text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – We are subject to cybersecurity attacks, which could adversely impact our results of operations and financial position" in this annual report on Form 10-K.


text: Matthews uses a number of means to assess cyber risks related to its third-party service providers, including processes governing interconnections with third-party systems and regular review of critical vendors' cybersecurity positions for potential risks. Third-party service provider assessments begin during onboarding and continue throughout the relationship, based upon an assessment of third-party risk. Those assessments include review of System and Organization Controls ("SOC") 1 and SOC 2 reports (as each such report is defined by the American Institute of Certified Public Accountants), and direct interaction with key vendors to assess and address risks. Contracts with third-party service providers contain appropriate protective provisions for the Company including audit rights, third-party notification obligations, and security requirements for the retention of data.

companyName: MATTHEWS INTERNATIONAL CORP

ticker: MATW

secItem: Item 1C

stage1Category: Third-Party Risk

stage1Method: unanimous


text: Matthews maintains a cybersecurity Incident Response Plan. In the event of a cybersecurity incident, designated personnel including members of Information Technology ("IT"), finance, legal, communications, human resources and any affected unit or department are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements.

stage1Category: Risk Management Process

stage1Method: majority


text: Matthews has experienced cyber-attacks in the past and, while none of these cyber-attacks resulted in a material disruption to the Company's business, Matthews may experience additional cyber-attacks in the future. As of the filing of this Form 10-K, the Company is not aware of any such attacks that have occurred since the beginning of fiscal 2024 that have materially affected, or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. While the Company has implemented a cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, the Company may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, refer to Item 1A - "Risk Factors - The Company relies on information technology to operate the Company's business. Security breach incidents and breakdowns of information technologies, or failure to comply with laws governing data privacy and data protection, could disrupt the Company's operations, subject the Company to legal claims, and impact the Company's financial results."

stage1Category: Strategy Integration


text: Board of Directors Oversight Cybersecurity risks are overseen by the Audit Committee of the Board of Directors of the Company. The Audit Committee and the Board of Directors oversee and periodically review the design and effectiveness of the Company's cybersecurity program, as well as its contingency plans. The Chief Information Officer ("CIO") and Director of IT Security provide regular reports to the Audit Committee, which include information about cyber-risk management, the effectiveness of the Company's cybersecurity framework, direct or emerging threats to the Company, program maturity and strategy, third-party risk management, and benchmarking against its industry peers.

stage1Category: Board Governance


text: Management's Role Managing Risk Matthews' CIO and Director of IT Security are primarily responsible for assessing and managing material risks from cybersecurity threats. The CIO reports directly to the Company's Chief Financial Officer, and the Director of IT Security reports to the CIO. The CIO, Director of IT Security, and the Company's cybersecurity team have decades of experience in various roles managing information security, developing cybersecurity strategy, and implementing, planning and operationalizing a comprehensive global IT infrastructure.

stage1Category: Management Role


text: The Director of IT Security is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents. With the support of legal, the Director of IT Security is responsible for global regulatory compliance related to cybersecurity regulations and industry standards. The Director of IT Security also advises on the implementation of cybersecurity risk management in the Company's products and services as they are being developed.


text: Cyber Expertise & Experience As discussed above, EOG's cybersecurity team consists of in-house cybersecurity professionals and external threat analysts, consultants and service providers. EOG's in-house professionals and external threat analysts possess various cybersecurity certifications.

companyName: EOG RESOURCES INC

ticker: EOG


text: Notwithstanding the vigorous approach Matthews takes to cybersecurity, the Company may not always be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on it. Matthews has experienced cyber-attacks in the past and, while none of these cyber-attacks resulted in a material disruption to the Company's business, Matthews may experience additional cyber-attacks in the future. As of the filing of this Form 10-K, the Company is not aware of any such attacks that have occurred since the beginning of fiscal 2025 that have materially affected, or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. While the Company has implemented a cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, the Company may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, refer to Item 1A - "Risk Factors - The Company relies on information technology to operate the Company's business. Security breach incidents and breakdowns of information technologies, or failure to comply with laws governing data privacy and data protection, could disrupt the Company's operations, subject the Company to legal claims, and impact the Company's financial results."


text: Board of Directors Oversight At Matthews, the Audit Committee of the Board of Directors is responsible for overseeing the Company's cybersecurity risk management efforts. The Company's Audit Committee regularly reviews and evaluates cybersecurity risks, the design and effectiveness of the Company's cybersecurity program, as well as its contingency plans, and the procedures and policies implemented by management to identify, manage, and mitigate such risks. The Chief Information Officer ("CIO") and CISO provide regular reports to the Audit Committee, which include information about cyber-risk management, the effectiveness of the Company's cybersecurity framework, direct or emerging threats to the Company, program maturity and strategy, third-party risk management, and benchmarking against its industry peers.


text: Management's Role Managing Risk Matthews' CIO and CISO are primarily responsible for assessing and managing cybersecurity risks. The CIO reports directly to the Company's Chief Financial Officer, and the CISO reports to the CIO. The CIO, CISO, and the Company's cybersecurity team have decades of experience in various roles managing information security, developing cybersecurity strategy and implementing, planning and operationalizing a comprehensive global IT infrastructure. In addition, the Company's legal team dedicates full-time internal resources to support the CISO in assessing and addressing compliance issues related to the various data protection and data privacy considerations arising from regulations, statutes and laws in the jurisdictions the Company operates.


text: The CISO is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents. With the support of legal, the CISO is responsible for global regulatory compliance related to cybersecurity regulations and industry standards. The CISO also advises on the implementation of cybersecurity risk management in the Company's products and services as they are being developed.


text: As part of its risk management process, the Matthews management team also identifies, assesses and evaluates risks impacting the Company's operations, including those risks related to cybersecurity, and raises them for internal discussion, and where it is determined to be appropriate, issues are also raised to the Board of Directors for consideration.


text: Risk Management and Strategy Cybersecurity risk management is overseen both as a critical component of our overall Enterprise Risk Management program and as a standalone program. We have implemented a risk-based, multilayered approach to assessing, identifying, and managing cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents.

companyName: MCCORMICK & CO INC

ticker: MKC


text: The team devotes significant resources to our cybersecurity risk management, which focuses on developing and implementing strategies and processes to protect the confidentiality, integrity, and availability of our assets and those of our consumers, customers and employees and seeks to continually improve our policies and practices to protect our platforms, adapt to changes in regulations, identify potential and emerging security risks and develop mitigation strategies for those risks. As part of this effort, the team periodically benchmarks our practices against the NIST Cyber Security and Privacy Frameworks, and other good practice control methods, which include updating technology, developing data privacy and security policies and procedures, implementing and assessing the effectiveness of controls, monitoring and routine testing of our information systems, conducting risk assessments of third-party service providers, providing data privacy and cybersecurity awareness training to employees and designing business processes to protect private data and mitigate the risk of cybersecurity incidents. We periodically conduct tests on our systems to help discover potential vulnerabilities, which enable improved decision-making and prioritization and promote monitoring and reporting across compliance functions. We believe that these actions provide adequate measures of protection against security breaches and generally reduce our cybersecurity risks, and we have not had a material cybersecurity threat or attack to date.


text: Our processes also address cybersecurity risks associated with our use of third-party service providers including suppliers, and software and cloud-based service providers. We proactively evaluate the cybersecurity risk of our third-party service providers by utilizing a repository of risk assessments, external monitoring sources, threat intelligence and predictive analytics to better inform ourselves during contracting and vendor selection processes. Third-party service providers security issues are documented, tracked, and monitored in order to mitigate risk.


text: We have adopted an incident response plan that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to such cybersecurity threats or incidents. The plan sets out a coordinated approach to investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping our Management Committee, the Audit Committee, the Board, and other key stakeholders informed and involved as appropriate. The plan is aligned to NIST guidance. It also includes the involvement of any personnel who may detect incidents, respond to incidents, resolve incidents, and manage communications and responsibilities with authorities about those incidents. The plan applies to all personnel (including third-party contractors, vendors, and partners) that perform functions or services requiring access to secure Company information, and to all devices and network services that are owned or managed by us.


text: Further, we currently maintain a cybersecurity insurance that provides coverage for certain types of incidents; however, such insurance may not be sufficient in type or amount to cover claims related to all cyber threats or risks.


text: While we have not experienced any material cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, as of the date of this Annual Report on Form 10-K, there can be no guarantee that we will not be the subject of future threats or incidents. Additional information on cybersecurity risks we face can be found in Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.

stage1Category: None/Other


text: Governance and Oversight Our Board and the Audit Committee are actively engaged in the oversight of our cybersecurity and data privacy program. The Board, at least annually, and the Audit Committee, periodically throughout the year, receive regular reports from our Chief Information Security Officer ("CISO") and members of the information security team on, among other things, recent developments, the state of the information security program, assessments of risks and threats to our information security systems, information security considerations arising with respect to our peers and third parties, third-party and independent reviews, and processes to maintain and strengthen information security systems. Under the oversight of the Audit Committee, we engage third-party experts to assess the state of our cybersecurity and data privacy program. The Audit Committee also provides regular updates to the Board, and the Board would be notified between such updates regarding significant new cybersecurity threats or incidents.


text: We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to the Management Committee, the Audit Committee or the Board in a timely manner.


text: We have an Executive Cybersecurity Steering Committee that is facilitated by our CISO, which is designed to engage business leadership and employ best practices, including ongoing enhancements to governance, risk and compliance. Our internal audit function also performs independent testing on aspects of the operations of our cybersecurity program and the supporting controls based upon its risk-based internal audit plan and reports the results of these audits in its periodic reports to the Audit Committee. Our CISO currently reports to our Chief Information and Digital Officer and is responsible for training and leading a dedicated information security team tasked with protecting data and preventing, identifying, and appropriately addressing cybersecurity threats. The CISO is a Certified Information Systems Security Professional with over 20 years of experience developing and maturing information security programs, including experience with leading privacy, enterprise risk, records management, business continuity and operational risk programs, among others.


text: Integrated Risk Management Management is responsible for the day-to-day management of the Company's risk exposures in a manner consistent with the strategic direction and objectives established by the Board. As a critical component of the Company's risk management process, management has adopted an integrated risk management framework to continuously identify, assess, measure, manage, monitor and report current and emerging non-financial risks. As part of this framework, the Company has an Enterprise Risk Management ("ERM") Committee which is chaired by the Company's Chief Risk & Compliance Officer. Our Chief Information Security Officer ("CISO") is also a member of the ERM Committee. The ERM Committee oversees the Company's risk management framework, including the implementation of the framework components across the Company and promotes a strong Company-wide culture of risk management, compliance and control.

companyName: S&P Global Inc.

ticker: SPGI


text: Engagement of Third-party Support We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. We also share and receive threat intelligence with our defense industrial base peers, government agencies, information sharing and analysis centers and cybersecurity associations.


text: Third-party Risk Management Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers.


text: Our Board, and Nominating and Audit Committees, gave significant consideration over the past several years to the appropriate Board and Committee oversight structure for risks associated with technology and cybersecurity. The full Board receives briefings from management on enterprise-wide technology, cybersecurity risk management and the overall technology and cybersecurity environment by management. Specifically, the full Board receives biannual reports from the Chief Digital Solutions Officer and the CISO.


text: The Board coordinates with the Audit Committee and Finance Committee to ensure active Board- and Committee-level oversight of the Company's technology and cyber risk profile, enterprise technology and cyber strategies, and information security initiatives. In addition, the Board has delegated primary responsibility for oversight of the Company's key risks, including cybersecurity, to the Audit Committee. The Audit Committee reviews technology and cybersecurity risks, as well as the Company's risk mitigation processes and internal control procedures to protect sensitive business information. The Audit Committee also receives regular updates from the Chief Digital Solutions Officer and the CISO on the Company's technology and cybersecurity programs. In addition, the Finance Committee oversees management's strategy with regard to technology and associated risks, including cybersecurity risks, when considering major capital expenditures and acquisitions. The Board also receives regular updates from the Audit Committee and Finance Committee on their in-depth Committee-level reviews.


text: Role of Management In addition to the risk management activities undertaken by the ERM Committee, our corporate information security organization, led by our CISO, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The current CISO has more than 26 years of technology industry leadership, cybersecurity expertise and engineering and operations experience. The corporate information security organization manages and continually enhances the Company's enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience to minimize the business impact should an incident occur. Central to this organization is our cyber incident response team, which is responsible for the Company's protection, detection and response capabilities. In the event of a cybersecurity incident, the Company is equipped with an incident response plan that includes: (i) detection and analysis, (ii) containment and eradication, and (iii) remediation and (iv) preparation for future incidents. Incident responses are led by our Information Security team and supported by Legal, Compliance and other functions as appropriate. The CISO and the Chief Digital Solutions Officer provide regular updates to the Board and the Audit Committee concerning the Company's technology and cybersecurity programs, associated risks and the Company's efforts to help mitigate those risks.


text: Integrated Risk Management Management is responsible for the day-to-day management of the Company's risk exposures in a manner consistent with the strategic direction and objectives established by the Board. As a critical component of the Company's risk management process, management has adopted an integrated risk management framework to continuously identify, assess, measure, manage, monitor and report current and emerging non-financial risks. As part of this framework, the Company has an Enterprise Risk Management ("ERM") Committee which is chaired by the Company's Chief Risk Officer. Our Chief Information Security Officer ("CISO") is also a member of the ERM Committee. The ERM Committee oversees the Company's risk management framework, including the implementation of the framework components across the Company and promotes a strong Company-wide culture of risk management, compliance and control.


text: Third-party Risk Management Our risk management program also assesses third-party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers.


text: Impact of Risks from Cybersecurity Threats We are regularly subject to cybersecurity attacks. None of the risks from cybersecurity threats we've faced to date have materially affected, and we do not believe are reasonably likely to materially affect the Company, our business strategy, results of operations or financial condition. For further information about risks we face from cybersecurity threats, see the risk factor entitled "Our size, scale and role in the global markets increases our risk for cyber attacks and other cyber-security risks. Our information systems and networks and those of our third-party service providers are exposed to risks related to cybersecurity and protection of confidential information, including material non-public information, which could have a material adverse effect on our business, financial condition or results of operations" in Item 1A, Risk Factors in this Annual Report on Form 10-K. Governance.


text: Board Oversight of Cybersecurity Threats The board of directors of the Company (the "Board") has oversight responsibility for the Company's risk management framework, including technology and cybersecurity risks facing the Company.


text: The Trust relies on the Sponsor's risk management program, which includes cyber risk assessments. These processes have been integrated into the Sponsor's overall risk management system.

companyName: 21Shares Ethereum ETF

ticker: TETH


text: Role of Management In addition to the risk management activities undertaken by the ERM Committee, our corporate information security organization, led by our CISO, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The current CISO has more than 27 years of technology industry leadership, cybersecurity expertise and engineering and operations experience. The corporate information security organization manages and continually enhances the Company's enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience to minimize the business impact should an incident occur. Central to this organization is our cyber incident response team, which is responsible for the Company's protection, detection and response capabilities. In the event of a cybersecurity incident, the Company is equipped with an incident response plan that includes: (i) detection and analysis, (ii) containment and eradication, and (iii) remediation and (iv) preparation for future incidents. Incident responses are led by our Information Security team and supported by Legal, Compliance and other functions as appropriate. The CISO and the Chief Digital Solutions Officer provide regular updates to the Board and the Audit Committee concerning the Company's technology and cybersecurity programs, associated risks and the Company's efforts to help mitigate those risks.


text: Cybersecurity Risk Management Securing the Company's business information, intellectual property, customer, patient and employee data and technology systems is essential for the continuity of its businesses, meeting applicable regulatory requirements and maintaining the trust of its stakeholders. Cybersecurity is an important and integrated part of the Company's enterprise risk management function that identifies, monitors and mitigates business, operational and legal risks.

companyName: CVS HEALTH Corp

ticker: CVS


text: To help protect the Company from a major cybersecurity incident that could have a material impact on operations or the Company's financial results, the Company has implemented policies, programs and controls, including technology investments that focus on cybersecurity incident prevention, identification and mitigation. The steps the Company takes to reduce its vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include, but are not limited to: establishing information security policies and standards, implementing information protection processes and technologies, monitoring its information technology systems for cybersecurity threats, assessing cybersecurity risk profiles of key third-parties, implementing cybersecurity training and collaborating with public and private organizations on cyber threat information and best practices. The Company is currently in material compliance with applicable information privacy and cybersecurity standards.


text: The Company has implemented a Cybersecurity Incident Response Plan (the "Plan"), which is integrated into its overall crisis management program. The Plan provides a framework for responding to cybersecurity incidents. The Plan identifies applicable requirements for incident disclosure and reporting as well as provides protocols for incident evaluation, including the use of third-party service providers and partners, processes for notification and internal escalation of information to the Company's senior management, the disclosure committee, the Board and appropriate Board committees. The Plan also addresses requirements for the Company's external reporting obligations. The Plan is reviewed and updated, as necessary, under the leadership of the Company's Chief Information Security Officer ("CISO") and Chief Privacy Officer ("CPO").


text: The Company's information technology systems and processes are assessed by independent third parties, as appropriate to their business requirements, for compliance with the following standards: HIPAA; NIST 800-53; System and Organization Controls ("SOC") 1; SOC 2 Type 2; HI-TRUST; Payment Card Industry Data Security Standards; and the National Association of Insurance Commissioners. The Company annually purchases a cybersecurity risk insurance policy that would help defray the costs associated with a covered cybersecurity incident if it occurred.


text: Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2023, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information on the Company's cybersecurity-related risks.


text: Management has responsibility to manage risk and bring to the Board's attention the most material near-term and long-term risks to the Company. The Company's CISO leads management's assessment and management of cybersecurity risk. The CISO reports to the Company's Chief Digital, Data, Analytics & Technology Officer (the "CDDATO"), who reports directly to the Company's Chief Executive Officer. The CDDATO, CISO and the CPO, regularly review cybersecurity matters with management. The current CDDATO, CISO and CPO each has more than 10 years of experience managing risks or advising on cybersecurity issues.


text: The Board is actively engaged in overseeing and reviewing the Company's strategic direction and objectives, taking into account, among other considerations, the Company's risk profile and related exposures, as part of this oversight the Board has delegated certain of these responsibilities to committees of the Board. The Board has delegated the responsibility for the oversight of the Company's cybersecurity risks program to the Nominating and Corporate Governance Committee. As part of this oversight, the Nominating and Corporate Governance Committee reviews the Company's cybersecurity program periodically, and at least annually. The Company's CDDATO and CISO update the Nominating and Corporate Governance Committee periodically, and at least annually, and the full Board as needed, on the Company's cybersecurity program, including with respect to particular cybersecurity threats, incidents or new developments in the Company's risk profile. The CISO is a member of the Company's disclosure committee, and the CPO advises the disclosure committee on cybersecurity matters on an as-needed basis. During 2023, the Board conducted a review of its overall committee structure, membership and responsibilities in an effort to enhance its oversight. As part of this review, the Board has determined that it will shift the delegation of the oversight of the Company's cybersecurity risks program to the Audit Committee effective March 2024.


text: Risk Management and Strategy A.Processes for Assessing, Identifying, and Managing Material Risks from Cybersecurity Threats The Company has developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of its critical systems and information. The Company's cybersecurity risk management is integrated into and embedded in its overall enterprise risk management framework, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: MERCURY GENERAL CORP

ticker: MCY


text: The Enterprise Risk Management Committee oversees cybersecurity risks Company-wide while the Company's Chief Technology Officer ("CTO"), a member of the Enterprise Risk Management Committee, oversees the Information Security business unit's cybersecurity management programs and activities. The Company's cybersecurity risk management program includes the following key elements: • formal cybersecurity risk assessment designed to help identify material cybersecurity risks to the Company's critical systems, information, services, and its broader enterprise information technology environment led by the Company's Information Security business unit and reported to its Enterprise Risk Management Committee; • a team comprised of information security, information technology, infrastructure, and compliance personnel responsible for directing the Company's cybersecurity risk assessment and security processes and its cybersecurity incident response; • third-party cybersecurity service provider, as needed, to conduct independent review and testing of the Company's cybersecurity risks and report to the Company; • systems for protecting information technology systems and monitoring for suspicious events, such as threat protection, firewall and anti-virus software; • cybersecurity awareness and prevention training for all employees; • a Security Incident Response Plan designed to respond to cybersecurity incidents, which is regularly tested; • a Vendor Risk Management Process for vetting third party service providers with access to the Company's information technology systems.


text: The Information Security business unit regularly evaluates the Company's cybersecurity risk profile and reports to the Board of Directors (the "Board"). In the event that a significant cybersecurity incident is identified, the Company engages a third-party cybersecurity incident response consultant, as needed, to provide an independent evaluation of the incident.


text: B.Oversight of Cybersecurity Risks Associated with Third Party Service Providers The Company oversees and identifies material risks from cybersecurity threats related to its use of third-party service providers in accordance with its Vendor Risk Management Process. The contracts with service providers are reviewed during the onboarding process, renewal periods, and as necessary. The contracts require service providers to report cybersecurity incidents that impact the Company's data or information systems or that can otherwise disrupt its operations to the Company on a timely basis.


text: C.Impact of Cybersecurity Threats on Business Strategy and Results of Operations The Company has experienced cybersecurity incidents in the past, and has been impacted by cybersecurity incidents experienced by its service providers, but none has materially affected the Company's operations. The Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected the Company, including its operations, business strategy, results of operations, or financial condition. The Company faces certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect the Company, including its operations, business strategy, results of operations, or financial condition. See "Risks Related to Technology and Cybersecurity" in "Part I – Item 1A. Risk Factors" for additional information.


text: EOG's cybersecurity team is led by EOG's group director, information systems and senior manager, information systems security, who each have over seven years of experience overseeing EOG's cybersecurity processes and strategy.


text: A.Board of Directors' Oversight of Risks from Cybersecurity Threats The Company's Board considers cybersecurity risk as critical to the enterprise. The full Board oversees the Company's Enterprise Risk Management program which incorporates cybersecurity risks together with other top operational, reporting and compliance risks the Company manages. The full Board is kept apprised by Management of the Company's cybersecurity risk assessment results, and an escalation process exists to inform the Board of high-severity cybersecurity incidents that may occur. In addition, the Board periodically engages independent third-party technology experts to test the Company's information technology systems, including cybersecurity.


text: The Company's Enterprise Risk Management Committee provides the Board with an overview of cybersecurity risks regularly. Additionally, the Company's Chief Executive Officer ("CEO") provides the Board with an Information Security Incident Report for Board meetings, which summarizes new incidents that did not require "off-cycle" escalation to the Board, and status updates on previously reported high severity incidents, as well as a cybersecurity incident analysis report issued by a third-party cybersecurity service provider.


text: B.Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats The Company's Information Security business unit primarily manages the day-to-day operations of monitoring cybersecurity risks to the Company's information systems, takes prevention, detection, and remediation measures for cybersecurity incidents, makes initial assessment of reported cybersecurity incidents, and reports such incidents to the Company's CEO, Chief Operating Officer ("COO"), CTO, Board and Enterprise Risk Management Committee as well as certain regulatory bodies, as needed. The following five management personnel are primarily responsible for assessing and managing the Company's material risks from cybersecurity threats: • Gabriel Tirador, Chief Executive Officer: The Company's CEO, along with its COO, oversees the Technology team who monitors the Company's information technology systems for suspicious events. The Company's CEO reports to the Board regarding cybersecurity incidents and issues. The Company's CEO, COO and CTO oversee the use of third-party cybersecurity consultants by the Information Security business unit to engage in periodic evaluations. Mr. Tirador has over 30 years' experience in the property and casualty insurance industry and in the Company and is an inactive Certified Public Accountant. As CEO of the Company, he has overseen its Technology business unit for over 20 years, among other business units. • Victor Joseph, President and Chief Operating Officer: The Company's President and COO oversees the technology team who monitors the Company's information technology systems for suspicious events. Mr. Joseph has overseen the technology team since 2022. Mr. Joseph has been employed by the Company in various capacities since 2009, and was appointed Executive Vice President and COO in January 2022 and President and COO in January 2024. • Theodore R. Stalick, Senior Vice President and Chief Financial Officer: The Company's CFO oversees its enterprise risk management program which, among others, includes oversight of cybersecurity risk management and serves as Chairperson of the Company's Enterprise Risk Management Committee. Mr. Stalick has been the Company's CFO since 2001. Mr. Stalick is a Certified Public Accountant and has a Bachelors Degree in Business Administration, Accounting and Finance concentration, and an MBA, Business Analytics concentration. • Wilson Pang, Vice President and Chief Technology Officer: The Company's CTO regularly provides the Board with updates on cybersecurity risk management or significant reported cybersecurity incidents. The Company's CTO works with the Company's CEO, COO and Head of Information Security to determine the severity of cybersecurity incidents. The Company's CTO also works with its Head of Information Security to direct action in the event of a severe cybersecurity incident. Mr. Pang has over 20 years' experience in the technology industry. He has served in Chief Technology Officer and Chief Data Officer roles in several public companies and has deep expertise in technology, data, and artificial intelligence. He has a Master's and a Bachelor's Degree in electrical engineering.


text: • Dustin Howard, Head of Information Security: The Company's Head of Information Security supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the information technology environment. The Company's Head of Information Security also oversees the creation of remediation action plans with the affected business units. Mr. Howard has over 30 years' experience managing various aspects of information technology, and has extensive expertise in information security, compliance, and information technology infrastructure and service delivery. He has served in Head of Information Security, Chief Information Officer and Vice President roles in several public companies and has maintained Certified Information Systems Security Professional ("CISSP") certification since 2001. He has a Bachelor's Degree in Business Administration and a Master's Degree in Information Systems.


text: The five management personnel above also serve in the Company's Enterprise Risk Management Committee and are informed about and discuss updates to the cybersecurity risk management programs and cybersecurity incidents, including any prevention and detection measures as well as mitigation and remediation measures for any reported cybersecurity incidents. The Enterprise Risk Management Committee oversees the Company's overall risk management processes that include oversight of material risks from cybersecurity threats. The CEO and CFO are also members of the Company's Disclosure Committee. The CTO and Head of Information Security participate in Disclosure Committee meetings, as needed, to facilitate discussion and provide information on cybersecurity incidents reported. The CEO, CTO and Head of Information Security provide the Board with information and updates on cybersecurity risks and incidents as in-house technology and cybersecurity experts during Board meetings or as needed.


text: Depending on the nature and severity of the reported cybersecurity incidents, the Enterprise Risk Management Committee may recommend activation of the Crisis Management Plan under the Company's Business Continuity Management Program. The Disclosure Committee is informed by the CEO of significant cybersecurity incidents for purposes of determining materiality.


text: Risk Management and Strategy A. Processes for Assessing, Identifying, and Managing Material Risks from Cybersecurity Threats The Company has developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of its critical systems and information. The Company's cybersecurity risk management is integrated into and embedded in its overall enterprise risk management framework, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Based on the information we have as of the date of this Annual Report on Form 10-K, we do not believe that any cybersecurity incident experienced by the Company has materially affected or is reasonably likely to materially affect Wiley, including our business strategy, results of operations or financial condition. For additional information about cybersecurity risks, see Item 1A. "Risk Factors."

companyName: JOHN WILEY & SONS, INC.

ticker: WLY


text: A. Board of Directors' Oversight of Risks from Cybersecurity Threats The Company's Board considers cybersecurity risk as critical to the enterprise. The full Board oversees the Company's Enterprise Risk Management program which incorporates cybersecurity risks together with other top operational, reporting and compliance risks the Company manages. The full Board is kept apprised by Management of the Company's cybersecurity risk assessment results, and an escalation process exists to inform the Board of high-severity cybersecurity incidents that may occur. In addition, the Board periodically engages independent third-party technology experts to test the Company's information technology systems, including cybersecurity.


text: Disclosure of Risks: We describe how risks from cybersecurity threats could materially affect us, including our business strategy, results of operations, or financial condition, as part of our risk factor disclosures at Part I, Item 1A of this Annual Report on Form 10-K.

companyName: WILLIAMS COMPANIES, INC.

ticker: WMB


text: Risk Management and Strategy Entergy and the Registrant Subsidiaries maintain a security-risk-management system with defined roles, duties, governance, and accountability. Under this physical- and cyber-risk model, Entergy and the Registrant Subsidiaries streamline security into a centralized program. The Chief Security Officer (CSO) is responsible for

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC


text: Part I Item 1A, 1B, and 1C establishing the security and reliability risk strategy, setting policies, monitoring controls and compliance, providing support activities, and reporting on the security program. The Chief Information Security Officer (CISO) is responsible for establishing the cybersecurity strategy and implementing physical and cyber security systems for the security program. The Chief Ethics & Compliance Officer works with the CSO to address requirements of external security-related regulations, and where applicable, incorporate them into business policies. Management is responsible for identifying and managing risk directly through execution of the security program and compliance with security policies. Entergy and the Registrant Subsidiaries' risk management model addresses compliance with certain regulatory constructs, such as the NERC Reliability Standards, the NRC Code of Federal Regulations, the Payment Card Industry Data Security Standard, and the Health Insurance Portability and Accountability Act, among other regulations. Entergy and the Registrant Subsidiaries' risk management model continuously evolves to improve and implement protections, controls, and monitoring to mitigate risks to their part of North America's electric grid, to protect sensitive information, and to maintain secure business operations. Entergy and the Registrant Subsidiaries manage cybersecurity threats as an enterprise risk with close coordination and information sharing with its federal, state, and local partners. Entergy and the Registrant Subsidiaries also engage with local, state, and federal law enforcement agencies on initiatives to share threat information and participate in a wide range of industry collaborations and classified briefings on cybersecurity developments and evolving risks.


text: Entergy and the Registrant Subsidiaries maintain access-management controls, including a layered multi-factor authentication process for network and system access, and a defense-in-depth security ecosystem that includes advanced threat detection from independent third parties and federal agencies, security logging and monitoring, and independent third-party penetration and vulnerability assessments. Relevant employees and contractors must complete cybersecurity trainings periodically to heighten security and threat awareness, promote best practices, and meet regulatory requirements. Additional multi-layered prevention and detection processes and technologies to mitigate and minimize the effects of cybersecurity risks include email security, continuous monitoring, vulnerability scanning, anti-virus and anti-malware software, backups and recovery strategy, network segregation, third-party security, and information protection.


text: Entergy and the Registrant Subsidiaries have incorporated certain cyber-specific response protocols and procedures into their Entergy Incident Management System framework for responding to emergency incidents. This includes the Entergy Incident Response Team Plan, which outlines Entergy's procedures, steps, and responsibilities for preparing for, detecting, containing, and recovering from an incident. The plan details the roles and responsibilities of Entergy's officers who would be engaged in such a response to an emergency incident, including key questions to be addressed, critical decision points, and sources of key information to support decision-making. Senior management and the Emergency Incident Response Team periodically review and drill on the plan.


text: As cybersecurity risks continue to evolve with multiple threat vectors, Entergy and the Registrant Subsidiaries maintain a comprehensive security strategy to keep current with the changing threats. To inform this effort, Entergy and the Registrant Subsidiaries utilize the National Institute of Standards and Technology Cybersecurity Framework, which consists of standards, guidelines, and best practices to manage cybersecurity risk across the enterprise. A risk-based approach is used to direct security initiatives to the most significant risks and provide the most value in terms of risk reduction and protection. Entergy and the Registrant Subsidiaries use a vendor risk management program to assess and monitor security risks that arise from third-party vendors. In addition, Entergy and the Registrant Subsidiaries utilize technology and threat intelligence services to assess and continuously monitor the cybersecurity risk of key vendors, as identified through the vendor risk management program.


text: While Entergy and the Registrant Subsidiaries have experienced cybersecurity incidents, except as otherwise summarized above or discussed elsewhere in this report, the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected them including their business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors" in Part I, Item 1A for a detailed description of the risks related to cybersecurity.


text: Corporate Governance The Board of Directors is responsible for oversight of the identification, management, and mitigation of enterprise-wide risk, including cybersecurity risk. The Audit Committee has the primary responsibility for overseeing risk management, including oversight of cybersecurity risk management practices and performance. The Audit Committee generally receives reports at each regular quarterly meeting provided by the Chief Information Officer, the CSO, the CISO, and the General Auditor on the cybersecurity management program. The reports focus on the programs and protocols in place to mitigate cybersecurity risks, led by the CSO. Among other things, the reports may include: recent cyber risk and cybersecurity developments; industry engagement activities; legislative and regulatory developments; cyber-risk governance and oversight; selected cyber risk metrics and activities; cyber risk incident response plans and strategies; cybersecurity drills and exercises; assessments by third party experts and Internal Audit; and major projects and initiatives.


text: While the Board of Directors and Audit Committee oversee cybersecurity risk management, Entergy's management is responsible for managing cybersecurity risk. Entergy and the Registrant Subsidiaries' security-risk-management system, as discussed above, is comprised of a three lines of defense model to enhance risk management efforts and define roles in the security program. The first line of defense, comprised of business units performing operational functions, including the CISO, is responsible for identification and management of security and reliability risks directly through design, implementation, and execution of control activities. The second line of defense, comprised of the CSO and Chief Security Office, performs and supports security and reliability risk management and governs and oversees the execution of security and reliability controls by the first line of defense. Ownership of specific security operations may migrate from a business unit in the first line of defense to the second line of defense, as determined to be appropriate by the Chief Security Office. The third line of defense, which includes Internal Audit, independent third parties, and certain regulatory constructs, such as the NERC Reliability Standards and the NRC Cyber Rule, provides assurance of selective actions taken by the first and second lines of defense to senior management and the Board of Directors.


text: Entergy's CSO is responsible for overseeing physical, cyber, and reliability risk, including governance, compliance, and threat intelligence. The CSO's background includes serving as the Global Lead Business Information Security Officer for a multinational pharmaceutical and biotechnology company, Vice President of Cybersecurity Solutions for an international consulting firm, and an operations manager for a multinational technology company. The CSO is also a former intelligence officer in the U.S. Marine Corps, with experience in the Fleet Marine Force, Joint Staff J-2/Defense Intelligence Agency, and Headquarters Marine Corps Command, Control, Communications, and Computers (C4I). The CSO participated in numerous exercises and crisis operations during his time in the military. The CSO is a certified Information Security Manager from the Information Systems Audit and Control Association and a certified Information Privacy Manager from the International Association of Privacy Professionals. The CSO also completed the Harvard Kennedy School Executive Education Program in Cybersecurity and the FBI Domestic Security Executive Academy.


text: Entergy's CISO is responsible for enterprise strategic and operational cybersecurity, physical security systems, and regulatory compliance. The CISO oversees investments in tools, resources, and processes that allow for the continuous improvement and maturity of Entergy's cybersecurity posture. The CISO has expertise spanning more than 25 years in the realm of information technology, information security, and cyber/physical security management. The CISO's background includes serving as the Vice President and Chief Information Security Officer for an electric utility with responsibility for enterprise cybersecurity covering corporate, electric, nuclear, and gas operations. Additionally, the CISO served as the Chief Security Officer for the Electric Reliability Council of Texas with overall responsibility for its cybersecurity, physical security, and emergency management programs. Her previous experience includes multiple technical, managerial, and strategic roles within industries ranging from energy, telecommunication, software development, and cybersecurity consulting. The CISO is a Certified Information Systems Security Professional, Certified Information Security Manager, and Certified in Risk and Information Systems Control.


text: We are committed to continually enhancing our cybersecurity processes and practices to address the dynamic nature of the threats we face and to ensure the security and integrity of our systems and data.


text: Part I Item 1A, 1B, and 1C Entergy Corporation, Utility operating companies, and System Energy In the event of a suspected or actual cybersecurity incident, the Security Incident Response Team (SIRT), which includes the CISO, has primary responsibility for initial identification and evaluation of potential business impacts and escalation of the incident's severity classification using pre-established criteria with a specified communication matrix and escalation thresholds. The Security Incident Commander, which role is served by rotating leaders in the CISO organization, provides tactical leadership and oversight management at the cross-functional level for the incident. The SIRT remains engaged throughout the incident response lifecycle, including detection and analysis, containment, eradication and recovery, and post-incident remediation, and coordinates with the impacted business functions, if warranted. Once a cyber incident is confirmed, the SIRT is responsible for maintaining situational awareness and continuous monitoring of the need for escalation or de-escalation of the incident's severity classification. As certain escalation thresholds are exceeded, additional levels of management notification are required by the SIRT, including notification of and recurring communication with Entergy's Incident Response Team, which includes the Chief Executive Officer, the Chief Operating Officer, the CSO, other executive management, and members of the affected business functions. Depending upon the facts, analysis, materiality, and anticipated or current impacts, the Chief Executive Officer and the General Counsel will determine the timing and cadence for communication of the cyber incident with the Board of Directors or Audit Committee.


text: Risk Management and Strategy Entergy and the Registrant Subsidiaries maintain a security-risk-management system with defined roles, duties, governance, and accountability. Under this physical- and cyber-risk model, Entergy and the Registrant Subsidiaries streamline security into a centralized program. The Chief Security Officer (CSO) is responsible for establishing the security and reliability risk strategy, setting policies, monitoring controls and compliance, providing support activities, and reporting on the security program. The Chief Information Security Officer (CISO) is responsible for establishing the cybersecurity strategy and implementing physical and cyber security systems for the security program. The Chief Information Officer (CIO) is responsible for ensuring that Entergy's information technology infrastructure is secure and reliable. The Chief Ethics & Compliance Officer works with the CSO to address requirements of external security-related regulations, and where applicable, incorporate them into business policies. Management is responsible for identifying and managing risk directly through execution of the security program and compliance with security policies. Entergy and the Registrant Subsidiaries' risk management model addresses compliance with certain regulatory constructs, such as the NERC Reliability Standards, the NRC Code of Federal Regulations, the Payment Card Industry Data Security Standard, and the Health Insurance Portability and Accountability Act, among other regulations. Entergy and the Registrant Subsidiaries' risk management model continuously evolves to improve and implement protections, controls, and monitoring to mitigate risks to their part of North America's electric grid, to protect sensitive information, and to maintain secure business operations. Entergy and the Registrant Subsidiaries manage cybersecurity threats as an enterprise risk with close coordination and information sharing with its federal, state, and local partners. Entergy and the Registrant Subsidiaries also engage with local, state, and federal law enforcement agencies on initiatives to share threat information and participate in a wide range of industry collaborations and classified briefings on cybersecurity developments and evolving risks.


text: Entergy and the Registrant Subsidiaries have incorporated certain cyber-specific response protocols and procedures into their Entergy Incident Management System framework for responding to emergency incidents. This includes the Entergy Incident Response Team Plan, which outlines Entergy's procedures, steps, and responsibilities for preparing for, detecting, containing, and recovering from an incident. The plan details the roles and responsibilities of Entergy's officers who would be engaged in such a response to an emergency incident,


text: Part I Item 1A, 1B, and 1C including key questions to be addressed, critical decision points, and sources of key information to support decision-making. Senior management and the Emergency Incident Response Team periodically review and drill on the plan.


text: As cybersecurity risks continue to evolve with multiple threat vectors, Entergy and the Registrant Subsidiaries maintain a comprehensive security strategy to keep current with the changing threats. To inform this effort, Entergy and the Registrant Subsidiaries utilize the National Institute of Standards and Technology Cybersecurity Framework, which consists of standards, guidelines, and best practices to manage cybersecurity risk across the enterprise. A risk-based approach is used to direct security initiatives to the most significant risks and provide the most value in terms of risk reduction and protection. Entergy and the Registrant Subsidiaries use a vendor risk management program to assess and monitor security risks that arise from certain third-party vendors. In addition, Entergy and the Registrant Subsidiaries utilize technology and threat-intelligence services to assess and continuously monitor the cybersecurity risk of key vendors, as identified through the vendor risk management program.


text: Our CISO has over twenty years of professional experience, with twelve years in information security roles. He has been with Pega for five years and has a Master of Science degree from Northwestern University.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: Corporate Governance The Board of Directors is responsible for oversight of the identification, management, and mitigation of enterprise-wide risk, including cybersecurity risk. The Audit Committee has the primary responsibility for overseeing risk management, including oversight of cybersecurity risk management practices and performance. The Audit Committee generally receives reports at each regular quarterly meeting provided by the CSO, the CISO, the CIO, and the General Auditor on the cybersecurity management program. The reports focus on the programs and protocols in place to mitigate cybersecurity risks, led by the CSO. Among other things, the reports may include: recent cyber risk and cybersecurity developments; industry engagement activities; legislative and regulatory developments; cyber-risk governance and oversight; selected cyber risk metrics and activities; cyber risk incident response plans and strategies; cybersecurity drills and exercises; assessments by third party experts and Internal Audit; and major projects and initiatives.


text: While the Board of Directors and Audit Committee oversee cybersecurity risk management, Entergy's management is responsible for managing cybersecurity risk. Entergy and the Registrant Subsidiaries' security-risk-management system, as discussed above, is comprised of a three lines of defense model to enhance risk management efforts and define roles in the security program. The first line of defense, comprised of business units performing operational functions, including the CISO and CIO, is responsible for identification and management of security and reliability risks directly through design, implementation, and execution of control activities. The second line of defense, comprised of the CSO and Chief Security Office, performs and supports security and reliability risk management and governs and oversees the execution of security and reliability controls by the first line of defense. Ownership of specific security operations may migrate from a business unit in the first line of defense to the second line of defense, as determined to be appropriate by the Chief Security Office. The third line of defense, which includes Internal Audit, independent third parties, and certain regulatory constructs, such as the NERC Reliability Standards and the NRC Cyber Rule, provides assurance of selective actions taken by the first and second lines of defense to senior management and the Board of Directors.


text: Entergy's CSO is responsible for overseeing physical, cyber, and reliability risk, including governance, compliance, and threat intelligence. The CSO's background includes serving as the Global Lead Business Information Security Officer for a multinational pharmaceutical and biotechnology company, Vice President of Cybersecurity Solutions for an international consulting firm, and an operations manager for a multinational technology company. The CSO is also a former intelligence officer in the U.S. Marine Corps, with experience in


text: Part I Item 1A, 1B, and 1C the Fleet Marine Force, Joint Staff J-2/Defense Intelligence Agency, and Headquarters Marine Corps Command, Control, Communications, and Computers (C4I). The CSO participated in numerous exercises and crisis operations during his time in the military. The CSO is a member of the Information Systems Audit and Control Association and a certified Information Privacy Manager from the International Association of Privacy Professionals. The CSO also completed the Harvard Kennedy School Executive Education Program in Cybersecurity and the FBI Domestic Security Executive Academy.


text: Entergy's CIO is responsible for ensuring that the organization's information technology systems, infrastructure, and applications are designed, implemented, and maintained to provide secure and reliable performance in support of Entergy's business objectives. The CIO establishes and enforces IT policies, procedures, and controls to mitigate information technology policies, procedures, and controls to mitigate information technology-related risks and provides guidance and support to the business units in the effective use of information technology resources and the management of information technology-related risks. By fulfilling these responsibilities across the three lines of defense model, the CIO plays a critical role in ensuring that Entergy's information technology-related risks are effectively identified, managed, and mitigated, thereby supporting Entergy's overall risk management and governance framework. The CIO's background includes serving in senior leadership roles, including CIO for multiple global manufacturing companies, serving on the board of directors for a telecommunications company, and consulting leadership positions providing services for numerous large, global organizations.


text: Risks from Cybersecurity Threats From time to time, we have experienced attempts by unauthorized parties to access or disrupt our information technology systems. To date, we have not experienced any known material breaches or material losses related to cyber-attacks. However, a failure of our information systems or a cybersecurity breach could materially and adversely affect our business, results of operations and financial condition. See Item 1A, "Risks related to Cybersecurity or Misappropriation of Our Critical Information."

companyName: MSA Safety Inc

ticker: MSA


text: In the event of a suspected or actual cybersecurity incident, the Security Incident Response Team (SIRT), which includes the CISO, has primary responsibility for initial identification and evaluation of potential business impacts and escalation of the incident's severity classification using pre-established criteria with a specified communication matrix and escalation thresholds. The Security Incident Commander, which role is served by rotating leaders in the CISO organization, provides tactical leadership and oversight management at the cross-functional level for the incident. The SIRT remains engaged throughout the incident response lifecycle, including detection and analysis, containment, eradication and recovery, and post-incident remediation, and coordinates with the impacted business functions, if warranted. Once a cyber incident is confirmed, the SIRT is responsible for maintaining situational awareness and continuous monitoring of the need for escalation or de-escalation of the incident's severity classification. As certain escalation thresholds are exceeded, additional levels of management notification are required by the SIRT, including notification of and recurring communication with Entergy's Incident Response Team, which includes the Chief Executive Officer, the Chief Operating Officer, the CSO, other executive management, and members of the affected business functions. Depending upon the facts, analysis, materiality, and anticipated or current impacts, the Chief Executive Officer and the General Counsel will determine the timing and cadence for communication of the cyber incident with the Board of Directors or Audit Committee.


text: Risk Management and Strategy Managing Material Risks & Integrated Overall Risk Management We assess, identify, and manage our cybersecurity risks by employing several processes, including conducting employee training, monitoring and testing our networks and systems, responding to vulnerability and threat assessments, and maintaining and refreshing backup and protective systems. Cybersecurity risk management is also a component of our overall Enterprise Risk Management ("ERM") program. Both the cybersecurity risk management component of the ERM program and associated risk management plans, including risk mitigation, are reviewed at regular intervals and updated as needed. Related reporting to management occurs on a routine basis, and the Board of Directors is updated through an established cadence via the Board's Audit Committee and the full Board.


text: The Company has an information security policy, and it provides cybersecurity training to employees on a recurring basis. As part of our processes, employees are trained on how to identify and report potential cybersecurity threats. The Company also engages in an ongoing process of risk assessments to identify and mitigate cybersecurity threats. This includes a vulnerability management program where such risks are identified, classified, and addressed. The Company conducts cybersecurity tabletop exercises to enhance mitigating controls and incident response preparedness. The Company also has incident response plans in place to address contingencies in the event of a cybersecurity incident.


text: Engage Third-parties on Risk Management As part of our cybersecurity risk management process, MSA engages a range of third parties, including consultants, advisors, and auditors, to assist with security and maturity assessments, security operations, employee training and awareness, compliance, penetration testing, network and endpoint monitoring, threat intelligence, and our vulnerability management platform. These relationships enable us to access specialized knowledge and insights with respect to our cybersecurity strategies and processes.


text: Oversee Third-party Risk We are aware of risks associated with third-party service providers, and the Company employs a third-party risk management program that includes a systematic evaluation of potential risks associated with engaging third-party vendors, suppliers or partners that may have access to Company sensitive information, systems, or networks. This process is also intended to provide for the security and integrity of the Company's data that may be stored on third-party systems. The process identifies and addresses potential security vulnerabilities, safeguarding Company information assets and reducing the overall risk of cyber threats. The Company's assessments begin during the onboarding of third parties and may continue throughout the relationship, based upon an assessment of third-party risk. Those assessments also include Company audit rights, third-party notification obligations, and security requirements for the retention of Company data. The Company maintains a team consisting of employees, contractors and consultants to oversee this process.


text: Board of Directors Oversight The Audit Committee and the Board of Directors oversee and periodically review the design and effectiveness of the Company's cybersecurity program, as well as its contingency plans. On an established cadence, the Audit Committee and the Board of Directors are briefed by the Chief Information Security Officer ("CISO") on the status and progress of the cybersecurity program, as well as on direct or emerging threats to the Company, program maturity and strategy, and third-party risk management. Additionally, the Board of Directors receives ERM program briefings that include cybersecurity risks.


text: Risks from Cybersecurity Threats Any risks from previous cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect the Company's business, financial condition, or results of operations. Such risks and incidents could have a material adverse effect in the future as cyberattacks continue to increase in frequency and sophistication. The Company also has cyber event related insurance.

companyName: MDU RESOURCES GROUP INC

ticker: MDU


text: Management's Role Managing Risk Company management is directly involved in assessing and managing risks from cybersecurity threats. The Company employs a CISO with substantial program management experience, along with a team of cybersecurity and IT professionals. The CISO reports directly to the Senior Vice President and Chief Product and Technology Officer, who is a member of the Company's Executive Leadership Team. Additionally, the CISO reports regularly on the cybersecurity program, including risks and mitigation, to the Cybersecurity Executive Steering Body. The Cybersecurity Executive Steering Body provides strategic oversight and is responsible for guiding and aligning organizational efforts to manage risks associated with cybersecurity threats. It is intended to ensure comprehensive risk management, effective policy development, and coordinated response measures to safeguard sensitive information and technology assets.


text: The Cybersecurity Executive Steering Body includes members of the Executive Leadership Team, among other senior managers, including cross-functional representation from Cybersecurity, Product and Technology, Law, Finance, and Operations departments. Collectively, the Cybersecurity Executive Steering Body has decades of enterprise risk management experience, including cybersecurity risk management.


text: Monitor Cybersecurity Incidents The Company's cybersecurity incident response plan provides a structured approach to prevent, detect, manage and mitigate a cybersecurity incident. Primary goals are to minimize harm to information technology systems and Company information, reduce recovery time, and ensure the continuity of operations. Internal resources manage and execute the Company's cybersecurity incident response plan with the support of retained external advisors. Plan testing and assessments occur to provide for the ongoing effectiveness against evolving threats. Pursuant to the plan, communication channels and escalation protocols are also maintained to engage and inform internal stakeholders – such as the Cybersecurity Executive Steering Body, corporate crisis management team, and other members of the Executive Leadership Team – of how incidents are prevented, detected, mitigated, and remediated.


text: The Company's measures to prevent and detect cyber security incidents include continuous monitoring of Company networks by a security operations team that includes a third-party managed security operations center. Employees throughout the Company are trained to report cybersecurity threats as they are identified. If an incident or suspected incident is reported, the cybersecurity team evaluates it for various factors, including severity and immediacy, pursuant to the Company's cybersecurity incident response plan.


text: Reporting to Board of Directors The CISO regularly informs the Cybersecurity Executive Steering Body of cybersecurity risks and incidents. Accordingly, the highest levels of management are informed of the cybersecurity position and risks, and significant cybersecurity matters are elevated to the Audit Committee of the Board of Directors.


text: The Company has an information security policy, and it provides cybersecurity training to employees on a recurring basis. As part of our processes, employees are trained on how to identify and report potential cybersecurity threats. The Company also engages in an ongoing process of risk assessments to identify and mitigate cybersecurity threats. This includes a vulnerability management program where such risks are identified, classified, and addressed. The Company conducts cybersecurity exercises to enhance mitigating controls and incident response preparedness. The Company also has incident response plans in place to address contingencies in the event of a cybersecurity incident.


text: Engage Third Parties on Risk Management As part of our cybersecurity risk management process, MSA engages a range of third parties, including consultants, advisors, and auditors, to assist with security and maturity assessments, security operations, employee training and awareness, compliance, penetration testing, network and endpoint monitoring, threat intelligence, and our vulnerability management platform. These relationships enable us to access specialized knowledge and insights with respect to our cybersecurity strategies and processes.


text: Oversee Third-Party Risk We are aware of risks associated with third-party service providers, and the Company employs a third-party risk management program that includes a systematic evaluation of potential risks associated with engaging third-party vendors, suppliers or partners that may have access to Company sensitive information, systems, or networks. This process is also intended to provide for the security and integrity of the Company's data that may be stored on third-party systems. The process identifies and addresses potential security vulnerabilities, safeguarding Company information assets and reducing the overall risk of cyber threats. The Company's assessments begin during the onboarding of third parties and may continue throughout the relationship, based upon an assessment of third-party risk. Those assessments also include Company audit rights, third-party notification obligations, and security requirements for the retention of Company data. The Company maintains a team consisting of employees, contractors and consultants to oversee this process.


text: To continually manage and control the material risks that cybersecurity threats present to the organization, ALLETE invests significantly in the cybersecurity elements outlined above. In addition, the Company has made significant investments to fulfill the operational and financial regulatory requirements laid out by the North American Electric Reliability Corporation Critical Infrastructure Protection Standards and Sarbanes-Oxley Act of 2002.

companyName: ALLETE INC

ticker: ALE


text: ALLETE faces a number of cybersecurity risks in connection with its business. Although such risks have not materially affected us, including our business strategy, results of operations, and financial conditions, to date, we have, from time to time, experienced threats to and breaches of our data systems, including malware, phishing and computer virus attacks. See Item 1A. Risk Factors for additional information regarding our organization's cybersecurity risks, which should be read together with this Item 1C. Cybersecurity.


text: The ALLETE board of directors provides enterprise-level oversight of risks associated with cybersecurity threats through the Audit Committee, which assists the Board in fulfilling its oversight responsibilities regarding the Company's policies and processes with respect to risk assessment and risk management, including any significant non-financial risk exposures; reviewing and discussing the Company's information security policies and internal controls regarding information security; and reviewing the Company's annual disclosures concerning the role of the Board in the risk oversight of the Company. The Audit Committee performs an annual review of the Company's cybersecurity program and receives quarterly updates on key cybersecurity risks, the cybersecurity risk management plan, and cyber incident event trends.


text: Employee Cybersecurity Training The Company provides ongoing cybersecurity training and compliance programs to facilitate education for employees who may have access to the Company's data and critical systems. Employee phishing tests are conducted on a monthly basis.


text: Cyber Governance & Oversight EOG's cybersecurity team reports to EOG's Senior Vice President and Chief Information and Technology Officer, who has served as EOG's Chief Technology Officer since 2017 and as EOG's Chief Information Officer for over 25 years.


text: ALLETE's Chief Technology Officer (CTO) has primary responsibility for the development and oversight of ALLETE's cybersecurity team and the development and maintenance of the company's related cybersecurity policies and procedures. The CTO has over 25 years' experience working in the information and operational technology field and is a registered professional engineer in the State of Minnesota. The company's cybersecurity team continuously assesses the evolving cyber threat landscape based on their expertise and that of our third-party partners. They then work with all parts of ALLETE to protect against, detect, identify, respond to, and recover from the risks that cybersecurity threats present. The cybersecurity team views and responds to cybersecurity risks in a holistic manner, applying a comprehensive multilayered strategy to prevent, detect, and mitigate them. They have identified ALLETE's critical cyber assets and taken appropriate steps to protect them. External expertise is regularly engaged to assess ALLETE's cybersecurity program and help the cybersecurity team to strengthen the organization's monitoring, alerting, prevention, mitigation, and recovery capabilities. Tabletop simulations, third-party cyber vulnerability assessments, maturity assessments, and partnerships are used to assess and refine all elements of our cybersecurity program. In addition to managing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Risk assessments are performed against third-party service providers with a specific focus on any sensitive data that is to be shared with them. The internal business owners of ALLETE's applications are required to document user access reviews regularly. We request a System and Organizational Controls (SOC) 2 report from the vendors of our enterprise cloud applications. If they do not provide us with a SOC 2, we seek additional compensating risk assurance in our contract language with them. Risks associated with the use of third-party service providers are managed as part of our overall cybersecurity risk management framework.


text: ALLETE faces a number of cybersecurity risks in connection with its business. Although we believe such risks have not materially affected us, including our business strategy, results of operations, and financial conditions, we have, from time to time, experienced threats to and breaches of our data systems, including malware, phishing and computer virus attacks. See Item 1A. Risk Factors for additional information regarding our organization's cybersecurity risks, which should be read together with this Item 1C. Cybersecurity.


text: Cybersecurity Risk Management and Strategy We are committed to protecting the confidentiality, integrity, and availability of our information assets and managing cybersecurity risks effectively. Our cybersecurity strategy focuses on proactive risk management, continuous improvement, collaboration and partnerships, and investment in security technologies.

companyName: DYCOM INDUSTRIES INC

ticker: DY


text: We face various cybersecurity risks, including unauthorized access, information leakage, malware and viruses, technical disruption, and insider threats. Identifying, assessing, and managing these risks is the foundation of our comprehensive cybersecurity framework and is integrated into our overall risk management systems and processes. We have implemented strong access controls, regular security assessments, vulnerability management, user education and awareness, monitoring, threat intelligence (including user behavior analytics), and managed detection and response to mitigate cybersecurity risks.


text: Our implementation of strong access controls includes multi-factor authentication, least privilege access, role-based access control, and network segmentation to ensure information assets are protected from unauthorized access and/or exposure.


text: We conduct regular security assessments to identify vulnerabilities, test compliance, proactively address security risks that would impact the organization, and prioritize those risks based on their likelihood and potential impact. The associated activities include performing risk, vulnerability, penetration, and compliance assessments to assist in identifying potential internal and external threats and weaknesses in our systems, networks, and applications and performing simulations to test and improve our incident response plans while building resiliency. In addition to the controls and assessments noted above, we regularly engage with our internal and external auditors and third-party cybersecurity consultants to assess our cybersecurity program, ensuring adherence to applicable industry standards, practices, and laws.


text: Our cybersecurity program also includes third-party risk management evaluation and monitoring of our suppliers, vendors, and other business partners to help identify and mitigate risks that may impact our company. We evaluate existing risks, threats, and prior cybersecurity incidents of new vendors, suppliers, and business partners using various risk assessments.


text: Cybersecurity Governance Cybersecurity governance is a critical component of our organization's overall risk management framework and an area of focus for our Board and management. Our Board has delegated primary responsibility for overseeing risks from cybersecurity threats to the Audit Committee. The Audit Committee oversees information technology and cybersecurity, including strategies, risk identification and mitigation, and data privacy protection ("Information Security").


text: Engage Third-parties on Risk Management Periodic external reviews, including penetration tests and security framework assessments, are conducted by auditors, external assessors, and/or consultants to assess and ensure compliance with the Company's information security programs and practices. Internal and external auditors assess the Company's information technology general controls on an annual basis.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes.

companyName: Personalis, Inc.

ticker: PSNL


text: The Company's Chief Information Officer has been serving in this role for the company for 17 years and has over 30 years of experience in various information security and related technology roles. The Chief Information Officer oversees an internal information security team, which works in partnership with the Company's internal audit department to review information technology-related controls with our external auditors as part of the overall internal controls process. The Chief Information Officer, who is in regular communication with the information security team, reports regularly to the Chief Executive Officer regarding vulnerabilities, new and developing threats, and compliance matters and also reports to the Audit Committee. The Audit Committee receives reports from the Chief Information Officer on a periodic basis, and more frequently, as needed, regarding cybersecurity-related matters. Such reports include updates with respect to existing and new cybersecurity risks, cybersecurity risk management and mitigation, cybersecurity incidents, as applicable, and key information security initiatives and recent developments.


text: The Company's Chief Information Officer has been serving in this role for the company for 18 years and has over 30 years of experience in various information security and related technology roles. The Chief Information Officer oversees an internal information security team, which works in partnership with the Company's internal audit department to review information technology-related controls with our external auditors as part of the overall internal controls process. The Chief Information Officer, who is in regular communication with the information security team, reports regularly to the Chief Executive Officer regarding vulnerabilities, new and developing threats, and compliance matters and also reports to the Audit Committee. The Audit Committee receives reports from the Chief Information Officer on a periodic basis, and more frequently, as needed, regarding cybersecurity-related matters. Such reports include updates with respect to existing and new cybersecurity risks, cybersecurity risk management and mitigation, cybersecurity incidents, as applicable, and key information security initiatives and recent developments.


text: Overall Risk Management The Company has implemented a cyber risk management program to help ensure that the Company's electronic information and information systems are protected from various threats. The cyber risk management program is maintained as part of the Company's overall governance, enterprise risk management program and compliance program. The Company's information systems experience ongoing and often sophisticated cyberattacks by a variety of sources with the apparent aim to breach the Company's cyber-defenses. The Company may face increased cyber risk due to the increased use of employee-owned devices and work from home arrangements. The Company is continuously reevaluating the need to upgrade and/or replace systems and network infrastructure. These upgrades and/or replacements could adversely impact operations by imposing substantial capital expenditures, creating delays or outages, or experiencing difficulties transitioning to new systems. System disruptions, if not anticipated and appropriately mitigated, could adversely affect the Company. The Company continually assesses risks from cybersecurity threats and adapts and enhances its controls accordingly.


text: Oversee Third-party Risk The Company has implemented a third-party management risk program to help monitor and reduce risks associated with the Company's vendors, which includes processes such as completing due diligence on third party service providers before engaging with them for their services; assessing the third party's cybersecurity posture by reviewing audit reports of the third party, completing cyber questionnaires, and reviewing applicable certification; including cybersecurity contractual language in contracts to limit risk; and monitoring and reassessing third party's to ensure ongoing compliance with their cybersecurity obligations.


text: Physical Security The Company safeguards assets through a standard physical security design process, including access controls, surveillance and monitoring, perimeter security controls, data center security, and incident response and reporting controls.


text: Operational Technology The Company has operation technology, consisting of the hardware and software that monitors and controls devices, processes, and infrastructure related to the Company's operational assets. Security protocols for the Company's operational technology follow applicable NERC, FERC and TSA regulations and security directives.


text: Other Risk Factors See also "Item 1A – Risk Factors – Other Risks – Technology disruptions or cyberattacks could adversely impact the Company's operations."


text: Board of Directors Oversight The board, as a whole and through its committees, has responsibility for oversight of risk management. In its risk oversight role, the board of directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are adequate for identifying, assessing, and managing risk. The audit committee of the board of directors of the Company is responsible for oversight of risks from cybersecurity threats.


text: Management's Role Managing Risk The CIO plays a large role in informing the audit committee on cybersecurity risks. The audit committee receives presentations and reports from the CIO on cybersecurity related issues which include information security, technology risks and risk mitigation programs regularly at the quarterly board meetings. In addition to scheduled meetings, the CIO and audit committee maintain an ongoing dialogue regarding emerging or potential cybersecurity risks.


text: Cybersecurity Incident Response The Company has an incident response plan to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents that is also tested on an annual basis. The incident response plan is updated based on results of the test or as new cyber related developments occur. The CIO, executive leadership which includes the chief executive officer, chief financial officer, chief accounting officer, chief legal officer, and SEC financial reporting department employees, and the board of directors are notified of any material cybersecurity incidents through a defined escalation process. The defined escalation process is a risk-based process that specifies who is to be contacted and when at each risk level.


text: Monitor, Manage, and Safeguard Against Cybersecurity Incidents and Risks The Company's CIO, along with the director of cybersecurity and a designated security team of professionals, are responsible for assessing and managing risks as well as developing and implementing policies, procedures, and practices based on the range of threats faced by the Company. There are processes around access management, data security, encryption, asset management, secure system development, security operations, network and device security to provide safeguards from a cybersecurity incident along with continual monitoring of various threat intelligence feeds.


text: Cyber Risk Management Personnel The Company's director of cybersecurity reports to the CIO. The CIO, who reports to the chief executive officer, holds a degree in Business Administration and oversees the information technology and cybersecurity portfolios for the Company with over 25 years of information technology experience and 19 years working directly in the energy and utilities business. The director of cybersecurity has a bachelor's degree in computer information systems, 25 years of information security experience, and holds certified information systems security professional and certified risk and information systems control certifications. The members of the designated cybersecurity team that report to the director of cybersecurity have a combined 57 years of experience. The other members of information technology director level leadership also responsible for managing cybersecurity risks have a combined 95 years of experience and have degrees including Bachelor of Computer Information Systems, information systems management, electronics, electrical engineering, business administration, and accounting, along with certified information systems auditor certification and a cybersecurity fundamentals certificate.


text: Cyber Risk Oversight Committee Additionally, in 2014 the board of directors established CyROC to provide executive management and the audit committee with analyses, appraisals, recommendations and pertinent information concerning cyber defense of the Company's electronic information, information technology and operation technology systems. The CyROC is responsible for guiding the Company's comprehensive cybersecurity policies. The CyROC is chaired by the Company's CIO and is comprised of members such as the chief financial officer, information technology leaders, internal auditors, and other leaders from the Company's business segments.


text: Overall Risk Management The Company has implemented a cyber risk management program to help ensure that the Company's electronic information and information systems are protected from various threats. The cyber risk management program is maintained as part of the Company's overall governance, ERM program and compliance program. The Company's information systems experience ongoing and often sophisticated cyberattacks by a variety of sources with the apparent aim to breach the Company's cyber-defenses. The Company has and may continue to face increased cyber risk due to the increased use of employee-owned devices and work from home arrangements. The Company is continuously reevaluating the need to upgrade and/or replace systems and network infrastructure. These upgrades and/or replacements could adversely impact operations by imposing substantial capital expenditures, creating delays or outages, or experiencing difficulties transitioning to new systems. System disruptions, if not anticipated and appropriately mitigated, could adversely affect the Company. The Company continually assesses risks from cybersecurity threats and adapts and enhances its controls accordingly.


text: Risks from Cybersecurity Threats Any risks from previous cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect the Company's business, financial condition, or results of operations. Such risks and incidents could have a material adverse effect in the future as cyberattacks continue to increase in frequency and sophistication. The Company also has cyber event related insurance.


text: Employee Cybersecurity Training The Company provides ongoing cybersecurity training and compliance programs to facilitate education for employees who may have access to the Company's data and critical systems. Employee phishing tests are conducted on a monthly basis.


text: Engage Third-parties on Risk Management Periodic external reviews, including penetration tests and security framework assessments, are conducted by auditors, external assessors, and/or consultants to assess and ensure compliance with the Company's information security programs and practices. Internal and external auditors assess the Company's information technology general controls on an annual basis.


text: Other Risk Factors Notwithstanding the breadth of the Company's information security program, the Company may be unsuccessful in preventing or mitigating a cybersecurity event that could have a material adverse impact. See "Item 1A – Risk Factors – Other Risks – Technology disruptions or cyberattacks could adversely impact the Company's operations."


text: Board of Directors Oversight The Company's board of directors, as a whole and through its committees, has responsibility for oversight of risk management. In its risk oversight role, the board of directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are adequate for identifying, assessing, and managing risk. The audit committee of the board of directors of the Company is responsible for oversight of risks from cybersecurity threats.