In particular, the Audit Committee oversees our cybersecurity strategy designed to identify, assess and mitigate cybersecurity risks, and reviews our cybersecurity and other information technology risks, controls and procedures, and receives periodic updates from management on cybersecurity regarding the adequacy and effectiveness of our cybersecurity measures. In fulfilling this oversight responsibility, the Audit Committee receives a periodic update of our cybersecurity strategy. Included in this review is a thorough discussion of the risks from cybersecurity threats including the potential impact of such threats to our operations. Specifically, with respect to cybersecurity risks, Incident Response Team members report to the Audit Committee on the (i) potential impact of the risk to the business, (ii) our current capabilities in managing such risks, (iii) the urgency for action in managing such risks and (iv) the outlook for a potential impact on us as a result of the risk. The Audit Committee also receives reports from members of the Incident Response Team on our mitigation efforts to address cybersecurity risks.


text: We have also instituted a separate process for communicating with the Audit Committee regarding any risks from an actual cybersecurity threat in the event we are the target of a specific cybersecurity incident. As part of our response to such an incident, members of the Incident Response Team would provide an initial awareness communication of the incident to our Chief Executive Officer who would in turn inform the Chairman of our Board of Directors ("Board Chair") and the Chair of the Audit Committee ("Audit Committee Chair"). Following an initial assessment of the incident by senior management and IT Systems personnel, we would provide a follow-up communication to the Board Chair and Audit Committee Chair and determine whether further escalation to the full Board of Directors is warranted.


text: Governance Related to Cybersecurity Risks The Board of Directors ("Board") has delegated oversight of the Company's cybersecurity risk management program to the Audit Committee. The Audit Committee is composed of board members with diverse expertise, including in the areas of risk management, technology, and finance. The Audit Committee periodically provides input regarding cybersecurity topics and initiatives, including the results of assessments, and cybersecurity policies.


text: Third-Party Risk Management. We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: Axe Compute Inc.

ticker: AGPU


text: Cybersecurity Governance Our Incident Response Team has the primary responsibility of assessing and managing risks from cybersecurity threats and implementing the various stages of our IRP set forth above. The Incident Response Team is comprised of the following IT Systems management personnel and members of senior management: • Chief Information Officer ("CIO") – Our CIO has over 25 years of information technology experience across a wide range of industry sectors including life sciences, medical device, pharmaceutical, real estate and software development with responsibility in cybersecurity, data analytics and GenAI implementations for the last 10 years, and 20 years of business continuity planning and disaster recovery planning and execution. Our CIO has oversight of our cybersecurity strategy and building out our cybersecurity capabilities and infrastructure in response to the growing threat from potential cyber security incidents on our IT Systems. Our CIO is also responsible for the integration of our cybersecurity management into our overall enterprise risk management strategy; • Associate Director, Information Technology ("IT Security Director") – Our IT Security Director has approximately 20 years of relevant information technology experience including at least 15 years of hands-on experience working in various cybersecurity domains, including asset and network security and architecture, identity access management, disaster recovery and business continuity. Our IT Security Director's responsibilities include serving as the lead for cybersecurity under the direction of the CIO and maturing our cybersecurity program across all cybersecurity domains, including security and risk management. Our IT Security Director is a Certified Information Systems Security Professional and has an NACD CERT certificate in cybersecurity oversight; • Senior Vice President, Chief Legal Officer – Our Chief Legal Officer oversees our enterprise risk management strategy and serves as the executive management representative on our Incident Response Team; and • Vice President, Business Continuity & Sustainable Operations ("VP Business Continuity") – Our VP Business Continuity has responsibility for overseeing our Business Continuity Plan which incorporates our IRP. Our VP Business Continuity has over 15 years leading the business continuity programs for various companies and has training on ISO 22301 (the Business Continuity ISO Standard).


text: We have also instituted a separate process for communicating with the Audit Committee regarding any risks from an actual cybersecurity threat in the event we are the target of a specific cybersecurity incident. As part of our response to such an incident, members of the Incident Response Team would provide an initial awareness communication of the incident to our Chief Financial Officer then to the Chief Executive Officer who would in turn inform the Chairman of our Board of Directors ("Board Chair") and the Chair of the Audit Committee ("Audit Committee Chair"). Following an initial assessment of the incident by senior management and IT Systems personnel, we would provide a follow-up communication to the Board Chair and Audit Committee Chair and determine whether further escalation to the full Board of Directors is warranted.


text: Cybersecurity Risk Management and Strategy We recognize the importance of developing, implementing, and maintaining cybersecurity measures designed to safeguard our information systems and protect the confidentiality, integrity, and availability of our data, including customer data. We have strategically integrated cybersecurity risk management into our broader risk management framework, and incorporate cybersecurity considerations into our decision-making processes. iRobot's IT department evaluates and addresses cybersecurity risks in alignment with our risk profile, business objectives, and operational needs. In support of these processes, we employ cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks.


text: In addition, iRobot's internal audit team facilitates risk assessment activities and manages formal IT general controls, evidence collection, and attestation for SOX compliance. We also engage with a range of external experts, including cybersecurity assessors and consultants to support the evaluation and testing of our risk management systems. These third parties assist with the preparation of threat assessments and penetration tests, and consult on security enhancements.


text: As part of our cybersecurity risk management program, we also implement risk-based processes to oversee and evaluate third-party vendors. Pursuant to these processes, as appropriate, we conduct security assessments of third-party vendors prior to onboarding, as well as ongoing monitoring of critical third-party vendors.


text: The Security Director and the Chief Information Officer ("CIO") have primary responsibility for informing the Audit Committee on cybersecurity risks. They provide periodic briefings to the Audit Committee, which may include topics such as updates regarding the cybersecurity threat landscape, the status of ongoing cybersecurity-related initiatives and strategies, and regulatory requirements.


text: The CIO has primary responsibility for assessing, monitoring and managing our cybersecurity risks, informed by thirty years of experience focusing on cloud, cybersecurity, and privacy in leadership roles at public companies. The Security Director also has thirty years of experience in the software and security industry, with executive positions in product security, security intelligence and data science. In his capacity at iRobot, the Security Director implements and oversees information security processes and regularly informs the Chief Financial Officer and CIO of cybersecurity developments, including potential threats and risk management techniques.


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to security incidents related to our and our third-party vendors' data and systems. For more information, please see the risk factor entitled "Cybersecurity risks could adversely affect our business and disrupt our operations" in Item 1A - Risk Factors.


text: The Security Director and the Senior Director Infrastructure & IT Operations have primary responsibility for informing the Audit Committee on cybersecurity risks. They provide periodic briefings to the Audit Committee, which may include topics such as updates regarding the cybersecurity threat landscape, the status of ongoing cybersecurity-related initiatives and strategies, and regulatory requirements.


text: The Senior Director Infrastructure & IT Operations has primary responsibility for assessing, monitoring and managing our cybersecurity risks, informed by thirty years of experience focusing on cloud, cybersecurity, and privacy in leadership roles at public companies. The Security Director also has thirty years of experience in the software and security industry, with executive positions in product security, security intelligence and data science. In his capacity at iRobot, the Security Director implements and oversees information security processes and regularly informs the Chief Financial Officer and Senior Director Infrastructure & IT Operations of cybersecurity developments, including potential threats and risk management techniques.


text: Management has responsibility for developing and coordinating the Company's cybersecurity policy and strategy, and for managing the prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: KORU Medical Systems, Inc.

ticker: KRMD


text: We utilize various risk assessment tools and technologies to identify potential cyber and information security threats and risks, including engaging a third-party information technology services provider to perform risk evaluation and testing. In addition, the Company is in the process of implementing a program for all team members to participate in ongoing training and awareness programs that include periodic assessments to drive adoption and awareness of cybersecurity processes and controls.


text: Physical controls are designed to work in conjunction with digital and cybersecurity controls to help protect the Company's IT and OT assets from physical threats. Our Chief Security Officer is responsible for a physical security program including site plans, cameras, security systems monitoring, and access control and badging systems to manage physical security risks.

companyName: CONOCOPHILLIPS

ticker: COP


text: We promote a company-wide culture of cybersecurity risk management intended to protect the confidentiality, integrity, and availability of our critical systems and the information contained therein. No risks from cybersecurity threats or previous cybersecurity incidents have materially affected, or are reasonably likely to materially affect, our business strategy, financial condition or results of operations. However, there can be no assurance that the controls and procedures in place to monitor and mitigate the risks of cyber threats will be successful or sufficient to avoid material losses or consequences in the future. Additionally, while we have insurance coverage in place that is designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.


text: Our Board of Directors, as a whole and through its committees, oversees risk management, including cybersecurity risks. The Board has delegated risk management responsibilities, including but not limited to cybersecurity risk, to the Nominating and Governance Committee. Specifically, the Nominating and Governance Committee periodically reviews our cybersecurity policies, data security programs and plans that management has established to monitor compliance and assess preparedness.


text: Cybersecurity Risk Management and Strategy Cybersecurity Risk Assessment and Management We take a multilayered approach to cybersecurity risk management and strategy. Our IT/OT Security Program integrates administrative, technical, and physical controls against evolving cybersecurity threats, and includes enterprise IT and OT security architecture, cybersecurity operations, data privacy and governance, supply chain security, and governance, risk, and compliance. Additionally, it is designed to identify, assess, and manage cybersecurity risks and protect the confidentiality, integrity, and availability of our data, IT, and OT.


text: Cybersecurity is a component of our IT/OT Security Program, which we periodically review and adapt to respond to new and evolving circumstances, cybersecurity threats and regulations. We evaluate security, privacy, and resiliency risks, including those related to cybersecurity, in our overall Enterprise Risk Management (ERM) program's annual risk assessment process. This annual risk assessment process takes into account broader risks based on likelihood, potential consequences, and mitigations, such as operational and economic impact; health, safety and environmental impact; and reputational and financial implications. This risk assessment is discussed with members of the ELT, Audit and Finance Committee (AFC) of the Board of Directors, and Board of Directors on at least an annual basis.


text: We consult recognized security frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework to organize, improve, and assess our IT/OT Security Program to manage and reduce cybersecurity risk. We deploy, configure, and maintain various technologies designed to enforce security policies, detect and protect against cybersecurity threats, and help safeguard IT and OT assets. We operate a Cybersecurity Operation Center (CSOC) to ingest threat intelligence, monitor cybersecurity threats, coordinate incident response resources and manage response times.


text: Our Global Computer Security Incident Response Plan (CSIRP) establishes the framework for our response to cybersecurity incidents. Under the CSIRP, cybersecurity incidents are escalated based on a defined incident categorization to the Chief Information Security Officer (CISO) and senior leaders, including the Chief Digital & Information Officer (CD&IO), General Counsel, Chief Financial Officer, and other cybersecurity program stakeholders, such as the AFC and/or the full Board of Directors. We also conduct incident response exercises at least annually, which are facilitated by internal team members and, in some instances, with assistance from third-party experts.


text: Our governing policies, standards and procedures create a structured approach to managing cybersecurity risk. Information security requirements for employees, contractors and partners are detailed in the ConocoPhillips Information Security & Protection Policy. Our workforce is required to complete information security training annually, and we periodically communicate ways to recognize and avoid cybersecurity threats to our workforce.


text: Engagement of Third Parties We engage third-party cybersecurity consultants and experts to supplement staffing of our CSOC, as well as to help us assess, validate, and enhance our security practices, including conducting cybersecurity maturity assessments, vulnerability assessments and penetration tests.


text: As part of the cybersecurity incident response process described above, we engage third-party experts as needed to support incident response, such as external legal advisors, cybersecurity forensic firms and other specialists.


text: Third Party Service Provider Risk Management Our third-party risk management process is designed to identify, assess, and mitigate risks associated with third-party service providers, including cybersecurity risks. An initial assessment is conducted to assess the cybersecurity risks associated with a third-party provider based on various criteria, such as whether the third-party provider has access to our network, data, and information systems. Third-party providers that are identified through the initial assessment as warranting further review are subject to additional risk assessment. In parallel, we have designed a contracting process to mitigate cybersecurity risks by specifying the rights and responsibilities of the parties.


text: Risks from Material Cybersecurity Threats While we are subject to ongoing cybersecurity threats, we do not believe that the risks from previous threats have materially affected or are reasonably likely to materially affect the company, including our business strategy, results of operations or financial condition. Nevertheless, we recognize cybersecurity threats are on-going and evolving, and our program is designed to identify and manage those threats. See item 1A. Risk Factors—Our technologies, systems and networks are subject to cybersecurity threats for more information on our risks relating to our technologies, systems, and networks.


text: Management's Role A dedicated CISO leads the IT/OT Security Team and is responsible for our cybersecurity risk management and strategy. The CISO has over 20 years of experience in security, of which 15 years is specific to cybersecurity and has served as a CISO since 2013, having joined ConocoPhillips as CISO in 2022. The CISO holds a master's degree and is a Certified Information Security Professional. The CISO reports to the CD&IO, who holds a master's degree in information technology and has served as Chief Information Officer/Chief Technology Officer and various roles in information technology for over 27 years. The CD&IO reports to the Executive Vice President, Strategy, Sustainability and Technology. This management team assesses and manages risks associated with cybersecurity.


text: Board of Directors' Oversight While our cybersecurity management team is responsible for the day-to-day assessment and management of material risks from cybersecurity threats, the ConocoPhillips Board of Directors has oversight responsibility for our ERM program and the individual risk management programs comprising our ERM program, including cybersecurity risk management. To help maintain effective Board of Directors' oversight across the entire enterprise, the Board of Directors delegates certain elements of its oversight function to individual committees. The AFC assists the Board of Directors in fulfilling its oversight of our ERM program and cybersecurity.


text: The Board of Directors receives a report on cybersecurity annually, and the AFC receives reports on cybersecurity twice a year. For meetings where cybersecurity is not on the formal agenda, the AFC will receive a pre-read that includes cybersecurity updates or discussion topics. During these reviews, management discusses various topics, including information relating to IT/OT Security strategy, program management, cybersecurity risks and threats, and provides briefings on notable cybersecurity attacks, including those relating to third-party service providers, if known. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated on an as needed basis to the AFC and Board of Directors.


text: Physical controls are designed to work in conjunction with digital and cybersecurity controls to help protect the company's IT and OT assets from physical threats. Our Chief Security Officer is responsible for a physical security program including site plans, cameras, security systems monitoring, and access control and badging systems to manage physical security risks.


text: Third-Party Service Provider Risk Management Our third-party risk management process is designed to identify, assess, and mitigate risks associated with third-party service providers, including cybersecurity risks. An initial assessment is conducted to assess the cybersecurity risks associated with a third-party provider based on various criteria, such as whether the third-party provider has access to our network, data, and information systems. Third-party providers that are identified through the initial assessment as warranting further review are subject to additional risk assessment. In parallel, we have designed a contracting process to mitigate cybersecurity risks by specifying the rights and responsibilities of the parties.


text: Management's Role A dedicated CISO leads the IT/OT Security Team and is responsible for our cybersecurity risk management and strategy. The CISO has over 20 years of experience in security, of which 15 years is specific to cybersecurity and has served as a CISO since 2013, having joined ConocoPhillips as CISO in 2022. The CISO holds a master's degree and is a Certified Information Security Professional. The CISO reports to the CD&IO, who holds a master's degree in information technology and has served as Chief Information Officer/Chief Technology Officer and various roles in information technology for over 28 years. The CD&IO reports to the Executive Vice President and Chief Financial Officer. This management team assesses and manages risks associated with cybersecurity.


text: Engaging Third Parties on Cybersecurity Risk Management. Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with third-party service providers, including cybersecurity assessors, and consultants, in evaluating and testing our cybersecurity risk management systems. This enables us to leverage knowledge and insights with the goal of aligning our cybersecurity strategies and processes with best practices for our industry and size. Accordingly, we engage third-party service providers for regular cybersecurity-related audits, threat assessments, and consultation on security enhancements.

companyName: SOUTH DAKOTA SOYBEAN PROCESSORS LLC

ticker: SDSYA


text: The Board of Directors receives a report on cybersecurity annually, and the AFC receives reports on cybersecurity multiple times a year. For meetings where cybersecurity is not on the formal agenda, the AFC will receive a pre-read that includes cybersecurity updates or discussion topics. During these reviews, management discusses various topics, including information relating to IT/OT Security strategy, program management, cybersecurity risks and threats, and provides briefings on notable cybersecurity attacks, including those relating to third-party service providers, if known. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated on an as needed basis to the AFC and Board of Directors.


text: Risk Management and Strategy U. S. Steel maintains robust processes for assessing, identifying and managing material risks from cybersecurity threats. U. S. Steel's cybersecurity program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and the risk of cybersecurity threats is integrated into the Company's Enterprise Risk Management ("ERM") program, led by the Chief Risk Officer. The ERM program includes an annual risk prioritization process to identify key enterprise risks. Each key risk is assigned risk owners to establish action plans and implement risk mitigation strategies. The cybersecurity threat risk action plan is managed at the enterprise level by the Senior Vice President – Global Information Technology and President, USSE (the "CIO") and the Chief Information Security Officer (the "CISO"). Each quarter, the risk owners review and update the cybersecurity threat risk action plan to provide the status on specific risk mitigation actions and to identify new threats. U. S. Steel works closely with its internal and external auditors to assess, plan for, prevent and mitigate cybersecurity risks.

companyName: UNITED STATES STEEL CORP


text: The Company maintains a Cybersecurity Incident Response Plan (CSIRP), which establishes an organizational framework and guidelines intended to facilitate an effective response and handling of cybersecurity incidents that could jeopardize the availability, integrity, or confidentiality of U. S. Steel's assets. The CSIRP outlines roles and responsibilities, criteria for measuring the severity of a cybersecurity incident, and an escalation framework. The CSIRP also addresses senior management responsibility with respect to disclosure determinations related to a cybersecurity incident and provides for Audit Committee and Board briefings as appropriate. Along with the CSIRP, management sustains numerous programs and processes to stay informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. The list of cybersecurity programs and processes described below is not meant to be exhaustive, but to provide examples of such programs and processes.


text: The Company engages with third party cybersecurity specialists to provide an independent assessment of U. S. Steel's cybersecurity programs and to prepare a 5-year plan to maintain compliance and operational excellence. Management periodically reviews the 5-year plan and modifies it in response to changes in the threat landscape and otherwise as needed. Management employs in-depth defense mechanisms throughout the enterprise, including, but not limited to, employee training, vulnerability management, multi-factor authentication, cybersecurity insurance and table top exercises to mitigate and/or prevent cybersecurity incidents. Management also assesses the cybersecurity proficiency of potential third party cloud suppliers before utilizing their services. The assessment identifies cybersecurity-related risks and makes recommendations to enhance the security of new cloud computing services. The Company reassesses cloud suppliers on a regular interval.


text: A cybersecurity incident may be detected in a number of ways, including, but not limited to, through automated reporting mechanisms, network and system indicators, intrusion detection systems, internal investigations, employee reports, law enforcement reports, or other third party notification. To oversee and identify cybersecurity threat risks on a day-to-day basis, including from third party service providers, the Company maintains a security operations center with round-the-clock monitoring, and the CIO receives regular reports on industry activity.


text: Upon receiving notification of a cybersecurity incident, the cybersecurity operations team acts to isolate and contain the threat. The CISO, along with the Chief Safety & Security Officer, will consult and determine the incident severity level, which determines whether the incident should be escalated. Critical and high severity incidents must be reported to the General Counsel. The Company may engage third party experts for assistance with crisis management, including forensic investigations, ransom negotiation, or crisis communication. During this process, the cybersecurity operations team will take steps to preserve evidence as soon as possible, including, but not limited to, memory dumps, log preservation and forensic hard drive collection. In addition, the General Counsel, in consultation with the CISO and others as necessary and appropriate, will promptly evaluate whether the incident requires legal notifications or disclosure, including whether the incident requires disclosure under the U. S. securities laws.


text: Following a cybersecurity incident, the General Counsel will direct the development of documentation regarding lessons learned in the response, including evaluation of preparedness capability, to continuously strengthen the cybersecurity posture of the Corporation.


text: Overseeing Third-Party Risk. Because we are aware of the risks associated with engaging third-party service providers, the Company has implemented processes designed to oversee and manage these risks. It is our policy to conduct security assessments of all third-party service providers before engagement and we aim to maintain ongoing monitoring for compliance with our cybersecurity standards. This monitoring includes regular assessments by our Chief Operations Officer.


text: Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect U. S. Steel, including its business strategy, results of operations or financial condition. See "Item 1A. Risk Factors, A failure of our information technology infrastructure and cybersecurity threats may adversely affect our business operations." above for more information. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third party providers.


text: The Board of Directors is responsible for overseeing the assessment and management of enterprise-level risks that may impact U. S. Steel. The Audit Committee has primary responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. Management, including the CIO and CISO, reports on cybersecurity matters regularly to the Board, primarily through the Audit Committee, including an annual report regarding specific risks and mitigation efforts within U. S. Steel and a 5-year cybersecurity threat assessment conducted by third party experts. Management provides benchmarking information and updates on key operational and compliance metrics to the Board. In addition, cybersecurity training is provided to the full Board of Directors, including training by third party experts, to educate directors on the current cybersecurity threat environment and measures companies can take to mitigate risk and impact of cyberattacks. As described above, management is actively involved in assessing and managing U. S. Steel's material cybersecurity risks. The CIO and the CISO primarily lead these efforts. The CIO is responsible for the oversight of U. S. Steel's entire global IT operation, including the cybersecurity program, and holds a Bachelor of Science in electrical engineering technology from Purdue University and a Master of Business Administration from Wayne State University. The CISO reports directly to the CIO and has responsibility for leadership of U. S. Steel's global cybersecurity program. She holds a bachelor's degree in Information Systems Management, a master's degree in Internet Information Systems, and a doctorate in Instructional Management and Leadership. The CISO also completed the Chief Information Security Officer Certificate program at Carnegie Mellon University, where she now serves as a coach for the program, and holds a Certified Information Systems Security Professional (CISSP) certification. She is an active member of the Greater Pittsburgh CISO Group and the Steel City OTSEC Information Sharing Group, and serves on the Editorial Review Board for two peer-reviewed journals (International Journal of Cyber Research and International Journal of Information and Communication Technology Education).


text: Risk Management and Strategy U. S. Steel maintains robust processes for identifying, assessing, and managing material risks from cybersecurity threats. U. S. Steel's cybersecurity program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and the risk of cybersecurity threats is integrated into the Company's Enterprise Risk Management ("ERM") program, led by the Chief Risk Officer. The ERM program includes an annual risk prioritization process to identify key enterprise risks. Each key risk is assigned risk owners to establish action plans and implement risk mitigation strategies. The cybersecurity threat risk action plan is managed at the enterprise level by the Senior Vice President – Business Development and President, USSE, the Vice President & Chief Information Officer (the "CIO") and the Chief Information Security Officer (the "CISO"). Each quarter, the risk owners review and update the cybersecurity threat risk action plan to provide the status on specific risk mitigation actions and to identify new threats. U. S. Steel works closely with its internal and external auditors to assess, plan for, prevent and mitigate cybersecurity risks.


text: The Company engages with third party cybersecurity specialists to provide an independent assessment of U. S. Steel's cybersecurity programs and to prepare a 5-year plan to maintain compliance and operational excellence. Management periodically reviews the 5-year plan and modifies it in response to changes in the threat landscape and otherwise as needed. Management employs in-depth defense mechanisms throughout the enterprise, including, but not limited to, employee training, vulnerability management, multi-factor authentication, cybersecurity insurance and table top exercises to mitigate and/or prevent cybersecurity incidents. The Company conducts security assessments of certain third party providers before and periodically throughout their engagement and has established procedures intended to mitigate risks related to security incidents originating from third parties. For example, management assesses the cybersecurity proficiency of potential third party cloud suppliers before utilizing their services. The assessment identifies cybersecurity-related risks and makes recommendations to enhance the security of new cloud computing services.


text: Additional information about cybersecurity risks we face is discussed in Item 1A, Risk Factors if this report under the heading "We are dependent upon information technology and operational technology systems, which are subject to disruption, damage, failure and risks associated with implementation, upgrade, operation and integration" which should be read in conjunction with the information above.

companyName: NEWMONT Corp /DE/

ticker: NEM

stage1Category: None/Other


text: The Board of Directors is responsible for overseeing the assessment and management of enterprise-level risks that may impact U. S. Steel. The Audit Committee has primary responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. Management, including the CIO and CISO, reports on cybersecurity matters regularly to the Board, primarily through the Audit Committee, including an annual report regarding specific risks and mitigation efforts within U. S. Steel and a 5-year cybersecurity threat assessment conducted by third party experts. Management provides benchmarking information and updates on key operational and compliance metrics to the Board. In addition, cybersecurity training is provided to the full Board of Directors, including training by third party experts, to educate directors on the current cybersecurity threat environment and measures companies can take to mitigate risk and impact of cyberattacks. As described above, management is actively involved in assessing and managing U. S. Steel's material cybersecurity risks. The CIO and the CISO primarily lead these efforts. The CIO is responsible for the oversight of U. S. Steel's entire global IT operation, including the cybersecurity program, and holds a Bachelor of Science in operations research and industrial engineering and a Bachelor of Arts in economics from Cornell University, as well as a Master of Science in engineering and Master of Business Administration from Massachusetts Institute of Technology. The CIO's previous work experience includes holding the position of CIO at a $25 billion manufacturing conglomerate and a $7 billion energy company. The CISO reports directly to the CIO and has responsibility for leadership of U. S. Steel's global cybersecurity program. She holds a bachelor's degree in Information Systems Management, a master's degree in Internet Information Systems, and a doctorate in Instructional Management and Leadership. The CISO also completed the Chief Information Security Officer Certificate program at Carnegie Mellon University, where she now serves as a coach for the program, and holds a Certified Information Systems Security Professional (CISSP) certification.


text: She is an active member of the Greater Pittsburgh CISO Group and the Steel City OTSEC Information Sharing Group, and serves on the Editorial Review Board for two peer-reviewed journals (International Journal of Cyber Research and International Journal of Information and Communication Technology Education).


text: Risk Management and Strategy The Company continuously monitors its information systems to proactively assess, identify, and manage risks from vulnerabilities and assess cybersecurity threats. The Company's process for identifying and assessing material risks from cybersecurity threats operates alongside the Company's broader overall risk assessment process. The Company's Computer Security Incident Response Team immediately investigates system alerts that may indicate the presence of a cybersecurity threat or incident and escalates information regarding the threat or incident as necessary to address it in a timely manner. The Company also maintains a computer security incident response plan with formalized workflows and playbooks. The computer security incident response plan, among other things, provides for inter-departmental coordination and management of cybersecurity threats or incidents to quickly assess the impact, mitigate risks to information systems, and work to resolve vulnerabilities. We periodically conduct simulation exercises involving employees at various levels of the organization. We also periodically engage external partners to conduct annual audits of our systems, test our systems infrastructure, and suggest improvements. Through these channels and others, we work to proactively identify potential vulnerabilities in our information security system. Senior management meets regularly with the Company's risk-management team and internal and external auditors to evaluate the effectiveness of the Company's systems, controls, and management processes with respect to cybersecurity risks. The results of key assessments are reported in summary to the Board of Directors periodically.

companyName: NORTHRIM BANCORP INC

ticker: NRIM


text: We also recognize that we are exposed to cybersecurity threats associated with our use of third-party service providers. To minimize the risk and vulnerabilities to our own systems stemming from such use, our Cybersecurity Program Manager and other subject matter experts monitor and identify known cybersecurity threats and incidents at third-party service providers on a regular basis. In addition, we strive to minimize cybersecurity risks when we first select or renew a vendor by including cybersecurity risk as part of our overall vendor evaluation and due diligence process. A vendor management policy is in place, which is approved by the Board of Directors annually. The vendor management policy calls for the evaluation of risk for each vendor based upon an assessment of the degree to which their relationship could expose the Company to risk in relation to the Company's reliance on the vendor's promise to perform and to protect customer privacy and based on the vendor's fiscal strength.


text: The Company provides mandatory initial and annual training thereafter for personnel regarding security awareness as a means to equip the Company's personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Company's information security policies, standards, processes and practices. We also work to educate our customers about the importance and understanding of their role in protecting their identities and the privacy of their information. We consider customer education regarding the use of electronic convenience products to be especially important due to the Bank's increased exposure to loss related to these products if procedures are not followed.


text: To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Part I. Item 1A, Risk Factors — Operational, Strategic and Business Risks.


text: Management of cybersecurity risk is the responsibility of the full Board of Directors, with additional assistance from the Audit Committee. The Board of Directors also devotes significant time and attention to the oversight of cybersecurity and information security risk and receives an operational risk update that includes a review of cybersecurity and information security risk. As part of its oversight of cybersecurity and informational security risk, on an annual basis, our Board of Directors reviews its Information Security Policy with its appointed Information Security Officer and frequently receives presentations on and discusses cybersecurity and information security risks, industry trends, and best practices from our Chief Information Officer and our Information Security Officer.


text: At the management level, the Chief Information Officer and Information Security Officer receive regular reports from the Company's systems department, both historical and real-time, about the Company's cybersecurity status. The Company has established written policies and procedures to ensure that significant cybersecurity incidents are immediately investigated, addressed through the coordination of various internal departments, and publicly reported (to the extent required by applicable law). If management determines a material cybersecurity incident has occurred, the Company's policies require management to promptly inform the Audit Committee with follow-up information to the full Board of Directors.


text: Under the direction of the Chief Information Officer, the Information Security Officer is responsible for cybersecurity and business continuity, which includes security architecture, security operations, incident response, IT risk and compliance, and security awareness and training. The Information Security Officer has over 40 years of security & risk management experience among other disciplines. The Cybersecurity Program Manager who reports directly to and supports the Information Security Officer in various aspects of cybersecurity and business continuity in the Company is a Certified Information Systems Security Professional (CISSP) and a Certified Information Systems Auditor (CISA), The other members of the Company's information security organization also have extensive cybersecurity, business, and technology experience and hold certifications in their area of expertise.


text: Risk Management and Strategy The Company continuously monitors its information systems to proactively assess, identify, and manage risks from vulnerabilities and assess cybersecurity threats. The Company's process for identifying and assessing material risks from cybersecurity threats operates alongside the Company's broader overall risk assessment process. The Company's Computer Security Incident Response Team immediately investigates system alerts that may indicate the presence of a cybersecurity threat or incident and escalates information regarding the threat or incident as necessary to address it in a timely manner. The Company also maintains a computer security incident response plan with formalized workflows and playbooks. The computer security incident response plan, among other things, provides for inter-departmental coordination and management of cybersecurity threats or incidents to quickly assess the impact, mitigate risks to information systems, and work to resolve vulnerabilities. We periodically conduct simulation exercises involving employees at various levels of the organization. We also periodically engage external partners to conduct annual audits of our systems, test our systems infrastructure, and suggest improvements. Through these channels and others, we work to proactively identify potential vulnerabilities in our information security system. Senior management meets regularly with the Company's risk-management team and internal and external auditors to evaluate the effectiveness of the Company's systems, controls, and management processes with respect to cybersecurity risks. The results of key assessments are reported in summary to our Board of Directors periodically.


text: We maintain relevant expertise within the Company's management team to manage cybersecurity risks. At the management level, the Chief Information Officer and Information Security Officer receive regular reports from the Company's systems department, both historical and real-time, about the Company's cybersecurity status. The Company has established written policies and procedures to ensure that significant cybersecurity incidents are immediately investigated, addressed through the coordination of various internal departments, and publicly reported (to the extent required by applicable law). If management determines a material cybersecurity incident has occurred, the Company's policies require management to promptly inform the Audit Committee with follow-up information to the full Board of Directors.


text: Risk Management and Strategy The Company recognizes the importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information and operational technologies and protect the confidentiality, integrity, and availability of our data. Our business is dependent upon our computer systems, devices, software and networks (operational and information technology) to collect, process and store the data necessary to conduct almost all aspects of our business, including the evaluation of acquisition and development opportunities, the monitoring and evaluation of our existing properties and the performance of and data from our operators and the recording and reporting of financial information.


text: Assessing, Identifying and Managing Material Cybersecurity Risks & Integrated Overall Risk Management. We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees mechanisms to detect and monitor unusual network activity and containment and incident response tools. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We monitor issues that are internally discovered or externally reported that may affect our systems, and have processes to assess those issues for potential cybersecurity impact or risk.


text: The Company has integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration is designed to include cybersecurity considerations as part of our decision-making processes at every level. Our IT department and third party service providers seek to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs and coordinate with our overall risk management framework.


text: In the event of a cybersecurity incident, we maintain an incident response plan. This plan sets forth immediate actions to mitigate the impact of cybersecurity incidents, including referring certain matters to the Company's Chief Executive Officer ("CEO") for additional evaluation and oversight, as well as long-term strategies for remediation and prevention of future cybersecurity incidents.


text: Cybersecurity Threats. As of the date of this Annual Report on Form 10-K, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our operations or financial condition. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. See Item 1A. Risk Factors "Risk Factors Relating to Our Business-We depend on computer and telecommunications systems, and failures in our systems or cyber security threats, attacks or other disruptions could significantly disrupt our business operations." for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.


text: Board of Directors Oversight. The Board has overall responsibility for the oversight of risk management, which includes cybersecurity risks. The Board receives periodic briefings on cybersecurity matters, including key risks to the Company, recent developments, and risk mitigation activities from members of management, who are responsible for overseeing our cybersecurity program. In addition, the Board receives annual briefings from our Chief Operations Officer and our third party service provider(s),on our cybersecurity program.


text: Management's Role. Our cybersecurity risk assessment and management efforts are led by our Chief Operations Officer, who is responsible for implementing and overseeing processes for the monitoring of our information systems. This includes responsibility for the deployment of cybersecurity measures and system audits to identify potential cybersecurity vulnerabilities. Our Chief Operations Officer reports directly to our CEO and Board of Managers.


text: Risk Management and Strategy We recognize the importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information and operational technologies and protect our data's confidentiality, integrity, and availability. Our business is dependent upon our computer systems, devices, software, and networks (operational and information technology) to collect, process, and store the data necessary to conduct almost all aspects of our business, including the evaluation of acquisition and development opportunities, the monitoring and evaluation of our existing properties, the performance of any data from our operators, and the recording and reporting of financial information.


text: Assessing, Identifying, and Managing Material Cybersecurity Risks & Integrated Overall Risk Management. We have processes to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things, ongoing security awareness training for employees, mechanisms to detect and monitor unusual network activity, and containment and incident response tools. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We monitor issues that are internally discovered or externally reported that may affect our systems and have processes to assess those issues for potential cybersecurity impact or risk.


text: We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration is designed to include cybersecurity considerations in our decision-making processes at every level. Our IT Security Program ("ITSP") Group and third-party service providers seek to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs and coordinate with our overall risk management framework.


text: In the event of a cybersecurity incident, we maintain an incident response plan. This plan sets forth immediate actions to mitigate the impact of cybersecurity incidents, including referring certain matters to the our chief executive officer for additional evaluation and oversight, as well as long-term strategies for remediation and prevention of future cybersecurity incidents.


text: Engaging Third Parties on Cybersecurity Risk Management. Recognizing the complexity and evolving nature of cybersecurity threats, we engage with third-party service providers, including cybersecurity assessors, and consultants, to evaluate and test our cybersecurity risk management systems. This enables us to leverage knowledge and insights to align our cybersecurity strategies and processes with best practices for our industry and size. Accordingly, we engage third-party service providers for regular cybersecurity-related audits, threat assessments, and consultation on security enhancements.


text: Overseeing Third-Party Risk. Because we know the risks associated with engaging third-party service providers, we have implemented processes designed to oversee and manage these risks. It is our policy to conduct security assessments of all third-party service providers before engagement, and we aim to maintain ongoing monitoring for compliance with our cybersecurity standards. This monitoring includes regular assessments by our chief operations officer and ITSP Group.


text: Cybersecurity Threats. As of the date of this Annual Report on Form 10-K, though we and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our operations or financial condition. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite implementing our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. While we devote resources to security measures designed to protect our systems and information, no security measure is infallible. See Item 1A. Risk Factors "Risk Factors Relating to Our Business." We depend on computer and telecommunications systems, and failures in our systems or cyber security threats, attacks, or other disruptions could significantly disrupt our business operations." for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.


text: Board of Directors Oversight. Our board of managers has overall responsibility for the oversight of risk management, which includes cybersecurity risks. Our board receives periodic briefings on cybersecurity matters, including key risks to us, recent developments, and risk mitigation activities from members of management, who are responsible for overseeing our cybersecurity program.


text: Management's Role. Our cybersecurity risk assessment and management efforts are led by our chief operations officer, who is responsible for implementing and overseeing processes for the monitoring of our information systems, and the ITSP Group. Included in this responsibility is the deployment of cybersecurity measures and system audits to identify potential cybersecurity vulnerabilities. Our chief operations officer reports directly to our chief executive officer and board of managers.


text: Risk Management and Strategy We rely upon technology and information systems to support our mining and business operations globally. These systems may be susceptible to cybersecurity risks including, but not limited to, external attackers, malware, viruses, and unauthorized access to our IT systems. We continuously invest and develop our cybersecurity controls and processes to address these threats and reduce the risk of future breaches and cyber attacks. Risk associated with a cybersecurity incident, impacting our operations, has been integrated into our overall global risk management system and process.


text: Foundationally, we seek to manage cyber risk through a structure of controls that includes cybersecurity standards, policies and cyber solutions that protect the availability, integrity, and confidentiality of our critical IT and mining systems. We monitor for emergent cyber threats and assess any actions required to reduce those risks. Our cybersecurity program is aligned to globally recognized security frameworks including the Mitre Att&ck Framework, NIST and ISO 27001. We are currently certified compliant against ISO 27001 and engage a certified audit firm to conduct annual control testing and reaffirm our certification. We further test our cybersecurity controls by engaging leading third-party cybersecurity service providers to perform external and internal penetration tests of critical business applications and mining system. Additionally, we review and tabletop test our incident response plan. We leverage continuous monitoring of our internet facing presence, as well as, known internet based criminal communities for mentions of Newmont, our executives, and employees. Our Security Operations Center ("SOC") continuously monitors for security events and threats, responding and escalating when appropriate. We also hold employee trainings on privacy and current cybersecurity topics, conduct phishing tests and generally seek to promote awareness of cybersecurity risk through communication and education of our employee population.


text: Newmont requires third parties that supply IT services, have access to Newmont systems, or manage Newmont data to adhere to established Newmont security policies. Additionally, Newmont requires that such third parties are required to provide detailed information on their established security controls via our third party risk assessment process. The third party risk assessment informs our contracting process. Specific certification may be required of critical third party IT service providers and partners. All third party workers are bound by our Acceptable Technology Use standard which governs appropriate IT systems access and usage.


text: Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, employee or vendor misconduct, and other external hazards could expose our information systems, and those of our vendors, to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business. Cybersecurity incidents may also cause disruption to mining operations; critical financial or reporting systems impairment; breach or integrity loss of Newmont proprietary or confidential data; or external reputational damage.


text: The sophistication of cybersecurity threats, including through the use of artificial intelligence, continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may become insufficient. In addition, new technology that could result in greater operational efficiency such as our use of artificial intelligence, fleet electrification, and autonomous vehicles may further expose our operations and computer systems to the risk of cybersecurity incidents. Newmont did not identify any cybersecurity incidents during the year ended December 31, 2023 that have materially affected or are reasonably likely to materially affect Newmont's business strategy, results of operations, or financial condition.


text: As part of our overall risk management approach, we prioritize the identification and management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Audit Committee, comprised of independent directors from our Board, oversees the responsibilities relating to the operational (including information technology (IT) risks and data security) risk affairs of the Company. Our Audit Committee is informed of such risks through quarterly reports from our cybersecurity leadership and it reports any material findings and recommendations to the full Board for consideration.


text: Our Cybersecurity team, comprised of seasoned IT and cybersecurity members, has decades of experience across multiple technical and compliance disciplines including cyber incident response, forensics, IT compliance, incident recovery, threat investigation and information technology. Our cybersecurity team includes several individuals who hold industry recognized certifications and advanced degrees in cybersecurity. Cybersecurity oversees the implementation and compliance of our information security standards, information technology compliance, and mitigation of information security related risks. The Chief Technology Officer (CTO) and Chief Information Officer (CIO) have direct oversight of the cybersecurity function. We also have management level committees, leaders, and a cybersecurity incident team who support our processes to assess and manage cybersecurity risk as follows: • The head of privacy, in conjunction with the cybersecurity leadership assists on identification and mitigation of privacy related risks across the enterprise. This combination brings together legal, compliance and other function leads as required. • The Cybersecurity Disclosure Steering Committee, comprised of leadership from IT, cybersecurity, operations, risk, finance, legal and compliance across business segments, contributes to the assessment of cybersecurity breach, planned response, and required disclosures and filings. • The Rapid Response Team, which includes senior executives across the Company and its global operations, is alerted as appropriate to cybersecurity incidents, natural disasters and business outages. The Rapid Response Team performs tabletop exercises on a yearly basis with inclusion across functions.


text: Each of these committees provides summary reports on their activities, which is then communicated as appropriate to the Audit Committee.


text: Risk Management and Strategy We rely upon technology and information systems to support our mining and business operations globally. These systems may be susceptible to cybersecurity risks including, but not limited to, external attackers, malware, viruses, and unauthorized access to our IT systems. Cybersecurity and the secure adoption of emerging technologies, including artificial intelligence ("AI"), remain strategic priorities for Newmont. We continuously invest and develop our cybersecurity controls and processes to address these threats and reduce the risk of future breaches and cyber attacks. Risk associated with a cybersecurity incident, impacting our operations, has been integrated into our overall global risk management system and process. Our Board of Directors and management team oversee these risks as part of our enterprise risk management framework, ensuring alignment with our business objectives and regulatory obligations.


text: Please see Item 1A. Risk Factors in this Form 10-K for more information regarding cybersecurity-related risks that could materially affect our business strategy, results of operations, or financial condition, including under the heading "Our business may be adversely affected by information technology disruptions".

companyName: Enpro Inc.

ticker: NPO


text: The sophistication of cybersecurity threats, including through the use of AI, continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may become insufficient. In addition, new technology that could result in greater operational efficiency such as our use of AI, fleet electrification, and autonomous vehicles may further expose our operations and computer systems to the risk of cybersecurity incidents. Newmont did not identify any cybersecurity incidents during the year ended December 31, 2024 that have materially affected or are reasonably likely to materially affect Newmont's business strategy, results of operations, or financial condition.


text: Additional information about cybersecurity risks we face is discussed in Item 1A, Risk Factors of this report under the heading "We are dependent upon information technology and operational technology systems, which are subject to disruption, damage, failure or cybersecurity attacks and risks associated with implementation, upgrade, operation and integration" which should be read in conjunction with the information above.


text: As part of our overall risk management approach, we prioritize the identification and management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Audit Committee, comprised of independent directors from our Board, oversees the responsibilities relating to the operational (including information technology ("IT") risks and data security) risk affairs of the Company. Our Audit Committee is informed of such risks through quarterly reports from our cybersecurity leadership and it reports any material findings and recommendations to the full Board for consideration.


text: Our Cybersecurity team, comprised of seasoned IT and cybersecurity members, has decades of experience across multiple technical and compliance disciplines including cyber incident response, forensics, IT compliance, incident recovery, threat investigation and information technology. Our cybersecurity team includes several individuals who hold industry recognized certifications and advanced degrees in cybersecurity. Cybersecurity oversees the implementation and compliance of our information security standards, information technology compliance, and mitigation of information security related risks. The Chief Technology Officer and Chief Information Officer have direct oversight of the cybersecurity function. We also have management level committees, leaders, and a cybersecurity incident team who support our processes to assess and manage cybersecurity risk as follows: • The head of privacy, in conjunction with the cybersecurity leadership assists on identification and mitigation of privacy related risks across the enterprise. This combination brings together legal, compliance and other function leads as required. • The Cybersecurity Disclosure Steering Committee, comprised of leadership from IT, cybersecurity, operations, risk, finance, legal and compliance across business segments, contributes to the assessment of cybersecurity breach, planned response, and required disclosures and filings. • The Rapid Response Team, which includes senior executives across the Company and its global operations, is alerted as appropriate to cybersecurity incidents, natural disasters and business outages. The Rapid Response Team performs tabletop exercises on a yearly basis with inclusion across functions.


text: Risk Management Strategy We recognize the critical importance of effectively managing cybersecurity risks to protect our businesses, intellectual property, employees, and customers. We manage cybersecurity risks as part of our broader enterprise risk management framework, which allows us to leverage existing, robust processes for assessing the effectiveness and coverage of our controls.


text: In recent years, we have invested significant time and resources to develop, implement, and maintain a robust set of cybersecurity measures, which all support our efforts to mitigate potential risks to the confidentiality, integrity, and availability of our data and critical business systems. Since the cybersecurity risk landscape is in a constant state of change, we employ a continuous, multi-layered approach to assess and measure the effectiveness of our cybersecurity defenses. Our approach includes using select third-party resources, including external cybersecurity consultants, auditors, and technologies, along with our internal staff, to benchmark, measure, and improve our cybersecurity risk management systems and processes, and ensure alignment with industry best practices.