text: Risk Management and Strategy We recognize the importance of maintaining the security of our information systems and assets, and have several cybersecurity processes and controls designed to identify, assess and manage the risks associated with cybersecurity threats and cybersecurity incidents.

companyName: GLAUKOS Corp

ticker: GKOS


text: Risk Management Systems and Processes To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk management program is administered by the Company's legal and internal audit functions, and facilitates the process of identifying and assessing cybersecurity threat risks, as well as monitoring the effectiveness of our risk mitigation efforts. During the year, our senior management periodically identifies the cybersecurity risks facing the Company and reviews our mitigation plans related to these risks. These senior leaders conduct an evaluation of the severity of these identified risks and any changes to this risk level or the Company's mitigation efforts since the prior evaluation. The severity of risks is measured based upon the potential adverse impact that could result, the immediacy of the threat and the availability of mitigating factors, among other elements. Management may consult with outside consultants, such as legal counsel or cybersecurity advisors, in assessing risks and developing mitigation plans. Both the Audit Committee and the full Board regularly receive reports from such outside experts in response to emerging or higher risk areas.

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: We also have specific cybersecurity risk assessment processes which help identify our cybersecurity threat risks, including a comparison of our processes to industry standards as well as periodic third-party assessments of our programs. We compare our Information Security Program with industry standards including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and ISO 27001. In order to enhance internal expertise, members of our Information Technology (IT) department maintain various cybersecurity-related certifications. We also maintain written incident response and security policies that seek to ensure we are protected and ready to respond should a security incident occur. Incidents are investigated and analyzed for potential impact. If impact is present, the appropriate departments, key employees, and executive management team members are notified as part of the incident response process. Our incident response plan coordinates the activities we would take to respond to and recover from cybersecurity incidents, which include processes to triage, assess severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate potential liability and reputational damage. If appropriate, incidents may be reported to senior management, the Audit Committee or the full Board.

stage1Method: majority


text: To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, we undertake the activities listed below: closely monitor emerging data protection laws and implement responsive changes to our processes; conduct annual cybersecurity training for all employees and contractors who use our systems; conduct regular email phishing testing exercises for all employees to enhance awareness and responsiveness to such possible threats;


text: require employees, as well as contractors who have access to our systems or the data of our employees or customers, to treat information as confidential;


text: schedule tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes, technologies and incident response plan; and carry cyber risk insurance that provides protection (as specified in the applicable policies) against certain potential costs and losses arising from a cybersecurity incident.


text: Engagement of Third Parties As part of the above processes, we regularly engage with assessors, consultants, and other third-parties to review our cybersecurity program. These reviews are intended to evaluate the effectiveness and robustness of the security measures implemented in our networks and information systems, identifying potential vulnerabilities, performance improvements, and recommended improvement strategies. These security assessments may focus on key areas such as user access controls, data encryption processes, auditing and monitoring of database activities, system and server configuration and update procedures.


text: Threats from Third Party Service Providers Our processes also address cybersecurity threat risks associated with our use of third-party software and system providers. Third-party risks are included within our enterprise risk management assessment program, which is discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on high-risk third-parties that provide us software or have access to our systems or highly sensitive information, and monitor cybersecurity threat risks identified through such diligence. New software is evaluated for risk and approved by our internal Software Approval Board before purchase or installation on our systems.

stage1Category: Third-Party Risk


text: We formed a Software Approval Board, which is made up of cross-functional members from Quality, Internal Audit, Information Security, Business Systems, and R&D, to help determine risk and impact of any potential newly proposed software. Additionally, we generally require those high risk third parties to agree by contract to manage their cybersecurity risks in specified ways. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Material Impact of Cybersecurity Threats or Incidents We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading " Risks Related to our Business, " included as part of our risk factor disclosures at Item 1A of this Annual Report, which disclosures are incorporated by reference herein.

stage1Category: None/Other


text: The Audit Committee of our Board is responsible for the oversight of risks from cybersecurity threats. At least twice a year, the Audit Committee receives a report from the head of Information Technology of our cybersecurity threat risk management and mitigation strategy covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and potentially material cybersecurity threat risks or incidents, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives information describing current and emerging material cybersecurity threat risks, and describing the company's plans to mitigate those risks, and discusses such matters with our head of IT and other members of senior management. Potentially material cybersecurity threat risks are also considered during separate Board discussions of important matters like enterprise risk management. Two members of our Board, including one member of the Audit Committee, have earned cybersecurity certifications to help them identify cybersecurity threats and oversee management's efforts to manage and mitigate them.

stage1Category: Board Governance


text: Management Oversight While the Audit Committee reviews and oversees the Company's information security efforts, senior leadership is responsible for the day-to-day management of cybersecurity risk and the design and implementation of policies, processes and procedures to identify and mitigate this risk. Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Legal department and our Internal Audit department, working with our IT department. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

stage1Category: Management Role


text: Risk Management and Strategy As a financial institution in today's digital landscape, we understand that cybersecurity and data protection are of paramount importance to our business, our customers, and our reputation. With the proliferation of online banking and the digitalization of financial services, we recognize that our policies and procedures for safeguarding sensitive customer data must be as sophisticated as the cyber threats we are defending against. Accordingly, cybersecurity is a high-priority component of our overall risk-management system and risk-control infrastructure. We have implemented robust, multi-layer security procedures and defense strategies that aim to proactively mitigate cyber risks, enable our early detection and prevention of security incidents, minimize our vulnerability to attacks, and protect us from both internal and external cybersecurity threats.

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Commensurate with the risks we face and the sensitivity of the data and systems we are protecting, our Information Systems Security Program (ISSP) includes layers of administrative and technical safeguards designed to protect the confidentiality and integrity of sensitive information belonging to us and our employees, partners, and customers, to guard against the unauthorized access, alteration, disclosure, or destruction of that information, and to defend that information from potential, known, emerging, and evolving security risks. We have established multiple control points within our security infrastructure to reduce the risks associated with embedded technologies that could fail or be manipulated by nefarious actors, to prevent the intentional and unintentional infiltration of cybersecurity threats, and to maximize their separation from our sensitive information systems and assets. In developing our ISSP, our policies, standards, and procedures were heavily informed by and incorporated provisions from various sources of statutory and regulatory guidance as well as numerous leading industry frameworks, including the NIST Cybersecurity Framework, various NIST special publications, the Fair Information Practice Principles established by the Federal Privacy Council, the Privacy Management Framework developed by the American Institute of Certified Public Accountants, and the Center for Internet Security's Critical Security Controls.


text: Enterprise Information Systems Security Policy, which, among other objectives, prescribes a comprehensive framework for creating a practice-based Information Security Management System; protecting the confidentiality, integrity, and availability of our data and systems; providing for the development, review, maintenance, and ability to ensure the effectiveness of minimum security controls required to protect our data and systems; and recognizing the highly-networked nature of the current computing environment to provide effective company-wide management and oversight of related cybersecurity risks;


text: Corporate Account Takeover Policy, which serves to mitigate the risks of corporate account takeover crimes and to document our compliance with the Texas Department of Banking's Supervisory Memorandum 1029 on "Risk Management of Account Takeovers," dated September 30, 2019, and the FFIEC's guidance on "Authentication and Access to Financial Institution Services and Systems," dated August 11, 2021;


text: Vendor Management Policy, which provides a risk-based process for identifying, measuring, monitoring, and managing third-party relationships with new and existing vendors by requiring an assessment, categorization, and ranking of the risks associated with each third-party vendor and implements a third-party risk-management process that focuses on risk assessment, due diligence in selecting third-party vendors, contract structuring and review, and ongoing oversight of the operational and financial performance of the third-party vendor's products and services;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; regular testing of our critical systems to identify and address potential vulnerabilities; cybersecurity awareness training of our employees, incident response personnel, and senior management;

companyName: Camping World Holdings, Inc.

ticker: CWH


text: Service Center Physical Security for Data and Computing Equipment Policy, which provides directives for implementing appropriate physical security controls to protect the hardware, infrastructure, and systems that store and transmit our sensitive information and data from damage, unauthorized access, and loss of availability; to monitor, analyze, and properly disclose security alerts and information; and to administer other administrative and technical operational security procedures; and Security Incident Response Policy, which establishes the steps necessary to ensure a timely and adequate response to security incidents impacting our security systems or infrastructure.


text: Some of the steps we have taken and processes we have implemented to assess, identify, and manage material risks from cybersecurity threats include the following:


text: Forming an IT Cybersecurity Committee (ITCC), which consists primarily of members of our management team and IT department, to develop and oversee our cybersecurity policies and infrastructure and establishing a multi-tiered reporting and governance system pursuant to which our ITCC reports to our Service Center Board, which reports to our Risk Committee, which reports to our Board;


text: Implementing heightened safety measures, physical-security controls, and controlled-access requirements to protect the Service Center that houses the hardware and infrastructure used to store and transmit sensitive and confidential bank, customer, and employee information in accordance with the FFIEC IT Examination Handbook on Information Security and designating a specialized Service Center Board within the Service Center Department to oversee the protection of the Service Center's physical integrity;


text: Maintaining a clearly defined ISSP, which prescribes measures to establish and enforce our security program, addresses each component of our information security (IS) position, and advances our objectives of protecting and managing risks to our data and security systems by establishing policies, standards, controls, procedures, and guidelines that address topics such as security and privacy governance, statutory, regulatory, and contractual compliance, business and disaster recovery, change management, identification and authentication processes, expectations for continuous monitoring, asset management, third-party provider management, endpoint security, and incident responses, among others;


text: Conducting an annual self-assessment using the Cyber Risk Institute (based on the NIST Cybersecurity Framework) to review our cyber risk-management strategy and framework, assess the effectiveness and legal and regulatory compliance of our organizational cybersecurity policy, and evaluate our policies and procedures for identifying risks, protecting information, detecting security threats, responding to cyber incidents, executing recovery plans, and managing levels of external dependence and resiliency;


text: Conducting regular cybersecurity training for our employees regarding security awareness, the proper use and handling of sensitive information, and the protocols in place to identify, assess, and manage any cybersecurity threats and periodically testing employees' cybersecurity knowledge, policy compliance, and response rates by engaging with third-party providers to conduct internal social engineering campaigns;


text: Engaging in security-incident preparedness simulations and completing disaster recovery and resilience tests designed to test and strengthen any vulnerabilities in our cybersecurity infrastructure;


text: Employing robust encryption and anonymization technologies and other cybersecurity monitoring and auditing systems to fortify our cybersecurity framework, including through our Online Banking Enhanced Security Program, which requires the authorized users on a customer's account to be validated and employs multi-factor authentication (MFA), which requires each of our retail and commercial customers to authenticate their identities by entering a secure access code that our MFA system automatically generates and sends to the customer each time there is an attempted login to the customer's online banking account;


text: Implementing MFA protections for our treasury customers by prohibiting their initiation of ACH transactions or wire transfers until they authenticate their identities using a security token that is generated and sent by our online-banking MFA system; Monitoring electronic mail and other network intrusion attempts with various tools to identify and stop intrusion and malware threats;


text: Scanning and assessing vulnerabilities arising from software and hardware on our network infrastructure, ATMs, software applications, computers, copiers and other electronic assets to ensure that vulnerabilities are identified and resolved timely;


text: Establishing a risk-appetite profile, which we review at least annually to regularly assess our cybersecurity infrastructure and software systems in a manner that ensures we capture their current state and identify emerging risks that would require changes in our cyber environment;


text: Leveraging internal and external auditors as well as security consultants to review the procedures, systems, and controls that comprise our ISSP to evaluate their design and operational effectiveness and to address any operational deficiencies or security weaknesses; and Maintaining an Incident Response Plan that establishes our procedures and standards for responding to actual or potential cybersecurity threats or incidents, which we review at least annually.


text: Furthermore, our IT security infrastructure and cybersecurity policies are designed to monitor and manage security risks associated with any third-party service providers, suppliers, software and hardware vendors, contractors, and consultants we collaborate with (hereinafter, collectively, Vendors) who might store, process, collect, share, create, transmit, destroy, or access any of our sensitive data. Our Vendor Management Policy establishes clearly defined requirements of engagements with Vendors and requires them to uphold similar security standards to those we internally require. Depending on their risk level, we may subject certain Vendors to heightened security requirements, such as enhanced risk assessments, ongoing monitoring, or additional contractual controls to restrict their levels of information access.


text: IT Cybersecurity Committee. As part of our cybersecurity governance framework and for purposes of establishing and maintaining our ISSP, we have established an IT Cybersecurity Committee (ITCC), which consists predominantly of members of our management team and IT department. The ITCC is subject to oversight by the Service Center Board, the Risk Committee, and the Board. The Risk Committee of the Board works directly with the ITCC to develop and implement our policies and procedures concerning cybersecurity and data protection. As stated in the Risk Committee Charter, our Risk Committee reviews management reports on the adequacy of our data-governance activities and IT security program; evaluates risks related to customer information, significant outsourcing with third parties or Vendors, and operational outsourcing arrangements; reviews, evaluates, and updates our data-governance framework, processes, and systems for identifying, assessing, and managing data risks that impact critical business operations; and reviews and evaluates our overall risk-management framework.


text: The ITCC meets at least quarterly to discuss its oversight of our cybersecurity policies and procedures, risk-management practices and controls, and efforts to mitigate and prevent cybersecurity risks. The ITCC may meet more frequently if required by our Incident Response Plan to facilitate timely response, monitoring, risk-management, and recovery efforts. The ITCC is also charged with periodically reporting to management, the Board, and the Risk Committee, the status and results of our compliance with our security program, results of security assessments, and effectiveness of remediation activities.


text: Other Committees. In addition to the ITCC and Risk Committees, we have established a Technology Committee, a Senior Management Committee, and a Business Continuity and Disaster Recovery (BC/DR) Committee. Each oversees aspects of our ISSP and coordinates with the ITCC to implement various cybersecurity procedures.


text: Chief Information Security Officer. In addition to establishing the ITCC and other committees, we designated a Chief Information Security Officer (CISO) to oversee all aspects of our IS policies, procedures, and controls. Our CISO reports to our Senior Management Committee, the ITCC, the Risk Committee, and the Chairman of the Board. At least annually, the CISO presents all of our IS policies to the Board. The CISO is also tasked with maintaining an effective Security Awareness Program and providing training to our management, Board, and employees on an annual basis. Additionally, the CISO meets with our Audit Committee on a quarterly basis to inform them of material cybersecurity-related regulatory updates and with our full Board on a monthly basis to discuss and provide pertinent regulatory information.


text: Procedures Governing our Cybersecurity Incident Responses. Our multi-layered, cross-functional approach to cybersecurity governance provides adequate checks and balances on the implementation of our cybersecurity protocols, enables us to effectively monitor both internal and external cyber risks, and allows for the swift escalation of any potential cybersecurity incidents to the appropriate levels of management so that assessments concerning materiality, potential disclosure, and possible responsive actions can be timely made. Our approach to cybersecurity governance is modeled in the Incident Response Team (IRT) that we have established to timely address cybersecurity incidents and minimize any disruptions to our business operations and customer activities caused by cyber threats or attacks. Designated IRT personnel are available 24 hours per day, seven days per week to respond to potential incidents. Having an integrated team for incident response facilitates information sharing, which allows organizational personnel, including developers, implementers, and operators, to leverage the team knowledge of the threat in order to implement defensive measures that will deter intrusions more effectively. In the event of a potential cybersecurity incident, our IRT is responsible for implementing our Security Incident Response Policy, in accordance with which the following steps occur:


text: After becoming aware of a potential cybersecurity incident, our IT Service Desk reports the incident and any pertinent information to our CISO. Our IT Service Desk is the central point of contact for reporting computer incidents or intrusions.


text: The CISO then conducts a preliminary analysis of the incident and determines whether activating the full IRT is warranted. Types of incidents that would generally require the activation of our IRT include but are not limited to a breach of personal information, a denial-of-service (DoS) or distributed DoS attack, excessive port scans, a firewall breach, or a virus or malware outbreak.


text: At the CISO's direction, the IT Security and Engineering Teams gather intel regarding the incident and take pre-planned steps to mitigate harm, address system weaknesses, and block ongoing threats. For example, our network engineers analyze network traffic for external attacks, search for signs of a firewall breach, and take action to block a suspected intruder's network traffic; our security analysts and engineers look for indications of an attack or suspicious activity by monitoring and reviewing the network activity of our business applications and the audit logs of our mission-critical servers; and our systems administrators examine system logs of our critical systems for any abnormal activity, confirm our mission-critical computers are up to date on all service packs and patches, and ensure backups have been created for our critical systems. The CISO reports the incident to our executive management team, Service Center Board, and ITCC.


text: Our CISO, executive management team, Service Center Board, and ITCC evaluate the type and severity of the incident, review applicable legal and regulatory requirements for disclosing cybersecurity incidents, and determine whether, when, and to whom the incident must be reported.


text: Procedures Governing our Third-Party Vendor Relationships. Similar to our governance approach with respect to responding to cybersecurity incidents, we have implemented a layered, collaborative governance system to manage our third-party Vendor relationships and to implement our Vendor Management Policy. Prior to working with any Vendor, we conduct a comprehensive security screening to evaluate the Vendor's security protocols and identify any potential vulnerabilities that could compromise our sensitive data. At least annually, we also perform a security assessment of the Vendor to identify any change in the Vendor's security posture that may negatively impact the security of our information systems. Our CISO or other designated IS personnel oversees and makes a final recommendation regarding the Vendor security assessments, determines the necessity of Vendor site visits, and coordinates and provides a final report on any site visit that occurs. Our Vendor relationships are monitored by our Vendor Management Department, the day-to-day operations of which are led by our Vendor Manager. In coordination with the applicable Business Unit Manager, the Vendor Manager categorizes and ranks the risks presented by our Vendors, performs Vendor due diligence, and provides periodic reports to our Board and Risk Committee concerning Vendor risk management. Before entering into any Vendor contract, the Business Unit Manager that will be contracting for the Vendor's service or product must perform a thorough risk evaluation. In addition to working alongside the Vendor Manager to categorize and rank Vendor risks, the Business Unit Manager participates in contract review and negotiations, establishes performance-monitoring controls, and completes Vendor reviews. The CISO or other designated IS personnel may participate with the Business Unit Manager in contract negotiations as needed.


text: Procedures Governing our Corporate Account Takeover Responses. Like our approaches to responding to cybersecurity incidents and managing our Vendor relationships, our strategy for managing corporate account takeover (CATO) threats integrates organizational operations at multiple governance levels involving our Board, executive management team, members of our Senior Management of Electronic Banking Services (EBS Management Team), an Electronic Banking Services Manager (EBS Manager), and our CISO. Our Board reviews our CATO Policy for compliance with the Texas Department of Banking standards for the risk management of CATOs and charges our EBS Management Team with the responsibility of determining necessary courses of action to ensure adherence to applicable guidance and regulations. Our EBS Management Team also ensures that our CATO Policy is understood and complied with across all of our operational divisions. Some of the responsibilities of our EBS Manager include developing, implementing, and maintaining policies and procedures to comply with our CATO Policy, coordinating the performance of period risk assessments of IBC Link, our online banking product, establishing trainings for IBC Link customers regarding security controls that mitigate CATO risks, reporting CATO incidents to executive management, and coordinating with our management team and IBC Link customers if an actual or threatened CATO attack is identified. Our CISO is responsible for ensuring appropriate security controls are implemented to prevent, detect, and respond to CATOs, establishing incident-response procedures to be employed if a CATO threat is in progress, and timely notifying our primary federal regulator of any CATO incidents that are required to be disclosed to comply with applicable laws, regulations, and CATO Policy procedures.


text: Notwithstanding the robust nature of our defensive measures and security processes and the multi-layered governance system that we have established to mitigate, monitor, analyze, and respond to incidents, cybersecurity threats are increasingly difficult to detect, and the risk of a data breach or cyber-attack is pervasive and severe. While we do not believe our business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity threats or incidents, there is no assurance that we will not be materially affected by such threats or incidents in the future. We will continue to monitor cybersecurity risks, stay apprised of changes in the cyber environment, and invest in strengthening our cybersecurity infrastructure. For additional information on our risks related to cybersecurity, please see "Risk Factors—Risks Related to Our Business— Our information systems may experience an interruption or breach in security."

stage1Category: Strategy Integration


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third party risk management process for certain service providers, suppliers, and vendors.


text: We regularly experience cyberattacks and other incidents, and will continue to experience varying degrees of attacks and incidents in the future. To date, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition, however we cannot guarantee that material incidents will not occur in the future.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives briefings from our Chief Information Security Officer ("CISO") on our cybersecurity risks no less than annually. In addition, management updates the Committee in addition to the full Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Company's information security team, led by our CISO, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The CISO reports to the Chief Administrative and Legal Officer, who, together with other members of our management team, including the Chief Financial Officer, Chief Operating Officer, and Chief Accounting Officer are responsible for assessing and managing our material risks from cybersecurity threats based on regular reports from the CISO and Chief Information Officer. The CISO together with the Chief Information Officer regularly report on the status of projects to strengthen the security of our information technology systems and efforts regarding the prevention, detection, mitigation, and remediation of cybersecurity events. Reports may include briefings that have been informed by internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources in addition to alerts and reports produced by security tools deployed in the IT environment.


text: Our CISO has 25 years of experience in industries including government, retail, and manufacturing, and industry certifications including CISSP and GIAC. Our CISO also has experience in forensic investigations, strategic risk management, and security program development. The information security team has an average of 15 years of prior work experience in roles including incident response, forensics, vulnerability management network security administration, fraud prevention, and other governance, risk, and compliance areas. The team maintains subject matter expert level knowledge in cybersecurity frameworks and governance organizations such as NIST, ISO 27001, and PCI along with industry certifications commensurate with their roles.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall risk management program/information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, and routine review of our policies and procedures to identify risks and enhance our practices. We engage certain external parties to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: FRANKLIN STREET PROPERTIES CORP /MA/

ticker: FSP


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives quarterly updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our Vice President and Director of Information Technology leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Prior to his approximately 14 years overseeing and securing our information technology operations, our Vice President and Director of Information Technology held various roles during his approximately 9 years of tenure at USI New England, most recently overseeing and securing their information technology operations as Regional IT Manager. This experience is reinforced with regular cybersecurity training from industry leading organizations such as the SANS Institute and ISC2.


text: In an effort to protect our resources from cyber threats, we maintain a security program that includes multiple layers designed to prevent, mitigate, detect, defend against, and remediate these threats. These include, but are not limited to, continuous vulnerability assessment and remediation, annual penetration testing conducted by a third party, security and monitoring tools that are monitored by a 24x7 SOC (Security Operations Center) and Incident Response Planning. Additionally, all employees are required to take annual cyber security training that aligns with our risks and current cyber trends such as ransomware, BEC (business email compromise,) phishing, and social engineering.


text: Cybersecurity Risk Management and Strategy We rely on computer, information, network, and communication technology and related systems to operate our business and to protect confidential, restricted, and sensitive company, customer, and partner information. We have a multi-layered cybersecurity risk management program designed to identify risks related to the organization's digital and physical assets, review and assess existing security measures, and implement and manage solutions to mitigate cyber risks. These solutions are designed to protect our facilities, our systems, our partners, our customers, and our financial data in case we experience a cyber incident. Protection includes phishing detection, social engineering, executive targeting, brand impersonation, configuration mistakes, sensitive data leakage, leaked credentials, malicious attacks, third-party risks, vulnerabilities, insider threats (both intentional and unintentional), and password attacks. This type of ongoing vulnerability risk management is crucial as the organization and the external threat landscape evolves. This cybersecurity risk management program is incorporated as part of the Primoris Enterprise Risk Management Program.

companyName: Primoris Services Corp

ticker: PRIM


text: Our cybersecurity policies and processes are based on the controls within the National Institute of Standards and Technology ("NIST") Framework, and we engage a number of external parties to enhance our cybersecurity oversight. For example, every other year, a third-party consulting firm performs an assessment of our cyber program, measuring our program against the NIST controls with a Capability Maturity Model Integration overlay to determine the program's maturity. The assessment findings are disclosed to the Audit Committee of the Board of Directors and our cross-functional management Security Steering Committee ("SSC"). Any improvements resulting from the assessment are identified, along with action plans. We also use a third party to perform an annual Breach Assessment targeting our external and internal network environment to determine the strengths and any weaknesses within our cybersecurity processes. As part of the Breach Assessment, our Incident Response Plan is instigated and reviewed to ensure it remains current and effective for all situations. We also have multiple third-party managed Security Operations Centers ("SOC") in place; including a SOC for logging and monitoring of security events; a SOC for endpoint managed detection and response, including identity protection; a SOC for executive digital and brand protection; and a SOC for protection of network credentials.


text: In order to oversee and identify risks from cybersecurity threats associated with the Company's use of vendors and other third-party service providers, we conduct continuous passive scanning of the Primoris network, as well as Primoris vendors' external perimeter, on a regular basis to assess any potential vulnerabilities and weaknesses.


text: We face certain ongoing risks from cybersecurity threats that, if realized, could materially affect us, including our business operations, results of operations or financial condition.


text: Cybersecurity Governance and Oversight The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and governance. We also maintain a cross-functional management Security Steering Committee ("SSC"), with members consisting of executive leadership, internal audit, and enterprise risk. The SSC meets quarterly and has a formal charter outlining its responsibility to provide oversite of our comprehensive cybersecurity program. The Audit Committee of the Board of Directors is briefed quarterly by the Chief Information Officer ("CIO") on the cybersecurity program, and both the Audit Committee and SSC are notified between such updates regarding significant new cybersecurity threats or incidents. The full Board of Directors also receives regular reports from the Audit Committee.


text: The CIO chairs the SSC and oversees Primoris' cybersecurity risk management program. The CIO is supported by the head of cybersecurity, who is a direct report to the CIO. The training and experience of the head of cybersecurity includes a Harvard MBA along with professional experiences involving Forensics and Investigation, NIST controls assessments and implementation, ISO 27001 assessments and implementation, Payment Card Industry Certification, and HITRUST implementation and certification. The head of cybersecurity and the security team are responsible for leading company-wide cybersecurity strategy, policy, standards, and processes and work across the organization to assess and prepare Primoris to address cybersecurity risks. Our head of cybersecurity and the security team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to our Incident Response Plan.


text: Our employees are also an important part of protecting our digital and technical environment. A key area of the cybersecurity program is the education of employees regarding cybersecurity using security awareness training, security bulletins and phishing simulations to reinforce training on a quarterly basis. Security awareness training covers all network users. On an annual basis an Acceptable Use Policy ("AUP") is distributed to employees through our Learning Management System for understanding and acknowledgement. Additionally, all new employees are provided the AUP by Human Resources and receive initial security training upon being granted access to our network.


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our Company, including, but not limited to, financial, operational, regulatory, reputational, and legal risks. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer and Chief Technology Officer are primarily responsible for this cybersecurity component. The Chief Technology Officer is responsible for the first line of defense and has assembled a capable team of professionals with expertise in cybersecurity. The Chief Information Security Officer is a key member of the Risk Management organization, reporting directly to the Chief Risk Management Officer and, as discussed below, provides updates to the Audit & Risk Committee of our Board of Directors.

companyName: National Bank Holdings Corp

ticker: NBHC


text: The Company's cybersecurity risk management program is designed to ensure the Company's data, information systems, networks and devices are appropriately protected from a variety of threats and that our third parties with access to the Company's data take similar precautions. Regular risk assessments are conducted to validate control requirements and ensure that the Company's information is protected at a level commensurate with its sensitivity and value. Preventative and detective security controls are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission to ensure the confidentiality, integrity, and availability of Company information. These controls include, but are not limited to, access control, data encryption, data loss prevention, incident response, security monitoring, third-party risk management, and vulnerability management.


text: The Company's cybersecurity risk management program and strategy are regularly reviewed and updated to ensure that they are aligned with the Company's business objectives and are designed to address evolving cybersecurity threats and satisfy regulatory requirements and industry standards.


text: Layered security controls monitoring traffic to and within the Company that identify and block suspicious activity, with system configurations that align with industry best practices. Preventative and detective controls to identify adverse internal and external trends and analyze the Company's response mechanisms.


text: Annual network and penetration testing by reputable third-parties to evaluate the Company's suite of security controls and tools, and identify potential vulnerabilities. Regular cybersecurity and information security awareness training for associates, supplemented with recurring social engineering tests.


text: An incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident, which is tested on a periodic basis.


text: Recurring audit and oversight of all critical third-parties within the Company's digital ecosystem to identify risks and adverse trends. Our third-party risk management program is designed to ensure that our third-party providers meet our cybersecurity requirements. This includes conducting periodic risk assessments of our third-party providers requiring them to implement appropriate cybersecurity controls and monitoring third-party compliance with our cybersecurity requirements. Annual evaluation of the Company's cybersecurity insurance program, with coverage levels benchmarked against industry peers. Use of external subject matter experts to provide threat intelligence and updates on trends and emerging schemes.


text: Annual risk and self-assessments against established industry frameworks to ensure best practices are in place and the Company's risk assessment continues to evolve.


text: Annual testing from a business continuity perspective, including annual business impact analysis reviews, annual testing of all critical departments, systems and third-parties, and established back-up, replication, and restoration to help ensure continuity of operations.


text: Our internal systems, processes, and controls are designed to mitigate loss from cyberattacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected the Company's business, financial condition, and results of operations. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it will not be able to anticipate all cybersecurity breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A Risk Factors.


text: The Enterprise Technology group, in conjunction with the Enterprise Risk Management department, and most specifically within that group, the Chief Information Security Officer, are responsible for implementing and maintaining the Company's cybersecurity risk management program. The Enterprise Technology group includes cybersecurity and information risk professionals who assess, identify, and manage cybersecurity risks. Individuals within these departments are subject to professional education and certification requirements. As a governance and oversight function, the Enterprise Risk Management department measures and reports on the quality of information and cyber risk management across all functions of the Company. Cybersecurity risk is reported by both the Enterprise Risk Management and Enterprise Technology departments through monthly cybersecurity meetings with executive management and quarterly Enterprise Risk Management Committee meetings.


text: Our board of directors holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Directors and through its committees. The audit committee of the board of directors oversees the management of systemic risks, including cybersecurity, in accordance with its charter. The audit committee engages in regular discussions with management regarding our significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats.

companyName: INNOVATIVE INDUSTRIAL PROPERTIES INC

ticker: IIPR


text: The Company's Board of Directors is charged with overseeing the establishment and execution of the Company's Risk Management program and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Consistent with this responsibility the Board has delegated primary oversight responsibility over the Company's Risk Management program, including oversight of cybersecurity risk and risk management, to the Audit & Risk Committee of the Board. The Audit & Risk Committee receives regular updates on the cybersecurity program, including cybersecurity risks and incidents through direct interaction with the Chief Technology Officer, the Chief Information Security Officer and the Chief Risk Management Officer. Additionally, the Board of Directors also receives periodic updates regarding cybersecurity risks and the cybersecurity program, as well as training at least annually on the Director's role in managing cybersecurity risks.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risk, and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: PDF SOLUTIONS INC

ticker: PDFS


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process appropriate disclosure personnel will collaborate with subject matter specialists, at least annually and more frequently as necessary due to business changes or external changes, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. As part of this process, and our processes to provide for the availability of critical data and systems, maintain regulatory compliance, identify and manage our risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities, among others: maintain a risk register and risk assessment process based on The National Institute of Standards and Technology ("NIST") Cybersecurity Framework; use various third-party software testing products and services designed to test and assess the security of our software; closely monitor emerging data protection laws and implement changes to our processes designed to comply with such laws; undertake an annual review of our policies and statements related to cybersecurity;


text: proactively inform our customers of substantive changes related to customer data handling through disclosures in our SOC 2 Type 2 report or other contractually mandated disclosures; conduct annual cybersecurity training for employees and contractors with access to PDF systems and sensitive data; conduct incident management training and practice for individuals with responsibilities responding to a cyber incident;


text: conduct regular phishing email simulations for employees and contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; use findings and root cause analysis of cybersecurity incidents to improve our cybersecurity processes and technologies;


text: maintain technologies designed to provide network and endpoint monitoring, regular vulnerability assessments, and annual penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K; carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident;


text: maintain an employee handbook, Code of Conduct, and Acceptable Use policy that makes clear the importance of cybersecurity and protection of PDF and customer intellectual property; and our incident response policy and plan specify the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal and reporting obligations and mitigate brand and reputational damage. We regularly exercise and update the plan after actual incident responses or simulated incident response scenarios.


text: We subscribe to several external independent monitoring services to score and assess our externally facing network and information services and we engage a third-party security firm at least annually to conduct external and web penetration testing exercises on our corporate network and our commercial SaaS service platform.


text: Cybersecurity events and data incidents are evaluated, assessed based on severity and prioritized for response and remediation. Under our incident response plan and related policies, incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact. Our team of cybersecurity professionals then collaborate with technical and business stakeholders to further analyze the risk to the company, and form detection, mitigation and remediation strategies. As part of the above processes, we regularly engage external consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards.

companyName: uniQure N.V.

ticker: QURE


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or to our systems. Third-party risks are included within our broader overall risk assessment and management process, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers during vendor onboarding and during periodic reviews. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and regularly monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits or independent information security assessments or certifications. Additionally, we have processes designed to monitor public and federal government database and other sources for evidence of known and/or exploited vulnerabilities in third-party services including those provided as SaaS and we take action to remediate or establish compensating controls if those systems are determined to be critical to our cybersecurity. We also maintain disaster recovery plans in place for all mission critical parts of the business, although we do not have a business continuity plan developed to account for all continuity risks.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the headings "We are exposed to risks related to information technology infrastructure, information management and protection, cybersecurity threats, and cyber incidents." and "Our business is subject to evolving corporate governance and public disclosure regulations and expectations, including with respect to environmental, social and governance matters that could expose us to numerous risks." included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K. For more than 5 years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Cybersecurity Governance Information technology and data security, particularly cybersecurity, is a top area of focus for our Board of Directors, who views our focus in these areas as essential for the success of our company and the broader technology industry in which we operate. As described in the Audit Committee Charter of the Board of Directors, the Audit Committee is tasked with oversight of certain risk issues, including cybersecurity. The Audit Committee is comprised entirely of independent directors, two of whom have significant work experience related to information security issues or oversight. Management reports high severity security incidents to the Audit Committee after they are discovered. Additionally, management provides a summary four times per year of all security incidents to the Audit Committee. The full Board of Directors is also provided an annual assessment of our security program, our internal response preparedness, and assessments led by outside assessors and auditors.


text: Our Audit Committee is regularly involved in reviewing cybersecurity risk management. At least quarterly, the Vice President of Operations presents and reviews key security metrics with the Audit Committee including a review of cyber-security events, cybersecurity initiatives and new or developing cybersecurity risks relevant to the business. The Audit Committee, which comprises at least two individuals with experience in cybersecurity and related matters, meets with these members of senior management to review our information technology and data security policies and practices, and to assess current and projected threats, cybersecurity incidents, and related risks. Our Vice President of Operations reports directly to our executive management team and advises the company on cybersecurity risks and assesses the effectiveness of information technology and data security processes and business policies impacting our overall cybersecurity risk.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Vice President of Operations and a cross section of subject matter experts from Information Technology, Exensio Cloud Operations and Corporate Legal and team. Such individuals have collectively over 30 years of prior work experience in various roles involving managing information security, data privacy risks and regulatory frameworks, developing cybersecurity strategy, implementing effective information and cybersecurity programs and experience in security controls testing and the planning and executing of independent cybersecurity assessments.


text: Our Incident Response Policy is reviewed annually and documents the controls and procedures for timely and accurate reporting of material cybersecurity incidents to the relevant parties, including the Audit Committee when applicable. Our Incident Response Team leads the response to any reported cybersecurity event and comprises experts from Engineering, Information Technology, Legal, Cloud Operations, and Data Security.


text: The Vice President of Operations and Executive Vice President of Products and Solutions are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above including the incident response.


text: Risks from Cybersecurity Threats. Information relating to risks from cybersecurity threats is included in this report in Item 1A under the caption " Cybersecurity breaches or a failure in our e-commerce operations and could disrupt our business."

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: In the ordinary course of our business, we collect, use, store, and transmit confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology ("IT") systems is important to our operations and business strategy. To this end, we have documented cybersecurity policies and standards and we assess risks from cybersecurity threats and monitor information systems for potential cybersecurity issues. These processes are managed and monitored by a dedicated cybersecurity team, including third-party service providers and led by our Head of IT, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we use processes and tools to conduct vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, CROs, and other contractors and suppliers. We also conduct regular employee training on matters such as phishing and email security best practices, among other topics. In addition, we consult with outside advisors and experts when appropriate to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment.

companyName: Protagonist Therapeutics, Inc

ticker: PTGX


text: Our current Head of IT reports directly to our Chief Financial Officer and has over twenty years of experience managing information technology and cybersecurity matters, holds a Master of Science degree in Telecommunications and Computer Networks and is Project Management Professional, Certified Scrum Master and IT Infrastructure Library certified. He, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have identified and mitigated certain known cybersecurity threats, which we determined are not reasonably likely to materially affect us, and have strengthened our cybersecurity ecosystem. However, cybersecurity attack techniques change frequently, and with increased volume and sophistication of such attacks there is the potential for us to be adversely affected. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors - Significant disruptions of information technology systems or breaches of data security could adversely affect our business."


text: Our Board as a whole has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks, including oversight of cybersecurity risks. Our Board receives at least two updates each year on cybersecurity and information technology matters and related risk exposures from our Head of IT as well as other members of our senior leadership team.


text: Our Board of Directors oversees our risk management process, including risks from cybersecurity threats. Our Board of Directors reviews strategic risk exposure, and members of our management are responsible for addressing the material risks we face on a day-to-day basis. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole as well as through our Audit Committee. Our Board and our Audit Committee receive updates from time to time from our management as appropriate on cybersecurity.

companyName: GENCO SHIPPING & TRADING LTD

ticker: GNK


text: Our Chief Financial Officer, our Internal Audit Director and our external Information Technology department are primarily responsible to assess and manage material risks from cybersecurity threats and oversee key cybersecurity policies and processes. They are informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Chief Information Manager of our Information Technology department has 35 years of experience in the design, implementation, and support of information technology infrastructures with significant expertise in information technology forensics. He is assisted by two network engineers with 26 years of information technology experience with a focus on information technology forensics.


text: Network and information systems and other technologies play an important role in our business activities. We also obtain certain confidential, proprietary and personal information about our charterers, personnel, and vendors. To protect our data, we have employed cybersecurity protocols which are designed to work in tandem with internal controls to safeguard our information technology environment. Our information technology infrastructure is designed with commercial flexibility, data integrity, and safety in mind. We utilize a layered approach of systems and policies intended to provide a secure operating environment and promote business continuity. Our hardware and software systems are equipped with technology intended to offer access and intrusion protection, software and communications systems protections, and mitigate cybersecurity threats.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information maintained in them.


text: We manage and oversee a cybersecurity risk program designed to evaluate potential threats, vulnerabilities, and the potential impact on our operations, data, and stakeholders. This program undergoes regular reviews and updates to address emerging risks. Our process for addressing risk aligns with industry standards as outlined in the NIST Cybersecurity Framework, NIST Risk Management Framework, and CIS Top 18 Security Controls.


text: We conduct regular risk assessments to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. As part of our risk management process, we may engage third party experts to help identify and assess risks from cybersecurity threats. For example, an outside consulting firm conducts a National Institute of Standards and Technology and International Organization for Standardization based cybersecurity capability maturity assessment every two years, which is reviewed with our Chief Financial Officer. We also perform penetration tests, data recovery testing, security audits and risk assessments throughout the year. We hold online cybersecurity trainings for our employees. Our risk management process also encompasses cybersecurity risks associated with our use of third-party service providers. Following these risk assessments, we design, implement, and maintain safeguards intended to minimize the identified risks; address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards.


text: The Company also maintains a cyber liability insurance policy. See Item 1 – "Business – Insurance – Cyber Liability Insurance" in this report.


text: While we develop and maintain protocols, controls, and systems, that seek to prevent cybersecurity incidents from occurring, we must constantly monitor and update these protocols, controls, and systems in the face of sophisticated and rapidly evolving attempts to overcome them. The occurrence of cybersecurity incidents could cause a variety of material adverse impacts on our business, although no such incident has had any such impact to date. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this report, including the risk factor entitled "Security breaches and other disruptions to our information technology infrastructure could interfere with our operations and expose us to liability." and Item 1, "Business – Environmental and Other Regulations - Safety Management System Requirements" in this report.


text: Risk Management and Strategy Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems are necessary for the operation of our business. We use these systems, among others, to manage our tenant and vendor relationships, for internal communications, for accounting and record-keeping functions, and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including confidential information that is proprietary, strategic or competitive in nature, and tenant data ("Information Systems and Data").


text: We rely on a multidisciplinary team, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, using manual and automated tools, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, and conducting threat and vulnerability assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, systems monitoring, employee training, and penetration testing.


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, conducting security assessments, and conducting periodic reassessments during their engagement.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K, including "The occurrence of cyber incidents or cyberattacks could disrupt our operations, result in the loss of confidential information and/or damage our business relationships and reputation," for additional discussion about cybersecurity-related risks.


text: Our management, represented by our Chief Operating Officer, Catherine Hastings, leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. Ms. Hastings is an experienced risk management professional, having previously served as our Chief Financial Officer and Treasurer from 2017 until March 2023, and as Vice President, internal audit of BioMed Realty Trust, Inc. (formerly NYSE: BMR) until December 2016, having joined BioMed Realty in 2009. Ms. Hastings currently oversees key functions for our development, asset management, human resources and information technology functions, including cybersecurity risk oversight and the development and enhancement of internal controls designed to prevent, detect, address, and mitigate the risk of cyber incidents. Since 2016, we have retained a third-party information technology specialist to develop and maintain our information technology infrastructure and network, who has extensive experience in the development of business processes, system infrastructure design and cybersecurity for large-scale, institutional real estate companies.


text: Management is responsible for helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Management is responsible for approving cybersecurity processes, reviewing cybersecurity assessments and other cybersecurity-related matters, and responding to cybersecurity incidents, including reporting to the audit committee for certain cybersecurity incidents. Our management team also evaluates the potential impact of cybersecurity incidents to determine materiality. This evaluation considers factors such as the nature and scope of the incident, and its effects on operations, assets, or reputation. The audit committee holds quarterly meetings and receives periodic reports from management, including our Chief Operating Officer and third-party information technology expert, concerning our significant cybersecurity threats and risks and the processes we have implemented to address them.


text: We use various tools and methodologies, including third-party services, to assess, identify, and manage cybersecurity threats. For example, we utilize third-party services to monitor the security and integrity of our information systems and the other third-party information systems upon which we rely on an ongoing basis. We also engage a third-party cybersecurity auditor for regular penetration and vulnerability testing and assessment of our processes. Our information technology department oversees cybersecurity risk management and reports significant incidents to management. We consult with our advisors as appropriate, including on materiality analysis and disclosure matters, and management makes the final materiality determinations and disclosure and other compliance decisions.

companyName: Solid Power, Inc.

ticker: SLDP


text: The Board has delegated primary responsibility for oversight of our cybersecurity risk exposures to the Audit Committee, and the Audit Committee receives routine updates on cybersecurity matters from management. Our Chief Financial Officer, Mr. Paprzycki, oversees our information technology department and has helped to develop our information systems and processes. Our information technology department works closely with Mr. Paprzycki and other members of management to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: We have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, but we cannot guarantee that we will not be materially affected in the future by such risks or any future cybersecurity incidents. For more information, see "Part I, Item A. Risk Factors—Risks Related to Legal and Regulatory Compliance—We may be adversely impacted by a disruption or failure of our information technology infrastructure, data security breach, or failure to comply with privacy laws."


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, the risk of intellectual property theft, fraud, harm to employees or third parties with which we conduct business and violation of data privacy or security laws.


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business are identified and addressed through a multi-faceted approach that consists of third-party assessments, testing of our information systems and information technology security. To defend against, detect and respond to cybersecurity incidents, we, among other things: have enabled regular monitoring of our environment by a combination of external partners and internal security tools, conduct employee trainings, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.


text: Consistent with our cybersecurity risk management policies and controls, we have prepared an incident response plan with several components, including: (i) engagement of a third party security operations center for regular vulnerability scanning and technical monitoring of our systems, (ii) detection and analysis of cybersecurity incidents that present risk of unauthorized access to company assets, including the escalation and triaging of incidents that present acute risks to our business, (iii) containment, eradication and data recovery, and (iv) post-incident analysis. Such incident responses are overseen by leaders from our information technology, finance, legal and compliance teams.


text: As part of our risk management process, we engage outside providers to conduct periodic internal and external penetration testing of our systems, networks and web properties. We also employ internal security testing solutions and security awareness training for all employees.

companyName: Verastem, Inc.

ticker: VSTM


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management team. Our board of directors has delegated responsibility to the Audit Committee for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive regular updates from senior management, including leaders from our information technology, legal and compliance teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, information on how management is addressing and/or mitigating those risks, cybersecurity incidents (if any) and status on key information security initiatives.


text: Despite our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business. For a discussion of cybersecurity risks applicable to us, see Part I, Item 1A, Risk Factors, under the heading "Our internal computer systems, or those of our collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs" in this Annual Report on Form 10-K.


text: Risk Management and Strategy Our Board of Directors and management team recognizes the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. Our cybersecurity risks are considered individually as part of our enterprise risk management program alongside other risks, and prioritized and discussed with our Board of Directors.

companyName: Norwegian Cruise Line Holdings Ltd.

ticker: NCLH


text: Our internal Security Operations Center ("SOC") has primary responsibility for assessing, identifying, and managing material risks associated with cybersecurity threats, and provides information security monitoring for both shoreside and shipboard information systems and applications. The SOC is a team comprised of cybersecurity professionals who are responsible for real-time incident response management for our IT infrastructure, which includes our websites, applications, databases, servers, network devices and components and workstations. They are trained and equipped to identify, contain, analyze and investigate any perceived security threats as well as assist internal users with any information security questions or reported issues, such as phishing/scam emails, information security concerns and security solution related access or performance issues.


text: As part of our cybersecurity program, team members are offered cybersecurity training and participate in awareness programs including phishing simulation exercises, regular cybersecurity newsletters and reminders and programming and events during cybersecurity awareness month.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those who have access to our customer, prospect, supplier or employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We generally require that third-party service providers that access, host our data, or could otherwise introduce cybersecurity risk to us, enter into contracts that obligate them to manage their cybersecurity risks in certain ways and report any cybersecurity incidents to us.


text: We engage third-party advisory firms to conduct assessments of the maturity of our security program and, among other measures, work to be Payment Card Industry ("PCI") compliant where required. We also maintain incident response procedures and business continuity and contingency plans and periodically hire third parties to conduct vulnerability analyses. We also compare our processes to standards set by the National Institute of Standards and Technology ("NIST") and/or International Organization for Standardization ("ISO"), as appropriate.


text: The Technology, Environmental, Safety and Security ("TESS") Committee of our Board of Directors oversees our programs and policies related to data protection and cybersecurity and receives updates on related risks from our Chief Information Security Officer on at least an annual basis, and more often as the circumstances require. The Audit Committee of our Board of Directors also receives updates, at least annually, from our Chief Information Officer and/or Chief Information Security Officer regarding cybersecurity and other information system compliance matters that may pose risks to our financial reporting or operations.


text: Our Chief Information Security Officer is responsible for our overall data security and cybersecurity risk reduction efforts, including information security compliance, training and awareness and application, network and system security. Our Chief Information Security Officer has 25 years of prior experience in the fields of information systems, cybersecurity, risk management, and infrastructure management. Our Chief Information Security Officer holds master's and bachelor's degrees in both Computer Information Systems and Business Administration and the following certifications: Certified Internal Controls Auditor (CICA), Payment Card Industry Professional (PCIP), Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA) and Certified in Risk and Information Systems Control (CRISC).


text: Identify We establish an understanding of our critical operational assets and those that could be attractive to potential threat actors. We consider any cyber activity that could diminish an asset's value, hinder our ability to use or access the asset, or covertly allow a threat actor to gain access to an asset as a potential risk.


text: We discuss risks related to cybersecurity threats under the heading "Breaches in data security or other disturbances to our information systems and other networks or our actual or perceived failure to comply with requirements regarding data privacy and protection could impair our operations, subject us to significant fines, penalties and damages, and have a material adverse impact on our business, financial condition and results of operations" included as part of our risk factor disclosures in Item 1A of this Annual Report, which disclosures are incorporated by reference herein. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business, including our business strategy, results of operations, or financial condition and any expenses we have incurred from cybersecurity incidents were immaterial.


companyName: NCL CORP Ltd.


text: The Technology, Environmental, Safety and Security ("TESS") Committee of NCLH's Board of Directors oversees our programs and policies related to data protection and cybersecurity and receives updates on related risks from our Chief Information Security Officer on at least an annual basis, and more often as the circumstances require. The Audit Committee of our Board of Directors also receives updates, at least annually, from our Chief Information Officer and/or Chief Information Security Officer regarding cybersecurity and other information system compliance matters that may pose risks to our financial reporting or operations.


text: Assess We evaluate the exposure of our assets to identified cyber risks and the potential impacts on our operations or reputation if we were unable to access or utilize an asset or realize its value, or if a threat actor gained access to an asset or its value. We also assess the potential materiality of these risks based on their potential impact on our operations or reputation.


text: Manage We apply a multi-layered defense strategy to maintain our ability to access or utilize an asset or its value and prevent threat actors from gaining or increasing their access to an asset or its value. We prioritize our defensive mechanisms, including administrative, procedural, and technical controls, based on their cost-effectiveness and their ability to reduce risk.


text: Periodically, we engage consultants and other third parties to assist in the continued improvement of our cybersecurity program. These engagements are designed to enhance our cybersecurity posture, and we work closely with these experts to help us identify and address vulnerabilities. Examples of these engagements include penetration testing, risk assessments, and cybersecurity control audits.


text: We maintain policies and procedures to oversee and identify cybersecurity risks associated with our third-party service providers, especially those with access to customer and employee data. Our selection and oversight of these providers incorporate cybersecurity considerations, including contractual and other mechanisms to mitigate and continually monitor risks.


text: We undertake proactive activities to prevent, detect, and minimize the impact of cybersecurity incidents. We maintain an incident response plan to respond to breaches and minimize disruption to our operations swiftly. The incident response process is consistently tested and reviewed through simulated incidents. To bolster the incident response process, we have business continuity, contingency, and recovery plans to ensure operational resilience during a cybersecurity incident. Previous cybersecurity incidents guide continuous improvements in our governance, policies, procedures, and technology. We use these lessons to strengthen our cybersecurity defenses.


text: Cybersecurity threats and risks, to include any previous cybersecurity incidents, have not materially affected, or are not reasonably likely to materially affect, our business strategy, results of operations, or financial condition. We have not, as of the date of this filing, experienced a cybersecurity breach that has materially affected our business or financial condition. However, because our business involves the collection, transmission, and storage of certain customer and employee data, it is possible that we could be susceptible to various cybersecurity threats, including cyberattacks, unauthorized access, and similar events.


text: We are committed to the ongoing identification and management of cybersecurity risks as part of our business strategy, financial planning, and capital allocation. We strive to incorporate cybersecurity considerations into all aspects of our operations. As the cybersecurity landscape evolves, so does our strategy to identify and mitigate these risks. We continuously work towards enhancing our processes to ensure an effective cybersecurity posture. Board of Directors and Management Governance.


text: Board of Directors Oversight. We recognize the critical importance of cybersecurity and data protection and understand the potential harm to our business from cybersecurity incidents. Accordingly, we place a high priority on mitigating risks associated with cybersecurity threats and any cybersecurity incidents.


text: Company management maintains primary responsibility for the risk management of the Company, including cybersecurity risks. The Board's Audit Committee is responsible for the oversight of risks associated with cybersecurity threats. The Audit Committee Charter provides that the Committee is responsible for reviewing management's assessment of the Company's information technology process framework and practices and the controls implemented to monitor and mitigate information technology risks. In addition, as part of the Audit Committee's quarterly meetings and as provided for in its Charter, the Committee receives reports and briefings from the Company's Chief Information Officer (CIO), Director of Cybersecurity, and management's cybersecurity team. Those reports and briefings include management's review of emerging cybersecurity developments and threats, the Company's risk relating to cybersecurity, and the Company's strategy to mitigate data protection and cybersecurity risks. The Audit Committee has the authority to obtain advice and input from external cybersecurity resources to assist in its oversight functions.


text: Management's Role. Our management team is actively engaged in assessing and managing material risks from cybersecurity threats. We have established a robust framework for identifying, evaluating, and mitigating these risks.


text: Responsibility for Cybersecurity Risks. Our CIO has developed expertise in cybersecurity, compliance, enterprise architecture and design, data analytics, digital transformation, and customer service through years of experience in the information technology space. Our Director of Cybersecurity is designated as the senior executive responsible for cybersecurity and reports directly to our CIO. He has a comprehensive information technology background with 30 years of information technology experience, to include 10 years of systems architecture and design, 12 years of management, and 14 years of service in managing, or assisting in managing, cybersecurity related risks.


text: To support the CIO and Director of Cybersecurity in managing cybersecurity risks, we established a cross-functional cybersecurity team that includes experts in various aspects of information security. Combined, this team of employees includes individuals with over 85 years of prior work experience in cybersecurity and data protection. These individuals are responsible for the day-to-day implementation of our cybersecurity program.


text: Additionally, the cybersecurity management team regularly consults with additional resources, to include attorneys, accountants, human resources personnel, and other information technology specialists, to determine materiality for cybersecurity related risks and incidents. There is an established Incident Response Plan that clearly identifies escalation measures based on the impact to our organization.


text: Processes for Monitoring and Mitigating Risks and Incidents. We employ a comprehensive set of processes to monitor and mitigate cybersecurity risks. These processes include: Continuous monitoring of network traffic and systems for signs of potential threats. Regular vulnerability assessments and penetration testing to identify and address weaknesses. Implementation of cybersecurity measures, such as firewalls, intrusion detection systems, and data encryption. Employee training and awareness programs to educate staff about cybersecurity best practices. Incident response plans to ensure swift and effective responses to cybersecurity incidents. Software and Vendor Risk Assessments. Vulnerability management solution to prioritize patches based on risk. Privileged account management solutions for administrative access.


text: These processes are designed to prevent cybersecurity incidents, but also allows our organization to quickly detect and respond to incidents if they do occur. They are regularly reviewed and updated to adapt to evolving cybersecurity threats.


text: If any incidents occur, we have a comprehensive Incident Response Plan in place. The Plan includes materiality qualifiers based on the size and scope of the incident. Furthermore, there is an escalation matrix that identifies who is directly involved with managing the incident based on the severity. An Incident Report is compiled for all incidents, regardless of materiality. Management reviews the incident reports and ensures all incidents are mitigated and remediated effectively. These reports are shared with the CIO, CFO, and Audit Committee so they can effectively manage resources to reduce risk and prevent future incidents.


text: Reporting to the Board. As noted above, our CIO, Director of Cybersecurity, and cybersecurity team provide quarterly updates and reports to our Audit Committee on cybersecurity risks as well as a review of the processes described above. Our management personnel are also required to provide more frequent updates to the Audit Committee on major developments regarding cybersecurity matters. The Committee, in turn, provides regular updates to the Board on these matters.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall risk management program/information technology function. These processes are designed to help protect our information assets and operations from internal and external cyber threats, protect employee, vendor, and collaborator information from unauthorized access or attack, and secure our networks and systems. They include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations, and routine review of our policies and procedures to identify risks and improve our cybersecurity risk management practices. We engage certain external parties, including consultants with expertise in information security, cybersecurity incident response, and governance, to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party information technology service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: Voyager Therapeutics, Inc.

ticker: VYGR