text: Management Governance The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by the Enterprise Information Security Steering Committee, led by the CISO. The CISO leverages his decades of experience building and leading cybersecurity programs and teams. The CISO has over 20 years of experience as a Chief Information Security Officer in multiple industries and has received Certified Information Systems Security Professional ("CISSP") and Certification in Risk Management Assurance ("CRMA") certifications. The CISO is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation and response to cybersecurity threats and incidents and is regularly engaged to determine whether the cybersecurity program is functioning effectively in the face of evolving cybersecurity threats.


text: Members of the Enterprise Information Security Steering Committee also include the Global Data Privacy Officer, Chief Technology Officer, Chief Administrative Officer, the General Counsel, and the Global Risk Officer of Protiviti.

companyName: ROBERT HALF INC.

ticker: RHI

secItem: Item 1C

stage1Category: Management Role

stage1Method: majority


text: Specifically, the Enterprise Information Security Steering Committee typically meets at least four times per year, or with greater frequency as necessary, to: • review with management the Company's cybersecurity threat landscape, risks and data security programs, and the Company's management and mitigation of cybersecurity risks and incidents; • review with management the Company's compliance with applicable information security and data protection laws and industry standards; • discuss with management the Company's cybersecurity, technology and information systems policies, including the guidelines and policies established by the Company to assess, monitor and mitigate the Company's significant cybersecurity, technology and information systems related risk exposures; and • review and provide oversight on the Company's crisis preparedness with respect to cybersecurity, including cybersecurity incident response preparedness, communication plans and business continuity capabilities.

stage1Category: Board Governance

stage1Method: unanimous


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats The Enterprise Information Security Steering Committee utilizes a CIRP to: (1) prepare for and protect against cybersecurity incidents; (2) detect and analyze cybersecurity incidents; and (3) contain, eradicate and appropriately report on cybersecurity events. In the event of a cybersecurity incident, the CIRP provides a framework to coordinate the response. The CIRP also addresses escalation protocols to senior management with respect to disclosure determinations related to a cybersecurity incident and provides for Executive Team briefings as appropriate. If the CIRP's initial investigation of the facts of a cybersecurity incident indicates the need for escalation for potential disclosure, the process in the Cyber Disclosure Procedure will be utilized, The Cyber Disclosure Procedure establishes a flexible and context dependent process for determining whether a cybersecurity incident ("Incident") constitutes a material issue pursuant to the rules and regulations of the Securities and Exchange Commission ("SEC"). A committee of senior management personnel is established to assess potential cybersecurity Incidents. Standing members of the Cyber Disclosure Committee ("CDC") include President and Chief Executive Officer, Chief Financial Officer, General Counsel, Global Privacy Officer and Chief Technology Officer.

stage1Category: Risk Management Process


text: In considering the materiality of an Incident the CDC may consider the nature, extent and potential magnitude of the risks to the Company related to the Incident, particularly as it may relate to any compromised information or the business and scope of Company operations. If the CDC determines the Board should be notified, a meeting will be called with the Executive Committee of the Board, the Audit Committee Chair, the Board's cybersecurity expert or any combination or subset of the foregoing.


text: EIS conducts annual security reviews of critical vendors. Vulnerabilities in third-party systems and software are monitored and managed through the Security Insights Program vulnerability management program. This program aggregates findings from the vulnerability detection and secure configuration management tools within a dashboard, which allows EIS personnel to focus on high priority matters.


text: Specifically, the Enterprise Information Security Steering Committee typically meets at least four times per year, or with greater frequency as necessary, to: • review with management the Company's cybersecurity threat landscape, risks and data security programs, and the Company's management and mitigation of cybersecurity risks and incidents; • review with management the Company's compliance with applicable information security laws and industry standards; • discuss with management the Company's cybersecurity, technology and information systems policies, including the guidelines and policies established by the Company to assess, monitor and mitigate the Company's significant cybersecurity, technology and information systems related risk exposures; and • review and provide oversight on the Company's crisis preparedness with respect to cybersecurity, including Incident response preparedness, communication plans and business continuity capabilities.


text: EIS employs a variety of measures to prepare for and protect against, detect, contain and eradicate cybersecurity incidents and threats. The preparatory and protective measures EIS has in place include, but are not limited to, password protection, multi-factor authentication, internal and external penetration testing, cybersecurity assessments, industry benchmarking, and annual cybersecurity awareness trainings for employees as well as social engineering awareness efforts. To detect and prevent cybersecurity incidents, the cybersecurity program uses automated event-detection technology monitored by the cyber defense team, notifications from employees, vendors or service providers and other tools. The Company has relationships with a number of third-party service providers to assist with cybersecurity incident response, containment and remediation efforts, including a forensic investigation firm, insurance providers and various law firms. While the Company maintains a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, the Company may not be able to detect threats in a timely manner or anticipate and implement adequate security measures. For additional information, see "Item 1A Risks Related to the Company's Information Technology, Cybersecurity and Data Protection".


text: Cybersecurity Risks The Company is currently not aware of any material cybersecurity incidents or threats that have impacted the Company or its business, financial condition, results of operations, employees, or customers in the past fiscal year. However, the Company and its customers routinely face risks of cybersecurity incidents, wholly or partially beyond the Company's control, as the Company relies heavily on information technology systems. Although the Company makes efforts to maintain the security and integrity of the Company's information technology systems, these systems and the proprietary, confidential internal and customer information that resides on or is transmitted through them, are subject to the risk of a cybersecurity incident or disruption, and there can be no assurance that the Company's security efforts and measures and those of the Company's third- party providers will prevent breakdowns or incidents affecting the Company's or the Company's third-party providers' databases or systems that could adversely affect the Company's business. For a discussion of these risks, see "Item 1A Risks Related to the Company's Information Technology, Cybersecurity and Data Protection."

stage1Category: Strategy Integration


text: As part of the Company's broader information security program, the cybersecurity program includes a defense-in-depth model that utilizes a variety of techniques and tools for protecting against, detecting, responding to and recovering from cybersecurity incidents ("Incidents"). The Company's cybersecurity program is designed to prioritize detection, analysis and response to known and anticipated cyber threats and effectively manage cyber risks and resilience against Incidents. The Company's program aligns its program using portions of several industry and regulatory frameworks to measure its program and progress, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), NIST 800-53, International Organization for Standardization Information Security Management Systems ("ISO 27001"), the CIS Critical Security Controls and the System and Organization Controls 2 Type 2 ("SOC2 Type 2").


text: Cybersecurity Governance The Company's cybersecurity strategy and risk management is overseen by the Board of the Directors (the "Board") and implemented and managed by the Company's Enterprise Information Security Steering Committee, a cross-functional team of senior executives representing business functions across Robert Half and chaired by the Chief Information Security Officer ("CISO"). The CISO oversees the Enterprise Information Security team ("EIS").


text: Board Governance The Board views cybersecurity as part of the Company's overall enterprise risk management function, which the Board oversees. The Board takes cybersecurity into account as part of the Company's business strategy, financial planning and capital allocation.


text: The Board oversees the Company's information security program, which includes oversight of the cybersecurity program and management of cybersecurity risks. The Board receives annual updates from the Company's CISO, and/or members of the executive leadership team. Such reports typically address, among other things, the Company's cybersecurity strategy, initiatives, key security metrics, business response plans and the evolving cyber threat landscape, and a detailed threat assessment relating to information technology risks. Notice of potential material Incidents to the Board is provided for in the Cybersecurity Incident Playbook (the "Playbook") and the Cybersecurity Incident Disclosure Control Procedure (the "Cyber Disclosure Procedure").


text: Management Governance The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by the Enterprise Information Security Steering Committee, led by the CISO. The CISO leverages his 15-plus years of experience building and leading cybersecurity programs and teams. The CISO has experience as a Chief Information Security Officer in multiple industries and has received Certified Information Systems Security Professional ("CISSP") and Certification in Risk Management Assurance ("CRMA") certifications. The CISO is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation and response to cybersecurity threats and incidents and is responsible for determining if the cybersecurity program is functioning effectively in the face of evolving cybersecurity threats.


text: Members of the Enterprise Information Security Steering Committee also include the Global Data Privacy Officer, Chief Technology Officer, Chief Administrative Officer, the General Counsel and the Global Risk Officer of Protiviti.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats The Cybersecurity Incident Response Team ("CIRT") and/or the Crisis Management Team ("CMT") utilize a Cybersecurity Incident Response Plan (the "CIRP") and the Playbook to: (1) prepare for and protect against Incidents; (2) detect and analyze Incidents; and (3) contain, eradicate and appropriately report on cybersecurity events. In the event of an Incident, the CIRP provides a framework to coordinate the response. The CIRP and Playbook also address escalation protocols to senior management with respect to disclosure determinations related to an Incident and provides for Executive Team briefings as appropriate. If the CIRT's initial investigation of the facts of an Incident indicates the need for escalation for potential disclosure, the CMT will utilize the process in the Playbook and the Cyber Disclosure Procedure will be utilized.


text: The Playbook provides understandable and flexible processes for analyzing and responding to Incidents. In the event of an Incident, the Playbook provides the CMT with predefined steps to follow to respond to, and escalate, cyber security incidents, as appropriate.


text: The Cyber Disclosure Procedure establishes a flexible and context-dependent process for determining whether an Incident constitutes a material issue pursuant to the rules and regulations of the SEC. A committee of senior management personnel is established to assess potential Incidents. Standing members of the Cyber Disclosure Committee ("CDC") include the President and Chief Executive Officer, Chief Financial Officer, General Counsel, Global Privacy Officer and Chief Technology Officer.


text: EIS conducts cybersecurity evaluations, reviews and due diligence of (i) critical vendors periodically and (ii) all new vendors prior to onboarding. Vulnerabilities in third-party providers' information security environments and software are monitored and managed through EIS' vulnerability management program. This program aggregates findings from the vulnerability detection and secure configuration management tools within a dashboard, which allows EIS personnel to focus on high priority matters.

stage1Category: Third-Party Risk


text: EIS employs a variety of measures to prepare for and protect against, and detect, contain and eradicate cybersecurity incidents and threats. The preparatory and protective measures EIS has in place include, but are not limited to, password protection, multi-factor authentication, internal and external penetration testing, cybersecurity assessments, industry benchmarking, annual cybersecurity awareness trainings to employees, and social engineering awareness efforts. To detect and prevent Incidents, the cybersecurity program uses automated event-detection technology monitored by the cyber defense team, notifications from employees, vendors or service providers, and other tools. The Company has relationships with a number of third-party service providers to assist with Incident response and containment and remediation efforts, including a forensic investigation firm, insurance providers, auditors, consultants, assessors and various law firms. While the Company maintains a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, the Company operates with, and plans for, the notion that it is impossible to prevent or detect all Incidents, that Incidents will occur, and that the Company will not always be able to detect threats in a timely manner or anticipate and implement adequate security measures. For additional information, see Item 1A. "Risks Related to the Company's Information Technology, Cybersecurity and Data Protection."


text: Cybersecurity Risks The Company is currently not aware of any material cybersecurity incidents or threats that have impacted the Company or its business, financial condition, results of operations, employees or customers in the past fiscal year. However, the Company and its customers routinely face risks of Incidents, as the Company relies heavily on information technology systems. Although the Company makes efforts to maintain the security and integrity of the Company's information technology systems, these systems and the proprietary, confidential internal and customer information that resides on or is transmitted through them are subject to the risk of a cybersecurity incident or disruption, and there can be no assurance that the Company's security efforts and measures and those of the Company's third-party providers will prevent breakdowns or incidents affecting the Company's or the Company's third-party providers' databases or systems that could adversely affect the Company's business.


text: The Information Security Director, who reports to the CIO, is responsible for establishing basic policies and procedures related to cybersecurity. The Information Security Director is also responsible for selecting the CIRT and the CIC to lead the response to each incident. Established policies and procedures are employed by the CIRT in planning and executing a response to a cybersecurity incident. The CIO and the Information Security Director have over 55 combined years of information technology and program management experience and have served over 31 combined years in the Company's corporate information security organization. They are familiar with the Company's cybersecurity landscape, risks and best practices for mitigation of those risks identified.

companyName: Coca-Cola Consolidated, Inc.

ticker: COKE


text: (iv) cybersecurity operations designed to prepare, identify, contain, eradicate, and recover from cyber-related incidents; and (v) identity and access management defining global practices for access, authentication, and authorization to technology systems.

companyName: EXPEDITORS INTERNATIONAL OF WASHINGTON INC

ticker: EXPD


text: Information security, including cybersecurity, is the risk of unauthorized access, use, disclosure, disruption, modification, recording or destruction of the firm's information or systems. As a large company in the financial services industry, we do business with a large number of clients, counterparties, and third-party service providers, and the nature of Schwab's business involves the secure processing, storage, and transmission of confidential information about our clients and us. We process, record, and monitor a high volume of transactions, and our operations are highly dependent on the integrity of our technology systems. As a result, we face extensive cybersecurity risks. It is through a combination of specialized internal and external teams, coupled with security software tools, that Schwab identifies, assesses, and manages material cybersecurity risk, and implements and enhances over time our cybersecurity policies, procedures, and strategies to reduce risk. We also maintain processes and procedures for identifying and investigating cybersecurity threats and remediation should an incident occur. Though the impact of prior cybersecurity events experienced by the Company has not been material to the Company's strategy, results of operations, or financial condition, we continue to face increasing cybersecurity risks.

companyName: SCHWAB CHARLES CORP

ticker: SCHW


text: CSC's Board of Directors oversees management's processes for risk management, and the Risk Committee of the Board of Directors assists the Board in fulfilling its oversight responsibilities with respect to managing risks, including cybersecurity risks. Integrated within the Company's overall enterprise risk management program, Schwab has an established information security program that knits together complementary tools, controls, and technologies to protect systems, client accounts and data. We continuously monitor the systems and work collaboratively with government agencies, law enforcement, and other financial institutions to address potential threats. We deploy advanced monitoring systems to identify suspicious activity and deter unauthorized access by internal or external actors. We also maintain policies, standards, and procedures, which apply to employees, contractors, and third parties, regarding the standard of care expected with all data, whether the data is internal company information, employee information, or non-public client information. This includes limiting the number of employees who have access to clients' personal information and internal authentication measures enforced to protect against the unauthorized use of employee credentials. All employees who handle sensitive information are trained in privacy and security. Schwab also engages with external firms specializing in discrete areas of cybersecurity to assess the Company's practices, vulnerabilities, and overall cyber risk posture.


text: Schwab's corporate cybersecurity program is led by our Chief Information Security Officer (CISO), who reports to our Chief Information Officer (CIO). The current CISO has been in his role for several years, and is responsible for our overall cybersecurity strategy, security engineering, security operations, cyber threat detection and incident response, and technology risk and compliance. Our CISO has extensive experience assessing and managing cybersecurity risk, and is supported by a cybersecurity organization comprised of hundreds of professionals, many of whom hold various certifications such as Certified Information Systems Security Professional, Certified Information Security Manager, and Certified in Risk and Information System Control. Our CISO and CIO attend meetings of and present to the Risk Committee of CSC's Board of Directors on our prevention, detection, mitigation, and remediation efforts of our cybersecurity program. We also have an escalation process in place to inform senior management and the Board of Directors of material cybersecurity incidents in a timely manner.


text: See Item 1A. Risk Factors for additional information on cybersecurity risk. See also Part II – Item 7 – Risk Management for additional information on the Company's Enterprise Risk Management Framework, including further discussion of the Company's risk governance and the management of related risks.

stage1Category: None/Other


text: As a large company in the financial services industry, we do business with a large number of clients, counterparties, and third-party service providers, and the nature of Schwab's business involves the secure processing, storage, and transmission of confidential information about our clients and us. We process, record, and monitor a high volume of transactions, and our operations are highly dependent on the integrity of our technology systems. As a result, we face extensive cybersecurity risks. It is through a combination of specialized internal and external teams, coupled with security software tools, that Schwab identifies, assesses, and manages material cybersecurity risk, and implements and enhances over time our cybersecurity policies, procedures, and strategies to reduce risk. We also maintain processes and procedures for identifying and investigating cybersecurity threats and remediation should an incident occur. Despite our efforts to protect our systems and data, there can be no assurance that we are able to maintain effective preventive measures against all cybersecurity risks, especially because attacks can originate from a wide variety of sources, and the techniques used change frequently and may not be immediately recognizable. Though the impact of prior cybersecurity events experienced by the Company has not been material to the Company's strategy, results of operations, or financial condition, we continue to face increasing cybersecurity risks.


text: The Company has developed a matrix to assist in determining if a cybersecurity incident is significant. The Information Security Director, with the help of the CIRT, determines whether an incident should be escalated to executive management, including to the Chief Executive Officer, the Chief Financial Officer and the General Counsel, based on its significance. Once escalated, executive management determines the appropriate incident handling strategy, with input from the Information Security Director, including whether the incident warrants immediate notification to the Audit Committee of the Board of Directors. After determining the incident handling approach, the CIC regularly updates executive management on incident response progress to ensure it is aware of the business risks posed by the incident until the incident is resolved.


text: CSC's Board of Directors, supported by the Board Risk Committee, oversees Schwab's enterprise risk management process and policies, including cybersecurity risks. Integrated within the Company's overall enterprise risk management program, Schwab has an established information security program that is regularly assessed against formal industry standards and knits together complementary tools, controls, and technologies to protect systems, client accounts, and data. We deploy advanced monitoring systems to identify suspicious activity and deter unauthorized access by internal or external actors, and work collaboratively with government agencies, law enforcement, and other financial institutions to address potential threats. We evaluate and manage risk related to third-party vendors, assessing their cybersecurity programs and practices both prior to onboarding and over the term of service. We also maintain policies, standards, and procedures, which apply to employees, contractors, and third parties, regarding the standard of care expected with all of our data, whether the data is internal company information, employee information, or non-public client information. This includes limiting the number of employees who have access to clients' personal information and internal authentication measures enforced to protect against the unauthorized use of employee credentials. Employees who handle sensitive information are trained in privacy and security, including training on recognizing social engineering. Schwab also engages with external firms specializing in discrete areas of cybersecurity to assess the Company's practices, vulnerabilities, and overall cyber risk posture.


text: Schwab's corporate cybersecurity program is led by our Chief Information Security Officer (CISO), who reports to our Chief Information Officer (CIO). The current CISO has been in his role for several years, and is responsible for our overall cybersecurity strategy, security engineering, security operations, cyber threat detection and incident response, and technology risk and compliance. Our CISO has extensive experience assessing and managing cybersecurity risk, and is supported by a cybersecurity organization comprised of hundreds of professionals, many of whom hold various certifications, such as Certified Information Systems Security Professional, Certified Information Security Manager, and Certified in Risk and Information System Control. Our CISO and CIO regularly review our cybersecurity program and our prevention, detection, mitigation, and remediation efforts with management level risk committees and the Board Risk Committee, and we maintain a process for timely escalation of significant risk events to senior management and the Board.


text: See Item 1A. Risk Factors for additional discussion on information security risks. See also Part II – Item 7 – Risk Management for additional information on the Company's Enterprise Risk Management Framework, including further discussion of the Company's risk governance and the management of related risks.


text: Risk Management and Strategy The Company is committed to maintaining robust processes to assess, identify and mitigate material risks from cybersecurity threats and to protect against, detect and respond to cybersecurity incidents. We integrate these processes into the Company's overall risk management program and, through the Company's Cybersecurity Incident Response Plan, we document the intended processes and the roles and responsibilities of teammates involved in assessing, identifying and managing material risks from cybersecurity threats. Periodically, the Company engages third parties to assist in the assessment and ongoing development of cybersecurity processes.


text: Our cybersecurity processes are grounded in the National Institute of Standards and Technology Cybersecurity Framework and include a number of different preventative measures. The Company performs periodic risk assessments of systems and applications to identify risks, vulnerabilities and threats in systems and software, performs an annual assessment of the effectiveness of the current cybersecurity response process by conducting incident response tabletop exercises that involve participation by members of the management team, and requires all teammates to participate in user awareness training for information technology and cybersecurity.


text: Our systems are reasonably designed to enable the information technology infrastructure group to capture application, system and network alerts. In the event of a cybersecurity incident, the Cyber Incident Response Team (the "CIRT"), led by a designated Cyber Incident Coordinator (the "CIC"), is responsible for collecting and analyzing relevant data about the incident and its risks. Members of the CIRT, including the CIC, are selected based on their knowledge of either cybersecurity or the specific information systems or business function affected by the incident.


text: As part of planning for any suspected cybersecurity incident, the CIRT has developed certain incident response strategies to help collect and preserve forensic data, to mitigate the threat and to perform other activities to restore systems to normal operation. These strategies include many of the practices recommended by the U.S. Department of Homeland Security's Industrial Control Systems Computer Emergency Response Team. In addressing and resolving a significant cybersecurity incident, the Company may engage external experts in relevant fields, such as legal or forensic services, as needed. The Company also has a process whereby the Chief Information Officer (the "CIO") periodically meets with and assesses third-party service providers in order to help ensure the Company is made aware of any potential material cybersecurity threats or incidents in a timely manner. The Company's largest external service provider is CONA, as further discussed in "Item 1A. Risk Factors" of this report.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also regularly receives briefings from management on our cyber risk management process. Board members receive presentations on cybersecurity topics from management or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: KLA CORP

ticker: KLAC


text: The Board of Directors delegates oversight of information technology and cybersecurity to the Audit Committee of the Board of Directors. As part of this oversight, information technology leadership annually provides a detailed cybersecurity update to the Audit Committee. Additionally, on a quarterly basis, the Audit Committee receives a summarized cybersecurity update, including the results of teammate phishing testing programs and the results of the quarterly cybersecurity disclosure questionnaires. In the event of a material cybersecurity incident, the Audit Committee will report such incident to the full Board of Directors.


text: As part of planning for any suspected cybersecurity incident, the CIRT has developed certain incident response strategies to help collect and preserve forensic data, to mitigate the threat and to perform other activities to restore systems to normal operation. These strategies include many of the practices recommended by the United States Department of Homeland Security's Industrial Control Systems Computer Emergency Response Team. In addressing and resolving a significant cybersecurity incident, the Company may engage external experts in relevant fields, such as legal or forensic services, as needed. The Company also has a process whereby the Chief Information Officer (the "CIO") periodically meets with and assesses third-party service providers in order to help ensure the Company is made aware of any potential material cybersecurity threats or incidents in a timely manner. The Company's largest external service provider is CONA, as further discussed in "Item 1A. Risk Factors" of this report.


text: During 2024, there were no identified cybersecurity risks or threats, including as a result of previous cybersecurity incidents, that had, or were reasonably likely to have, a material effect on our business strategy, results of operations or financial condition. While we maintain cybersecurity insurance, the costs related to cybersecurity incidents or disruptions may not be fully insured. See "Item 1A. Risk Factors" for a discussion of cybersecurity risks.


text: The Information Security Director, who reports to the CIO, is responsible for establishing basic policies and procedures related to cybersecurity. The Information Security Director is also responsible for selecting the CIRT and the CIC to lead the response to each incident. Established policies and procedures are employed by the CIRT in planning and executing a response to a cybersecurity incident. The CIO and the Information Security Director have over 56 combined years of information technology and program management experience and have served over 32 combined years in the Company's corporate information security organization. They are familiar with the Company's cybersecurity landscape, risks and best practices for mitigation of those risks identified.


text: Risk Management and Strategy Amgen has a multi-layered and iterative approach towards assessing, identifying, managing and mitigating risks from cybersecurity threats. The Company's Digital, Technology & Innovation (DTI) function is designed to support our productivity, innovation and outreach globally through the quality delivery of information systems, solutions and services for our business and operations. The DTI function has a Cybersecurity & Digital Trust (CDT) team that assesses and reduces cybersecurity exposure, including by providing employees with training and resources to identify potential cybersecurity threats and implementing information technology security practices. The CDT team also monitors for cybersecurity threat activity and seeks to mitigate the impact from cybersecurity incidents by deploying information security engineers, system architects, analysts and cybersecurity specialists to provide monitoring, reporting and management of cybersecurity incidents.

companyName: AMGEN INC

ticker: AMGN


text: To evaluate the progress of its activities, our DTI function uses various industry and regulatory frameworks as guides to assess the state of the Company's cybersecurity program maturity and controls, including our organizational, people, physical and technological controls. The CDT team also conducts reviews and evaluations of our cybersecurity resilience program with Amgen's Cybersecurity & Digital Trust Governance Council (which includes leaders from information security, compliance, regulatory affairs, manufacturing, audit, law and business development functions).


text: Our cybersecurity risk management program is considered by and integrated into our Company-wide Enterprise Risk Management program, and shares common methodologies, reporting channels and governance processes that apply across the Enterprise Risk Management program to that of other enterprise level risks (such as product development, safety and surveillance, financial and intellectual property risks). Regular evaluations are conducted of the greatest risks to our business and their underlying risk drivers as well as the associated mitigation activities, maturity and controls. This program is overseen by our Executive Vice President and Chief Financial Officer and guided by the Enterprise Risk Council, a cross-functional group of the Company's business leaders representing key business functions that is chaired by our Chief Audit Executive. The results of the enterprise risk evaluations and the status and operation of the Enterprise Risk Management program are presented to our Board of Directors, which oversees the Company's enterprise-level risks.


text: Further, our corporate audit function is responsible for assessing risk and testing whether, and the extent to which, our information security policies and practices are being implemented effectively within our business and by third party providers. Findings from such reports and related corrective action plans are shared with our CDT team, Company leadership, and the Audit Committee and Corporate Responsibility and Compliance Committee (CRCC) of our Board of Directors. In addition to leveraging the Company's own information technology resources, our Incident Response and Cyber Threat Intelligence teams engage, as needed, third-party cybersecurity risk assessors and consultants to assist in recognizing threats, identifying security vulnerabilities, and evaluating the impact of cybersecurity attacks and incidents when they occur. On a biennial basis, our DTI organization also engages external third-party experts to assess the Company's cybersecurity control maturity across the organization and develops plans to address such experts' recommendations.


text: Our CDT function has processes to oversee and identify the risks of cybersecurity threats associated with third-party service providers and monitors and works to mitigate the impact of cybersecurity incidents encountered by our third-party service providers. Upon becoming aware of cybersecurity incidents encountered by our third-party service providers, the CDT function's Incident Response and Cyber Threat Intelligence teams are deployed to evaluate and mitigate the impact of such incidents on our business.


text: Despite our layered controls and cybersecurity efforts, the Company and its third-party vendors have experienced cyberattacks and information security vulnerabilities, and while such incidents have not had a material adverse effect on the Company, there can be no assurance that future cybersecurity attacks or incidents would not result in a material adverse effect on our business strategy, results of operations or financial condition. For examples of such matters and a discussion of the risks that we face, see Item 1A. Risk Factors—A breakdown of our information technology systems, cyberattack or information security breach could significantly compromise the confidentiality, integrity and availability of our information technology systems, network-connected control systems and/or our data, interrupt the operation of our business and/or affect our reputation. However, we have not identified risk from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition.


text: Risk Management and Strategy Amgen has a multi-layered and iterative approach towards assessing, identifying, managing and mitigating risks from cybersecurity threats. The Amgen Technology & Medical Organizations (ATMOS) function is designed to support our productivity, innovation and outreach globally through the quality delivery of information systems, solutions and services for our business and operations. The ATMOS function has a Cybersecurity & Digital Trust (CDT) team that assesses and reduces cybersecurity exposure, including by providing employees with training and resources to identify potential cybersecurity threats and implementing information technology security practices. The CDT team also monitors for cybersecurity threat activity and seeks to mitigate the impact from cybersecurity incidents by deploying information security engineers, system architects, analysts and cybersecurity specialists to provide monitoring, reporting and management of cybersecurity incidents.


text: Our Board of Directors oversees an enterprise-wide approach to risk management, including risks related to information systems and cybersecurity, and each Board committee has primary risk oversight responsibilities aligned with its areas of focus. At each regular meeting of the Board, the Board receives and considers reports from each of its committees, and such reports provide additional detail on significant risk management issues as appropriate, including cybersecurity. The CRCC is the committee that has primary oversight responsibility for the Company's information systems and management of cybersecurity and receives reports from our Senior Vice President and Chief Information Officer (CIO) and Chief Information Security Officer (CISO) that includes reviews of our information systems strategy, technology investments, cybersecurity risks and incidents, and third-party risk management, as well as an annual evaluation of the Company's cybersecurity status. The Board's Audit Committee has oversight responsibility of our internal controls, assurances and financial risks. The Audit Committee is provided with copies of materials presented to our CRCC by our CIO and CISO and receives reports from our CIO regarding topics including integration or implementation of new financial systems and key controls and governance designed to address cybersecurity risks associated with the use of such new financial systems.


text: Our management team, including our CIO and CISO, supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information systems environment.


text: Our CISO, who heads our CDT team and is accountable for the Company's cybersecurity risk management program, joined the Company's information systems organization in 2016, is a Certified Information Systems Security Professional and is certified in risk and information systems control. Previously, our CISO served in both leadership and operational positions as a cybersecurity professional in the U.S. government and was a cybersecurity consultant, providing a wide range of cybersecurity services to various U.S. government agencies and departments. Our DTI organization is led by, and our CISO is overseen by, our CIO, who has held roles of increasing responsibility within our information systems organization since 2001 and has developed his knowledge and skills in the cybersecurity area over the course of his career in information systems. Our inaugural Executive Vice President and Chief Technology Officer (CTO), effective as of the end of 2023, oversees our CIO. Prior to the establishment of the CTO role, our CIO was overseen by our Executive Vice President and Chief Financial Officer.


text: As leaders of the DTI organization and CDT function, respectively, the Company's CIO and CISO are informed about and monitor significant cybersecurity threats and incidents through the Company's internal cybersecurity reporting structure. Our CDT team is responsible for monitoring and detecting cybersecurity threats and incidents. Our CDT team, overseen by our CISO, is also responsible for the mitigation and remediation of cybersecurity incidents. When members of the CDT team detect a cybersecurity threat or incident or are made aware of a cybersecurity incident encountered by a third-party service provider, the discovery is communicated to the Incident Response team, which includes our CISO and other senior members of the CDT function. The Incident Response team evaluates the severity of the cybersecurity threat or incident and shares its findings with our CISO.


text: Our CISO and/or his senior team leaders, in addition to our CIO and CTO, also provide regular reports to executives leading our finance, compliance, law and human resources functions on potentially significant cybersecurity incidents and the progress made towards mitigation and remediation of those incidents. These leaders oversee reporting to our CRCC and Audit Committee, and reporting of such cybersecurity incidents are included in the course of regular meetings of such committees. Additionally, in appropriate circumstances, reporting of potentially significant cybersecurity incidents are made directly to the leaders of our CRCC and Audit Committee or directly to the Board of Directors outside of their regular meeting schedule. Further, in support of our internal controls, our CISO also reviews cybersecurity matters and trends with our accounting and law functions on a quarterly basis.


text: Information Systems Acquired from Horizon Therapeutics plc On October 6, 2023, we completed our acquisition of Horizon. Horizon's legacy information systems are currently maintained separately from Amgen's preexisting information system infrastructure. After we are able to fully evaluate Horizon's legacy information systems, protocols and practices, we plan to operationally integrate the legacy Horizon systems into our own, and these integrated systems will then be subject to Amgen's cybersecurity risk management structure and strategy. While we integrate these systems, our CISO and CDT function are engaging in cybersecurity risk management activities, and any cybersecurity incidents detected on the legacy Horizon information systems are assessed, mitigated and remediated by our CDT function's Incident Response and Cyber Threat Intelligence teams and reported in accordance with the governance processes detailed above. See Item 1A. Risk Factors—Our efforts to collaborate with or acquire other companies, products, or technology, and to integrate the operations of companies or to support the products or technology we have acquired, may not be successful, and may result in unanticipated costs, delays or failures to realize the benefits of the transactions and Item 1A. Risk Factors—A breakdown of our information technology systems, cyberattack or information security breach could significantly compromise the confidentiality, integrity and availability of our information technology systems, network-connected control systems and/or our data, interrupt the operation of our business and/or affect our reputation.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Offerpad Solutions Inc.

ticker: OPAD


text: To evaluate the progress of its activities, our ATMOS function uses various industry and regulatory frameworks as guides to assess the state of the Company's cybersecurity program maturity and controls, including our organizational, people, physical and technological controls. The CDT team also conducts reviews and evaluations of our cybersecurity resilience program with Amgen's Cybersecurity & Digital Trust Governance Council (which includes leaders from CDT, Worldwide Compliance and Business Ethics, Regulatory Affairs, Operations, R&D, Global Commercial Operations, Corporate Audit, Law and Business Development functions).


text: Our cybersecurity risk management program is considered by and integrated into our Company-wide Enterprise Risk Management program and shares common methodologies, reporting channels and governance processes that apply across the Enterprise Risk Management program to that of other enterprise level risks (such as product development, safety and surveillance, financial and intellectual property risks). Regular evaluations are conducted of the greatest risks to our business and their underlying risk drivers as well as the associated mitigation activities, maturity and controls. This program is overseen by our Executive Vice President and Chief Financial Officer and guided by the Enterprise Risk Council, a cross-functional group of the Company's business leaders representing key business functions that is co-chaired by our Chief Audit Executive. The results of the enterprise risk evaluations and the status and operation of the Enterprise Risk Management program are presented to our Board of Directors, which oversees the Company's enterprise-level risks.


text: Further, our corporate audit function is responsible for assessing risk and testing whether, and the extent to which, our information security policies and practices are being implemented effectively within our business and by third party providers. Findings from such reports and related corrective action plans are shared with our CDT team, Company leadership, and the Audit Committee and Corporate Responsibility and Compliance Committee (CRCC) of our Board of Directors. In addition to leveraging the Company's own information technology resources, our Incident Response and Cyber Threat Intelligence teams engage, as needed, third-party cybersecurity risk assessors and consultants to assist in recognizing threats, identifying security vulnerabilities and evaluating the impact of cybersecurity attacks and incidents when they occur. On a biennial basis, our ATMOS also engages external third-party experts to assess the Company's cybersecurity control maturity across the organization and develops plans to address such experts' recommendations.


text: In connection with our adoption of artificial intelligence (AI) tools in our business, including AI tools customized for our business and a variety of Amgen-built tools for use across applications, the Company established an AI Governance Council composed of cross-functional leadership that oversees the safe adoption of third-party AI services, including by establishing guardrails to reduce risks and allocating resources to provide staff training on the proper use of AI and responsible AI practices. The AI Governance Council is co-sponsored by our Chief Compliance Officer and Senior Vice President, Artificial Intelligence & Data.


text: Our management team, including our CIO and CISO, supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information systems environment.


text: Our CISO, who heads our CDT team and is accountable for the Company's cybersecurity risk management program, joined the Company's information systems organization in 2016, is a Certified Information Systems Security Professional and is certified in risk and information systems control. Previously, our CISO served in both leadership and operational positions as a cybersecurity professional in the U.S. government and was a cybersecurity consultant, providing a wide range of cybersecurity services to various U.S. government agencies and departments. Our CISO is overseen by our CIO, who has 27 years of experience in information systems (including over 14 years at the Company and more than 6 years as a senior technology executive outside of Amgen), and holds a Computer Information Systems B.S. and an Information Technology Management MBA. Our Executive Vice President and Chief Technology Officer (CTO) leads our ATMOS function and oversees our CIO.


text: As leaders of the Technology and CDT functions within ATMOS, respectively, the Company's CIO and CISO are informed about and monitor significant cybersecurity threats and incidents through the Company's internal cybersecurity reporting structure. Our CDT team is responsible for monitoring and detecting cybersecurity threats and incidents. Our CDT team, overseen by our CISO, is also responsible for the mitigation and remediation of cybersecurity incidents. When members of the CDT team detect a cybersecurity threat or incident or are made aware of a cybersecurity incident encountered by a third-party service provider, the discovery is communicated to the Incident Response team, which includes our CISO and other senior members of the CDT function. The Incident Response team evaluates the severity of the cybersecurity threat or incident and shares its findings with our CISO.


text: Our CISO and/or his senior team leaders, in addition to our CIO and CTO, also provide regular reports to executives leading our Finance, Compliance, Law and Human Resources functions on potentially significant cybersecurity incidents and the progress made towards mitigation and remediation of those incidents. These leaders oversee reporting to our CRCC and Audit Committee, and reporting of such cybersecurity incidents is included in the course of regular meetings of such committees. Additionally, in appropriate circumstances, reporting of potentially significant cybersecurity incidents is made directly to the leaders of our CRCC and Audit Committee or directly to the Board of Directors outside of their regular meeting schedule. Further, in support of our internal controls, our CISO also reviews cybersecurity matters and trends with our Accounting and Law functions at least on a quarterly basis.


text: Information Systems Acquired from Horizon Therapeutics plc On October 6, 2023, we completed our acquisition of Horizon. Certain Horizon legacy information systems are maintained separately from Amgen's preexisting information system infrastructure. We are continuing to operationally integrate and transition the legacy Horizon systems into our own, with the integrated systems becoming subject to Amgen's cybersecurity risk management structure and strategy. While we are integrating these systems, our CISO and CDT function are engaging in cybersecurity risk management activities, and any cybersecurity incidents detected on the legacy Horizon information systems are assessed, mitigated and remediated by our CDT function's Operations, Incident Response and Cyber Threat Intelligence teams and reported in accordance with the governance processes detailed above. See Item 1A. Risk Factors—Our efforts to collaborate with or acquire other companies, products, or technology, and to integrate the operations of companies or to support the products or technology we have acquired, may not be successful, and may result in unanticipated costs, delays or failures to realize the benefits of the transactions and Item 1A. Risk Factors—A breakdown of our information technology systems, cyberattack or information security breach could significantly compromise the confidentiality, integrity and availability of our information technology systems, network-connected control systems and/or our data, interrupt the operation of our business and/or affect our reputation.


text: Risk Management and Strategy Peoples has a comprehensive Enterprise Risk Management program ("ERM Program"), which includes policies and processes for assessing, identifying and managing material risks from cybersecurity threats to Peoples and its customers. Peoples' information security policy and procedures are reviewed and assessed on an annual basis and as needed throughout the year by the Risk Committee of the Board. Peoples assesses itself against the Federal Financial Institutions Examination Council's ("FFIEC") Cybersecurity Assessment Tool ("CAT") on a quarterly basis. Additional assessment of Peoples' cybersecurity capabilities is performed by consultants, and regulators annually. Identified risks resulting from these assessments are documented, rated and mitigated by Peoples Bank's Chief Information Security Officer ("CISO"), with oversight by the Risk Committee.

companyName: PEOPLES BANCORP INC

ticker: PEBO


text: Peoples also has a third-party risk management program pursuant to which Peoples performs annual reviews of third-party vendors as to their cybersecurity and business continuity capabilities to ensure they meet the stated requirements and the risk appetite of Peoples as documented in Peoples' information security policy. Vendors not meeting Peoples' risk requirements are notified of necessary improvements and, if the vendors cannot mitigate the identified risks, Peoples looks to identify alternative vendors. Documentation of performance of the third-party risk assessments is retained and acknowledged by appropriate Risk and Information Security employees of Peoples.


text: Roles and Responsibilities Peoples' Board of Directors provides oversight of risks from cybersecurity threats primarily through the Risk Committee of the Board. The Risk Committee is comprised of all of the independent directors of the Board, along with Peoples' Chief Executive Officer ("CEO"), and is responsible for oversight of Peoples' risk management policies, programs and processes. The Risk Committee is organized and conducts its business pursuant to a written charter adopted by the Board. At least annually, the Risk Committee reviews and reassesses the adequacy of its charter and recommends any proposed changes to the full Board as necessary to reflect changes in regulatory requirements, authoritative guidance and evolving practices. The Risk Committee provides a report to the entire Board at each meeting of the Board of Directors regarding the overall risk condition of the firm and whether Peoples risk remain within its stated risk appetite.


text: Peoples' Chief Risk Officer ("CRO") reports to the Risk Committee and the Chief Operating Officer and has primary responsibility for the design and implementation of the ERM Program. The ERM Program establishes Peoples' risk appetite, monitors key risk and performance indicators, identifies key risks within the firm, designs and executes specific risk initiatives and monitors risk mitigation efforts and control processes. The CRO updates the Risk Committee quarterly on the overall risk condition of Peoples inclusive of any cybersecurity issues or threats.


text: Peoples Bank also has an executive governance structure which includes the Capital and Risk Management Committee ("CRMC"). The CRMC, which is comprised of individuals representing each of the functional areas of Peoples and its subsidiaries, meets monthly and is responsible for the review of risk issues faced by Peoples, including material risks from cybersecurity threats. Summaries of the topics and discussions at CRMC meetings are provided to the Risk Committee along with an overview and recommendations regarding key risks and mitigating actions.


text: The CISO has primary responsibility for assessing and responding to material risks from cybersecurity threats. The current CISO is an experienced Information Security and Information Technology officer with 21 years of experience in Information Security and Information Technology and a master's degree in business administration. The CISO is also a Certified Information Systems Security Professional ("CISSP"), which is an industry recognized certification that recognizes cybersecurity professionals with the knowledge, skills and abilities to lead an organization's information security program. On a quarterly basis, the CISO updates the Risk Committee on the state of cybersecurity and potential risks to Peoples' to be considered by the Risk Committee.


text: Assessment and Response to Cybersecurity Threats Peoples employs an in-depth, layered, defensive approach that leverages people, processes, and encryption and multi-factor authentication technology to manage and mitigate cybersecurity threats. Peoples employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Peoples and the CISO leverage several technologies and a third-party Managed Security Service Provider to monitor and respond to cybersecurity threats. In the event that the CISO assesses a material risk from a potential cybersecurity threat, the CISO immediately notifies and works with Peoples' Crisis Management Team, which includes Peoples' General Counsel, to appropriately respond and mitigate the threat. If necessary, third-party resources will be engaged, with the support of Peoples' cyber insurance provider, to mitigate the cybersecurity threat, perform forensic activities and distribute appropriate notifications to impacted parties and/or regulators. In the event a material cybersecurity incident occurs that requires notification to the Board of Directors, the General Counsel and CEO will coordinate notifications to the Board of Directors and provide updates to the Board of Directors as needed.


text: While Peoples has implemented security controls and processes to mitigate against cybersecurity threats, Peoples cannot be certain that these measures will be successful. The threat from cybersecurity attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date, Peoples has not detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, Peoples' systems and those of its customers and third-party service providers are under constant threat and it is possible that Peoples could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by Peoples and Peoples' customers. Any breach, compromise or disruption of its information security or systems as a result of a cybersecurity incident or threat could result in damage to Peoples' reputation, loss of customer business, increased costs of incentives to customers or business partners in order to maintain their relationships, litigation, increased regulatory scrutiny and potential enforcement actions, repairs of system damage, increased investments in cybersecurity (such as obtaining additional technology, making organizational changes, deploying additional personnel, training personnel and engaging consultants), increased insurance premiums, and loss of investor confidence and a reduction in the price of Peoples' common shares, all of which could result in financial loss and material adverse effects on Peoples' results of operations and financial condition.


text: Risk Management and Strategy Peoples has a comprehensive Enterprise Risk Management program ("ERM Program"), which includes policies and processes for assessing, identifying and managing material risks from cybersecurity threats to Peoples and its customers. Peoples' information security policy and procedures are reviewed and assessed on an annual basis and as needed throughout the year by the Risk Committee of the Board. Peoples assesses itself against the Federal Financial Institutions Examination Council's ("FFIEC") Cybersecurity Assessment Tool ("CAT") on a quarterly basis. Beginning in 2025, Peoples will assess itself using the Cyber Risk Institute Tool ("CRIT") on at least an annual basis. Additional assessment of Peoples' cybersecurity capabilities is performed by consultants and regulators annually. Identified risks resulting from these assessments are documented, rated and mitigated by Peoples Bank's Chief Information Security Officer ("CISO"), with oversight by the Risk Committee.


text: Roles and Responsibilities Peoples' Board of Directors provides oversight of risks from cybersecurity threats primarily through the Risk Committee of the Board. The Risk Committee is comprised of all of the independent directors of the Board, along with Peoples' Chief Executive Officer ("CEO"), and is responsible for oversight of Peoples' risk management policies, programs and processes. The Risk Committee is organized and conducts its business pursuant to a written charter adopted by the Board. At least annually, the Risk Committee reviews and reassesses the adequacy of its charter and recommends any proposed changes to the full Board as necessary to reflect changes in regulatory requirements, authoritative guidance and evolving practices. On at least a quarterly basis, Peoples' Chief Risk Officer provides a report to the Risk Committee regarding the overall risk condition of Peoples and whether it is within Peoples' stated risk appetite.


text: Peoples' Chief Risk Officer ("CRO") reports to the Risk Committee and the CEO and has primary responsibility for the design and implementation of the ERM Program. The ERM Program establishes Peoples' risk appetite, monitors key risk and performance indicators, identifies key risks within the firm, designs and executes specific risk initiatives and monitors risk mitigation efforts and control processes. The CRO updates the Risk Committee quarterly on the overall risk condition of Peoples inclusive of any cybersecurity issues or threats.


text: The CISO has primary responsibility for assessing and responding to material risks from cybersecurity threats. The current CISO is an experienced Information Security and Information Technology professional with over 25 years of experience specializing in cyber defense, vulnerability management, security operations, recovery management and as a Windows system engineer. On a quarterly basis, the CISO updates the Risk Committee on the state of cybersecurity and potential risks to Peoples' to be considered by the Risk Committee.


text: Overall Process and Governance We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. An analysis of the impact, likelihood, and management preparedness of cybersecurity threats to our strategic priorities is integrated into our enterprise risk management program. This provides cross-functional and geographical visibility, as well as executive leadership oversight, to address and mitigate associated risks. We engage third party experts as well as our internal information technology ("IT") audit group to audit our information security programs, and the results are reported to our executive management and the Audit Committee.

companyName: TEAM INC

ticker: TISI


text: In managing material risks from cybersecurity threats, we require that a security and technical architecture review is conducted for all new software and applications, and for all changes to the underlying IT infrastructure that manages, processes, stores, or transmits our data or data of our customers, vendors, suppliers, joint ventures, or employees. Any deviations from our IT security policies and standards are assessed by our IT security team. Any critical and high-risk levels are identified, documented and reported to relevant key stakeholders.


text: We have established an Incident Response Plan that defines and documents procedures for assessing, identifying, and managing a cybersecurity incident. This plan requires the IT Security Manager to determine whether a cybersecurity incident has occurred and to communicate such findings to the Incident Response Team. The IT Security Manager is responsible for communicating incidents to the Vice President - IT and the other members of management as appropriate. If a cybersecurity incident is determined to be material by our management team, they would notify our Board of Directors.


text: Our Vice President - IT and IT Security manager have developed expertise in cybersecurity, data protection, compliance, enterprise architecture and design, data analytics, and digital transformation through years of experience in the information technology space. Our Vice President - IT is designated as the senior executive responsible for cybersecurity and reports directly to our CFO. She and the IT Security manager have comprehensive information technology background with over 30 years of information technology experience. These individuals are responsible for the day-to-day implementation of our cybersecurity program.


text: We have an established practice to oversee and manage third-party service providers in order to protect our interests related to cybersecurity threats. We utilize the National Institute of Standards and Technology (NIST) Cybersecurity Framework to identify, assess and manage our cybersecurity risks, including third-party risks. Our risk assessment involves analyzing and minimizing risk associated with outsourcing to third-party vendors or service providers. We continue to evaluate and enhance our systems, controls, and processes where possible, including responses to actual or perceived threats specific to us or experienced by other third-party vendors or service providers.


text: The Audit Committee is responsible for the oversight of risks from cybersecurity threats. Our Vice President - IT and the IT security team update the Audit Committee on our cyber risk management program during each of its quarterly meetings. This update includes metrics on the effectiveness of technical and human security controls, cybersecurity training program compliance, internal and third-party cybersecurity incidents, and cybersecurity risks. The Audit Committee also receives a detailed annual update on our cybersecurity program and strategy including cybersecurity risks.


text: Third Party Security Experts We engage third party security experts for cyber security assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. In addition, our third-party experts work with us to conduct cybersecurity tabletop exercises and internal phishing awareness campaigns. We use the findings of these exercises to improve our practices, procedures, and technologies. We also engage third party security experts to support our cybersecurity threat and incident response management and maintain information security risk insurance coverage.


text: Incidents & Risks To date, we have not experienced any material internal or external cybersecurity incidents and although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see "Risks Related to Information Systems" identified in the "Risk Factors" section of Part 1 of Item 1A herein.


text: In managing material risks from cybersecurity threats, we require that a security and technical architecture review is conducted for all new software and applications, and for all changes to the underlying IT infrastructure that manages, processes, stores, or transmits our data or data of our customers, vendors, suppliers, joint ventures, or employees. Any deviations from our IT security policies and standards are assessed by our IT security team. Any critical and high-risk levels are identified, documented, addressed and reported to relevant key stakeholders.


text: We have established an Incident Response Plan that defines and documents procedures for assessing, identifying, and managing a cybersecurity incident. This plan requires the IT Security Manager to determine whether a cybersecurity incident has occurred and to communicate such findings to the Incident Response Team. The IT Security Manager is responsible for communicating incidents to the Vice President - IT and the other members of management as appropriate. If a cybersecurity incident is determined to be material by our management team, they would notify the Board.


text: Third Party Security Experts We engage third party security experts for cyber security assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. In addition, our third-party experts work with us to conduct cybersecurity tabletop exercises and internal phishing awareness campaigns. We use the findings of these exercises to improve our practices, training, procedures, and technologies. We also engage third party security experts to support our cybersecurity threat and incident response management and maintain information security risk insurance coverage.


text: Cybersecurity Risk Management and Strategy We have a cybersecurity risk management process intended to protect the confidentiality, integrity and availability of our critical systems and information. We design and assess our process based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management process is integrated into our overall risk management process, and shares common methodologies, reporting channels and governance processes that apply across the risk management process to other legal, compliance, strategic, operational and financial risk areas.


text: Key elements of our cybersecurity risk management process include, but are not limited to, the following: • Risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • A cybersecurity team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • Cybersecurity awareness training of our workforce; • A cybersecurity incident response plan and processes for responding to cybersecurity incidents; and • Risk management processes based on our assessment of the respective risk profile of key third parties.


text: We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I Item 1A "Risk Factors – We depend on information technology for our business and are exposed to risks related to cybersecurity threats and cyber incidents affecting our, our customers', suppliers' and other service providers' systems and networks."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management process.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant.


text: Our management team, including our Chief Legal Officer and Chief Information Security Officer ("CISO"), is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management process and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO has a degree with a focus on information technology, and is a Certified Information Systems Auditor with over 20 years of experience in information technology related roles, including building and leading cybersecurity, risk management and information protection teams. Our CISO reports to our Chief Legal Officer who oversees cybersecurity, and holds a Carnegie Mellon University Software Engineering Institute CERT Certificate for Cybersecurity Oversight. The other members of the operational cybersecurity team collectively have decades of relevant education and experience and maintain a wide range of industry certifications. We invest in regular, ongoing cybersecurity training for the cybersecurity team.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also regularly receives briefings from management on our cyber risk management process. Board members receive presentations on cybersecurity topics from management or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our CISO provides reports to the Audit Committee of our Board of Directors on a standing basis at each Audit Committee meeting, and as otherwise requested by the Chair of the Audit Committee or as determined necessary by the CISO or other members of senior management. The CISO is personally involved in, and responsible for, the risk assessment, identification and management process described above.

companyName: TELOS CORP

ticker: TLS


text: We recognize the critical importance of maintaining the trust and confidence of partners, shareholders, government agencies and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST") and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: LISATA THERAPEUTICS, INC.

ticker: LSTA


text: Cybersecurity Risk Management and Strategy We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, and tabletop exercises. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by the NIST as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; • provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; • conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • conduct cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • carry cyber liability insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: As part of the above processes, we may engage with assessors, consultants, auditors, and other third-parties, including by having a third-party review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: We describe how risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading, "We may be unable to adequately protect our information systems from cyberattacks, which could result in the disclosure of confidential or proprietary information, including personal data, damage our reputation, and subject us to significant financial and legal exposure," which disclosures are incorporated herein by reference. In the last three fiscal years, we have not experienced any material cybersecurity incidents.


text: At NIKE, cybersecurity risk management is an important part of our overall risk management efforts. We have cybersecurity processes, technologies and controls in place to aid in our efforts to assess, identify and manage material risks associated with cybersecurity threats. We assess cybersecurity risk at both the board and management levels.

companyName: NIKE, Inc.

ticker: NKE


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, the audit committee of our board of directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our board of directors has authorized our audit committee to oversee risks from cybersecurity threats.


text: At least quarterly, our audit committee receives an update from management of our cybersecurity threats and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our audit committee generally receives materials that include a cybersecurity update and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Chief Information Officer. Our audit committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Members of our audit committee are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer. This individual has over 29 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs (nationally and globally), as well as several relevant degrees and certifications, including a Bachelors and Master's Degree focusing in Computer Science, along with cybersecurity leadership, computer security, forensics, and technology certifications earned over the years. This management team member is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, this management team member reports to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis.


text: Management's Role in Managing Risk At the management level, primary responsibility for assessing and managing material risks from cybersecurity threats rests with our Vice President, Corporate Information Security, Risk & Compliance ("VP, CIS"). Our VP, CIS has over two decades of experience in information technology and cybersecurity. The VP, CIS reports to our Chief Information Officer ("CIO") who has significant experience leading technology teams at large public companies and our CIO reports to our Chief Technology Officer.


text: As part of our enterprise resource planning, we also employ systems and processes designed to oversee, review, identify, and reduce the potential impact of a security incident occurring at third-party vendors and service providers with direct implications to the Company's systems and internal controls or otherwise implicating the third-party technology and systems we use.

companyName: SILVERBOW RESOURCES, INC.


text: Our approach to managing cybersecurity risk is informed by the industry-standard National Institute for Standards and Technology Cybersecurity Framework. The VP, CIS has primary responsibility for implementing and overseeing our enterprise-wide cybersecurity strategy, policy, architecture and processes. We use various tools and methodologies to identify and manage cybersecurity risk, including risk assessments and a vulnerability management program that includes periodic penetration testing. We have a third-party cyber risk management program that conducts assessments on third parties who integrate with our data, network, systems and applications. These tools and methodologies inform our remediation activities, which are tracked and reported to senior management.


text: Company's processes to assess, identify, and manage material cybersecurity risks We have developed an ISO/IEC 27001-certified Information Security Management System ("ISMS") designed to enhance our corporate security measures, identify and mitigate information security risks, and protect and preserve the confidentiality, integrity, and continued availability of all information owned by the Company and that of its customers and suppliers in our control. Our ISO certification can be verified on the BSI Group website using certificate number IS 64920.


text: Our ISMS includes developing, implementing, and continually improving policies and procedures designed to safeguard information and ensure the availability of critical data and systems. These policies cover areas such as requiring secure coding practices and a secure development lifecycle process, monthly information security awareness training for all employees and enhanced training for specialized personnel, review and assessment by external, independent third parties, who certify and report on our weaknesses and internal response preparedness for the entire Company, and the performance of daily vulnerability scanning of our network infrastructure as well as annual third-party penetration testing.


text: Our cybersecurity risk assessment, identification, and management process consists of a dedicated Governance Risk and Compliance ("GRC") team, within our Information Security organization, that implements a repeatable, ISO/IEC 27001-compliant methodology to asses and track cybersecurity risk. This team, reporting to and working with the Chief Information Security Officer ("CISO"), identifies, tracks, and updates cybersecurity risks that threaten the Company directly and through third parties. The GRC team collaborates closely with risk owners throughout the Company, vendors, and suppliers, working with them in an effort to ensure their risks are identified, documented, and mitigated in a timely fashion. In addition to our active ISO/IEC 27001 certification, the Company also assesses itself against the National Institute of Standards and Technology Special Publication 800-171 as required by the Defense Federal Acquisition Regulation Supplement. In accordance with our ISMS, we also actively monitor known threats that could affect our products and services and work with our suppliers to provide us with real-time reports of threats or vulnerabilities that may affect our enterprise-wide systems. Our program also includes a cyber incident response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incident as well as a business continuity plan that is designed to provide a clear framework for how the Company can continue in the event of any significant disruption in an effort to ensure that we can offer the same level of security, support, and excellence to all our customers. In the normal course, our Security and GRC teams engage assessors, consultants, and other third parties to assist in various cyber-related matters. For example, to maintain our ISO certification, the Company utilizes an external third party to conduct yearly audits of its ISMS. Our Information Security organization also leverages third-party advisors, as appropriate, for various tasks such as conducting annual third-party penetration testing.


text: In 2023, we conducted an enterprise risk assessment that included an assessment of cybersecurity risk in context with other enterprise-level risks. Furthermore, our CISO and our General Counsel regularly discuss cybersecurity risk mitigation. We carry errors and omissions insurance that provides some protection against the potential losses arising from a cybersecurity incident. For additional information regarding potential cybersecurity risks, see relevant business and operational risks under Item 1A, "Risk Factors", of this Annual Report on Form 10-K.


text: In the last three years, we have not experienced a material information security breach incident or any penalties or settlements related to the same, and the expenses we have incurred from information security breach incidents were immaterial.


text: Management's role and expertise in assessing and managing material cybersecurity risks Our Information Security team is charged with the responsibility for assessing and managing material cybersecurity risks. That team is led by our CISO. Certifications held by the Information Security team include CompTIA A+, Network+, Security+, Project+, & CyberSecurity Analyst+, eLearnSecurity Junior Penetration Tester, EC-Council Certified Ethical Hacker ("CEH"), Certified Encryption Specialist, Certified Security Analyst, & Computer Hacking Forensic Investigator ("CHFI"), CMMC-AB Registered Practitioner ("RP"), and ISC2 Certified Information Systems Security Professional ("CISSP"). Our CISO's background includes over 17 years of experience in IT and Information Security. His formal education includes a Master's degree in Cybersecurity and Information Assurance and a Bachelor's degree in Computer Forensics. Certifications held by the CISO include CompTIA A+, Network+, & Security+, Microsoft Technology Associate ("MTA"), CMMC-AB RP, ISO 27001 Certified Lead Implementer Professional, EC-Council CEH & CHFI, ISACA Certified Data Privacy Solutions Engineer & Certified Information Security Manager, ISC2 CISSP, and Offensive Security Certified Professional. Our CISO reports to our Chief Information Technology Officer ("CITO"), who in turn reports to our Chief Executive Officer ("CEO"). Each of our CITO and our CEO have extensive experience in cybersecurity matters.


text: Our CISO provides reports to the Audit Committee of our Board of Directors on a standing basis at each Audit Committee meeting, and as otherwise requested by the Chair of the Audit Committee or as determined necessary by the CISO or other members of senior management. The CISO is personally involved in, and responsible for, the risk assessment, identification and management process described above.


text: Board of Director's oversight of cybersecurity risks The Board of Directors has oversight responsibility with respect to risk management and reviews matters with management as part of management's regular Board reporting. The Board of Directors has delegated responsibility for information security and cybersecurity risk oversight to the Audit Committee. In accordance with its charter, the Audit Committee discharges these responsibilities through various processes, including the option to use third party advisers as and when it deems appropriate, and discusses with management the Company's major policies with respect to risk assessment and risk management. The Audit Committee regularly reports the results of these discussions to the Board of Directors. As noted above, the CISO reports to the Audit Committee at each regular Audit Committee meeting on the status of cybersecurity risk assessment, identification and management, as well as reporting information security incidents as they occur, if material, and providing periodic briefings about our information security program, our internal response preparedness, and assessments led by outside advisors. The Chair of the Audit Committee, in turn, reports on these topics to the Board of Directors as and when deemed necessary and/or material. Overall, our Board contains two directors with work experience related to cybersecurity issues or oversight.


text: The Company's processes to assess, identify, and manage material cybersecurity risks We developed an ISO/IEC 27001-certified Information Security Management System ("ISMS") designed to enhance our corporate security measures, identify and mitigate information security risks, and protect and preserve the confidentiality, integrity, and continued availability of all information owned by the Company and that of its customers and suppliers in our control. Our ISO certification can be verified on the BSI Group website using certificate number IS 649202.