text: Through these processes, we did not identify risks from current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For more information about these risks, please see the "Risk Factors" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Our Board and our Board Committees are actively engaged in the oversight of our information security program. Before the establishment of our Risk Oversight Committee, our Audit Committee assisted our Board of Directors with its oversight of risks associated with Etsy's technology and information security policies and practices, the internal controls relating to information security, and the steps taken by management to identify, monitor, and control any risk exposures. In December 2023, our Board approved the formation of a Risk Oversight Committee to assist the Board with its oversight of Etsy's management of risk exposures, including oversight of technology and information security related risks (which responsibility will move from the Audit Committee to the Risk Oversight Committee), as well as oversight of management's processes for effectively monitoring and mitigating risk.

companyName: ETSY INC

ticker: ETSY

secItem: Item 1C

stage1Category: Board Governance

stage1Method: unanimous


text: Our management has general responsibility for day-to-day implementation of our information technology, cybersecurity, and privacy strategies and policies, including deployment and use of security tools, applications, and annual employee training. Role or project specific employee training, as well as other training, may occur more frequently than annually, as needed. Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Technology Officer ("CTO"), who is assisted by our Chief Information Security Officer ("CISO"). Our CISO, CTO, and our Risk Steering Committee are informed about and oversee the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

stage1Category: Management Role


text: Our CTO holds a Bachelor's degree from RV College of Engineering in Bengaluru, India and a Master of Public Administration from Columbia University. Our CTO has been recognized as one of the Top 50 Women in Tech by the National Diversity Council and has received the Digital Diversity Network's Innovation and Inclusion CodeBreakers Award, Innovators & Disrupters Award from New York on Tech and Future CIO Award at Women in IT Awards. Our CISO has nearly twenty years of experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, and secure architecture and design, as well as several relevant degrees and certifications, including a Bachelors of Science in Computer Engineering from the University of Denver, and IAPP Certified Information Privacy Technologist ("CIPT"). Our CISO held previous certifications include ISC2 Certified Information Systems Security Professional ("CISSP"), EC-Council Certified Chief Information Security Officer ("C|CISO"), and ISACA Certified Data Privacy Solutions Engineer ("CDPSE").

stage1Method: majority


text: Given the importance of information security to our stakeholders, our Board or the committee of our Board of Directors responsible for assisting the Board of Directors with its oversight of cybersecurity risk receives regular reports from our CISO on cybersecurity-related matters, including the status of projects to strengthen our security systems and to improve our cyber threat readiness, as well as on the existing and emerging cyber threat landscape and our program for managing these security risks. In addition, our CISO has direct access to the chair of the committee of our Board of Directors overseeing cyber-related risks and is expected to keep that committee apprised of any significant developments that may emerge between scheduled meetings that may require the attention of the Board or relevant committee.


text: Our Board also periodically participates in tabletop exercises conducted by senior management, with the assistance of outside counsel as needed, as part of risk management and disaster-related planning to validate, test, and assess the effectiveness and adequacy of certain roles and decision-making processes in the event of a cyber-incident.


text: Cybersecurity Risk Management and Strategy Etsy recognizes the importance of information security, cyber readiness, and data privacy protections to our business and reputation, which includes assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks; intellectual property risks; harm to employees or members of our buyer and seller communities; violation of privacy or security laws; litigation or other legal risks; and reputational risks.


text: We use processes, technologies, and controls to assist in our efforts to assess, identify, and manage material cybersecurity-related risks. We also employ a range of tools and services, including network monitoring, vulnerability assessments, and tabletop exercises to inform our risk identification and assessment processes. We maintain an incident response plan that outlines the activities we take to respond to, remediate, and resolve any cybersecurity incidents, which include processes designed to triage, assess the severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with relevant legal obligations. Additionally, we conduct cybersecurity awareness and sensitive information protection training for our employees, and we periodically test the effectiveness of our training and policies through simulations, which may include simulated phishing emails and tabletop exercises.

stage1Category: Risk Management Process


text: We apply similar processes, technologies, and controls to manage cybersecurity risks associated with third-party suppliers. In addition, cybersecurity considerations affect the selection and oversight of our third-party suppliers. We perform diligence on critical third-party suppliers that have access to our systems and data and to facilities that house critical third-party systems or data, and we monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require third-parties that we have identified as parties that could introduce significant cybersecurity risk to agree by contract to manage their cybersecurity risks based on accepted industry standards and/or to agree to be subject to cybersecurity audits conducted by our agents, which we conduct as we deem appropriate.

stage1Category: Third-Party Risk


text: We engage third-parties to conduct information security testing, including penetration testing, on our systems including our credit card payments infrastructure. In addition, our information security program is subject to periodic self-assessments that measure the maturity of our program in a manner aligned with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: To identify and assess material risks from cybersecurity threats, using our enterprise risk management framework, we consider cybersecurity risks as part of our overall risk assessment and risk management process. Our information security team serves as a first line of defense, including managing cyber risk strategy execution and owning the day-to-day management of these risks. Our enterprise risk management program serves as a second line of defense, bringing holistic risk oversight and serving as a partner to the business to help first line teams strategically manage risk. Our enterprise risk management function also establishes a risk and governance framework to help identify, prioritize and optimize risk-reward decisions. Certain risks identified by our enterprise risk management function, including cybersecurity risks, are monitored by our Risk Steering Committee, a senior management level committee that includes our Executive Team. The Risk Steering Committee's review of these risks in turn informs the risk management updates provided to the Risk Oversight Committee of our Board of Directors. Additionally, Internal Audit will annually review certain aspects of our cybersecurity program and the related Internal Controls, and our external auditor will test relevant controls around our cybersecurity program and incident reporting. We also do external testing, and in 2024 completed a NIST Cybersecurity Framework audit with Mandiant.


text: Through these processes, we did not identify risks from current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For more information about these risks, please see the "Risk Factors" in this Annual Report.

stage1Category: Strategy Integration


text: Cybersecurity Governance Our Board of Directors and our Risk Oversight Committee are actively engaged in the oversight of our information security program. Our Risk Oversight Committee assists our Board of Directors with its oversight of Etsy's management of risk exposures, including oversight of technology and information security related risks, as well as oversight of management's processes for effectively monitoring and mitigating risk.


text: Our management has general responsibility for day-to-day implementation of our information technology, cybersecurity, and privacy strategies and policies, including deployment and use of security tools, applications, and annual employee training. Role or project specific employee training, as well as other training, may occur more frequently than annually, as needed. Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are typically led by our Chief Technology Officer ("CTO"), who is assisted by our Chief Information Security Officer ("CISO"). Our CISO, CTO, and our Risk Steering Committee are informed about and oversee the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: On December 5, 2024, we announced that our CTO would cease serving as CTO effective December 31, 2024, and that we had initiated a search for her successor. In the interim, two current vice presidents of engineering, one of whom is our CISO, are providing interim leadership of our engineering organization. Our CISO is also primarily responsible for cybersecurity and risk-related matters in his capacity as interim Co-CTO, with assistance from our Senior Director of Information Security. Our CISO has nearly twenty years of experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, and secure architecture and design, as well as several relevant degrees and certifications, including a Bachelors of Science in Computer Engineering from the University of Denver, and IAPP Certified Information Privacy Technologist. Our CISO previously held certifications include ISC2 Certified Information Systems Security Professional, EC-Council Certified Chief Information Security Officer, and ISACA Certified Data Privacy Solutions Engineer.


text: We maintain Information Systems Incident Management Standards that are intended to ensure information security events and weaknesses associated with information systems are communicated and acted on in a timely manner. Our internal controls and procedures address cybersecurity and include processes intended to ensure that security breaches are reported to appropriate personnel and, if warranted, analyzed for potential disclosure. While we have experienced cybersecurity attacks, such attacks to date have not materially affected the Company or our business strategy, results of operations, or financial condition.

companyName: KIORA PHARMACEUTICALS INC

ticker: KPRX


text: Given the importance of information security to our stakeholders, our Risk Oversight Committee receives regular reports from our CISO on cybersecurity-related matters, including the status of projects to strengthen our security systems and to improve our cyber threat readiness, as well as on the existing and emerging cyber threat landscape and our program for managing these security risks. In addition, our CISO has direct access to the chair of our Risk Oversight Committee and is expected to keep that committee apprised of any significant developments that may emerge between scheduled meetings that may require the attention of our Risk Oversight Committee.


text: Our Risk Oversight Committee provides a quarterly report to the Board of Directors on enterprise risk management matters overseen by that Committee, including cybersecurity-related matters. Our Board of Directors also periodically participates in tabletop exercises conducted by senior management, with the assistance of outside counsel as needed, as part of risk management and disaster-related planning to validate, test, and assess the effectiveness and adequacy of certain roles and decision-making processes in the event of a cyber-incident.


text: Our CIO has 19 years of experience in the information technology industry, including engagement with cybersecurity strategy and oversight. Our CIO reports directly to our Chief Executive Officer.

companyName: Owens Corning

ticker: OC


text: Our Vice President, Global Information Security has 27 years of experience in the cybersecurity industry, including previous experience in the U.S. Air Force, consulting, and 21 years with Owens Corning, and reports directly to our CIO.


text: The Company's cybersecurity program is overseen by our CIO, who is responsible for global information technology, including cybersecurity. Our Vice President, Global Information Security, is primarily responsible for assessing and managing material risks from cybersecurity threats, including monitoring the measures used for prevention, detection, mitigation and remediation of cybersecurity incidents. Our CIO is responsible for our information security organization, which is comprised of internal Owens Corning employees and external security suppliers. Our information security organization provides security monitoring and response and provides regular reports to our CIO and Vice President, Global Information Security. These regular reports inform our CIO and Vice President, Global Information Security as they monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents under the oversight of the risk committee. Our Global Information Services team is regularly engaged in cybersecurity training and awareness and incorporates relevant reviews in technology design and development.


text: Our CIO has 20 years of experience in the information technology industry, including engagement with cybersecurity strategy and oversight. Our CIO reports directly to our Chief Executive Officer.


text: Our Vice President, Global Information Security has 28 years of experience in the cybersecurity industry, including previous experience in the U.S. Air Force, consulting, and 22 years with Owens Corning, and reports directly to our CIO.


text: As part of its oversight of our company, our board of directors is involved in overseeing our risk management program. Cybersecurity is an important component of overall enterprise risk management ("ERM"). Our cybersecurity processes are fully integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and industry standards and regulations, including the NYDFS Cybersecurity Regulation and PCI DSS. We address cybersecurity risks through an approach that focuses on preserving the confidentiality, integrity, and availability of our assets, including the information we collect and store, by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents as they occur.

companyName: TRUPANION, INC.

ticker: TRUP


text: Risk Management and Strategy Our cybersecurity risk management program focuses on the following key areas: • Technical Safeguards. We utilize technical safeguards that are designed to protect our assets from cybersecurity threats. These safeguards include firewalls, intrusion prevention and detection systems, Managed Detection and Response, antimalware and access controls solutions, which we evaluate and improve through security assessments and threat intelligence. • Incident Response and Recovery Planning. We have established and maintained incident response and recovery plans that address how we respond to cybersecurity incidents, and we test and evaluate these plans on a regular basis. • Third-Party Risk Management. We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including software and services vendors, Territory Partners and other external users of our systems and those of third parties that could adversely impact our business in the event of a cybersecurity incident. • Education. We provide regular, mandatory training for all team members regarding general security concepts, cybersecurity, and physical threats. The training is designed to equip team members to identify and properly respond to a variety of cybersecurity threats and risks, as well as to communicate our processes. • Governance. We maintain a management Risk Committee that assists with our ERM function. We also utilize a virtual Chief Information Security Officer ("vCISO") and other members of senior management and our IT team to support our risk management program. Our board of directors receives regular reports regarding our ERM function to support its oversight responsibilities, and we ensure our business units receive appropriate updates that may impact operations. • Collaboration. Our processes are designed to identify, prevent, and mitigate cybersecurity threats and incidents and provide for prompt escalation when appropriate. This approach is cross-functional, drawing on the skills and experiences of our diverse team, and it is designed to allow management to make timely decisions regarding public disclosure and business matters.


text: We periodically assess and test our cybersecurity processes. These efforts include a wide range of activities, such as audits, assessments, tabletop exercises, threat modeling and vulnerability testing focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage independent third parties to assess our cybersecurity measures, including audits and reviews of our information security control environment and operating effectiveness. The results of such assessments are reported to management's Risk Committee and to our board of directors. We adjust our cybersecurity documentation, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: Our board of directors, in coordination with our internal Risk Committee, oversees our ERM function, including the management of risks arising from cybersecurity threats. Our board of directors receives regular updates on cybersecurity matters from management's Risk Committee and from the Information Security Committee, which is comprised of Information Technology and Security leadership and oversees operational aspects of our cybersecurity program. Those updates to our board of directors address a wide range of topics that may include information on recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, and information security considerations with respect to our partners and third parties. Our board of directors and management's Risk Committee also receive prompt information regarding any cybersecurity incident that meets established reporting thresholds and ongoing updates on any such incident until it has been addressed. Our Information Security Committee and vCISO annually report on the status of our cybersecurity program and meet with our board of directors to discuss our approach to cybersecurity and risk management.


text: Our Information Security Committee and vCISO, in coordination with management's Risk Committee, work collaboratively to implement a program designed to protect our assets from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, we deploy multidisciplinary teams to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, our Information Security Committee monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management's Risk Committee when appropriate.


text: Our vCISO has served in various information technology, security, and privacy roles for over 25 years, including as the Chief Information Security Officer for several large public companies. Our vCISO holds undergraduate and graduate degrees in business administration and law, including specialties in information systems management and legal risk and compliance. Additionally, he has attained professional certifications in information security, auditing and assessment, and threat intelligence.


text: Cybersecurity threats, including those related to previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect us, our business strategy, operations, or financial condition.


text: Cybersecurity Risk Management and Strategy We maintain a data protection and cybersecurity risk management program to assess, identify and manage cybersecurity risks. We also maintain an incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents. In the event of an incident, we intend to follow our incident response plan, which provides a step-by-step framework to follow from incident detection to mitigation, recovery and notification, including notifying senior leadership and the Board of Directors, as appropriate. As part of our risk management program, we regularly conduct vulnerability assessments, as well as internal user training and tabletop exercises. We also conduct self and third-party assessments of our cybersecurity risk management program to evaluate effectiveness and alignment with industry standards and best practices. As part of the above approach and processes, we periodically engage with assessors, consultants, auditors, and other third-parties, for purposes of evaluating our cybersecurity posture and identifying areas for continued focus, improvement and/or compliance.

companyName: HIGHWATER ETHANOL LLC


text: Our Company's business strategy, results of operations and financial condition have not been materially affected, and we believe that they are not reasonably likely to be materially affected, by risks from cybersecurity threats, but we cannot provide assurance that the Company will not be materially affected in the future by such risks or any future material incidents. For more information about the cybersecurity risks we face, see "ITEM 1A - Risk Factors."


text: Cybersecurity Governance Our cybersecurity program addresses potential risks and implements processes to support our cybersecurity program and respond to potential cyber incidents. Our cybersecurity program is managed by our senior management with support from third-party providers that provide relevant expertise, certifications and skills in cybersecurity. Quarterly risk assessments are performed and incorporated as part of our overall risk management process, which is overseen by our Board of Directors. Our third-party providers provide regular data protection and cybersecurity reports to our senior management who then reports to the Audit Committee and the Board of Directors on a regular basis. These reports include updates on cybersecurity initiatives, cybersecurity metrics and threat landscape.


text: Our IT and related systems are critical to the efficient operation of our business and essential to our ability to perform day to day processes. We face persistent security threats, including threats to our IT infrastructure and unlawful attempts to gain access to our confidential or otherwise proprietary information, or that of our employees, via phishing/malware campaigns and other cyberattack methods.

stage1Category: None/Other


text: Our security policies and processes are based on industry best practices and are revisited regularly to ensure their appropriateness based on risk, threats and current technological capabilities. We regularly assess our threat landscape and monitor our systems and other technical security controls, maintain information security policies and procedures, including a breach response plan, ensure maintenance of backup and protective systems, and engage with a Managed Service Provider who has a team of security personnel managing our efforts and initiatives. We review System and Organization Controls 1 (SOC 1 Type II) certifications where relevant from key third party partners and other service providers with access to information assets at least annually.


text: From an operational perspective, we use vulnerability scanning tools to assess potential data security risks. We correlate the results and prioritize any key actions based on threat modeling analysis and monitor any such actions in-progress with the system owners based on assigned timelines for remediation. However, patch and vulnerability management, including for products and information assets, remains a complex and key risk that can lead to exploits, security breaches and service disruption. In addition, our online employees are required to participate in cyber, information security, and privacy training at least annually. We also maintain insurance coverage that is intended to address certain aspects of cybersecurity risks. To date, there have not been any cybersecurity threats that have materially affected the Company.


text: Board Oversight of Cybersecurity Matters Assessing and managing information security matters is the responsibility of our full Board of Directors. The Board meets with the senior executives, specifically the Chief Development Officer, Chief Executive Officer, and Executive Vice President of Finance on at least an annual basis to discuss cybersecurity posture. The Board also periodically receives targeted briefings related to cybersecurity and reviews our incident response capabilities.


text: Management of Cybersecurity Risks The senior executives work to protect our information systems from cybersecurity threats and to promptly assist in coordinating a response to any cybersecurity incidents in accordance with our cybersecurity incident response and recovery plans. We have engaged an IT Managed Service Provider who assists in the oversight of our corporate-wide data security, including developing, implementing and enforcing security policies to manage our overall cybersecurity risks. The senior executives regularly meet with our IT Managed Service Provider during the course of the year to review and discuss cybersecurity issues.


text: Our Security Culture We protect our information assets and manage risk by promoting a culture that communicates security risks, designs secure IT systems and operates according to approved processes to reduce the likelihood and impact of security incidents. We achieve this objective by: • Designing, implementing and maintaining solutions with appropriate security controls; • Sustaining solutions with required patching and vulnerability remediation; • Creating and executing controls in support of policy as well as regulatory compliance; • Ensuring that our policies, processes, practices and technologies proactively protect, shield, defend and remediate cyber threats; and • Delivering quality communications and annual training to stakeholders on cyber awareness and computing hygiene.


text: We believe that the conduct of our employees is critical to the success of our information security. We keep our employees apprised of threats, risks and the part that they play in protecting both themselves and the company. We conduct periodic compliance training for our employees regarding the protection of sensitive information, which includes training intended to prevent the success of cyberattacks. We also conduct regular phishing simulations to increase employee awareness on how to spot phishing attempts, and what to do if they suspect an email to be a phishing attack.


text: We execute penetration testing against our technical environment and processes, and continuously monitor our network and systems for signs of intrusion. We also retain consultants to enhance our penetration testing program with current trends and methodologies utilized against other companies, ensuring we are proactively reducing risk from emerging threats.


text: We assess our service providers prior to allowing our information to be processed, stored or transmitted by third parties, and we include standardized contractual requirements in each contract where appropriate. We validate our service providers' security via questionnaires, open-source intelligence and, where appropriate, SOC 1 Type II reports on financially significant third-party service providers. Our process also includes regular monitoring of risk related to third parties on a periodic basis or when services or product purchases expand beyond their original scope or intended use.


text: Training and testing for all employees on cybersecurity risks, mitigation, and best practices. New employees are required to complete cybersecurity training and testing, and all employees must complete annual training and testing. Written policies and procedures that govern the use of information technology and the handling of sensitive information. Written incident response plans. Regular cybersecurity reporting to the Audit Committee.

companyName: NVE CORP /NEW/

ticker: NVEC


text: From an operational perspective, we use vulnerability scanning tools to assess potential data security risks. We correlate the results and prioritize any key actions based on threat modeling analysis and monitor any such actions in-progress with the system owners based on assigned timelines for remediation. However, patch and vulnerability management, including for products and information assets, remains a complex and key risk that can lead to exploits, security breaches and service disruption. In addition, our online employees are required to participate in cyber, information security, and privacy training at least annually. We also maintain insurance coverage that is intended to address certain aspects of cybersecurity risks. To date, there have not been any known cybersecurity threats that have materially affected the Company.


text: Board Oversight of Cybersecurity Matters Assessing and managing information security matters is the responsibility of our Board of Directors. The Board of Directors' Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The Board meets with the senior executives, specifically the Chief Executive Officer, and Chief Financial Officer on at least an annual basis to discuss cybersecurity posture. The Board also periodically receives targeted briefings related to cybersecurity and reviews our incident response capabilities. The Audit Committee receives regular reports from management concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Management of Cybersecurity Risks The senior executives work to protect our information systems from cybersecurity threats and to promptly assist in coordinating a response to any cybersecurity incidents in accordance with our cybersecurity incident response and recovery plans. Our Chief Executive Officer is responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our Chief Financial Officer is responsible for preparing budgets, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Both executives have experience overseeing the information technology function and implementing and overseeing internal controls frameworks in our industry. We have engaged an IT Managed Service Provider who assists in the oversight of our corporate-wide data security, including developing, implementing and enforcing security policies to manage our overall cybersecurity risks. The senior executives regularly meet with our IT Managed Service Provider during the course of the year to review and discuss cybersecurity issues.


text: The Audit Committee ("Audit Committee") of the Company's Board of Directors (the "Board") is actively involved in oversight of the Company's risk management program, and cybersecurity represents an integral component of the Company's overall approach to enterprise risk management ("ERM"). A cybersecurity threat is any potential unauthorized occurrence, on or conducted through, the Company's information systems that may result in adverse effects on the confidentiality, integrity or availability of the Company's information systems or any information residing therein. The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the Center for Internet Security Cybersecurity Framework. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Green Brick Partners, Inc.

ticker: GRBK


text: Cybersecurity risk management and strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the disclosure and reporting of such material incidents may be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems. • Outside Consultants: The Company engages various outside consultants, including contractors, auditors, and other third parties, to among other things: monitor Company networks, servers and endpoints to identify vulnerabilities;


text: conduct bi-weekly email phishing campaigns for Company employees to evaluate employee responses to such campaigns, identify vulnerabilities and advise on possible attack preparedness and responses;


text: obtain information of a cybersecurity incident and isolate compromised systems and electronic data from further exposure; and determine and execute mitigation and remediation options and plans.


text: • Education and Awareness: The Company provides annual, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. If an employee fails a bi-weekly phishing campaign they are re-enrolled in the Company's cybersecurity awareness training.


text: The Company conducts periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including annual penetration testing, adoption of an incident response plan, employee email phishing campaigns, email security monitoring, real-time vulnerability scanning and intrusion detection, employee cyber security awareness program, real-time (offsite) backups of production systems, regular audits and progress reports, and continuous improvement of the information security management system. The Company engages third parties, which it believes is the top of the market, to perform assessments on the Company's cybersecurity measures, including audits and independent reviews of the Company's information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: As discussed above, the Board has delegated to the Audit Committee the responsibility for monitoring and overseeing the Company's cybersecurity and other information technology risks, controls, strategies and procedures. The Audit Committee periodically evaluates the Company's information security strategies to ensure its effectiveness and, if appropriate, may also include a review from third-party experts. The Company's Vice President of IT reports to the Audit Committee as part of every regularly scheduled quarterly meeting of the Audit Committee (or more frequently, as needed) regarding technological risk exposure and cybersecurity risk management strategy. In addition, the full Board may review and assess cybersecurity risks as part of its responsibilities for oversight of the Company's broad ERM program.


text: The Company's Vice President of IT, Randall Anderson, in coordination with the Company's Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), and General Counsel ("GC"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. The Company maintains a cyber incident response plan to timely, consistently, and compliantly address cybersecurity threats that may occur despite the Company's safeguards. The response plan covers preparation, detection and analysis, containment and investigation, notification (which may include timely notice to the Board if deemed material or appropriate), eradication and recovery, and incident closure and post-incident analysis. The Company retains a third-party cyber security firm to leverage in the event of a cyber security incident. The Company's response planning is reviewed annually and kept up to date with industry developments. The scope of this plan is enterprise-wide and includes the Company's business units and subsidiaries. Through ongoing communications with management, the Company's Vice President of IT monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.


text: As discussed above, the Board has delegated to the Audit Committee the responsibility for monitoring and overseeing the Company's cybersecurity and other information technology risks, controls, strategies and procedures. The Audit Committee periodically evaluates the Company's information security strategies to ensure its effectiveness and, if appropriate, may also include a review from third-party experts. The Company's Vice President of IT, Randall Anderson, reports to the Audit Committee as part of every regularly scheduled quarterly meeting of the Audit Committee (or more frequently, as needed) regarding technological risk exposure and cybersecurity risk management strategy. In addition, the full Board may review and assess cybersecurity risks as part of its responsibilities for oversight of the Company's broad ERM program.


text: Management's Expertise Mr. Anderson holds a bachelor's degree in business administration with a focus on supply chain management and operations engineering from the University of Texas at Austin. He has served in various roles in information technology and information security for over 10 years, including as an IT business analyst with another publicly traded homebuilder where he was responsible for maintaining production data structures and system trainings. Mr. Anderson currently serves as a CyberUSA advisory board member where he regularly attends seminars given by cyber industry experts, including certain governmental agencies. Mr. Anderson is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. Staying informed on developments in the cyber industry is crucial to the Company's effective prevention, detection, mitigation and remediation of any cybersecurity incidents. In addition, the Company's CEO, CFO and GC each hold undergraduate and graduate degrees in their respective fields, and each have over 20 years of experience managing risks at the Company or at similar companies, including risks arising from cybersecurity threats.


text: Risks from Cybersecurity Threats Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: The Audit Committee ("Audit Committee") of the Company's Board of Directors (the "Board") is actively involved in oversight of the Company's risk management program, and cybersecurity represents an integral component of the Company's overall approach to enterprise risk management ("ERM"). A cybersecurity threat is any potential unauthorized occurrence or a series of related unauthorized occurrences, on or conducted through, the Company's information systems that may result in adverse effects on the confidentiality, integrity or availability of the Company's information systems or any information residing therein. The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the Center for Internet Security Cybersecurity Framework. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: conduct regular email phishing campaigns for Company employees to evaluate employee responses to such campaigns, identify vulnerabilities and advise on possible attack preparedness and responses;


text: Technical Safeguards We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.

companyName: ServiceNow, Inc.

ticker: NOW


text: The Company's Vice President of IT in coordination with the Company's Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), and General Counsel ("GC"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. The Company maintains insurance coverage for potential breaches and a cyber incident response plan to timely, consistently, and compliantly address cybersecurity threats that may occur despite the Company's safeguards. The response plan covers preparation, detection and analysis, containment and investigation, notification (which may include timely notice to the Board if deemed material or appropriate), eradication and recovery, and incident closure and post-incident analysis. The Company retains a third-party cyber security firm to leverage in the event of a cyber security incident. The Company's response planning is reviewed annually and kept up to date with industry developments. The scope of this plan is enterprise-wide and includes the Company's business units and subsidiaries. Through ongoing communications with management, the Company's Vice President of IT monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.


text: Risks from Cybersecurity Threats Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected nor are they reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: We take a comprehensive approach to cybersecurity risk management. While securing the data customers and other stakeholders entrust to us is a top priority, we, like all companies, are subject to threats of breaches of our cybersecurity programs. Our board of directors (the "Board") and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments in our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective as cyber criminals are becoming more sophisticated and effective every day and increasingly targeting enterprise software companies. Although our Risk Factors include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.


text: Risk Management and Strategy Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards. Our cybersecurity program in particular focuses on the following key areas: Collaboration


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.


text: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, Audit Committee and members of management.


text: Third-Party Risk Management We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Education and Awareness Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees of the importance of handling and protecting customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: External Assessments Our cybersecurity policies, standards, processes and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. For example, in 2022, 2023 and 2024 we conducted independent cyber maturity assessments to review our controls against the NIST Cybersecurity Framework. The results of significant assessments are reported to management, the Board and Audit Committee. Cybersecurity processes are adjusted, as appropriate, based on the information provided from these assessments. We have also obtained industry certifications and attestations that demonstrate our dedication to protecting the data our customers entrust to us.


text: Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk. They receive regular reports from management about the prevention, detection, mitigation, and remediation of material information security risks, including cybersecurity incidents and vulnerabilities. Our Audit Committee is responsible for overseeing our cybersecurity program. The Audit Committee receives regular updates from management on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, third-party compliance certifications, control maturity assessments, and relevant ServiceNow, customer and industry cybersecurity incidents.


text: Management's Role The following individuals have primary responsibility for assessing and managing cybersecurity risks: • Chief customer officer ("CCO"), who oversees the digital transformation, digital technology and security functions • Chief digital information officer ("CDIO"), who oversees enterprise-wide digital transformation • Chief information security officer ("CISO"), who oversees the security function and reports to the CCO • Chief technology officer ("CTO"), who oversees product engineering and advanced technologies • General Counsel, who oversees the legal and compliance functions These individuals, among others, also serve as members of management's Security Steering Committee (the "Security Committee"), which is a governing body that drives alignment on security decisions across the Company. The Security Committee meets quarterly to review security performance metrics, identify security risks, and assess the status of approved security enhancements. The Security Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation strategies.


text: Our CCO has served in various roles in information technology and information security for over 20 years, including serving as our Chief Information Officer ("CIO") and either the Chief Technology Officer or CIO of three other public companies. He holds an undergraduate degree in computer engineering. Our CDIO has served in various roles in information technology for over 20 years, including serving as our Senior Vice President of Digital Technology Experience and in similar senior roles at two other public companies. Our CISO has served in various roles in information technology and information security for almost 20 years, including serving as the Chief Information Security Officer or Chief Security Officer at two other large public companies. He holds an undergraduate and master's degree in computer science. Our CTO has served in various roles in information technology for over 25 years and has been with us since 2011. Our General Counsel has over 20 years of experience managing risks, including risks arising from cybersecurity threats, at several large public technology companies.


text: Risk Management and Strategy We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address risks from cybersecurity threats. Our information security management program seeks to follow processes set forth in recognized industry standards, and we evaluate and evolve our security measures as appropriate. We maintain a cybersecurity incident response plan that we periodically practice and update as needed. The identification, assessment and management of cybersecurity risk is integrated into our overall enterprise risk management program that is ultimately overseen by the Board.

companyName: Super Micro Computer, Inc.

ticker: SMCI


text: We consult with external parties, such as third-party cybersecurity firms, to provide, among other things, monitoring of systems, threat intelligence, and employee cybersecurity training. We also use third parties to assist our risk management processes by conducting security assessments.


text: We have a vendor risk assessment process to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. These processes consist of the distribution and review of questionnaires designed to identify cybersecurity risks associated with the engagement of third parties. We also periodically audit cybersecurity practices of certain third-party service providers.


text: As part of its broader risk oversight activities, our Board maintains oversight of cybersecurity matters, including managing and assessing risks from cybersecurity threats. The Audit Committee also reviews the adequacy and effectiveness of our information security policies and practices and the internal controls regarding information security risks. The Audit Committee receives updates relating to cybersecurity risk from management, including from our Director of Information Security. The Board also periodically receives reports on risks from cybersecurity threats from our Director of Information Security.


text: Cybersecurity risk is primarily managed by our Directors of Information Security and Information Technology. These individuals have decades of experience in managing cybersecurity risk for public companies. Additionally, we have established a cross-functional Cybersecurity Committee, consisting of executive-level leadership, including representatives from the Finance, Marketing, IT, Legal, Internal Audit, and other teams, that meets periodically to review cybersecurity risks, incidents, and assess emerging threats. The Committee is also informed of our responses to such risks, incidents and threats.


text: Our cybersecurity incident response plan also contains mechanisms to notify executive management of cybersecurity incidents. As part of the plan, an executive-level leadership team may be activated and can act to direct our response efforts, to include mitigation and remediation activities, when appropriate.


text: Risk Management and Strategy We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address risks from cybersecurity threats. This includes processes for assessing, identifying, and managing material risks from cybersecurity threats. Our information security management program seeks to follow processes set forth in recognized industry standards, and we evaluate and evolve our security measures as appropriate. We maintain a cybersecurity incident response plan that we practice and update as needed. The identification, assessment and management of cybersecurity risk is integrated into our overall enterprise risk management program that is ultimately overseen by the Board.


text: We also have a vendor risk assessment process to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. These processes consist of the distribution and review of questionnaires designed to identify cybersecurity risks associated with the engagement of third parties. We also audit cybersecurity practices of certain third-party service providers, and take steps designed to ensure that such vendors have implemented data privacy and security controls that help mitigate the cybersecurity risks associated with these vendors, depending on the nature and sensitivity of the supplier and data it processes on our behalf. We routinely assess our high-risk suppliers' conformance to industry standards and evaluate them for additional information, product, and physical security requirements.


text: We employ a number of protective measures, including firewalls, endpoint detection and response technologies, regular annual training of employees with respect to cybersecurity and testing employee competence with anti-phishing policies followed up by additional remedial training as needed.


text: While there have been cyber incidents in the past, none of these incidents, individually or in aggregate, had a material adverse effect on our business strategy, operations, or financial conditions. Refer to "Risk Factors" in Item 1A of this Form 10-K for additional information about cybersecurity-related risks.


text: As part of its broader risk oversight activities, our Board maintains oversight of cybersecurity matters, including managing and assessing risks from cybersecurity threats. The Audit Committee also reviews the adequacy and effectiveness of our information security policies and practices and the internal controls regarding information security risks. The Audit Committee and the Board receive regular information security updates relating to cybersecurity risk from management, including from our Director of Information Security.


text: Cybersecurity risk is primarily managed by our Directors of Information Security and Information Technology. These individuals have decades of experience in managing cybersecurity risk for public companies. Additionally, we have established a cross-functional Cybersecurity Committee, consisting of executive-level leadership, including representatives from Finance, IT, Legal, and other teams, that meets periodically to review cybersecurity risks, incidents, and assess emerging threats. The Cybersecurity Committee is also informed of our responses to such risks, incidents and threats.


text: The Company has implemented processes to assess, identify and manage material risks resulting from cybersecurity incidents. Our Cybersecurity program and processes are based upon the International Standards Organization ("ISO") guidance on information security. The Company's processes used to identify, assess, and mitigate cybersecurity risks are integrated into the Company's broader risk management system and processes, including through the risk management activities of the Board and its Audit Committee, our Enterprise Risk Management Committee ("ERM Committee"), and our internal audit and information technology functions.

companyName: CVR ENERGY INC

ticker: CVI


text: Board Oversight of Cybersecurity Matters The Company's board of directors (the "Board") considers oversight of CVR Energy's risks and risk management activities, including those related to cybersecurity risk, to be a responsibility of the entire Board. The Board also delegates certain risk oversight responsibilities to certain of its committees, and oversight of the Company's cybersecurity risk is delegated by the Board to its Audit Committee. The Audit Committee receives regular reports, typically on a quarterly basis, from management regarding information technology, cybersecurity risk, and efforts to prevent and mitigate such risks. The Chairperson of the Audit Committee subsequently reports on the Company's cybersecurity risk, monitoring, and mitigation activities to the full Board, which equips the Board and its committees to fulfill their risk oversight role.


text: The Board and Audit Committee are supported in their oversight capacity by the Company's ERM Committee, and internal audit and information technology functions. On a quarterly basis, the ERM Committee evaluates past, existing, and future risks to the Company; the likelihood, severity, and velocity of such risks; and the controls and mitigation tools implemented to address such risk. Several members of the ERM Committee have functional responsibility for the Company's information technology and cybersecurity risk monitoring activities and provide expertise to the ERM Committee in those areas.


text: Likewise, the Company's internal audit function periodically performs audit engagements focused on information technology processes and cybersecurity risks. These audits have provided the Company with assessments of the effectiveness and efficiency of our information technology and cyber threat management processes with the goal of safeguarding Company assets and information.


text: Management of Cybersecurity Matters At the management level, the Company's cybersecurity risk management activities are integrated into the day-to-day activities of the Company's information technology function led by our Chief Information Officer, who operates under the supervision of our Chief Financial Officer. The Company's information technology function has a dedicated cybersecurity team comprised of employees with, on average, nearly 20 years of experience and expertise in cybersecurity, and includes individuals with degrees in Computer Studies and cybersecurity-related certifications including Certified Information Systems Security Specialist (CISSP), Certified in Risk and Information Systems Controls (CRISC), and Certified Information Security Manager (CISM).


text: Management utilizes certain tools and controls to detect, monitor, prevent, mitigate, and remediate cybersecurity threats to our systems, networks, applications, and data. Management also conducts annual cybersecurity training and periodic phishing tests, which provide contemporaneous feedback and instruction to our employees and strengthen the Company's defenses against cyber threats. Lastly, management maintains information security incident response processes to guide response and mitigate impact in the event of a cybersecurity incident. A third-party cybersecurity service provider is on retainer to assist the Company should a cybersecurity incident occur.


text: Engagement of Third Parties The ERM Committee, internal audit function, information technology function and various other groups each occasionally engage third-party service providers to assist in their management of cybersecurity risk, including but not limited to cybersecurity vendors, assessors, consultants, auditors, and other third parties. The information technology function maintains processes to oversee and identify cyber risks associated with the Company's use of third-party service providers who may have access to sensitive Company data and systems.


text: Material Impact on Company During 2023, the Company did not experience any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: The Company has implemented processes to assess, identify and manage material risks resulting from cybersecurity incidents. Our Cybersecurity program and processes are based upon the International Standards Organization ("ISO") guidance on information security. The Company's processes used to identify, assess, and mitigate cybersecurity risks are integrated into the Company's broader risk management system and processes, including through the risk management activities of the Board and its Audit Committee, our Enterprise Risk Management Committee ("ERM Committee"), and our internal audit and information technology functions. Refer to Part I, Item 1A, "Risk Factors—We are subject to cybersecurity risks and may experience cyber incidents resulting in disruption or harm to our businesses" of this Report for further discussion of our processes for managing cybersecurity risks.


text: As previously disclosed, in June 2020, we were the subject of a ransomware attack on our network that briefly disrupted access to some of our systems. Although we did not pay the ransomware and did not incur any fines or settlements, we did incur out of pocket expenses costs related to this incident of $100,000. We have not encountered any other cybersecurity challenges that have materially impaired our operations or business.

companyName: CarParts.com, Inc.

ticker: PRTS


text: Board Oversight of Cybersecurity Matters The Board considers oversight of CVR Energy's risks and risk management activities, including those related to cybersecurity risk, to be a responsibility of the entire Board. The Board also delegates certain risk oversight responsibilities to certain of its committees, and oversight of the Company's cybersecurity risk is delegated by the Board to its Audit Committee. The Audit Committee receives regular reports, typically on a quarterly basis, from management regarding information technology, cybersecurity risk, AI use and governance, and efforts to prevent and mitigate such risks. The Chairperson of the Audit Committee subsequently reports on these activities to the full Board, which equips the Board and its committees to fulfill their risk oversight role.


text: Management of Cybersecurity Matters At the management level, the Company's cybersecurity risk management activities are led by our Chief Executive Officer and his executive team and is integrated into the day-to-day activities of the Company's information technology function led by our Chief Information Officer, who operates under the supervision of our Chief Financial Officer, and reports regularly to the Audit Committee on cybersecurity risks, typically on a quarterly basis. The Company's information technology function has a dedicated cybersecurity team comprised of employees with, on average, nearly 20 years of experience and expertise in cybersecurity, and includes individuals with degrees in Computer Studies and cybersecurity-related certifications including Certified Information Systems Security Specialist (CISSP), Certified in Risk and Information Systems Controls (CRISC), and Certified Information Security Manager (CISM).


text: Management utilizes certain tools and controls to detect, monitor, prevent, mitigate, and remediate cybersecurity threats to our systems, networks, applications, and data. Management also conducts annual cybersecurity training and periodic phishing tests, which provide contemporaneous feedback and instruction to our employees and seek to strengthen the Company's defenses against cyber threats. Management also monitors AI usage and has implemented a framework that tracks use and is governed by CVR Energy's Artificial Intelligence Policy, which was most recently updated in 2024, and includes a review and approval process for adopting use of AI tools. Such governance activities are designed to mitigate the risks presented by AI. Management also monitors AI usage and has implemented a framework that tracks use and is governed by the Company's Artificial Intelligence Policy, which was most recently updated in 2024, and includes a review and approval process for adopting use of AI tools. Such governance activities are designed to mitigate the risks presented by AI. Lastly, management maintains information security incident response processes to guide response and mitigate impact in the event of a cybersecurity incident. A third-party cybersecurity service provider is on retainer to assist the Company should a cybersecurity incident occur.


text: Material Impact on Company During 2024, the Company did not experience any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: We face significant and persistent cybersecurity risks due primarily to: the substantial level of harm that could occur to us and our customers were we to suffer impacts of a material cybersecurity incident; and our use of third-party products, services and components. We are committed to maintaining robust governance and oversight of these risks and to implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. While we have not, as of the date of this Annual Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We seek to detect and investigate unauthorized attempts and attacks against our network, products, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools and changes or updates to our products and services; however, we remain potentially vulnerable to known or unknown threats.

companyName: MIMEDX GROUP, INC.

ticker: MDXG


text: We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards and is assessed periodically by independent third-parties. We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our business, and have processes to assess those issues for potential cybersecurity impact or risk. We also have a process in place to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including: maintaining an effective security management program and abiding by information handling and asset management requirements. Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board of Directors is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board of Directors. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur at least annually, or more frequently as determined to be necessary or advisable. Our cybersecurity program is run by the head of our information security department, who reports to our Chief Financial Officer. Our Chief Financial Officer is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security team, who hold cybersecurity certifications such as a Certified Information Systems Security Professional, and through the use of technological tools and software and results from third party audits. We have an escalation process in place to inform senior management and the Board of Directors of material issues.


text: We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards and is assessed periodically by independent third-parties. We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our business, and have processes to assess those issues for potential cybersecurity impact or risk. We also have a process in place to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including: maintaining an effective security management program and abiding by information handling and asset management requirements. These processes and response mechanisms are continually assessed for effectiveness, and any new security mechanisms, including several in 2024, are integrated when business needs arise or industry best practices shift.


text: Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board of Directors is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board of Directors. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur at least annually, or more frequently as determined to be necessary or advisable. Our cybersecurity program is run by the head of our information security department, who reports to our Chief Financial Officer. Our Chief Financial Officer is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security team, who hold cybersecurity certifications such as a Certified Information Systems Security Professional, and through the use of technological tools and software and results from third party audits. We have an escalation process in place to inform senior management and the Board of Directors of material issues.


text: We recognize the increasing importance of cybersecurity and its potential impact on our business operations, financial condition, and reputation. We are committed to protecting our information assets and have implemented a comprehensive cybersecurity risk management program to identify, assess, and mitigate cybersecurity risks. We have not experienced any material cybersecurity incidents in the last three years.


text: Board of Directors Oversight of Cybersecurity Our Board of Directors Audit Committee has ultimate oversight of cybersecurity risks. The Committee is composed of independent directors with cybersecurity expertise. Management briefs the Committee on cybersecurity and information security at least annually.


text: Cybersecurity Risk Management We operate under written cybersecurity policies and procedures, and we use a risk-based approach to information security and periodically assess our cybersecurity risks. Our risk management strategy is based on the following principles:


text: Risk Management and Strategy In connection with the operation of the Company's business, we identify, assess and manage key risks that may affect the Company, including material risks from cybersecurity threats through our system security plan. Our system security plan is aligned with the 110 controls detailed in the NIST (SP) 800-171 and Department of Defense CMMC Level 2 guidelines for Cybersecurity. We have company-wide security policies, standards and controls that seek to incorporate best practices in security engineering, technology architecture and data protection. Our policies and controls include security measures designed to protect our systems against unauthorized access. We also maintain cybersecurity protection measures covering our information technology systems, including with respect to the protection of customer data, vendor data and employee information. We have also implemented specialized training and education programs to seek to guard against cybersecurity incidents, including company-wide communications and presentations, phishing simulations, focused training for specific roles and a general cybersecurity training program required for all employees.

companyName: TAYLOR DEVICES, INC.

ticker: TAYD


text: We engage third parties to perform regular reviews of our security controls which includes 24x7x365 security incident and event management (SIEM) as well as vulnerability services and penetration testing. Our processes to identify, assess and manage material risks from cybersecurity threats include risks associated with our use of third-party service providers, including cloud-based platforms. We oversee and identify cybersecurity risks from our third-party service providers in a number of ways, including appropriate due diligence in connection with new third-party service provider onboarding, robust security terms and conditions in our third-party service provider contracts and ongoing risk-based monitoring to ensure compliance with our cybersecurity standards. We believe that these policies and controls provide us with an appropriate assessment of potential cybersecurity threats.


text: As of the date of this Annual Report on Form 10-K (this "Form 10-K"), we are not aware of any risks from any potential cybersecurity threat or from any previous cybersecurity incident that have materially affected or are likely to materially affect our business strategy, results of operations or financial condition. However, the preventative actions we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against these potential threats and incidents in the future.


text: The Company's Board of Directors is responsible for overseeing management's identification, assessment and management of key risks, including cybersecurity risks.


text: Our Director of Information Technology, Mitch Reszczenski, is primarily responsible for assessing and managing our cybersecurity risks. Mr. Reszczenski has over 28 years of extensive information technology experience in highly successful manufacturing, engineering and financial organizations. Mr. Reszczenski provides regular updates on cybersecurity risks and threats and key developments in Company policies, practices and related risk exposures to the Chief Executive Officer and Chief Financial Officer. Additionally, senior management provides an update to the Board of Directors on cybersecurity matters at least once a year, and more often as appropriate. The Board of Directors annually reviews and approves the capital and operating budgets, ultimately reviewing and approving the amount spent by the Company on cybersecurity measures.


text: Mr. Reszczenski works with senior management to implement and oversee processes for the regular monitoring of our information systems. If a cybersecurity incident involving the Company were to occur, Mr. Reszczenski would engage senior management to initially determine the potential materiality of the incident, the potential need for public disclosure, the timing and extent of the Company's response and whether any future vulnerabilities are expected. As part of this evaluation, senior management would also identify immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future cybersecurity incidents. After an initial evaluation by senior management, the relevant information regarding the cybersecurity incident and its materiality would be promptly reported to the Company's Board of Directors for further review and evaluation, including as to whether public disclosure would be required or advisable.


text: Risk Management and Strategy We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could negatively impact the confidentiality, integrity, or availability of our information systems or the information held on such systems. These processes include controls, procedures, systems and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. These policies are found within our Compliance Manual and are the chapters "Cybersecurity, Privacy Protection, and the Prevention of Identity Theft" and "Business Continuity and Succession Planning" (collectively, the "Cybersecurity Policy"). The Cybersecurity Policy is available upon request.

companyName: X1 Capital Inc.


text: Material Impact of Cybersecurity Risks As of the date of this annual report on Form 10-K, we are not aware of any material risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about the cybersecurity risks that we face is discussed in Item 1A of Part I, "Risk Factors" in this Annual Report on Form 10-K under the heading "Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and/or damage to our business relationships, all of which could negatively impact our business, results of operations or financial condition."


text: The Board of Directors provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer ("CCO"), which is currently James Hickey, regarding the overall state of the Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents potentially impacting the Company. The CCO is responsible for assessing and managing material risks from cybersecurity threats that may impact the Company.


text: Our business does not require us to collect personal customer information. We minimize other cybersecurity risks by using specialized service providers for sensitive operations such as payroll processing, credit card transactions, email, and remote data backup. We verify our information service providers ' cybersecurity policies.


text: Identify and assess cybersecurity risks through a variety of methods, including audits to information security standards, threat testing, and vulnerability scanning. Prioritize risks based on their potential severity, likelihood, and detectability.


text: Controls to mitigate risks, including access controls, data protection, data backups, redundant systems, and incident response plans. We keep our controls up-to-date. Actions to correct any deficiencies and reduce or eliminate vulnerabilities. Written cybersecurity contingency plans, including plans for various specific scenarios.


text: Training and testing for all employees on cybersecurity risks, mitigation, and best practices. New employees are required to complete cybersecurity training and testing, and annual training and testing is required for all employees. Written policies and procedures that govern the use of information technology and the handling of sensitive information. Written incident response plans. Regular cybersecurity reporting to the Audit Committee.


text: We have a full-time information technology specialist who reports directly to our CEO and is responsible for assessing and managing cybersecurity risks. Both our information technology specialist and our CEO have extensive experience managing our cybersecurity. We have not engaged third-party service providers for cybersecurity, because we believe it is better to have the expertise in-house.


text: Cyber Risk Management and Strategy We understand the critical importance of assessing, identifying, and managing material risks associated with cybersecurity threats. To address this, we have established a cybersecurity risk management process that aligns with industry standards and is integrated into the Company's overall risk management systems.

companyName: SCIENTIFIC ENERGY, INC

ticker: SCGY


text: By strategically embedding cybersecurity risk management within our broader risk management framework, we foster a company-wide culture of cybersecurity awareness. This integration ensures that cybersecurity considerations are a fundamental part of our decision-making processes at all levels. As a holding company, the Company's board of directors and management work closely especially with IT department from our subsidiary Macao E-Media Development Company Limited ("MED"), to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Particularly, we had established a dedicated management standard for information security and cyber-security titled "Aomi APP Production Environment Anomaly Handling Guideline W-OM-CZ-001" ("Guideline") since August 2020. This Guideline provides detailed definitions of incident levels, operational processes, anomaly handling workflows, review requirements, and a list of emergency response personnel. Since its formulation in 2020, we have adhered to these guidelines.


text: On a daily basis, we maintain an efficient communication channel between our customer service department and IT department, through which any anomaly issues are promptly reported and responded to. Any severe anomaly will receive immediate attention. During national holidays, designated personnel from IT department will be responsible to monitor. In the event of the occurrence of any serious anomaly, we will refer to the Guideline for protocols and workflow.


text: We leverage the support of third-party information technology and security providers, including for periodic security testing and vulnerability scanning, as part of our risk management process, designed to identify, assess, and manage cybersecurity risks. We, especially MED, has utilized services from AliCloud Hong Kong since its inception, employing the AliCloud WAF firewall to effectively block potential conventional cyber-attacks. We actively cooperate and engage with AliCloud Hong Kong security team, to conduct penetration testing on our entire system regularly, to identify and address any vulnerabilities promptly. Being a key client of AliCloud Hong Kong, we have established and maintained a group chat including account manager and support team of AliCloud, through which any anomaly issues can be immediately responded and resolved.


text: The organizational structure of the IT department of our subsidiary MED includes a specialized cyber-security team. Different levels of anomaly incidents are addressed through different workflows and reporting paths as stipulated in the Guideline, generally led and overseen by the head of the IT department in MED.


text: Our Chief Executive Officer Stanley Chan, with the input and assistance of the management, is responsible for the strategic leadership and direction of the Company's cybersecurity program. Our Chief Executive Officer is also primarily responsible for the assessment and management of material cybersecurity risks and establishing and maintaining adequate and effective internal controls covering cybersecurity matters.


text: As of the date of this report, other than the foregoing, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this report. For more information about these risks, please refer to the section entitled "Risk Factors" in this Annual Report on Form 10-K.


text: Risk Management and Strategy In connection with the operation of the Company's business, we identify, assess and manage key risks that may affect the Company, including material risks from cybersecurity threats, through our system security plan. Our system security plan is aligned with the 110 controls detailed in the NIST (SP) 800-171 and Department of Defense CMMC Level 2 guidelines for Cybersecurity. We have company-wide security policies, standards and controls that seek to incorporate best practices in security engineering, technology architecture and data protection. Our policies and controls include security measures designed to protect our systems against unauthorized access. We also maintain cybersecurity protection measures covering our information technology systems, including the protection of customer data, vendor data and employee information. We have also implemented specialized training and education programs to guard against cybersecurity incidents, including company-wide communications and presentations, phishing simulations, focused training for specific roles and a general cybersecurity training program required for all employees.


text: We engage third parties to perform regular reviews of our security controls which includes 24/7/365 security incident and event management as well as vulnerability services and penetration testing. Our processes to identify, assess and manage material risks from cybersecurity threats include risks associated with our use of third-party service providers, including cloud-based platforms. We oversee and identify cybersecurity risks from our third-party service providers in a number of ways, including appropriate due diligence in connection with service provider onboarding, robust security terms and conditions in our third-party service provider contracts and ongoing risk-based monitoring to ensure compliance with our cybersecurity standards. We believe that these policies and controls provide us with an appropriate assessment of potential cybersecurity threats.


text: As of the date of this Annual Report on Form 10-K (this "Form 10-K"), we are not aware of any risks from any potential cybersecurity threat or from any previous cybersecurity incident that have materially affected or are likely to materially affect our business strategy, results of operations or financial condition. However, the preventative actions we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against these potential threats and incidents in the future.


text: The Company's Board of Directors is responsible for overseeing management's identification, assessment and management of key risks, including cybersecurity risks.


text: Our Director of Information Technology, Mitch Reszczenski, is primarily responsible for assessing and managing our cybersecurity risks. Mr. Reszczenski has over 29 years of extensive information technology experience in highly successful manufacturing, engineering and financial organizations. Mr. Reszczenski provides regular updates on cybersecurity risks and threats and key developments in Company policies, practices and related risk exposures to the Chief Executive Officer and Chief Financial Officer. Additionally, senior management provides an update to the Board of Directors on cybersecurity matters at least once a year, and more often as appropriate. The Board of Directors annually reviews and approves the capital and operating budgets, ultimately reviewing and approving the amount spent by the Company on cybersecurity measures.


text: Additional information regarding risks from cybersecurity threats is discussed in Part I, Item IA, "Risk Factors," under the heading "Security threats, such as ransomware attacks, to our IT infrastructure could expose us to liability, and damage our reputation and business," which should be read in conjunction with the information herein.


text: Mr. Reszczenski works with senior management to implement and oversee processes for the regular monitoring of our information systems. If a cybersecurity incident involving the Company were to occur, Mr. Reszczenski would engage senior management to initially determine the potential materiality of the incident, the potential need for public disclosure, the timing and extent of the Company's response and whether any future vulnerabilities are expected. As part of this evaluation, senior management would also identify immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future cybersecurity incidents. After an initial evaluation by senior management, the relevant information regarding the cybersecurity incident and its materiality would be promptly reported to the Company's Board of Directors for further review and evaluation, including as to whether public disclosure would be required or advisable.


text: TVA's cybersecurity risk management programs and processes exist under a written cybersecurity policy, which provides the foundation for TVA's information security programs. Under the policy, TVA engages assessors, consultants, auditors, and other third parties. All TVA employees, contractors, grantees, other federal agencies, state and local governments, industry partners, and others who possess TVA information or who operate, use, or have access to TVA's information systems are made responsible for complying with TVA's cybersecurity policy and information security-related communications, plans, practices, procedures, and standards issued as part of the information security programs.

companyName: Tennessee Valley Authority

ticker: TVE