text: Management of Material Risks and Integrated Overall Risk Management Our comprehensive risk management framework is intended to strategically incorporate cybersecurity risk management across the company, with the objective of ensuring that cybersecurity considerations underpin the decision-making processes at all organizational levels. Our risk management team collaborates closely across various Enterprise-wide business units to continually assess and address identified cybersecurity risks in alignment with business objectives. The CTIO regularly updates the Chief Financial Officer and Chief Executive Officer on material cybersecurity risks and events.


text: Engagement with Third Parties on Management of Cybersecurity Risk Recognizing the dynamic nature of cybersecurity threats, Nordstrom collaborates with external experts, including assessors, consultants and examiners, to evaluate and test our cybersecurity risk preparedness. Regular exams, threat assessments and consultation on security enhancements with these third parties ensure that our cybersecurity strategies align with industry best practices.

companyName: NORDSTROM INC

secItem: Item 1C


text: Oversight of Third-party Risk In the course of our business, we regularly exchange data and information with certain third parties in various ways, exposing us to risk related to the cybersecurity posture of and information management practices of those third parties. To try to mitigate this risk, we have implemented processes that may, depending upon the nature of the relationship with the third party, require security assessments and data integration design reviews prior to allowing our systems to connect with theirs. In addition, we seek to require these third parties to adhere to pre-established cybersecurity standards. Where applicable, we try to obtain contractual commitments with those third parties to ensure these security requirements are met.


text: Risks from Cybersecurity Threats Nordstrom has not experienced any cybersecurity incident that has materially impacted, or that is reasonably likely to materially impact, our operations, financial condition or cash flows.

stage1Category: Strategy Integration

stage1Method: unanimous


text: Cybersecurity Risk Management Personnel Primary responsibility for assessing, monitoring, mitigating and managing our cybersecurity risks rests with our information security organization, currently led by our CTIO. The CTIO has over 25 years of experience leading technology teams in retail and in many highly regulated industries including Healthcare, Pharmaceuticals and Financial Services. Our CTIO supports a skilled information security organization that brings expertise in vulnerability management, incident response, penetration testing, regulatory compliance and other critical information security domains. Our information security team maintains certifications from recognized external security authorities such as ISC2, CompTIA, ISACA, GIAC, SANS, PCI and OffSec. The security program is assessed annually by a reputable third party to provide guidance for continuous improvement.

stage1Category: Management Role

stage1Method: majority


text: Monitoring and Responding to Cybersecurity Incidents The security organization stays informed about the latest developments in cybersecurity, implements processes for regular monitoring of information systems and deploys relevant security measures. In the event of a cybersecurity incident, a formal incident response plan is in place for immediate actions and long-term strategies.


text: Board of Directors Oversight The Board of Directors has oversight responsibilities regarding cybersecurity risk. At regularly scheduled meetings (at least quarterly), in addition to such additional interactions as may be necessary in specific circumstances, our Chief Executive Officer and CTIO update the Board on emerging cybersecurity risks and developments impacting Nordstrom.

stage1Category: Board Governance


text: The Trust is a grantor trust, conducts no active operations, has no customers, and maintains no personal or credit data. The Trust's from cybersecurity threats are tailored to its specific circumstances.

companyName: NORTH EUROPEAN OIL ROYALTY TRUST

ticker: NRT

stage1Category: None/Other


text: The Company's policies, practices and technologies allow it to protect its information systems and operational assets from threats. The Board of Trustees and its Finance and Audit Committees continue to provide substantial and focused attention to cyber and system security. The Finance Committee of the Board of Trustees is responsible for oversight of the Company's enterprise-wide risks, including risks associated with cyber and physical security, and the Company's programs and practices to monitor and mitigate these risks.

companyName: NSTAR ELECTRIC CO

ticker: NSARO


text: Management prepares comprehensive cyber security reports that are discussed at each meeting of the Finance Committee. The reports focus on the changing threat landscape and the risks to the Company, describe Eversource's cyber security drills and exercises, attempted and actual breaches on our systems, cyber incidents within the utility industry and around the world, and mitigation strategies. In addition, third-party experts of cyber security risks provide periodic assessments to the utility industry and the Company in particular to the Finance Committee. The Company regularly reviews and updates its cyber and system security programs, and the Finance Committee continues to enhance its robust oversight activities, including meetings with financial, information technology, legal and accounting management, other members of the Board, representatives of the Company's independent registered public accounting firm, and outside advisors and experts in cyber security risks, at which cyber and system security programs and issues that might affect the Company's financial statements and operational systems are discussed.


text: The Company has a robust Enterprise Risk Management Program which has identified cyber security as a top enterprise risk. The managing and monitoring of risks are the responsibility of the Company's Risk Committee, which meets quarterly and is chaired by the Chief Financial Officer.

stage1Category: Risk Management Process


text: The Company is committed to continuous monitoring and assessment of cyber security controls. The Chief Information Security Officer is responsible for developing, implementing, and enforcing our cyber security program and information security policies to protect the Company's information systems and operational assets. The Chief Information Security Officer position requires at least 15 years of relevant information security experience and relevant security certifications. The Chief Information Security Officer reports directly to the Chief Information Officer and provides regular updates to the executive management team. Our Chief Information Security Officer has over 20 years of relevant experience.


text: The Company created a Cyber Governance Committee, which includes the Chief Information Security Officer, Chief Information Technology Officer, Chief Accounting Officer, members of the executive management team, and other assurance functions such as Corporate Compliance, Enterprise Risk Management, and Internal Audit.


text: To assess, identify and manage material risks from cybersecurity threats and to prevent, detect, mitigate and remediate a cyber security or ransomware incident, the following key processes and programs have been implemented and are performed by the Company's Cyber Security Group, which is overseen by the Chief Information Security Officer: • Implementation of security solutions and standards based on industry best practices to prevent unauthorized access. The Company's cyber program has been modeled after the National Institute of Standards and Technology framework; a widely accepted framework utilized by critical infrastructure industries. • Periodic external assessments, including outside system access testing, are performed. Rigorous auditing of all safeguards is performed on a regular basis. Risk assessments are held to identify and address new and changing risks to protect systems and sensitive data. Identified areas are monitored and improvements are implemented. • Eversource participates in information sharing programs both within and outside the utility industry, including with the U.S. government and industry organizations, to be able to identify and respond to emerging threats. • The Company maintains current incident response and business continuity plans, which are periodically updated and tested. • Network activity is monitored on an ongoing basis. • Anti-phishing and malware tools are utilized and assessed. • Employees are trained to recognize phishing attempts and are periodically tested. Results of phishing testing are benchmarked against other companies both within and outside the utility industry.


text: Specific to third parties, Eversource has implemented formal screening processes for any applicable vendors by the Company's Cyber Security Group as part of the Procurement process. The vendors are risk ranked based on the type of work being performed. Periodic rescreening is performed on critical vendors. Vendors are required to attest to their business continuity programs and provide evidence of appropriate insurance and indemnification agreements. The Company bars sourcing from countries included on the Department of Homeland Security's list of Prohibited Nations to further protect the Company's supply chain. The Company maintains cyber insurance which covers breaches of networks and operational technology. Our existing insurance limits may be inadequate to cover a material cyber incident. This could expose us to potentially significant claims and damages.

stage1Category: Third-Party Risk


text: As of December 31, 2023, there were no risks from cybersecurity threats, including due to any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operations, or financial condition.


text: The Company's CISO has over 15 years of experience in cybersecurity, information security and information risk management, including several years each in security engineering and in operations, as well as running incident response organizations. The CISO's organization includes a dedicated team of centralized information security experts and a network of security professionals embedded in each business unit and function.

companyName: PROCTER & GAMBLE Co

ticker: PG


text: The Company's policies, practices and technologies allow it to protect its information systems and operational assets from threats. The Board of Trustees and its Finance and Audit Committees continue to provide substantial and focused attention to cyber and system security. The Finance Committee of the Board of Trustees is responsible for oversight of the Company's enterprise-wide risk s, including risks associated with cyber and physical security, and the Company's programs and practices to monitor and mitigate these risks.


text: The Company has a robust Enterprise Risk Management Program that has identified cyber security as a top enterprise risk. The managing and monitoring of risks are the responsibility of the Company's Risk Committee, which meets quarterly and is chaired by the Chief Financial Officer. Members include key leaders of the Company, including the Chief Information Officer.


text: To assess, identify and manage material risks from cybersecurity threats and to prevent, detect, mitigate and remediate a cyber security incident, the following key processes and programs have been implemented and are performed by the Company's Cyber Security Group, which is overseen by the Chief Information Security Officer: • Implementation of security solutions and standards based on industry best practices to prevent unauthorized access. The Company's cyber program has been modeled after the Department of Energy's Cyber Capability Maturity Model and the National Institute of Standards and Technology framework; both widely accepted frameworks utilized by utilities and other critical infrastructure industries. • Periodic external assessments, including outside system access testing, are performed. Rigorous auditing of all safeguards is performed on a regular basis. Risk assessments are held to identify and address new and changing risks to protect systems and sensitive data. Identified areas are monitored and improvements are implemented. • Eversource participates in information sharing programs both within and outside the utility industry, including with the U.S. government and industry organizations, to be able to identify and respond to emerging threats. • Established an Artificial Intelligence Executive Working Committee to ensure a "Secure by Design" approach to implementations of artificial intelligence. • The Company maintains current incident response and business continuity plans, which are periodically updated and tested. • Network activity is monitored on an ongoing basis. • Anti-phishing and malware tools are utilized and assessed. • Employees are trained to recognize phishing attempts and are periodically tested. Results of phishing testing are benchmarked against other companies both within and outside the utility industry.


text: As of December 31, 2024, there were no cyber incidents that have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operations, or financial condition.


text: As described in Item 1A – Risk Factors, Xcel Energy operates in an industry that requires the continued operation of sophisticated information technology, control systems and network infrastructure, as such, our business is subject to the risk of interruption by cybersecurity incidents that range from attacks common to most industries, such as phishing and denial-of-service, to attacks from more sophisticated adversaries, including nation state actors, that target the critical infrastructure used in the operation of our business.

companyName: XCEL ENERGY INC

ticker: XEL


text: Our CIO and CISO are also responsible for approving cybersecurity budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Veritone, Inc.

ticker: VERI


text: The Company has a security risk program in place to identify, assess, manage and report material risks from cybersecurity incidents. As a utility provider, Xcel Energy complies with reliability standards imposed by NERC, including critical infrastructure protection standards related to both cybersecurity and physical security. These standards imposed by NERC, in alignment with the NIST Cybersecurity Framework, are the basis for which Xcel Energy has designed the cybersecurity control framework within its security risk program.


text: Annually, as part of Xcel Energy's enterprise risk program, an integrated cybersecurity risk identification and assessment is completed across Xcel Energy's business, including generation, transmission, distribution and fuel storage facilities, information technology systems and other infrastructure or physical assets as well as information processed in our systems (including systems hosted by third parties) that could be affected by cybersecurity incidents. This analysis includes the impact, likelihood, timeframe and controllability of cybersecurity risks and is presented to the Board of Directors. Management monitors and reviews the results of this analysis, integrating them into the enterprise risk assessment processes and implements appropriate mitigating actions as needed.


text: Xcel Energy's cybersecurity policies, standards, practices and readiness are regularly assessed by third-party consultants. These partners are engaged to perform independent penetration testing and other security related services to assist in the prevention, detection, monitoring, mitigation and remediation of cybersecurity incidents and risks. The results of these assessments are communicated to management and the Board of Directors by the Chief Security Officer.


text: Xcel Energy employs a comprehensive risk based approach to assess the magnitude and significance of a vendor's risk to the Company. Certain third-party service providers are subject to vendor security risk assessments at the time of integration, contract execution/renewal, and upon detection of any increase in risk profile. Xcel Energy uses a variety of inputs in such risk assessments, including information supplied by providers and third parties (including information analysis centers that share daily threat intelligence and improve organizational agility associated with management of cybersecurity risks). In addition, the Company requires certain third-party service providers to meet appropriate security requirements, controls and responsibilities. The Company deploys periodic monitoring activities to assess compliance with our cybersecurity control framework and investigates security incidents that have impacted our third-party service providers as appropriate.


text: Management has assigned responsibility for the security risk program to the Chief Security Officer who has extensive experience in critical infrastructure protection, including multiple years of experience with the Department of Defense. The Chief Security Officer is informed about and monitors prevention, detection, mitigation and remediation efforts through a team of security professionals, many of whom are Certified Information Systems Security Professionals, Certified Information Security Managers or have received other cybersecurity certifications. The team has extensive experience selecting, deploying and operating cybersecurity technologies, initiatives and processes that aid in preventing, remediating and mitigating known and unknown cybersecurity threats.


text: The Chief Security Officer or members of management brief the Board on routine and regular cybersecurity risk and threat updates, typically on a quarterly basis. In the event of a significant threat or incident, management and the Chief Security Officer leverage Xcel Energy's incident response processes to assess impacts and resolve incidents. When a significant cybersecurity incident occurs, management communicates with the Board of Directors and relevant committees.


text: The Board of Directors oversees the risks associated with cybersecurity and the physical security of our assets, with information security matters being discussed at each regular board meeting as well as at the ONES and Audit Committee meetings throughout the year.


text: While the ONES Committee has primary committee responsibility for cybersecurity due to the operational issues involved, the Board of Directors has determined that the topic is of sufficient importance to warrant this comprehensive oversight approach. Augmenting such oversight efforts, the Board of Directors conducts drills to practice its response in a possible emergency situation to ensure it is well prepared and positioned to perform in a possible crisis.


text: Cybersecurity risks are a part of Xcel Energy's normal course of business. To date, no cybersecurity incident or attack has had a material impact on our business or results of operations. As of Feb. 21, 2024 there have been no material cybersecurity incidents to report.


text: Board Oversight of Cybersecurity Matters Oversight of information security matters is conducted by our full Board of Directors. The Board annually receives a comprehensive presentation on information security and controls from our Chief Information Officer (CIO) and, as may be necessary for specific topics, follow up occurs at additional meetings during the course of the year.

companyName: TEXTRON INC

ticker: TXT


text: Xcel Energy's cybersecurity policies, standards, practices, annual cybersecurity training content and readiness are regularly assessed by third-party consultants. These partners are engaged to perform independent penetration testing and other security related services to assist in the prevention, detection, monitoring, mitigation and remediation of cybersecurity incidents and risks. The results of these assessments are communicated to management and the Board of Directors by the Chief Security Officer.


text: Management has assigned responsibility for the security risk program to the Chief Security Officer who has multiple years of experience in the Defense Industrial Base. The Chief Security Officer is informed about and monitors prevention, detection, mitigation and remediation efforts through a team of security professionals, many of whom are Certified Information Systems Security Professionals, Certified Information Security Managers or have received other cybersecurity certifications. The team has extensive experience selecting, deploying and operating cybersecurity technologies, initiatives and processes that aid in preventing, remediating and mitigating known and unknown security threats.


text: The Chief Security Officer or members of management brief the Board on routine and regular cybersecurity risk and threat updates, typically on an annual basis. In the event of a significant threat or incident, management and the Chief Security Officer leverage Xcel Energy's incident response processes to assess impacts and resolve incidents. When a significant cybersecurity incident occurs, management communicates with the Board of Directors and relevant committees.


text: The Board of Directors oversees the risks associated with cybersecurity and the physical security of our assets, with information security matters being discussed at board meetings as well as at the ONES and Audit Committee meetings throughout the year.


text: While the ONES Committee has primary committee responsibility for cybersecurity due to the operational issues involved, the Board of Directors has determined that the topic is of sufficient importance to warrant this comprehensive oversight approach. Augmenting such oversight efforts, the enterprise has the ability to notify and update the Board of Directors in the event of a possible crisis situation.


text: Cybersecurity risks are a part of Xcel Energy's normal course of business. To date, no cybersecurity incident or attack affecting us or our vendors has had a material impact on our business or results of operations. As of Feb. 27, 2025 there have been no material cybersecurity incidents to report.


text: NSP-Wisconsin is a wholly owned subsidiary of Xcel Energy. As such, its cybersecurity processes are maintained by Xcel Energy management and governed by its Board of Directors. As described in Item 1A – Risk Factors, Xcel Energy operates in an industry that requires the continued operation of sophisticated information technology, control systems and network infrastructure, as such, our business is subject to the risk of interruption by cybersecurity incidents that range from attacks common to most industries, such as phishing and denial-of-service, to attacks from more sophisticated adversaries, including nation state actors, that target the critical infrastructure used in the operation of our business.

companyName: NORTHERN STATES POWER CO /WI/


text: In order to identify and mitigate cybersecurity threats related to our use of material third-party vendors, we conduct periodic reviews of internal controls of certain third-party service providers to assess their procedures to mitigate material security risks.

companyName: NATIONAL HEALTH INVESTORS INC

ticker: NHI


text: Xcel Energy has a security risk program in place to identify, assess, manage and report material risks from cybersecurity incidents. As a utility provider, Xcel Energy complies with reliability standards imposed by NERC, including critical infrastructure protection standards related to both cybersecurity and physical security. These standards imposed by NERC, in alignment with the NIST Cybersecurity Framework, are the basis for which Xcel Energy has designed the cybersecurity control framework within its security risk program.


text: Annually, as part of Xcel Energy's enterprise risk program, an integrated cybersecurity risk identification and assessment is completed across Xcel Energy's business, including generation, transmission, distribution and fuel storage facilities, information technology systems and other infrastructure or physical assets as well as information processed in our systems (including systems hosted by third parties) that could be affected by cybersecurity incidents. This analysis includes the impact, likelihood, timeframe and controllability of cybersecurity risks and is presented to the Board of Directors. Management monitors and reviews the results of this analysis, integrating them into the enterprise risk assessment processes and implements appropriate mitigating actions as needed.


text: Xcel Energy's cybersecurity policies, standards, practices and readiness are regularly assessed by third-party consultants. These partners are engaged to perform independent penetration testing and other security related services to assist in the prevention, detection, monitoring, mitigation and remediation of cybersecurity incidents and risks. The results of these assessments are communicated to management and the Board of Directors by the Chief Security Officer.


text: Xcel Energy employs a comprehensive risk based approach to assess the magnitude and significance of a vendor's risk to Xcel Energy. Certain third-party service providers are subject to vendor security risk assessments at the time of integration, contract execution/renewal, and upon detection of any increase in risk profile. Xcel Energy uses a variety of inputs in such risk assessments, including information supplied by providers and third parties (including information analysis centers that share daily threat intelligence and improve organizational agility associated with management of cybersecurity risks). In addition, Xcel Energy requires certain third-party service providers to meet appropriate security requirements, controls and responsibilities. Xcel Energy deploys periodic monitoring activities to assess compliance with our cybersecurity control framework and investigates security incidents that have impacted our third-party service providers as appropriate.


text: Management has assigned responsibility for the security risk program to the Chief Security Officer who has extensive experience in critical infrastructure protection, including multiple years of experience with the Department of Defense. The Chief Security Officer is informed about and monitors prevention, detection, mitigation and remediation efforts through a team of security professionals, many of whom are Certified Information Systems Security Professionals, Certified Information Security Managers or have received other cybersecurity certifications. The team has extensive experience selecting, deploying and operating cybersecurity technologies, initiatives and processes that aid in preventing, remediating and mitigating known and unknown cybersecurity threats.


text: The Chief Security Officer or members of management brief the Board on routine and regular cybersecurity risk and threat updates, typically on a quarterly basis. In the event of a significant threat or incident, management and the Chief Security Officer leverage Xcel Energy's incident response processes to assess impacts and resolve incidents. When a significant cybersecurity incident occurs, management communicates with the Board of Directors and relevant committees.


text: The Board of Directors oversees the risks associated with cybersecurity and the physical security of our assets, with information security matters being discussed at each regular board meeting as well as at the ONES and Audit Committee meetings throughout the year.


text: While the ONES Committee has primary committee responsibility for cybersecurity due to the operational issues involved, the Board of Directors has determined that the topic is of sufficient importance to warrant this comprehensive oversight approach. Augmenting such oversight efforts, the Board conducts drills to practice its response in a possible emergency situation to ensure it is well prepared and positioned to perform in a possible crisis.


text: Cybersecurity risks are a part of Xcel Energy's normal course of business. To date, no cybersecurity incident or attack has had a material impact on our business or results of operations. As of Feb. 21, 2024 there have been no material cybersecurity incidents to report.


text: Education and Awareness: We provide regular training regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: Champion Homes, Inc.

ticker: SKY


text: The Company has a security risk program in place to identify, assess, manage and report material risks from cybersecurity incidents. As a utility provider, Xcel Energy complies with reliability standards imposed by NERC, including critical infrastructure protection standards related to both cybersecurity and physical security. These standards imposed by NERC, in alignment with the NIST Cybersecurity Framework, are the basis for which Xcel Energy has designed the cybersecurity control framework within its security risk program.


text: Xcel Energy's cybersecurity policies, standards, practices, annual cybersecurity training content and readiness are regularly assessed by third-party consultants. These partners are engaged to perform independent penetration testing and other security related services to assist in the prevention, detection, monitoring, mitigation and remediation of cybersecurity incidents and risks. The results of these assessments are communicated to management and the Board of Directors by the Chief Security Officer.


text: Xcel Energy employs a comprehensive risk based approach to assess the magnitude and significance of a vendor's risk to the Company. Certain third-party service providers are subject to vendor security risk assessments at the time of integration, contract execution/renewal, and upon detection of any increase in risk profile. Xcel Energy uses a variety of inputs in such risk assessments, including information supplied by providers and third parties (including information analysis centers that share daily threat intelligence and improve organizational agility associated with management of cybersecurity risks). In addition, the Company requires certain third-party service providers to meet appropriate security requirements, controls and responsibilities. The Company deploys periodic monitoring activities to assess compliance with our cybersecurity control framework and investigates security incidents that have impacted our third-party service providers as appropriate.


text: Management has assigned responsibility for the security risk program to the Chief Security Officer who has multiple years of experience in the Defense Industrial Base. The Chief Security Officer is informed about and monitors prevention, detection, mitigation and remediation efforts through a team of security professionals, many of whom are Certified Information Systems Security Professionals, Certified Information Security Managers or have received other cybersecurity certifications. The team has extensive experience selecting, deploying and operating cybersecurity technologies, initiatives and processes that aid in preventing, remediating and mitigating known and unknown security threats.


text: The Chief Security Officer or members of management brief the Board on routine and regular cybersecurity risk and threat updates, typically on an annual basis. In the event of a significant threat or incident, management and the Chief Security Officer leverage Xcel Energy's incident response processes to assess impacts and resolve incidents. When a significant cybersecurity incident occurs, management communicates with the Board of Directors and relevant committees.


text: The Board of Directors oversees the risks associated with cybersecurity and the physical security of our assets, with information security matters being discussed at board meetings as well as at the ONES and Audit Committee meetings throughout the year.


text: While the ONES Committee has primary committee responsibility for cybersecurity due to the operational issues involved, the Board of Directors has determined that the topic is of sufficient importance to warrant this comprehensive oversight approach. Augmenting such oversight efforts, the enterprise has the ability to notify and update the Board of Directors in the event of a possible crisis situation.


text: Cybersecurity risks are a part of Xcel Energy's normal course of business. To date, no cybersecurity incident or attack affecting us or our vendors has had a material impact on our business or results of operations. As of Feb. 27, 2025, there have been no material cybersecurity incidents to report.


text: Northern Trust understands the importance of managing cybersecurity risk to ensure the safety and security of our data and systems. The Business Risk Committee of the Board of Directors (Business Risk Committee), which reports regularly to the Board, oversees management's actions to identify, assess, mitigate and remediate material issues related to cybersecurity and technology risk as part of our enterprise risk management program and processes. The Cybersecurity Risk Oversight Subcommittee, chaired by the former chief information officer and chief transformation officer of a Fortune 50 company, assists the Business Risk Committee in discharging its oversight duties with respect to cybersecurity risk and meets on a regular basis to provide for an even deeper focus on, and governance framework around, cybersecurity risks inherent in the Corporation's business. The Business Risk Committee, Cybersecurity Risk Oversight Subcommittee, and the Board are regularly briefed on the organization's cybersecurity posture by senior management, including the Chief Executive Officer, Chief Information Officer (CIO), Chief Risk Officer, Head of Non-Financial Risk and Chief Information Risk Officer (CIRO), and Chief Information Security Officer (CISO). The CISO, a Certified Information Systems Security Professional (CISSP) with nearly 30 years of relevant experience, reports to the CIO and is responsible for identifying, managing, and, if necessary, remediating cybersecurity risk to ensure the protection of our data, network, and systems. The primary management-level committees responsible for assessing and managing cybersecurity risk are the Information Technology Oversight Committee, chaired by the CIO, who has over 20 years of experience in technology leadership roles, and the Information Technology Risk Committee, chaired by the CIRO, who has over 20 years of cybersecurity and risk management experience.

companyName: NORTHERN TRUST CORP

ticker: NTRS


text: Effective management of risks related to the confidentiality, integrity, and availability of information is crucial in an environment of increasing cybersecurity threats and requires a structured approach to establish and communicate expectations and required practices. Northern Trust's cybersecurity and technology risk management program provides the overall structure for managing the respective risks in a sustainable manner supported by an organizational structure that reflects support from executive management and includes risk committees comprised of members from across the business. The program is supported by the Cyber and Technology Risk Management Policy and Framework approved by the Business Risk Committee. The Cyber and Technology Risk Management Policy and Framework are based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework and provide a comprehensive overview of cybersecurity and technology risk management governance activities pertaining to the confidentiality of information, integrity of systems, data and processes, and the availability of business functions that may be adversely impacted. These governance processes, internal controls, and risk management practices, which are part of our enterprise risk management program and processes, are designed to keep risk at levels appropriate to Northern Trust's overall risk appetite and the inherent risk in the markets in which Northern Trust operates. Northern Trust employees are responsible for promoting cybersecurity as well as adhering to applicable policies and standards to safeguard data and business systems. In cases where Northern Trust relies on vendors to perform services, controls are routinely reviewed for alignment with industry standards and their ability to protect information. Any findings identified are remediated following a risk-based approach. In addition to the cybersecurity controls managed and monitored within the organization, Northern Trust uses external third-party security teams on a regular basis to assess effectiveness of our cybersecurity program and controls. These teams perform program maturity assessments, penetration tests, security assessments, and reviews of Northern Trust's vulnerability to cyber-attacks. Northern Trust also operates a global security operations center for threat identification and response. This center aggregates security threat information from systems and platforms across the business and alerts the organization in accordance with its documented Cybersecurity Incident Response Plan.


text: The Cybersecurity Incident Response Plan was developed to respond to cybersecurity incidents. A cybersecurity incident can include, but is not limited to, disruptions of service, denials-of-service, compromises of information systems, data exfiltration or data corruption. The plan provides a streamlined approach that can be invoked rapidly to address matters that raise enterprise concern and to communicate impact, actions, and status to senior management, including the CISO, CIRO, and appropriate stakeholders. The plan design includes enterprise-level response plans, including escalation to appropriate Board-level governance committees, and is reviewed, tested, and updated regularly.


text: Northern Trust's disclosure procedures and controls also address cybersecurity incidents and include elements to ensure an analysis of potential disclosure obligations arising from any such incidents. Northern Trust maintains compliance programs to address the applicability of restrictions on securities trading while in possession of material, nonpublic information, including instances in which such information may relate to cybersecurity incidents.


text: Northern Trust also maintains a comprehensive Information and Cyber Security Training and Awareness practice providing baseline and targeted education and awareness for employees and contractors. This program includes at least one required annual online training class for all employees and contractors, supplemental refresher training throughout the year, targeted training based on roles and risk levels, multiple simulated phishing and vishing attacks with associated training, the distribution of regular cybersecurity awareness materials, and the designation of individuals as Information Security and Privacy champions within the businesses.


text: To date, Northern Trust has not identified any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity threat or incident. For more information about these risks, see, "Breaches of our security measures, including, but not limited to, those resulting from cyber-attacks or other information security incidents, may result in losses," in Item 1A, "Risk Factors."


text: Risk management and strategy Northern Trust understands the importance of managing cybersecurity risk to ensure the safety and security of our data, network and systems. Our cybersecurity program is regularly assessed by Audit Services through various assurance activities, with the results reported to the Audit Committee of the Board of Directors (Audit Committee), and by the Non-Financial Risk team, with the results reported to the Business Risk Committee of the Board of Directors (Business Risk Committee). Northern Trust also operates a global security operations center for threat identification and response. The center aggregates security threat information from systems and platforms across the business and alerts the organization in accordance with its documented Cybersecurity Incident Response Plan. In addition to the cybersecurity controls managed and monitored within the organization, Northern Trust uses external third-party security teams on a regular basis to assess the effectiveness of our cybersecurity program and controls. These teams perform program maturity assessments, penetration tests, security assessments, and reviews of Northern Trust's vulnerability to cyber-attacks. Annually, certain elements of the cybersecurity program are subject to an audit by an independent consultant, as well as an assessment by a separate, independent third party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the Board. Our cybersecurity program is also examined regularly by the Corporation's prudential and conduct regulators within the scope of their jurisdiction.


text: The Cybersecurity Incident Response Plan was developed to respond to cybersecurity incidents. A cybersecurity incident starts with malicious intent and can include, but is not limited to, disruptions of service, denials-of-service, compromises of information systems, data exfiltration or data corruption. The plan provides a streamlined approach that includes enterprise-level response plans. The plans can be invoked rapidly to address matters that raise enterprise concern and to communicate impact, actions, and status to senior management, including the Chief Information Security Officer (CISO), and appropriate stakeholders, including escalation to appropriate Board-level governance committees, and is reviewed, tested, and updated regularly.


text: The Business Risk Committee, which reports regularly to the Board, oversees management's actions to identify, assess, mitigate and remediate material issues related to cybersecurity and technology risk as part of our enterprise risk management program and processes. The Cybersecurity Risk Oversight Subcommittee of the Business Risk Committee, chaired by the former chief information officer and chief transformation officer of a Fortune 50 company, assists the Business Risk Committee in discharging its oversight duties with respect to cybersecurity risk and meets on a regular basis to provide for an even deeper focus on, and governance framework around, cybersecurity risks inherent in the Corporation's business. The Business Risk Committee, Cybersecurity Risk Oversight Subcommittee, and the Board are regularly briefed on the organization's cybersecurity posture by senior management, including the Chief Executive Officer, Chief Information Officer (CIO), Chief Risk Officer, Head of Non-Financial Risk, Head of Cyber and Technology Risk, and CISO. The CISO has over 20 years of experience leading teams at financial institutions, including in the areas of risk management and information security, reports to the CIO and is responsible for identifying, managing, and, if necessary, remediating cybersecurity risk to ensure the protection of our data, network, and systems. The primary management-level committees responsible for assessing and managing cybersecurity risk are the Information Technology Oversight Committee, chaired by the CIO, who has over 20 years of experience in technology leadership roles, and the Information Technology Risk Committee, chaired by the Head of Cyber and Technology Risk, who has over 20 years of cybersecurity and risk management experience.


text: Effective management of risks related to the confidentiality, integrity, and availability of information is crucial in an environment of increasing cybersecurity threats and requires a structured approach to establish and communicate expectations and required practices. Northern Trust's cybersecurity and technology risk management program provides the overall structure for identifying, assessing and managing the respective risks in a sustainable manner supported by an organizational structure that reflects support from executive management and includes risk committees comprised of members from across the business. The program is supported by the Cyber and Technology Risk Management Policy approved by the Business Risk Committee. The Cyber and Technology Risk Management Policy and Framework are based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework and Cyber Risk Institute (CRI) Profile and provide a comprehensive overview of cybersecurity and technology risk management governance activities pertaining to the confidentiality of information, integrity of systems, data and processes, and the availability of business functions that may be adversely impacted. These governance processes, internal controls, and risk management practices, which are part of our enterprise risk management program and processes, are designed to keep risk at levels appropriate to Northern Trust's overall cyber risk appetite and the inherent risk in the markets in which Northern Trust operates. Northern Trust employees are responsible for promoting cybersecurity best practices as well as adhering to applicable policies and standards to safeguard data and business systems. In cases where Northern Trust relies on third-party vendors to perform services, controls are routinely reviewed for alignment with industry standards and their ability to protect information in accordance with Northern Trust's Third-Party Risk Management Program.


text: To date, Northern Trust has not identified any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity threat or incident. For more information about these risks, see "Breaches of our security measures, including, but not limited to, those resulting from cyber-attacks or other information security incidents, may result in losses," in Item 1A, "Risk Factors."


text: Risk Management and Strategy Oceaneering continues to make cybersecurity a priority as the threat landscape evolves and becomes increasingly complex and sophisticated.

companyName: OCEANEERING INTERNATIONAL INC

ticker: OII


text: Managing Material Risks & Integrated Overall Risk Management The Company has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cyber risk awareness. Our Chief Information Technology Officer ("CITO") and Chief Information Security Officer ("CISO") work closely with our Enterprise Risk Committee, which oversees—in part—cybersecurity, to continuously evaluate and address cyber risks in alignment with business objectives, operational needs and industry-accepted standards, such as the National Institute of Standards and Technology ("NIST") and the Cybersecurity Maturity Model Certification ("CMMC") frameworks.


text: The Company has processes and procedures in place to monitor the prevention, detection, mitigation and remediation of cybersecurity risks. These include but are not limited to: • Maintaining a defined and practiced incident response plan with dedicated Cybersecurity Event Response and Corporate Crisis Management Teams, including maintaining a 24/7 security operations center ("SOC"); • Maintaining cyber insurance coverage; • Employing appropriate incident prevention and detection safeguards; • Maintaining a defined disaster recovery policy and employing disaster recovery software, where appropriate; • Educating, training and testing our user community on information security practices and identification of potential cybersecurity risks and threats; and • Reviewing and evaluating new developments in the cyber threat landscape.


text: While the ONES Committee has primary committee responsibility for cybersecurity due to the operational issues involved, the Board of Directors has determined that the topic is of sufficient importance to warrant this comprehensive oversight approach. Augmenting such oversight efforts, the Board conducts drills to practice its response in a possible emergency situation to ensure it is well prepared and positioned to perform in a possible crisis.

companyName: PUBLIC SERVICE CO OF COLORADO


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity risk, Oceaneering engages with a range of external support, including cybersecurity consultants, in evaluating, monitoring and testing our cyber management systems and related cyber risks. The Company's collaboration with these third parties includes audits, threat and vulnerability assessments, incident response plan testing, company-wide monitoring of cybersecurity risks and consultation on security enhancements.


text: Managing Third Party Risk Oceaneering recognizes the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough risk-weighted security assessments of various third-parties and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes both annual assessments and assessments on an ongoing basis.


text: Risks from Cybersecurity Incidents To our knowledge, Oceaneering has not been subject to cybersecurity incidents that have materially affected, or are reasonably likely to materially affect the Company, its operations or financial standing.


text: Risk Management Personnel Oceaneering's cybersecurity risk management program is overseen by management at multiple levels. The CITO and the Director of IT Security play key roles in assessing, monitoring and managing the Company's cybersecurity risks with support of the Enterprise Risk Committee, as well as dedicated information technology and security personnel. Our CITO has over 18 years of experience as an information technology executive, and earned a Bachelor's and Master's degrees in Management Information Systems. Our Director of IT Security has almost 25 years of experience managing global information technology security and has served as Oceaneering's CISO since 2018. Our Director of IT Security earned a Bachelor's degree in Business and has several relevant certifications including Risk and Information Systems Control ("CRISC"), Information Systems Auditor ("CISA"), Information Systems Security Architecture ("ISSAP"), Security Certified Network ("SCNP"), Information Systems Security ("CISSP") and Cisco Certified Network Associate ("CCNA").


text: Monitor Cybersecurity Incidents Our CITO and Director of IT Security are continually informed and updated about the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. They implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Company is equipped with a defined and practiced incident response plan managed by a dedicated Cybersecurity Event Response Team and Corporate Crisis Management Team. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Board of Director Oversight The Audit Committee of the Company's Board of Directors is responsible for overseeing the Company's cyber risk. The Audit Committee receives regular updates that encompass a broad range of topics, including: • Current cybersecurity threat landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from unique cybersecurity events, including those of other companies; • Compliance status and efforts with regulatory requirements and industry standards; • Regulatory updates; • Vulnerability developments; and • Other cyber risk topics as requested by the Board.


text: Our Chairman of the Board, Mr. M. Kevin McEvoy, has earned a National Association of Corporate Directors ("NACD") Cybersecurity Oversight certification and a Computer Early Response Team ("CERT") Cybersecurity Oversight Certification from Software Engineering Institute, and our Board is composed of directors with diverse qualifications, skills and expertise, including risk management, technology and finance, that we believe equip them to oversee cybersecurity risks effectively.


text: Managing Material Risks & Integrated Overall Risk Management The Company has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cyber risk awareness. Our Chief Information Technology Officer ("CITO") and Chief Information Security Officer ("CISO") work closely with our Enterprise Risk Committee to continuously evaluate and address cyber risks in alignment with business objectives, operational needs and industry-accepted standards, such as the National Institute of Standards and Technology ("NIST") and the Cybersecurity Maturity Model Certification ("CMMC") frameworks.


text: The Audit Committee of the Company's Board of Directors has oversight authority to review the Company's data protection and cybersecurity risk exposure and the steps management has taken to assess and respond to the overall threat landscape, including the strategy management implemented to mitigate the Company's cyber risk exposure. The CISO and CIO report to the Audit Committee on current data protection and cybersecurity matters quarterly, and as may otherwise be needed. The CISO is authorized to report directly to the Audit Committee on the Company's security program and status of cybersecurity risk management efforts. The Chair of the Audit Committee reports these matters, as appropriate, to the Board of Directors.

companyName: OLD REPUBLIC INTERNATIONAL CORP

ticker: ORI


text: Managing Third Party Risk Oceaneering recognizes the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough risk-weighted security assessments of various third parties and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes both annual assessments and assessments on an ongoing basis.


text: Risk Management Personnel Oceaneering's cybersecurity risk management program is overseen by management at multiple levels. The CITO and the Director of IT Security play key roles in assessing, monitoring and managing the Company's cybersecurity risks with support of the Enterprise Risk Committee, as well as dedicated information technology and security personnel. Our CITO has 20 years of experience as an information technology executive, and earned a Bachelor's and Master's degrees in Management Information Systems. Our Director of IT Security has 25 years of experience managing global information technology security and has served as Oceaneering's CISO since 2018. Our Director of IT Security earned a Bachelor's degree in Business and has several relevant certifications including Risk and Information Systems Control ("CRISC"), Information Systems Auditor ("CISA"), Information Systems Security Architecture ("ISSAP"), Security Certified Network ("SCNP"), Information Systems Security ("CISSP") and Cisco Certified Network Associate ("CCNA").


text: Monitor Cybersecurity Incidents Our CITO and the Director of IT Security are continually informed and updated about the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. They implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Company is equipped with a defined and practiced incident response plan managed by a dedicated Cybersecurity Event Response Team and Corporate Crisis Management Team. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: In addition, our Board receives regular presentations from management about cyber risks and controls and has received formal cyber risk training from external advisors. Our Chairman of the Board, Mr. M. Kevin McEvoy, and Ms. Reema Poddar, member of the Board, have each earned a National Association of Corporate Directors ("NACD") Cybersecurity Oversight certification and a Computer Early Response Team ("CERT") Cybersecurity Oversight Certification from Software Engineering Institute, and our Board is composed of directors with diverse qualifications, skills and expertise, including risk management, technology and finance, that we believe equip them to oversee cybersecurity risks effectively.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: Oil-Dri Corp of America

ticker: ODC


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other risk areas. We have also implemented a specific cybersecurity program which adopts a risk management approach to information security, requiring the identification, assessment, and appropriate mitigation of vulnerabilities and threats that can adversely impact our information assets. Our cybersecurity program includes: • A risk assessment process designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • An information security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, incident response personnel, and senior management; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A third-party risk management process for customers, service providers, suppliers, and vendors.


text: In evaluating the risks identified as a part of the annual assessment process, the Company's information security team considers the likelihood and severity of the respective risk and the potential impact of the risk on the Company, its customers, and its employees. These risks are then prioritized and monitored by the information security team.


text: The Company conducts periodic testing of software, hardware, defensive capabilities, and other information security systems to assess its cybersecurity readiness and maturity of the cybersecurity program. Tests are conducted by the information security team and reputable third-party consultants and auditors. In developing and evaluating the testing procedures, the Company considers both its individual risks and industry standards.


text: The cybersecurity program includes an incident response plan with a cross-functional team comprised of designated members of the information technology department, senior management, and other appropriate individuals. The team is responsible for assessing and managing the cybersecurity incident response process, as outlined within the incident response plan, and taking necessary corrective actions to mitigate and eliminate the issue.


text: As of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents and potential impact to the Company, see the cybersecurity risk factors within "Item 1A. Risk Factors" in this Form 10-K.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from management, including leaders from our information security and legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our information security team, such as our Chief Information Officer, Director, Applications Delivery, and our Director of Information Technology. Such individuals have nearly 40, over 30, and over 20 years of experience, respectively, in various roles involving information technology, including infrastructure and operations, security, auditing, compliance, and application development. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: Old Republic depends upon technology-based information systems to conduct business. The Company uses computer systems and other electronic information resources, including both proprietary and third-party technology systems and tools, to process, transmit, receive, and store certain personal, confidential, and proprietary information; to communicate with customers, service providers, and other third parties by email and other electronic means; and perform various business operations, including transferring significant amounts of funds.


text: The Company's systems and processes have been, and will likely remain, subject to cyber threats and cyber-attacks and other intrusions. These threats and attacks are occurring with greater frequency and sophistication, and include malware and computer virus attacks, ransomware, unauthorized access, misuse, denial-of-service attacks, system failures and disruptions. While these cyber threats and attacks have not resulted in a material adverse effect on the Company, a future cyber incident involving breach of the Company's information systems or the information systems of a third-party vendor or services provider could adversely affect the Company's business strategy, results of operations or financial condition by exposing the Company to substantial costs and negative consequences, including the loss of funds, costs of investigation and remediation, lost revenues and reputational damage.


text: Old Republic dedicates significant resources across the enterprise to regularly monitor its networks, infrastructure and procedures in an effort to prevent, detect, address and mitigate these risks. The Company's Chief Information Security Officer (CISO) oversees the Company's enterprise cybersecurity strategy while the Company's Chief Executive Officer (CEO) retains primary responsibility for managing enterprise-wide risks, including those related to cybersecurity. The Company's Board of Directors' oversight responsibilities include ascertaining that appropriate policies and practices are in place for managing the identified risks faced by the enterprise, and, as discussed below, the Audit Committee of the Board of Directors has oversight authority over data protection and cybersecurity risk exposure. The Company's CISO has more than 26 years of experience in the field of information technology and security, comprised of six years in the U.S. Defense Industry and 20 years in the civilian sector. The CISO has a bachelor's degree in computer studies and is an EC-Council Certified Chief Information Security Officer, as well as a member of ISACA (formerly known as the Information Systems and Audit and Control Association) and the governing bodies for the Evanta National CISO community and the Evanta Regional (Dallas, Texas) CISO community.


text: Each Old Republic operating subsidiary maintains its own security program based on its particular risk, applicable insurance industry requirements, and mandates and guidance from the CISO and enterprise-wide security advisory team. These programs encompass asset protection, threat identification, monitoring, timely response procedures, containment and recovery measures, and internal escalation procedures. An enterprise-wide information technology team consisting of a working group of information technology leaders representing all operating subsidiaries meets regularly for the review and monitoring of and updates to information security business processes due to significant changes in operating environments, statutory or regulatory changes or changing or emerging threats. Operating subsidiaries are required to report certain cyber incidents based on documented severity classification to the enterprise-wide information technology team. This team consists of key information technology personnel, including the CISO and the Chief Information Officer (CIO). They are responsible for overseeing incident response and escalation to the Company's General Counsel and Chief Financial Officer (CFO) when necessary. As part of the Company's overall risk management strategy, the General Counsel, CFO, and CIO, in consultation with the CEO, navigate escalated incidents for law enforcement and other external engagements and assess the impact and materiality of such incidents on the Company's enterprise-wide business.


text: While exact practices vary depending on each operating subsidiary's particular business and risk, risk assessments performed at the enterprise-level and subsidiary level generally incorporate threat and vulnerability analyses and consider mitigations provided by in-place security controls. These procedures are intended to identify and assess internal and external cybersecurity risks that may threaten the security or integrity of nonpublic information stored on the Company's information systems by use of defensive infrastructure and the implementation of policies and procedures to protect the Company's information systems from unauthorized access, use or other malicious acts.


text: When engaging third-party vendors, operating subsidiaries are directed to use cybersecurity screening and risk assessment measures and to include appropriate data security privacy terms and conditions in vendor agreements, including, as necessary for certain vendors, a duty to report certain security incidents to the Company's information technology team. Third-party engagement procedures generally include (1) the identification and risk assessment of third-party service providers; (2) minimum cybersecurity practices required to be met by such third-party service providers in order for them to do business with the Company; (3) due diligence processes used to evaluate the adequacy of cybersecurity practices of such third-party service providers; and (4) periodic assessment of such third-party service providers based on the risk they present and the continued adequacy of their cybersecurity practices.


text: Third-party cybersecurity consultants are periodically retained by the Company to conduct targeted security control assessments, and to review the Company's security policies, standards, procedures, and controls, when applicable. Annual third-party penetration testing is used to simulate cyber-attacks and to identify potential vulnerabilities. The Company subscribes to paid third-party threat intelligence services that provide real-time information on emerging threats. The Company engages security platform partners to provide advisory services related to security technologies and practices.


text: At the holding company level, Old Republic employs security awareness and training initiatives to inform associates about their role in cybersecurity risk mitigation.


text: The Company relies on the cybersecurity strategy and policies implemented by the Advisor. The cybersecurity program seeks to address cybersecurity risks and support the Company's operational resilience.

companyName: 5C Lending Partners Corp.


text: The Company's systems and processes have been, and will likely remain, subject to cyber threats and cyber-attacks and other intrusions. These threats and attacks are occurring with greater frequency and sophistication, and include ransom attacks, unauthorized access, misuse, denial-of-service attacks, system failures and disruptions. While these cyber threats and attacks have not resulted in a material adverse effect on the Company, a future cyber incident involving breach of the Company's information systems or the information systems of a third-party vendor or services provider could adversely affect the Company's business strategy, results of operations or financial condition by exposing the Company to substantial costs and negative consequences, including the loss of funds, costs of investigation and remediation, lost revenues, and reputational damage.


text: Old Republic dedicates significant resources across the enterprise to regularly monitor its networks, infrastructure and procedures in an effort to prevent, detect, address and mitigate these risks. The Company's Chief Information Security Officer (CISO) oversees the Company's enterprise cybersecurity strategy while the Company's Chief Executive Officer (CEO) retains primary responsibility for managing enterprise-wide risks, including those related to cybersecurity. The Company's Board of Directors' oversight responsibilities include ascertaining that appropriate policies and practices are in place for managing the identified risks faced by the enterprise, and, as discussed below, the Audit Committee of the Board of Directors has oversight authority over data protection and cybersecurity risk exposure, as well as the Company's practices and protocols for the use of AI. The Company's CISO has more than 27 years of experience in the field of information technology and security, comprised of six years in the U.S. Defense Industry and 21 years in the civilian sector. The CISO has a bachelor's degree in computer studies and is an EC-Council Certified Chief Information Security Officer, a member of ISACA (formerly known as the Information Systems and Audit and Control Association), a member of the Factor Analysis of Information Risk (FAIR) Institute risk management education committee, and holds membership on the governing bodies for the Evanta National CISO community and the Evanta Regional (Dallas, Texas) CISO community.


text: While exact practices vary depending on each operating subsidiary's particular business and risk, risk assessments performed at the enterprise and subsidiary levels generally incorporate threat and vulnerability analyses and consider mitigations provided by in-place security controls. These procedures are intended to identify and assess internal and external cybersecurity risks that may threaten the security or integrity of nonpublic information stored on the Company's information systems by use of defensive infrastructure and the implementation of policies and procedures to protect the Company's information systems from unauthorized access, use or other malicious acts.


text: Third-party cybersecurity consultants are periodically retained by the Company to conduct targeted security control assessments, and to review the Company's security policies, standards, procedures, and controls, when applicable. Annual third-party penetration testing is used to simulate cyber-attacks and to identify potential vulnerabilities. The Company subscribes to paid third-party threat intelligence services that provide real-time information on emerging threats. The Company engages security partners to provide advisory services related to security technologies and practices.


text: Cybersecurity Program Overview The Advisor has established a cybersecurity program designed to identify, evaluate, and mitigate risks from cybersecurity threats applicable to the Company.


text: The Audit Committee of the Company's Board of Directors has oversight authority to review the Company's data protection and cybersecurity risk exposure and the steps management has taken to assess and respond to the overall threat landscape, including the strategy management implemented to mitigate the Company's cyber risk exposure. The CISO and CIO report to the Audit Committee on current data protection and cybersecurity matters quarterly, and as may otherwise be needed. The CISO is authorized to report directly to the Audit Committee on the Company's security program and status of cybersecurity risk management efforts. The Chair of the Audit Committee reports these matters, as appropriate, to the Board of Directors.


text: Cybersecurity Risk Management and Strategy We have an enterprise-wide cybersecurity risk management approach designed to identify, protect, detect, respond to and manage cybersecurity and information technology risks and threats. This program is integrated into our enterprise risk management (ERM) framework, and the underlying controls leverage recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework.

companyName: OLIN Corp

ticker: OLN


text: Our Company's Chief Information Officer (CIO) is responsible for developing and maintaining our global cybersecurity and information technology program and directs our Information Security team. The Information Security team is primarily responsible for identifying and protecting against cybersecurity threats and maintains a comprehensive set of policies and standards applicable to our global organization. We consult with multiple third-party firms to assess and review these policies and standards and regularly update them for contemporary best practices. Our CIO has over fifteen years of experience leading cybersecurity oversight for global organizations, and our Information Security team leaders have extensive cybersecurity and information technology industry experience with Olin or other large public companies and hold industry certifications, including the Certified Information Systems Security Professional certification.


text: Our Information Security team monitors alerts and meets to discuss threat levels, trends and remediation tactics. Every identified cyber event is evaluated, ranked by severity and prioritized for response and remediation in compliance with our global Security Incident Management Procedure. Significant events are evaluated for both quantitative and qualitative factors to determine materiality on a case-by-case basis, including, among other factors, potential privacy, operational, financial, or reputational impacts for the Company, and our customers, vendors, shareholders, or other external stakeholders. The Information Security team prepares a monthly scorecard for senior management, summarizing cyber events for the month and reporting on our remedial actions. While we have experienced cybersecurity attacks, such attacks to date have not materially affected the Company or our business strategy, results of operations, or financial condition.


text: The Company regularly conducts penetration testing, both internally and by third parties, and conducts automated attacks simulating real-world cyber incidents. These tests and assessments are useful tools for maintaining a comprehensive cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. We continue to expand our cybersecurity risk mitigation strategies, which includes around-the-clock monitoring of our global network, using layered defenses and identifying and protecting critical assets, including our manufacturing facilities. The Information Security team conducts annual cybersecurity awareness training and quarterly email phishing tests and training for all employees.


text: We rely on certain external service providers to assist in the management of the day-to-day operation of our business, operate elements of our manufacturing facilities, manage relationships with our employees, customers, and suppliers, fulfill customer orders, and maintain our financial, accounting, or other business records. The Information Security team maintains a third-party security program to identify, prioritize, assess, mitigate, and remediate our third-party risks; however, we also rely on our third-party vendors, suppliers, and other business partners to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful. Cybersecurity risks are assessed when selecting our third-party service providers and reassessed periodically.


text: We face a number of cybersecurity risks in connection with our business. Failure of any one or more than one of our information technology systems could be caused by internal or external events or parties, such as incursions by intruders or hackers, computer viruses, cyber-attacks, failures in hardware or software, or power or telecommunication fluctuations or failures. For more information about the cybersecurity risks we face, see Item 1A - Risk Factors.


text: As of the date of this Annual report on Form 10-K, we do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. In addition, while we have implemented a risk management process to mitigate cybersecurity risks that arise from utilizing third party service providers, suppliers, and vendors, our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. For more information on our cybersecurity related risks, see Part I, Item 1A. Risk Factors of this Report.

companyName: OXFORD INDUSTRIES INC

ticker: OXM


text: Cybersecurity Governance Cybersecurity is an important component of our ERM framework and an area of focus for both our Board of Directors (Board) and management team. While management holds primary responsibility for our Company's risk management strategy, our Board, with the support of its committees, oversees the process to ensure that the framework designed, implemented and maintained by management is functioning as intended and adapts, when necessary, to our evolving strategy and emerging risks. The Board's Audit Committee is delegated responsibility for oversight of our ERM process, including our strategies to identify, detect and respond to cybersecurity and information technology risks and threats. Our Audit Committee's process includes an annual review of our ERM program to ensure appropriate practices are in place to monitor and mitigate identified risks on an ongoing basis. Additionally, our CIO meets with the Audit Committee or Board each quarter to discuss cyber hygiene, incidents (as needed), and provide updates on our enterprise-wide cybersecurity risks and strategies, including steps taken to mitigate and manage the same. To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on current cyber topics, trends and best practices. We have established protocols by which certain cybersecurity incidents are reported to the Audit Committee and Board.


text: Continuous improvement is a critical aspect of Parker's cybersecurity program, which is why we integrate security intelligence from internal and external sources to help identify areas for improvement and gap remediation. As a supplement to our internal cybersecurity capabilities and controls, we partner with third-party consultants and advisors to conduct penetration testing and to assess our incident response plan. We periodically undergo a third-party risk assessment and third-party incident response adversarial engagement exercises to strengthen our security profile. We also conduct internal tabletop exercises to prepare for responding to potential cybersecurity events. Parker also maintains cyber security insurance designed to mitigate the impact of any attacks or threats to our business.

companyName: Parker-Hannifin Corp

ticker: PH


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats. We obtain input, as appropriate, for our cybersecurity risk management program from threat intelligence services, cybersecurity consultants, and multiple external sources. Our cybersecurity program is managed by our Head of Cyber Security, whose team is responsible for leading enterprise-wide cybersecurity strategy, risk assessment, and management policies, standards, architecture, and processes. The Head of Cyber Security has a master's degree in cybersecurity, maintains industry certifications, and has over 20 years of prior work experience in various roles involving information technology, cybersecurity, and compliance. We augment our cybersecurity team with consultants, contract resources, and managed security service providers when needed. Our executive leadership team, along with input the Head of Cyber Security, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.


text: Our Board has delegated to its Audit Committee oversight responsibility for cyber risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements. The Head of Cyber Security provides quarterly reports to our Audit Committee regarding cyber risk trends, technology security risks, projects to continually enhance our information security systems, cybersecurity strategy, and the emerging threat landscape. The Audit Committee reports any findings and recommendations, as appropriate, to the full Board for consideration. Our cybersecurity program is periodically evaluated by internal and external resources to evaluate and enhance the effectiveness of our information security policies, controls, and procedures. The results of those reviews are reported to senior management and the Audit Committee. As part of our cyber risk management program, we track and log security incidents across our enterprise and perform third-party risk assessments to identify and attempt to mitigate risks from third parties such as vendors and suppliers.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. In addition, while we have implemented a risk management process to mitigate cybersecurity risks that arise from utilizing third party service providers, suppliers, and vendors, our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. For more information on our cybersecurity related risks, see Part I, Item 1A. Risk Factors of this Report.


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our overall risk management system. We obtain input, as appropriate, for our cybersecurity risk management program from threat intelligence services, cybersecurity consultants, and multiple external sources. Our cybersecurity program is managed by our Head of Cyber Security, whose team is responsible for leading enterprise-wide cybersecurity strategy, risk assessment, and management policies, standards, architecture, and processes. The Head of Cyber Security has a master's degree in cybersecurity, maintains industry certifications, and has over 20 years of prior work experience in various roles involving information technology, cybersecurity, and compliance. We augment our cybersecurity team with consultants, contract resources, and managed security service providers when needed. Our executive leadership team is responsible for our overall enterprise risk management system and processes and, along with the Head of Cyber Security, regularly consider cybersecurity risks in the context of other material risks to the company.


text: Management of cybersecurity risks is an integral part of our overall risk management framework. We have developed an information security program designed to assess, identify and manage material risks from cybersecurity threats, which is integrated into our overall risk management program and governance structure. The program includes policies and procedures that identify how security measures and controls drawn from relevant frameworks are developed, implemented and maintained. Our cybersecurity risk management program works to balance critical infrastructure, network, application, cloud and information security objectives with overall business objectives and risk tolerance. Specific controls that are used include endpoint threat detection and response, identity and access management, privileged access management, logging and monitoring involving the use of security information and event management, multi-factor authentication, firewalls, and intrusion detection and prevention, and vulnerability and patch management.

companyName: PARK OHIO HOLDINGS CORP

ticker: PKOH


text: We also use threat intelligence to inform our defensive measures. We use external and internal threat intelligence sources, including information from vendors and Information Sharing and Analysis Centers.


text: We have the following security processes in place: • Cybersecurity Awareness Trainings: We educate employees on best practices for online safety and for identifying potential cybersecurity threats, including by initiating quarterly training programs for our non-represented salaried workforce. • Simulated Cyberattacks: With assistance from third-party providers, we periodically conduct penetration and vulnerability testing to test our technical controls and incident response plans. • Security Monitoring: We monitor our information technology environment with both our internal cybersecurity resources and third-party service providers. We also have processes in place to monitor the cybersecurity practices of various third-party service providers, including certain vendors that have access to our information systems or sensitive data. • Proactive Reporting and Investigation: As part of our training initiatives, we educate certain employees depending on their role on how to report any suspicious cyber activity or potential cybersecurity issues, and we investigate reported concerns.


text: Third-party security firms are used in different capacities to provide or operate some of these programs, controls, and technology systems, including cloud-based platforms and services.


text: Our Board of Directors ("Board") has overall oversight responsibility for our enterprise risk management framework and cybersecurity risk management. The Board is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Management, including the Vice President of Information Technology with support from our Information Technology Council, updates the Board on at least an annual basis regarding our cybersecurity programs and material cybersecurity risks and mitigation strategies. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our Vice President of Information Technologies receives reports from our Information Technology Council and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our information technology council includes experienced information systems security professionals and information security managers. Our Information Technology Council, which is composed of technology leaders from each of our business units, collaborates on a cross-functional basis to identify practices that can counter threats and to monitor our cybersecurity programs and our cybersecurity incident response plans.


text: In 2023 we did not identify any material cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For more information about these risks, please see Part I - Item 1A. "Risk Factors - We may experience breaches of, or disruptions to, our information technology systems or those of our third-party providers, or other compromises of our data, including the improper disclosure of personal or confidential data, which may adversely affect our operations and reputation."


text: Third-party risk management We maintain a risk-based third-party risk management process designed to identify, assess and manage risks presented by service providers, vendors and other third parties that access our systems or that process or store our data.

companyName: PENTAIR plc

ticker: PNR


text: Our Board of Directors ("Board") has overall oversight responsibility for our enterprise risk management framework and cybersecurity risk management. The Board is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Management, including the Vice President of Information Technology with support from our Information Technology Council, updates the Board on at least an annual basis regarding our cybersecurity programs and material cybersecurity risks and mitigation strategies. Our Vice President of Information Technology, who has more than 30-years of global information technology, systems, and IT audit experience, is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis; establishing processes to ensure that such potential cybersecurity risk exposures are monitored; putting in place appropriate mitigation measures; and maintaining cybersecurity programs. The Vice President of Technology oversees a cybersecurity team that includes experienced cybersecurity professionals with credentials such as CISSP (Certified Information Systems Security Professional), CompTIA Security+, and ISO 27001. Our Vice President of Information Technology receives reports from our Information Technology Council and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our Information Technology Council includes experienced information systems security professionals and information security managers. Our Information Technology Council, which is composed of technology leaders from each of our business units, collaborates on a cross-functional basis to identify practices that can counter threats and to monitor our cybersecurity programs and our cybersecurity incident response plans.


text: In 2024, we did not identify any material cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For more information about these risks, please see Part I - Item 1A. "Risk Factors - We may experience breaches of, or disruptions to, our information technology systems or those of our third-party providers, or other compromises of our data, including the improper disclosure of personal or confidential data, which may adversely affect our operations and reputation."


text: Cybersecurity Risk Management and Strategy Parker is committed to the protection of the Company's data, data systems and digital assets while in storage, use or transit. Our cybersecurity program is integrated into our overall Enterprise Risk Management program and exists to secure our information systems and data assets, including those data assets entrusted to us by our stakeholders, and to promote our compliance with applicable laws and regulations.


text: We proactively work to address cybersecurity risk through our Digital & IT Risk Management Program, which focuses on identifying, assessing, responding to, monitoring and remediating cybersecurity-related risks. Parker's dedicated Cyber Security team utilizes the National Institute of Standards and Technology (NIST) Cyber Security Framework as its primary resource for identifying areas of risk and benchmarking and implementing continuous improvements. Our technical security configuration employs a centrally managed, layered approach, including hardened PCs, endpoint security detection software, email security, firewall appliances, and various network security protections. We employ enhanced security measures for operational technologies and secure account management, including recently adding a secondary anti-malware solution to our existing software to bolster our company-wide defenses. Additionally, we utilize third-party security monitoring services to further improve our 24/7 monitoring capabilities. We also maintain a third-party risk management program designed to oversee, identify, and reduce the potential impact to Parker and our customers of a security incident at a third-party vendor, supplier or other provider.


text: We have adopted comprehensive Information Security Policies and Standards that clearly articulate Parker's expectations and requirements with respect to acceptable use, risk management, data privacy, education and awareness, security incident management and reporting, identity and access management, third-party management, security (with respect to physical assets, products, networks and systems), security monitoring and vulnerability identification. These policies and standards set forth a detailed security incident management and reporting protocol, with clear escalation timelines and responsibilities. We also maintain a global incident response plan and regularly conduct exercises to help with our overall preparedness.


text: We believe cybersecurity is the responsibility of every team member and provide ongoing mandatory cybersecurity awareness training globally to help team members recognize, avoid and report malicious activity. This includes interactive training to engage team members in identifying phishing risks and their appropriate response. We also provide regular training on data protection so that our team members understand the types of data they have and how to safeguard it.


text: Security awareness and training We provide ongoing security awareness and training to educate internal users on how to identify and report potential issues. Professional-level employees receive mandatory cybersecurity education and training. Employee phishing tests are conducted on a regular basis. Employees who do not follow protocol are redirected for additional training. We also provide periodic updates to employees on emerging cybersecurity trends and ways to protect themselves and our company.


text: As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, as discussed more fully under Item 1A. "Risk Factors—Business and Operational Risks" of this Form 10-K, cybersecurity threats remain a risk to our business operations.