text: The Company maintains cybersecurity policies and standards which align with the International Organization for Standardization (ISO) 27001 standard and the National Institute of Standards and Technology (NIST) Cybersecurity Framework. The Company's cybersecurity policies and standards have been developed in collaboration with groups across the enterprise, such as Legal, Compliance and each of its business segments. The Company's policies include, for example, Information and System Use policies for employee and non-employee system users. These policies reinforce the data privacy and protection sections of the Company's Code of Business Conduct and Ethics.


text: The Audit Committee of the Allstate Board oversees the effectiveness of the cybersecurity program. The Audit Committee retains an external cybersecurity advisor to consult on cybersecurity matters and perform assessments of the Allstate Information Security Program.

companyName: ALLSTATE CORP

ticker: ALL

secItem: Item 1C

stage1Category: Board Governance

stage1Method: majority


text: To help manage risk from potential cybersecurity threats, as part of the annual Code of Business Conduct and Ethics training, all Company employees receive data protection and privacy training, which focuses on the need to appropriately protect and secure confidential Company information. Additionally, the Company provides annual security awareness training that covers a broad range of security topics. The Company also provides regular targeted training on topics such as phishing and secure application development, among others. In addition to online training, employees are provided with cybersecurity related information through a number of different methods, including event-triggered awareness campaigns, recognition programs, security presentations, intranet articles, videos, system-generated communications, email publications and various simulation exercises.

companyName: TRAVELERS COMPANIES, INC.

ticker: TRV

stage1Category: Risk Management Process

stage1Method: unanimous


text: The Company has a Security Incident Response Framework in place. The framework is a set of coordinated procedures and tasks that the Company's Incident Response team, under the direction of the CISO, executes with the goal of ensuring timely and effective resolution of cybersecurity incidents. To maintain the robustness of the framework, from time-to-time the Company conducts cybersecurity tabletop testing exercises.


text: As part of the Company's supplier risk management program, using a risk-based approach, the Cybersecurity team conducts formal risk assessments with respect to certain of the Company's third-party service providers. The assessment process addresses aspects of the service providers' data security controls and policies. The team also conducts reassessments of its third-party risk assessments, the frequency of which is determined based on a risk assessment and rating process. Where appropriate, the Company seeks to incorporate contractual language with third-party service providers that includes clear terms involving the collection, use, sharing and retention of user data, as well as compliance with appropriate security terms.

stage1Category: Third-Party Risk


text: To date, the Company does not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations, or financial condition. As discussed more fully under "Item 1A—Risk Factors", the sophistication of cyber threats continues to increase, and the preventative actions the Company takes to reduce the risk of cyber incidents and protect its systems and information may be insufficient. No matter how well designed or implemented the Company's cybersecurity controls are, it will not be able to anticipate all security breaches, and it may not be able to implement effective preventive measures against cybersecurity breaches in a timely manner. See "Item 1A—Risk Factors—If we experience difficulties with technology, data and network security (including as a result of cyber attacks), outsourcing relationships or cloud-based technology, our ability to conduct our business could be negatively impacted."

stage1Category: Strategy Integration


text: The Risk Committee of the Board, consistent with its charter, reviews and discusses with management the strategies, processes and controls pertaining to the management of the Company's information technology operations, including cyber risks and cybersecurity. The CISO typically provides quarterly updates regarding cybersecurity and cyber risk to executive management and the Risk Committee of the Company's Board of Directors.


text: The CISO leads the Company's cybersecurity department. The CISO reports to the Chief Technology and Operations Officer and is a member of the Enterprise Risk team and the Company's Disclosure Committee. The CISO has over 20 years of cybersecurity and information security risk compliance and threat analysis experience. Prior to joining the Company in 2023, the CISO served as Chief Security Officer for a national telecommunications service provider. Under the direction of the CISO, the Company's Cybersecurity department analyzes cybersecurity and resiliency risks to the Company's business, considers industry trends and implements controls, as appropriate, to mitigate these risks. This analysis drives the Company's long- and short-term strategies, which are executed through a collaborative effort within Technology, Cybersecurity and Business Resiliency and are communicated to the Risk Committee of the Board of Directors on a regular basis.

stage1Category: Management Role


text: Risk management and strategy The Company has implemented technologies and tools to evaluate its cybersecurity protections and maintain a cyber risk management strategy related to its technology infrastructure that includes monitoring emerging cybersecurity threats and assessing appropriate responsive measures.


text: Risk Identification The Company's Chief Information Security Officer ("CISO") and Cybersecurity team are actively engaged within the cybersecurity community in order to monitor emerging trends and developments and share best practices for identifying and mitigating cyber threats. For example, the Company participates in threat intelligence information-sharing networks, such as the Financial Services Information Sharing and Analysis Center (FS-ISAC). The Company also tracks industry and government intelligence sources for information about evolving cyber threats and deploys updates to its systems, as appropriate. The Company's Cybersecurity team monitors and investigates suspicious events.


text: Cybersecurity Governance Seaboard acknowledges the importance of effectively managing risks linked to cybersecurity threats. Seaboard has implemented oversight mechanisms to ensure effective governance in handling risks linked to cybersecurity threats because of the impact these threats can have on operational integrity and stakeholder confidence.

companyName: SEABOARD CORP /DE/

ticker: SEB

stage1Category: None/Other


text: Our Vice President of Cloud Technology has been with Pega for seven years and has twenty-five years of networking and security management experience, with seventeen years of leadership roles in cloud services and related information security issues.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: The Company performs an annual cybersecurity risk and control assessment as part of the Enterprise Risk Management team's risk assessment processes. The CISO and the Chief Financial Officer of the Company's Technology group review and approve the cybersecurity assessment. The Company's Chief Technology and Operations Officer reviews and approves the list of emerging, strategic and transformative risks upon which the Enterprise Risk Management team's cybersecurity risk and control assessment processes are based. In addition, as part of their regular responsibilities, the Company's Governance, Risk and Compliance officers within its Technology and Cybersecurity groups assess technology and cybersecurity risks by leveraging the Company's risk framework related to technology and cybersecurity, which aligns with the Company's enterprise risk management strategy.


text: On an annual basis, under the direction of the Company's Chief Risk Officer, the Company's Technology, Cybersecurity and Business Resiliency groups also participate in the enterprise-wide Own Risk and Solvency Assessment ("ORSA"), which outlines identified risks and describes the controls in place across the Company to address those risks. The ORSA is reviewed with the Company's lead regulator, the State of Connecticut Department of Insurance, which in turn performs periodic financial examinations, including a technology control assessment.


text: In addition, the Company regularly self-assesses against its internal policies, using its internal risk assessment process and a variety of frameworks, such as the New York Department of Financial Services Cybersecurity Requirements for Financial Services Companies, the Insurance Data Security Model Law as adopted and modified by various states and the Payment Card Industry Data Security Standard.


text: As the workforce, the work environment and the threat landscape continue to evolve, the Company seeks to evaluate related risks and implement appropriate controls.


text: The Company maintains cybersecurity policies and standards which align with the International Organization for Standardization (ISO) 27001 standard and the National Institute of Standards and Technology (NIST) Cybersecurity Framework. The Company's cybersecurity policies and standards have been developed in collaboration with groups across the enterprise, such as Legal, Compliance, Technology, and each of its business segments. The Company's policies include, for example, Information and System Use policies for employee and non-employee system users. These policies reinforce the data privacy and protection sections of the Company's Code of Business Conduct and Ethics.


text: The Company uses technologies and tools, as appropriate, to enhance cybersecurity, such as multifactor authentication, encryption, firewalls, intrusion detection and prevention systems, endpoint detection and response, vulnerability scanning, penetration testing, patch management and identity and access management systems. These systems are designed, implemented and maintained with the goal of identifying, assessing and managing cybersecurity risks. In addition to its internal cybersecurity team, the Company uses internal and external auditors and, as appropriate, third-party consultants, service providers and assessors to review and test its processes.


text: To help manage risk from potential cybersecurity threats, as part of the annual Code of Business Conduct and Ethics training, all Company employees receive data protection and privacy training, which focuses on the need to appropriately protect and secure confidential Company information. Additionally, the Company provides annual security awareness training that covers a broad range of security topics. The Company also provides regular targeted training on topics such as artificial intelligence (AI) related risks, phishing and secure application development, among others. In addition to online training, employees are provided with cybersecurity information through a number of different methods, including awareness campaigns, gamified activities, recognition programs, security presentations, intranet articles, videos, system-generated communications, email publications and various simulation exercises.


text: The Company has a Security Incident Response Framework (Framework) in place. The Framework is a set of coordinated procedures and tasks that the Company's Incident Response team, under the direction of the CISO, executes with the goal of ensuring timely and effective resolution of cybersecurity incidents. To maintain the robustness of the Framework, from time-to-time the Company conducts cybersecurity tabletop testing exercises.


text: As part of the Company's supplier risk management program, using a risk-based approach, the Cybersecurity team conducts formal risk assessments with respect to certain of the Company's third-party service providers. The assessment process addresses aspects of the service providers' data security controls and policies. The team also conducts reassessments of its third-party service providers, the frequency of which is determined based on a risk assessment and rating process. Where appropriate, the Company seeks to incorporate contractual language with third-party service providers that includes clear terms involving the collection, use, sharing and retention of user data, as well as compliance with appropriate security terms. Additionally, our Procurement group has a framework to help identify and mitigate supplier risks, as well as enable management to make risk informed decisions.


text: The Audit Committee or the full Board of Directors receive quarterly cybersecurity updates, which are prepared by our VP of IT Security. The report provides comprehensive cybersecurity updates, including topics such as security incidents, our threat landscape, compliance, key performance metrics and material risks, along with updates on general cybersecurity project execution.

companyName: SEMTECH CORP

ticker: SMTC


text: To date, the Company does not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations, or financial condition. As discussed more fully under "Item 1A—Risk Factors", the sophistication of cyber threats continues to increase, and the preventative actions the Company takes to reduce the risk of cyber incidents and protect its systems and information may be insufficient. No matter how well designed or implemented the Company's cybersecurity controls are, it will not be able to anticipate all security breaches, and it may not be able to implement effective preventive measures against cybersecurity breaches in a timely manner. See "Item 1A—Risk Factors—If we experience difficulties with technology, data and network security (including as a result of cyber attacks), outsourcing relationships or cloud-based technology, our ability to conduct our business could be negatively impacted."


text: The Risk Committee of the Board, consistent with its charter, reviews and discusses with management the strategies, processes and controls pertaining to the management of the Company's information technology operations, including cyber risks and cybersecurity. The CISO typically provides quarterly updates regarding cybersecurity and cyber risk to executive management and the Risk Committee of the Company's Board of Directors.


text: The CISO leads the Company's cybersecurity department. The CISO reports to the Chief Technology and Operations Officer and is a member of the Enterprise Risk team and the Company's Disclosure Committee. The CISO has over 20 years of cybersecurity and information security risk compliance and threat analysis experience. Prior to joining the Company in 2023, the CISO served as Chief Security Officer for a national telecommunications service provider. Under the direction of the CISO, the Company's Cybersecurity department analyzes cybersecurity and resiliency risks to the Company's business, considers industry trends and implements controls, as appropriate, to mitigate these risks. This analysis drives the Company's long- and short-term strategies, which are executed through a collaborative effort within Technology, Cybersecurity and Business Resiliency and are communicated to the Risk Committee of the Board of Directors on a regular basis.


text: Cybersecurity Risk Management and Strategy Seaboard recognizes the importance of maintaining the trust and confidence of its customers, business partners, employees and other stakeholders. The Board is involved in the oversight of Seaboard's enterprise risk management program, of which cybersecurity is a component. Seaboard's information security program includes cybersecurity policies, standards, processes and practices that are based on recognized frameworks established by the Center for Internet Security ("CIS") and other applicable industry standards. Seaboard seeks to address cybersecurity risks through a comprehensive, company-wide information security program that is focused on preserving the confidentiality, integrity and availability of the information that Seaboard collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Managing Material Cybersecurity Risks Seaboard maintains a risk-based approach to information security that is based on the CIS-18 controls framework to identify key areas of cybersecurity risk. Seaboard's information security program maintains a team responsible for managing the cybersecurity risk assessment process across all segments (the "Information Security Team"). The Information Security Team routinely performs assessments and generates reports throughout the year to determine risks, threats and compliance with information security policies, standards and the framework of controls. This Information Security Team partners with each of the segments to identify key areas of cybersecurity risk based on the framework and develop action plans tailored to address those risks. These action plans are included on a multi-year roadmap that addresses priority, funding and implementation. These risks are evaluated on a quarterly basis according to Seaboard's cybersecurity reporting process.


text: Employees and directors with login credentials are required to participate in trainings on at least a quarterly basis to identify potential cybersecurity risks, which are supplemented by periodic phishing tests; Seaboard engages independent third parties to perform some services such as a penetration test; Seaboard maintains end user and administrative user policies governing the use of company technology.


text: Overseeing Third-Party Cybersecurity Risk Seaboard's information security program includes a documented process to oversee, identify and mitigate cybersecurity risk associated with Seaboard's use of new third-party service providers. As part of this process, prior to onboarding a third-party service provider, designated information security personnel from each segment will work with the internal business sponsors to perform a cybersecurity risk assessment and determine the potential impact on Seaboard's systems, data and networks if an identified cybersecurity breach were to occur. Risk assessments are documented, and reports are shared with the Information Security Team and others responsible for accepting the risk tolerance and monitoring the risks going forward.


text: Risks from Cybersecurity Threats As of the date of this report, Seaboard is not aware of any cybersecurity threats that have materially affected or are reasonably likely to affect Seaboard's business strategy, results of operations or financial condition. However, cybersecurity threats and cyber-attacks continue to increase in sophistication and volume. As a result, Seaboard frequently updates its information security plan to address new threats, and Seaboard continues to make investments to protect its information technology infrastructure.


text: As of the date of this report, we are not aware of any cybersecurity incidents, that have had a materially adverse effect on our operations, business, results of operations, or financial condition.

companyName: Thunder Power Holdings, Inc.

ticker: AIEV


text: Management's Role Managing Cybersecurity Risk and Board of Director Oversight The IS Director and the Information Security Team communicate guidance to all divisional information security personnel to ensure consistent execution of cybersecurity risk management activities. Updates on divisional cybersecurity risks, compliance and roadmap status are provided on at a least a quarterly basis to Seaboard's CEO and CFO for purposes of risk monitoring, updates to policies, allocation of resources, feedback on roadmap progress and discussions on threat remediation, among other topics.


text: On at least a quarterly basis, the IS Director and other members of management inform Seaboard's full Board of new risks or changes to risks, the status of projects to strengthen Seaboard's information security systems, assessments of Seaboard's security program and the emerging threat landscape. The Board provides feedback on management's plans and allocates resources for plan expenditures. Seaboard also maintains disclosure controls and procedures to ensure that executive management and the Board receives prompt and timely information regarding any material cybersecurity incidents. Upon confirmation of a cybersecurity incident, the impacted segment invokes their response plan and notifies the IS Director who then communicates the details of the incident to management's Cybersecurity Committee for determination of materiality.


text: Cybersecurity Risk Management and Strategy Seaboard recognizes the importance of maintaining the trust and confidence of its customers, business partners, employees and other stakeholders with the security of its data and information systems. The Board is involved in the oversight of Seaboard's enterprise risk management program, of which cybersecurity is a component. Seaboard's information security program includes cybersecurity policies, standards, processes and practices that are based on recognized frameworks established by the Center for Internet Security ("CIS") and other applicable industry standards. These frameworks and standards serve as guides and references. Seaboard adapts them to its specific environment, needs and industries. They are not meant to imply that Seaboard meets, or fully complies with, any specific technical standards, specifications or requirements set forth within them. Seaboard seeks to address cybersecurity risks through a comprehensive, company-wide information security program that is focused on preserving the confidentiality, integrity and accessibility of the information that Seaboard collects and stores, supporting legal and regulatory compliance and preventing disruptions to business operations. Seaboard's information security program monitors the systems and networks Seaboard relies upon for threats, breaches, intrusions and potential other weaknesses; assesses the security of company-wide software, applications and systems; responds to cybersecurity incidents; and facilitates training for employees.


text: Seaboard maintains a risk-based approach to information security that is based on the CIS-18 controls framework to identify key areas of cybersecurity risk. Seaboard's information security program maintains a team responsible for managing the cybersecurity risk assessment process across all segments (the "Information Security Team"). The Information Security Team routinely performs various reviews and generates reports throughout the year to determine risks, threats and compliance with information security policies, standards and the framework of controls. This Information Security Team partners with each of the segments to identify key areas of cybersecurity risk based on the framework and develop action plans tailored to address those risks. Risks are evaluated at least on a quarterly basis according to Seaboard's cybersecurity reporting process.


text: Employees and directors with login credentials are required to participate in trainings on at least a quarterly basis to identify potential cybersecurity risks, which are supplemented by periodic phishing tests.


text: Seaboard engages independent third parties to perform some services such as penetration testing and monitoring on an ongoing basis by automated tools that detect threats and trigger alerts for assessment and investigation by Seaboard's Information Security Team. Seaboard maintains end user and administrative user policies governing the use of company technology. Seaboard conducts risk assessments of certain of its third-party service providers with attention to cybersecurity risks.


text: As of the date of this report, Seaboard is not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect Seaboard's business strategy, results of operations or financial condition. However, cybersecurity threats and cyber-attacks continue to increase in sophistication and volume. As a result, Seaboard frequently updates its information security plan to address new threats, and Seaboard continues to make investments to protect its information technology infrastructure. Cybersecurity risks that may materially impact Seaboard are discussed in more detail in Item 1A "Risk Factors," under the heading "Operational Risks," which should be read in conjunction with this Item 1C.


text: Cybersecurity Governance Seaboard acknowledges the importance of effectively managing risks linked to cybersecurity threats. Seaboard has implemented oversight mechanisms to ensure effective governance in handling risks linked to cybersecurity threats because of the impact these threats can have on operational integrity and stakeholder confidence.


text: Seaboard's information security program and the Information Security Team is led and managed by a dedicated Director of Information Security (the " IS Directo r"). The IS Director, whose experience includes over eight years in information security leadership roles and relevant certifications, brings appropriate expertise to Seaboard's information security program. The IS Director's experience and knowledge are crucial to the ongoing development and execution of Seaboard's information security program.


text: The IS Director and the Information Security Team communicate guidance, including various alerts to monitor and assess threats, to information security personnel in all segments to ensure consistent execution of cybersecurity risk management activities. Updates on segment-level cybersecurity risks, compliance and implementation status are provided on at least a quarterly basis to Seaboard's Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO") for purposes of risk monitoring, updates to policies, allocation of resources, progress on action plans and discussions on other topics as necessary.


text: On at least a quarterly basis, the IS Director and other members of management inform Seaboard's full Board of new risks or changes to risks, the status of projects supporting Seaboard's information security systems, assessments of Seaboard's information security program and the emerging threat landscape. The Board provides feedback on management's plans and allocates resources for plan improvement expenditures.


text: Seaboard also maintains disclosure controls and procedures to ensure that executive management and the Board receive prompt and timely information regarding any material cybersecurity incidents. Upon confirmation of a cybersecurity incident, the impacted segment invokes their response plan and notifies the IS Director who then communicates the details of the incident to management's Cybersecurity Committee for determination of materiality.


text: All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. We understand the importance of securing our data and information technology systems and networks, as well as the data customers and other stakeholders entrust to us. We have established policies, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats which are integrated into our overall risk management program and based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO") and other applicable industry standards. Despite this, there can be no guarantee that our policies and procedures will be effective. Refer to "Risk Factors" for additional detail about the material cybersecurity risks we face. Our cybersecurity program includes the following:

companyName: SPX Technologies, Inc.

ticker: SPXC


text: Collaboration, Education, Incident Response and Recovery Planning Our key security, risk, and compliance personnel meet regularly and, together with our cybersecurity consultants, develop strategies for preserving the confidentiality, integrity and availability of data and our information technology systems and networks. We have established incident response and recovery plans to address potential cybersecurity incidents which are regularly evaluated for their effectiveness. Management maintains controls and procedures and periodically conducts tabletop exercises that are designed to ensure prompt escalation of material cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board of Directors (our "Board") in a timely manner. In addition, we regularly educate employees on the importance of maintaining the security of our information technology systems and networks and over handling and protecting customer and employee data, including through regular phishing awareness campaigns, security awareness communications, and recurring privacy and security training.


text: Risk Assessment and Technical Safeguards On an ongoing basis, we assess cybersecurity risk, including the review of our policies, standards, processes and practices. These assessments include a variety of activities including third party security penetration testing and independent reviews of our information security control environment and operating effectiveness. The results of these assessment activities are presented to our Board, Audit Committee, and members of management. We regularly assess and deploy technical safeguards based on vulnerability assessments, cybersecurity threat intelligence and incident response experience. In addition, our third-party technology service providers are contractually obligated to maintain cybersecurity controls and complete our security questionnaires at the time of onboarding. On a recurring basis, our third-party service providers are required to update their responses to our security questionnaires and, where available, additional information such as System and Organization Controls ("SOC") SOC 1 or SOC 2 reports are provided.


text: Board and Management Oversight Our chief information officer ("CIO") and chief information security officer ("CISO") have primary responsibility for assessing and managing material cybersecurity risks. Quarterly cybersecurity updates are provided to executive leadership to review security key performance indicators, identify security risks, and assess the status of approved security enhancements, and risk mitigation strategies. Our CIO has served in various roles in information technology and information security for over 30 years, including serving as the CIO of three other companies. Our CIO holds an undergraduate degree in computer science. Our CISO holds 11 industry security, risk, and/or privacy certifications and has served in various roles in information technology and information security for 25 years, including serving as the Director, Global Security, Privacy & Data Governance for one of the world's largest privately held transport corporations. Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk. The Audit Committee receives regular cybersecurity risk reports from management and, at least annually, our Board receives reports from management, including our CIO and CISO about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities.


text: Our security technology tools and processes provide protection against security breaches and reduce cybersecurity risks. Our cybersecurity incident response plan includes procedures for identifying, containing, and responding to incidents. While we continue to invest in our program and capabilities, we cannot guarantee prevention of all incidents.

companyName: J M SMUCKER Co

ticker: SJM


text: All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. We understand the importance of securing our data and information technology systems and networks, as well as the data customers and other stakeholders entrust to us. We have established policies, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats which are integrated into our overall risk management program and based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO") and other applicable industry standards. Despite this, there can be no guarantee that our policies and procedures will be effective. Refer to " Risk Factors " for additional detail about the material cybersecurity risks we face. Our cybersecurity program includes the following:


text: Collaboration, Education, Incident Response and Recovery Planning Our key security, risk, and compliance personnel meet regularly and, together with our cybersecurity consultants, develop strategies for preserving the confidentiality, integrity and availability of data and our information technology systems and networks. We have established incident response and recovery plans to address potential cybersecurity incidents, including assessing the severity of a cyber incident, which are regularly evaluated for their effectiveness. Management maintains controls and procedures and periodically conducts tabletop exercises that are designed to ensure prompt escalation of material cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board of Directors (our "Board") in a timely manner. In addition, we regularly educate employees on the importance of maintaining the security of our information technology systems and networks and over handling and protecting customer and employee data, including through regular phishing awareness campaigns, security awareness communications, and recurring privacy and security training.


text: Risk Management and Strategy As part of our overall enterprise risk management strategy, our cybersecurity processes seek to help the Company prevent or mitigate potential cybersecurity incidents, and to detect and remediate them quickly when they occur. To achieve this, the Company uses a broad selection of security tools and methodologies to assess, identify and manage material risks from cybersecurity threats.


text: Key aspects of our cybersecurity risk management and threat mitigation strategy include: • Maintaining our ISO/IEC 27001:2022 certification and using it along with other common security frameworks to help assess, identify, and manage material risks from cybersecurity; • Utilizing dedicated IT Security Operations and Product Security teams focused on monitoring, enforcing and improving cybersecurity throughout the enterprise; • Engaging and training internal stakeholders from representative aspects of the business (product and functional teams) on our Incident Response and Reporting plan on a quarterly basis; • Maintaining and regularly testing our disaster recovery and business continuity plans; and • Creating information security awareness among our employees and partners through the use of phishing exercises and regular cyber-awareness articles & newsletter campaigns.


text: The Company evaluates our third-party vendors and service providers to ensure appropriate oversight and to identify any risks from cybersecurity threats associated with the use of their tools or services. To that end, as part of the onboarding process, our internal IT Security Operations team: • Collects and evaluates self-certification information about each vendor's cybersecurity program and external certifications; • Reviews independent security reports that inform us about each vendor's security posture and historical incidents; and • Provides a timely evaluation of whether to continue the vendor's engagement based on their cybersecurity risk profile.


text: As part of our processes, we also engage third parties and industry experts to conduct audits and other assessments of our cybersecurity system. These assessments include vulnerability assessments, penetration testing and table-top exercises. The results of these reviews help to identify areas for continued focus, improvement and/or compliance. We also regularly evaluate our cybersecurity position against benchmarks of our peers and industry leaders, and expect our strategy and management approach to change as the general cybersecurity landscape evolves.


text: Consistent with our overall risk management governance structure, the Vice President of IT Security is responsible for the day-to-day management of cybersecurity risk, while our Board and its Audit Committee play an active, ongoing oversight role.


text: The Audit Committee or the full Board receive quarterly cybersecurity updates, which are prepared by our Vice President of IT Security. The report provides comprehensive cybersecurity updates, including topics such as security incidents, our threat landscape, compliance, key performance metrics and material risks, along with updates on general cybersecurity project execution.


text: The Vice President of IT Security works directly with the IT Security Operation Team and the Product Security Team to ensure effective and timely monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents. In line with our incident response plan, the Vice President of IT Security provides regular updates about cybersecurity incidents to the Audit Committee, the Chief Operating Officer and other members of the executive management team.


text: Our Vice President of IT Security has held IT security and leadership roles at the Company for over 23 years and maintains a wide range of industry certifications including Certified Information Systems Security Professional.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected or protected against all cybersecurity threats or incidents. For additional information on our cybersecurity risks, see "Item 1A. Risk Factors – We rely on certain critical information systems for the operation of our business and a disruption in our information systems, including those related to cybersecurity, could adversely affect our business operations."


text: The Company evaluates our third-party vendors and service providers to ensure appropriate oversight and to identify any risks from cybersecurity threats associated with the use of their tools or services. To that end, as part of the onboarding process, our internal IT Security Operations team: • Collects and evaluates self-certification information about each vendor's cybersecurity program and external certifications; • Reviews independent security reports that inform us about each vendor's security posture and historical incidents; and • Provides a timely evaluation of whether to move forward with the vendor's engagement based on their cybersecurity risk profile.


text: Consistent with our overall risk management governance structure, the Vice President of IT Infrastructure and Security ("VP of IT Security") is responsible for the day-to-day management of cybersecurity risk, while our Board of Directors and its Audit Committee play an active, ongoing oversight role.


text: We also simulate responses to cybersecurity incidents by conducting tabletop exercises. Our cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation, and remediation strategies.

companyName: CHART INDUSTRIES INC

ticker: GTLS


text: The VP of IT Security works directly with the IT Security Operation Team and the Product Security Team to ensure effective and timely monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents. In line with our incident response plan, the VP of IT Security informs executive management regarding cybersecurity risks and incidents and provides regular updates about cybersecurity incidents to the Board, the Chief Operating Officer and other members of the executive management team as well as to the Audit Committee and the Board of Directors, as appropriate.


text: Our VP of IT Security has held IT security and leadership roles at the Company for over 24 years and maintains a wide range of industry certifications including Certified Information Systems Security Professional.


text: Risk Management and Strategy We recognize the necessity of a flexible and dynamic cybersecurity risk management strategy to defend against threats in a fast-changing digital world. For this purpose, we have invested in building a cybersecurity infrastructure to protect our information systems and secure our data from cyberattacks. Our information security program features risk management strategies, security awareness training, security operations, incident response, security governance, third-party risk management, IT security risk management, security architecture, and vulnerability management.

companyName: SERVICE CORP INTERNATIONAL

ticker: SCI


text: 20 Service Corporation International Managing Material Risks & Integrated Overall Risk Management Cybersecurity risk management is integrated into our broader enterprise risk management system, and cybersecurity risk is strategically reviewed, monitored and managed alongside other enterprise risks on a regular basis. Our information security program is designed to evaluate, identify, and manage risks from cybersecurity threats and vulnerabilities, including malware, phishing, hacking, social engineering, and data breaches. Our program is regularly assessed using the NIST Cybersecurity Framework, and information security training is provided to our employees. Our information security team is empowered to assess and address cybersecurity risks in close collaboration with the operational teams. This forward-thinking strategy ensures that cybersecurity risk management awareness informs each stage of the business decision-making process.


text: Engage External Experts on Risk Management To effectively target emerging cybersecurity threats, our information security program engages with a diverse group of third-party external experts, including cybersecurity assessors, consultants, and auditors for cybersecurity risk management. Our partnerships with these third party professionals feature regular audits, assessments, and simulated testing.


text: Oversee Third-Party Risk Risk assessments are conducted when we onboard new services and new vendors, including third-party vendors, applications, and other technology services, when there are significant changes to IT or security architecture, and when systems handle sensitive data. Third-party risks are documented as part of a risk management process that follows an industry standard framework with a goal of remediation or mitigation.


text: Cybersecurity Threat Risks We have not experienced a cybersecurity incident or data breach that has had a material impact on our operations or financial standing.


text: The Board of Directors recognizes that an encompassing, effective cybersecurity risk management strategy is essential to sustaining business operations and investor confidence. Our management assumes executive responsibility for assessing, identifying, and managing cybersecurity risks and incidents.


text: Board of Directors Oversight Certain members of the Board of Directors have experience conducting oversight of cybersecurity risk management across different industries, including technology and finance. The Audit Committee is the primary committee responsible for overseeing the company's cybersecurity risks with the Board receiving updates on at least an annual basis.


text: Management's Role in Managing Cybersecurity Risk The Assistant Vice President, Information Technology Security reports to the Vice President of Information Technology and is responsible for briefing the Audit Committee on information security risks. The AVP, IT Security provides comprehensive briefings to the Audit Committee on a regular basis. These briefings highlight various cybersecurity topics, including new cybersecurity threats, incidents, risks, risk management solutions, strategy pivots, or proposed governance changes. The Audit Committee actively participates in cybersecurity-related business decisions.


text: Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk.

companyName: byNordic Acquisition Corp

ticker: BYNO


text: Risk Management Expertise With over 22 years of experience working on information technology and cybersecurity teams, the AVP, IT Security is the lead architect of the company's security infrastructure. In his role, the AVP, IT Security has built and developed effective and lasting information security solutions, establishing a robust framework of technical, administrative and physical controls while providing stakeholders such as executive management, operations leadership and legal counsel clear and constant visibility into rapidly evolving business threats. The AVP, IT Security is responsible for detecting known and potential cybersecurity incidents, leading cybersecurity incident investigations, and ensuring that cybersecurity incidents are reported timely, promptly escalated and resolved in accordance with the Company cybersecurity incident response plan. The AVP, IT Security is a Certified Information Security Manager (CISM) and his cybersecurity expertise is a valuable resource for Company executive leadership and the Board.


text: Monitoring Cybersecurity Incidents The AVP, IT Security manages the information security program responsible for the regular monitoring of our information systems for cybersecurity risks. The monitoring process is led by an experienced team of information security professionals. Advanced security software preemptively detects threats and regular system scans are conducted to identify potential vulnerabilities. The AVP, IT Security regularly receives updates about potential cybersecurity threats and remains informed about the latest threat detection software technologies and new risk management solutions. In the event of a cybersecurity incident, the AVP, IT Security is supported by the cyber security incident response team and the crisis response team. The cyber security incident response plan guides the AVP, IT Security and includes immediate actions to escalate an incident based on its seriousness, to mitigate the impact, and to enact long-term strategies for remediation and prevention of future incidents.


text: Reporting Cybersecurity Risk The AVP, IT Security is responsible for informing executive management of cybersecurity risks and incidents. The AVP, IT Security presents quarterly briefings to the Cyber Security and Data Governance Executive Steering Committee on all issues related to cybersecurity risks and incidents. The Cyber Security and Data Governance Executive Steering Committee includes members from the senior leadership team, such as the Chief Operating Officer, the Senior Vice President of Operations Services and the General Counsel. Our highest levels of management are actively aware and involved in shaping the company's cybersecurity position and analyzing potential risks. Any cybersecurity incident or data breach that is determined to be material will be reported to the Audit Committee and the Board of Directors.


text: Managing Material Risks & Integrated Overall Risk Management Cybersecurity risk management is integrated into our broader enterprise risk management system, and cybersecurity risk is strategically reviewed, monitored and managed alongside other enterprise risks on a regular basis. Our information security program is designed to evaluate, identify, and manage risks from cybersecurity threats and vulnerabilities, including malware, phishing, hacking, social engineering, data breaches, and emerging risks associated with artificial intelligence. Our program is regularly assessed using the NIST Cybersecurity Framework, and mandatory information security training is provided to our employees. Our information security team is empowered to assess and address cybersecurity risks in close collaboration with the operational teams. This forward-thinking strategy ensures that cybersecurity risk management awareness informs each stage of the business decision-making process.


text: Management's Role in Managing Cybersecurity Risk The Assistant Vice President, Information Technology Security, who also functions as the company's data protection officer, reports to the Vice President of Information Technology and is responsible for briefing the Audit Committee on information security risks. The AVP, IT Security provides comprehensive briefings to the Audit Committee on a quarterly basis. These briefings highlight various cybersecurity topics, including new cybersecurity threats, incidents, risks, risk management solutions, strategy pivots, or proposed governance changes.


text: Risk Management Expertise With over 23 years of experience working on information technology and cybersecurity teams, the AVP, IT Security is the lead architect of the company's security infrastructure. In his role, the AVP, IT Security has built and developed effective and lasting information security solutions, establishing a robust framework of technical, administrative and physical controls while providing stakeholders such as executive management, operations leadership and legal counsel clear and constant visibility into rapidly evolving business threats. The AVP, IT Security is responsible for detecting known and potential cybersecurity incidents, leading cybersecurity incident investigations, and ensuring that cybersecurity incidents are reported timely, promptly escalated and resolved in accordance with the Company cybersecurity incident response plan. The AVP, IT Security is a Certified Information Security Manager and his cybersecurity expertise is a valuable resource for Company executive leadership and the Board.


text: Risk Management and Strategy Our business operations depend on the availability, integrity and secure processing, storage, and transmission of confidential and sensitive information, digitally and through interconnected systems, including those of our vendors, service providers and other third parties on which we rely. Consequently, we maintain a formal data protection program, including physical, technical and administrative safeguards, to prevent and mitigate the risks posed by cybersecurity threats and incidents and to identify, analyze, address, mitigate and remediate those incidents that do occur. As part of our program: • we regularly review and update at least annually our standard policies and procedures related to information technology and analyze those policies against the standards and controls that we believe are most relevant to our Company set by organizations such as the National Institute of Standards and Technology (NIST) cybersecurity framework and the International Organization for Standardization (ISO); • we maintain a dedicated cybersecurity team under the direction of our Chief Information Officer (CIO), who has expertise related to data and network security, data governance and risk management; • we regularly test our internal IT controls; • we regularly conduct internal vulnerability assessments as well as third-party penetration tests; • we maintain, and we require our third-party service providers to maintain, security controls designed to ensure the confidentiality, integrity, and availability of our information systems and the confidential and sensitive information we maintain and process, or which is processed on our behalf; • all employees are required to complete periodic trainings that cover security and privacy best practices and company policies; and • we have prepared and regularly review and test our business continuity, disaster recovery and other back-up plans, including as they relate to cybersecurity incidents.

companyName: MUELLER INDUSTRIES INC

ticker: MLI


text: In connection with the design, implementation and testing of our cybersecurity program, we also work, as appropriate, with our accountants, independent assessors, legal counsel and other consultants.


text: We have an incident reporting and escalation process that we believe to be effective in detecting and analyzing cyber incidents as they occur to determine appropriate response action and reporting, including the materiality of any such incidents to our financial condition and operations. This process includes: • continual monitoring of our systems and logs by both internal and outsourced staff; • immediate escalation to and review by our CIO of certain signals, including evidence of external threat actors, ransomware attacks, data exfiltration, identity compromise or unusual requests from management or certain departments; • if deemed appropriate, reporting by our CIO to the Company's senior leadership, which based on the circumstances, may include executive officers and representatives of our accounting, human resources, finance, information technology and legal functions, and consultation with internal and external legal counsel, for further review and determination of the scope and materiality of the incident or incidents, including whether public disclosure is appropriate or required; and • informing our Board of Directors (the "Board") of significant or material cybersecurity incidents, as appropriate.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. Our board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes.

companyName: Syndax Pharmaceuticals Inc

ticker: SNDX


text: While we, our clients and our vendors are regularly exposed to malicious technology-related events and threats, none of these threats or incidents, either individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this report. In determining materiality, cybersecurity incidents are reviewed not only for potential financial impacts, which could include potential legal and regulatory penalties, stolen assets or funds, system damage, forensic and remediation costs, lost client revenue or litigation costs, but also the breadth and sensitivity of data exposure, data exfiltration, impacts on the ability to operate our business or provide our services, client dissatisfaction, and loss of investor confidence.


text: Our Board actively oversees our risk management activities both directly and through its committees and considers various risk topics throughout the year, including cybersecurity and information security risk management and controls. As part of its oversight function, the Audit Committee of the Board oversees the Company's risk assessment and risk management policies, including related to cybersecurity and the data protection program, and performs an annual review and assessment of the primary operational and regulatory risks facing the Company, their relative magnitude and management's plan for mitigating these risks. At least annually, our CIO reports to the Audit Committee with a comprehensive report addressing a broad range of topics, including significant cybersecurity incidents that have occurred since the last update, the status of projects and initiatives to update our cybersecurity policies and practices, and ongoing efforts to prevent, detect, and respond to internal and external critical threats.


text: Our senior management is responsible for assessing and managing the Company's various exposures to risk, including those related to cybersecurity, on a day-to-day basis, including the identification of risks through a robust enterprise risk management framework and the creation of appropriate risk management programs and policies to address such risks. Our CIO has primary responsibility for managing our cybersecurity program and efforts. Our internal audit team is responsible for the testing and audit of our information-technology internal controls.


text: We believe our information technology team to be well-qualified in this area. These qualifications include professional experience in the field and recent participation in IT and cybersecurity programs organized by leading institutions with expertise in the field.


text: While we, our customers and our vendors are regularly exposed to malicious technology-related events and threats, none of these threats or incidents, either individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this report. In determining materiality, cybersecurity incidents are reviewed not only for potential financial impacts, which could include potential legal and regulatory penalties, stolen assets or funds, system damage, forensic and remediation costs, lost customer revenue or litigation costs, but also the breadth and sensitivity of data exposure, data exfiltration, impacts on the ability to operate our business or provide our services, customer dissatisfaction, and loss of investor confidence.


text: Internal and external networks, including the networks on which the Company relies, are assessed for vulnerabilities. Bain Capital also engages with independent third parties to conduct relevant technical assessments.

companyName: Bain Capital Specialty Finance, Inc.

ticker: BCSF


text: We maintain a cybersecurity program that is aligned with our business and focused on managing risks to our Company. As described below, we have established policies, standards, processes and practices for assessing, identifying and managing material risks from cybersecurity threats, which are integrated into our overall risk management program and governance structure.

companyName: SHERWIN WILLIAMS CO

ticker: SHW


text: We use various controls, technologies, and other processes designed to identify, protect against, detect, respond to and mitigate cybersecurity risks, in alignment with frameworks established by the National Institute of Standards and Technology (NIST). These include, but are not limited to, internal reporting, monitoring and detection tools, threat intelligence, and general and role-based training. We also maintain third party management processes to identify and manage the cybersecurity risks associated with third party service providers. We periodically evaluate and improve the effectiveness of our cybersecurity program internally and by engaging with consultants and other third party advisors to conduct reviews and assessments of our program. These periodic assessments and reviews may include penetration and vulnerability testing, simulations, table-tops, and other exercises.


text: Overseeing the assessment and management of our exposure to various risks, including cybersecurity, is a key oversight responsibility for the Board of Directors. We have an enterprise risk management (ERM) program that includes the processes used to identify, assess, and manage our most significant enterprise risks and uncertainties that could materially impact the long-term health of the Company or prevent the achievement of strategic objectives. These risks are identified, measured, monitored and managed across key risk categories, which include the consideration of cybersecurity risks. Our chief financial officer (CFO) facilitates the Company's ERM program, which includes a formal assessment of the Company's risk environment at least once per year. The ERM program also facilitates the incorporation of risk assessment and evaluation into the strategic planning process and the provision of regular reports to senior management, including our CEO. The Audit Committee assists the Board with its oversight of both the ERM program and cybersecurity risk, providing regular reports to the Board. Our CFO reviews the ERM program with the Audit Committee at least once per year, including reviewing existing risks and significant emerging risks across the Company's key risk categories. In reviewing specific threats and risks with the Board, senior management may incorporate reports from consultants and other third party advisors.


text: Our Chief Information Security Officer (CISO) leads our global cybersecurity program and is responsible for management of our cybersecurity risks. Our CISO reports to our CFO. Our CISO has served in that position since 2022 and has relevant experience in cybersecurity leadership positions, including prior experience as CISO of a public company. The Audit Committee regularly reviews our risk exposures relating to cybersecurity with our CISO and CFO, including the review of the state of the Company's cybersecurity and emerging cybersecurity developments and threats, and the steps management has taken to monitor and mitigate such exposures. Our CISO manages a team of cybersecurity professionals with expertise and experience in information security.


text: Our CISO is informed of cybersecurity incidents by the cybersecurity team's security operations center, which is generally responsible for monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. We have an established process governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident, including for our evaluation of materiality. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and Board of Directors.


text: We depend on IT systems, third-party service providers, and strategic partners to facilitate our business operations. This includes secure handling of personal, confidential, financial, sensitive, proprietary, and other forms of information, as well as enabling our service offerings. Despite continuous efforts to enhance both our and our partners' cybersecurity defenses, we cannot guarantee the protection of all information systems, products, and service technologies.


text: Despite our efforts to prevent cybersecurity threats and incidents, our systems may be affected by damage or interruption resulting from, among other causes, cyber attacks, security breaches, power outages, system failures or malware (including ransomware and other programs that operate with malicious intent). Disruptions to these systems may impair our ability to conduct business and have a material adverse effect on our business, results of operations and financial condition. Despite the security measures we have in place, our facilities and systems, and those of third parties we rely on or do business with, may be vulnerable to cyber attacks, security breaches, malware (including ransomware and other programs that operate with malicious intent), power outages, system failures, acts of vandalism, human or technical errors or other similar events or disruptions. Any such event involving the misappropriation, loss or other unauthorized disclosure of information, whether impacting us or third parties we rely on or do business with, could result in losses, damage our reputation or relationships with customers and suppliers, expose us to the risks of litigation, regulatory action and liability, disrupt our operations and have a material adverse effect on our business, results of operations and financial condition.


text: To date, we have not experienced a cybersecurity threat or incident that has had a material adverse affect on our business, results of operations and financial condition. We, and third parties we do business with, have experienced cybersecurity attacks and incidents in the past, some of which have resulted in unauthorized access to our information and systems and other disruptions to our business operations, and we could in the future experience similar incidents. See Risk Factors in Item 1A for additional information on cybersecurity risks.


text: We use various controls, technologies and other processes designed to identify, protect against, detect, respond to and mitigate cybersecurity risks, in alignment with the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0. These include, but are not limited to, internal reporting, monitoring and detection tools, threat intelligence and general and role-based training. We also maintain third-party management processes to identify and manage the cybersecurity risks associated with third-party service providers. We periodically evaluate and improve the effectiveness of our cybersecurity program internally and by engaging with consultants and other third-party advisors to conduct reviews and assessments of our program. These periodic assessments and reviews may include penetration and vulnerability testing, simulations, table-tops and other exercises.


text: Overseeing the assessment and management of our exposure to various risks, including cybersecurity, is a key oversight responsibility for the Board of Directors. We have an enterprise risk management (ERM) program that includes the processes used to identify, assess and manage our most significant enterprise risks and uncertainties that could materially impact the long-term health of the Company or prevent the achievement of strategic objectives. These risks are identified, measured, monitored and managed across key risk categories, which include the consideration of cybersecurity risks. Our chief financial officer (CFO) facilitates the Company's ERM program, which includes a formal assessment of the Company's risk environment at least once per year. The ERM program also facilitates the incorporation of risk assessment and evaluation into the strategic planning process and the provision of regular reports to senior management, including our CEO. The Audit Committee assists the Board with its oversight of both the ERM program and cybersecurity risk, providing regular reports to the Board. Our CFO reviews the ERM program with the Audit Committee at least once per year, including reviewing existing risks and significant emerging risks across the Company's key risk categories. In reviewing specific threats and risks with the Board, senior management may incorporate reports from consultants and other third-party advisors.


text: Our Chief Information Security Officer (CISO) leads our global cybersecurity program and is responsible for management of our cybersecurity risks. Our CISO reports to our CFO. Our CISO has served in that position since 2022 and has relevant experience in cybersecurity leadership positions, including prior experience as CISO of a public company. The Audit Committee regularly reviews our risk exposures relating to cybersecurity with our CISO and CFO, including review of the state of the Company's cybersecurity and emerging cybersecurity developments and threats and the steps management has taken to monitor and mitigate such exposures. Our CISO manages a team of cybersecurity professionals with expertise and experience in information security.


text: Our CISO is informed of cybersecurity incidents by the cybersecurity team's security operations center, which is generally responsible for monitoring the prevention, detection, mitigation and remediation of cybersecurity incidents. We have an established process governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident, including for our evaluation of materiality. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and Board of Directors.


text: While we face regular cybersecurity threats, including ransomware and data breaches, we have not encountered significant incidents during the year ended April 30, 2025. We believe our security measures are adequate, but we acknowledge the rising sophistication of threats. Despite vigilance, system disruptions or unauthorized disclosures remain possible.


text: Despite our efforts to prevent cybersecurity threats and incidents, our systems may be affected by damage or interruption resulting from, among other causes, cyber attacks, security breaches, power outages, system failures or malware (including ransomware and other programs that operate with malicious intent). Disruptions to these systems may impair our ability to conduct business and have a material adverse effect on our business, results of operations and financial condition. Despite the security measures we have in place, our facilities and systems and those of third parties we rely on or do business with, may be vulnerable to cyber attacks, security breaches, malware (including ransomware and other programs that operate with malicious intent), power outages, system failures, acts of vandalism, human or technical errors, or other similar events or disruptions. Any such event involving the misappropriation, loss or other unauthorized disclosure of information, whether impacting us or third parties we rely on or do business with, could result in losses, damage our reputation or relationships with customers and suppliers, expose us to the risks of litigation, regulatory action and liability, disrupt our operations and have a material adverse effect on our business, results of operations and financial condition.


text: To date, we have not experienced a cybersecurity threat or incident that has had a material adverse affect on our business, results of operations and financial condition. We, and third parties we do business with, have experienced cybersecurity attacks and incidents in the past, some of which have resulted in unauthorized access to our information and systems, and other disruptions to our business operations, and we could in the future experience similar incidents. See Risk Factors in Item 1A for additional information on cybersecurity risks.


text: Risk Management and Strategy We have processes in place aimed at assessing, identifying, and managing material risks from cybersecurity threats. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: SIFCO INDUSTRIES INC

ticker: SIF


text: Key elements of our cybersecurity risk management program include: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a formal register documenting and mitigating identified risks, reviewed by management on a quarterly basis; • a data protection team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the regular use of external service providers to independently assess and test security posture, as well as to otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a written cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, including data storage and restoration and disaster recovery plans; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: As reported on Forms 8-K filed January 6, 2023 and February 10, 2023, the Company became aware of unauthorized access to the Company's systems on December 30, 2022. The Company's domestic operations were impacted by the Cyber Incident, which resulted in production delays and delayed shipments due to information access limitations. The Company immediately initiated response protocols and an investigation, engaging cyber security experts to assist with the assessment of the incident and to help determine what data was impacted. The Company has since completed data recovery and restoration from the cyber incident. See Note 12 — Commitments and Contingencies of the Notes to Consolidated Financial Statements.

stage1Category: Incident Disclosure


text: Except for the above incident, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Our Business and Operations."


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and maintains oversight of risk assessment and risk management, including cybersecurity and other information technology risks. In addition, our Board of Directors oversees management's implementation of our cybersecurity risk management program.


text: The Board of Directors receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board of Directors, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant. These presentations may cover a range of topics, including: • the current cybersecurity landscape and best practices for mitigating emerging threats; • progress on cybersecurity projects; • incident reports; • updates from past event(s); and • adherence to regulatory requirements and/or industry standards, as appropriate.


text: Key has implemented cybersecurity, privacy, and fraud education and awareness programs across the enterprise to educate teammates on how to identify and report cybersecurity and privacy concerns. Employees and contractors with access to assets or data owned or maintained by Key receive mandatory enterprise-wide cybersecurity, privacy, and fraud training on an annual basis.

companyName: KEYCORP /NEW/

ticker: KEY


text: Our management team, including our Data Protection Officer and external counsel, are responsible along with the Company's Board of Directors for assessing and managing our material risks from cybersecurity threats. Our Data Protection Officer has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Data Protection Officer has extensive experience in information technology, including prior experience in cybersecurity architecture. We have a diverse information security team, including external consultants, with varying backgrounds and experience and levels of information security certification.


text: Our management team takes steps to remain informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Cybersecurity Governance We recognize the importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. This process is supported by both our management and our Board of Directors.

companyName: SMITH A O CORP

ticker: AOS


text: Our Chief Information Officer (CIO) oversees our information systems and cybersecurity function and reports to our Chief Executive Officer (CEO). She has over 30 years of experience in leading information systems management, strategy, and operational execution, including incident management, prevention, and response. Our Senior Director of Global Information Security (ISD) reports to our CIO and is responsible for the protection and defense of our networks and systems and managing cybersecurity risk. He has over 20 years of experience in managing cybersecurity and related risks, including threat identification, incident response, and defense strategies. Our CIO and ISD are supported by a direct and a cross-functional team of professionals with broad experience and expertise in threat assessment and detection, mitigation technologies, training, incident response, and regulatory compliance.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, which includes our management of information and cybersecurity risk. The full Board receives an update on our cyber risk management process and trends related to cybersecurity at least annually. The Audit Committee of the Board assists the full Board in its oversight of cybersecurity risks and as part of its oversight, the Audit Committee receives reports from management on information systems and security at each meeting, including metrics and controls, and other items from time to time such as risk assessments, security software, and incident response plans.


text: We have also established a committee of our executive leadership team to consider cybersecurity risk, mitigation strategies, and to consider trends and developments in managing the risk. Our CIO and ISD participate on this committee, which meets regularly. We have an established incident response plan led by our CIO and ISD to assess, respond, and report in the event of a cybersecurity incident. Depending on the nature and severity of the incident, the plan requires escalating notifications up to our CEO and our Board.


text: Cybersecurity Risk Management Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program in a similar fashion to other legal, compliance, strategic, operational, and financial risk areas. Our program is guided by cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), although we also look to other standards to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our approach to cybersecurity risk management includes: • Periodic risk assessments designed to help identify significant or potentially material cybersecurity risks to our critical systems, information, and our broader enterprise information technology (IT) environment; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • A multi-layered defense and continuous monitoring strategy employing various tools and testing, and incorporating lessons learned from our defense and monitoring efforts to help prevent future attacks; • Cybersecurity awareness training, including interactive simulations and tabletop exercises for our employees, incident response personnel, senior management, and our Board; • Regular testing by our Internal Audit function of controls related to our financial information systems; and • Information security assessments conducted on third parties with whom we share sensitive electronic data against established cybersecurity frameworks;


text: While we have experienced cybersecurity incidents in the past, to-date none have materially affected the Company or our financial position, results of operations and/or cash flows. We continue to invest in cybersecurity and the resiliency of our networks, including our controls and processes, all of which are designed in an effort to protect our IT systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors – Business, Operational, and Strategic Risks."


text: Our Chief Information Officer (CIO) oversees our information systems and cybersecurity function and reports to our Chief Operating Officer (COO). She has over 30 years of experience in leading information systems management, strategy, and operational execution, including incident management, prevention, and response. Our Senior Director of Global Information Security (ISD) reports to our CIO and is responsible for the protection and defense of our networks and systems and managing cybersecurity risk. He has over 20 years of experience in managing cybersecurity and related risks, including threat identification, incident response, and defense strategies. Our CIO and ISD are supported by a direct and cross-functional team of professionals with broad experience and expertise in threat assessment and detection, mitigation technologies, training, incident response, and regulatory compliance.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, which includes our management of information and cybersecurity risk. The full Board receives an update on our cyber risk management process and trends related to cybersecurity at least annually, or real-time if a material event occurs. The Audit Committee of the Board assists the full Board in its oversight of cybersecurity risks. As part of its oversight, the Audit Committee receives regular reports from management on information systems and security, including metrics and controls at each meeting, and other items at least annually including risk assessments, security software, incident response plans, and key updates to the cybersecurity program and its effectiveness.


text: We have also established a committee of our executive leadership team to consider cybersecurity risks and to consider mitigation strategies in managing the risk. Our CIO and ISD participate on this committee, which meets regularly. We have an established incident response plan led by our CIO and ISD to assess, respond, and report in the event of a cybersecurity incident. Depending on the nature and severity of the incident, the plan requires escalating notifications up to our CEO, Audit Committee and our Board.


text: Cybersecurity Risk Management Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program consistent with other legal, compliance, strategic, operational, and financial risk areas. Our program is guided by cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), although we also look to other standards to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: The Company has a robust cybersecurity program to assess, identify and manage material risk from cybersecurity threats and to prevent, detect and respond to cybersecurity threats, including those associated with the use of third-party service providers. Our approach to cybersecurity risk management includes: • Cybersecurity awareness training, including interactive simulations and tabletop exercises for our employees, incident response personnel, senior management, and our Board; • Periodic risk assessments designed to help identify significant or potentially material cybersecurity risks to our critical systems, information, and our broader enterprise information technology (IT) environment; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • A multi-layered defense and continuous monitoring strategy employing various tools and testing, and incorporating lessons learned from our defense and monitoring efforts to help prevent future attacks; • Regular testing by our Internal Audit function of controls related to our financial information systems; and • Information security assessments conducted on third parties with whom we share sensitive electronic data against established cybersecurity frameworks;


text: While we have experienced cybersecurity incidents in the past, to-date none have materially affected the Company or our financial position, results of operations and/or cash flows. We continue to invest in cybersecurity and the resiliency of our networks, including our controls and processes, all of which are designed in an effort to protect our IT systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Item 1A - Risk Factors.


text: Risk Management and Strategy We acknowledge the significance of cybersecurity in protecting our operations, data, and shareholders' interests, and have made cybersecurity a fundamental component of our overall risk management framework. Our cybersecurity program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. This framework guides our efforts to protect critical assets, identify potential threats, respond to incidents, and strengthen resilience, while simultaneously allowing us to assess and enhance the maturity of our program. The cybersecurity program is informed by our Enterprise Risk Management ("ERM") process and relies on internal and external expertise. We proactively evaluate and refine our security controls by utilizing best practices and threat intelligence to mitigate cyber risks. The Company also utilizes third parties for some cybersecurity services, including managed security services, external penetration testing, and social engineering tests. Additionally, we maintain an incident response plan that aligns with industry standards to ensure timely detection, containment, and remediation of security incidents.

companyName: SMITHFIELD FOODS INC

ticker: SFD


text: Cybersecurity Incidents When a cybersecurity incident is identified, we follow established processes in our enterprise privacy and cyber incident response plans, which are a supplement to our corporate incident response plan. These plans provide a framework to enable the appropriate personnel to recover operations in the event of a cyberattack and manage incidents impacting banking information, including our clients' and employees' information.


text: Cybersecurity Program Components Our cybersecurity program includes a focus on governance, process, technology and people. Key components include prevention, detection, and response capabilities, employee training programs, threat intelligence monitoring, and the implementation of an array of technologies. For example, to effectively manage cybersecurity risks, we maintain an asset inventory and classify critical systems to ensure appropriate protection measures. Our risk management processes include regular assessments of internal and third-party risks, which are aligned with our ERM strategy. We enforce cybersecurity policies, standards, and governance practices, ensuring they align with regulatory requirements and industry best practices. Additionally, we conduct periodic business impact analyses to strengthen resilience and inform risk-based decision-making.


text: The cybersecurity program incorporates multiple layers of security controls to safeguard our systems and data. Access controls are established based on the principle of least privilege, and all employees engage in cybersecurity awareness training to cultivate a security-conscious culture. We train our employees through periodic security training, phishing simulations and regular communications about timely security topics to enhance their understanding of cybersecurity threats and their ability to identify and escalate potential cybersecurity events. We maintain robust security configuration management and regularly update systems to minimize vulnerabilities. Investments in security technology include vulnerability management tools, malicious software protection, email security, and around-the-clock monitoring.


text: Our cybersecurity team continuously monitors network activity using advanced threat detection tools. Through automated alerts, behavioral analytics, and threat intelligence, security anomalies are identified in a timely manner. Routine vulnerability scanning and independent penetration testing further enhance our ability to detect weaknesses before they can be exploited.


text: We have an established incident response plan that aligns with NIST guidelines, ensuring a structured approach to identifying, containing, eradicating, and recovering from security incidents. The plan includes defined escalation procedures to engage executive leadership and regulatory authorities as necessary. Our cybersecurity team conducts regular incident response exercises to enhance response readiness. Additionally, we have a process in place to perform post-incident reviews to refine processes and prevent recurrence.


text: Recovery strategies are in place and supervised by a crisis management plan to restore critical operations following a cybersecurity event. We maintain secure, redundant backups and regularly test them for integrity and availability. Our recovery strategies prioritize minimizing downtime and rapid service restoration. We strive to incorporate lessons learned from past incidents, strengthening our resilience against future threats.


text: Third-party risk management is a critical component of IT risk management. We evaluate new vendors before onboarding to identify and manage potential risks and establish contractual requirements for security controls and notification. We also strive to monitor emerging risks associated with those third-party service providers. Assessment of these providers includes completing a standardized questionnaire and conducting risk evaluations for financial, reputational, information security, cybersecurity, and business resiliency risks.


text: Impact of Cybersecurity Risks and Threats While some of the Company's third-party service providers have experienced cybersecurity incidents and the Company has experienced threats to its data and systems, as of the date of this report, the Company's management is not aware of any cybersecurity threats or incidents that have materially affected its business strategy, results of operations, or financial condition. While we remain vigilant, there can be no guarantee that we will not be the subject of future threats or incidents. Additional information on cybersecurity risks we face can be found in "Item 1A. Risk Factors—Risks Relating to Our Business and Operations—We are increasingly dependent on information technology, and our business and reputation could suffer if we are unable to protect our information technology systems against, or effectively respond to, cyberattacks, other cyber-incidents or security breaches or if our information technology systems are otherwise disrupted," which should be read in conjunction with the foregoing information.


text: Board of Directors and Audit Committee Our Board of Directors has delegated oversight of the Company's ERM program, including cybersecurity, to the Audit Committee. The Audit Committee receives updates from our Senior Vice President, Information Technology ("SVPIT") and members of our Information Technology Security Services Department regarding our enterprise-wide cybersecurity programs at least on a quarterly basis. These updates may address data management and security initiatives, significant existing and emerging cybersecurity risks, and any material cybersecurity incidents and their impact on the Company and its stakeholders.


text: Key also has a Privacy Team led by a Chief Privacy Officer (CPO) who has over ten years of experience in legal, compliance, and risk roles at financial institutions, focusing primarily on data protection and privacy. Our CPO holds an undergraduate degree in finance, a master's degree in business administration, and a juris doctorate. He is licensed to practice law in the state of Ohio and has obtained the CIPP/US certification through the International Association of Privacy Professionals. The CPO and Privacy team have the authority to escalate privacy risks to the Board. The Privacy and Information Security teams work together to implement controls around how personally identifiable information is managed and protected and to comply with applicable laws and regulations.


text: The Company's management is responsible for identifying, assessing, and managing the Company's exposure to cybersecurity risk. The Company has an internal team that is supported by security technologies, third-party experts, and threat intelligence resources in support of cybersecurity risk reduction. Our SVPIT oversees the team responsible for leading the enterprise-wide information technology strategy, policy, standards, architecture, and processes. This team includes our Information Technology Security Services Department and incorporates input from personnel from different functions, levels, and operating regions to support a high level of visibility and accountability throughout the company and to incorporate multiple vantage points on risks and potential mitigations. Our cybersecurity team also includes our Cybersecurity Operations Center, which is comprised of cybersecurity professionals and is responsible for the detection, analysis, and response to cybersecurity events, including threats and incidents, and is overseen by the Director of Cybersecurity Operations. Our Information Technology Security Services Department is responsible for overseeing the execution of cybersecurity strategy and maturing the Company's cybersecurity posture. Our SVPIT has over 20 years of experience in the IT industry, including change management, cybersecurity, and enterprise architecture. The Information Technology Security Services Department has extensive experience in cybersecurity, including graduate degrees in information security and Certified Information Security Systems Professional certifications.


text: Risk Management and Strategy IT systems and networks are important to our business operations, and we are committed to protecting the privacy, security, and integrity of our data, inclusive of our employee and customer data. We have a comprehensive cybersecurity program in place that is responsible for identifying, preventing, and mitigating data security risks. This program is aligned with the Company's overall Enterprise Risk Management process.


text: We actively monitor and update our IT systems and infrastructure to prevent unauthorized access, viruses, phishing, and other security risks. Our cybersecurity program follows the National Institute of Standards and Technology ("NIST") Cybersecurity Framework standards.


text: Our security technology tools and processes provide protection against security breaches and reduce cybersecurity risks. Our cybersecurity incident response plan includes procedures for identifying, containing, and responding to incidents. While we continue to invest in our program and capabilities, we cannot guarantee prevention of all incidents.


text: We depend on IT systems, third-party service providers, and strategic partners to facilitate our business operations. This includes secure handling of personal, confidential, financial, sensitive, proprietary, and other forms of information, as well as enabling our service offerings. Despite continuous efforts to enhance both our and our partners' cybersecurity defenses, we cannot guarantee the protection of all information systems, products, and service technologies.


text: While we face regular cybersecurity threats, including ransomware and data breaches, we have not encountered significant incidents during the year ended April 30, 2024. We believe our security measures are adequate, but we acknowledge the rising sophistication of threats. Despite vigilance, system disruptions or unauthorized disclosures remain possible.


text: Governance and Oversight The Board actively supports strategy and oversees risk management, drawing on a diverse range of experiences, skills, qualifications, and backgrounds. This includes oversight of cybersecurity matters. The Audit Committee, composed entirely of independent Board members, receives quarterly updates on the cybersecurity program, which includes recent developments, program improvements, risk analysis, and an annual update on the Company's scenario-based cybersecurity exercise. The Audit Committee also receives periodic updates as may be needed, including any cybersecurity events that would require notification to the Audit Committee. The Audit Committee provides quarterly updates to the Board on key cybersecurity activities, and cybersecurity is also reviewed at least annually with the Board. In addition, two of our Audit Committee members, including the Chair, hold a CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors.


text: We actively educate our employees about potential cybersecurity threats and actions. Our executive officers and global workforce receive ongoing trainings in response to cyber threats and cybersecurity incidents. We mandate annual completion of our information security training and compliance program, which includes reviewing and acknowledging the Company's information security policy. All employees also participate in regular security awareness training, which includes data protection principles, general end-user security hygiene, and internal phishing simulations. Additional annual training covers information security topics related to our Code of Conduct and Records Management Policies.