text: Although the risks from cyber threats have not materially affected FirstEnergy's or FET's business strategy, results of operations, or financial condition to date, FirstEnergy continues to closely monitor cyber risk. Overall, FirstEnergy has implemented tactical processes for assessing, identifying, and managing material risks from cyber security threats to FirstEnergy including governance at the executive and board level of FirstEnergy's Cyber Security Program, including FE's risk management strategy and the controls designed to protect its operations. Additionally, FirstEnergy, through its Disclosure Committee, has updated its disclosure controls and procedures to ensure appropriate disclosure of any material cyber security incidents. See Item 1A. Risk Factors for additional information regarding FirstEnergy's or FET's cyber security risks. Those sections of Item 1A. Risk Factors should be read in conjunction with this Item 1C. Cybersecurity.


text: Risk Management and Strategy The Company maintains a cybersecurity program that establishes safeguards for protecting the confidentiality, integrity, and availability of the Company's data, technology, and information systems, and the material risks associated with the threats identified from time to time under the cybersecurity program are incorporated into the Company's corporate risk register. The program includes general controls for managing changes in and access to the Company's information technology environment, cybersecurity awareness and training programs to help employees identify and mitigate against cybersecurity threats, cybersecurity incident response plans and third-party incident response retainers to help expedite the Company's response in the event of a cybersecurity incident, and guidelines regarding system vulnerability management, third-party threat intelligence, endpoint detection and response solutions, and network security measures.

companyName: APA Corp

ticker: APA

secItem: Item 1C


text: The program also establishes protocols for identifying and managing material risks related to cybersecurity threats associated with the Company's use of third-party service providers. The Company monitors and oversees the material risks related to vulnerabilities, threats, and incidents impacting its third-party service providers via onboarding reviews, threat intelligence reports, and annual assessments. As an example of the Company's efforts to manage third-party cybersecurity risks, when third parties are engaged to provide software-as-a-service offerings, the Company's standard licensing terms require such third parties to utilize safeguards to protect the Company's data, in compliance with applicable standards from the International Organization for Standardization (ISO) regarding security techniques, and to notify the Company within 24 hours of becoming aware of a cybersecurity incident impacting the Company's data.


text: As of December 31, 2024, no risks from cybersecurity threats or incidents have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.

stage1Category: Strategy Integration

stage1Method: unanimous


text: The standing Cybersecurity Committee of the Company's Board of Directors assists with oversight of the Company's cybersecurity program and the material risks associated with the threats identified under the program. Given the Cybersecurity Committee's chair's previous military experience in positions relevant to information security and his NACD-sponsored CERT Certificate in Cybersecurity Oversight from Carnegie Mellon University's Software Engineering Institute, the committee benefits from his perspectives, skills, and training when reviewing and managing the Company's exposure to cybersecurity risks.

stage1Category: Board Governance

stage1Method: majority


text: As stated in its charter, the Cybersecurity Committee's responsibilities include: • providing oversight of the Company's cybersecurity policies, procedures, and plans, including the quality and effectiveness of the cybersecurity program; • reviewing the Company's policies and procedures related to its preparation for, defense against, response to, and recovery from material cybersecurity incidents; • reviewing with management the plans and methodology for periodic assessments of the Company's cybersecurity program by outside professionals, including the findings of such assessments and plans to remediate any material deficiencies identified by such assessments; • overseeing the Company's management of risks related to its cybersecurity systems and processes; • reviewing with management any cybersecurity insurance program the Company may procure, including with respect to coverage and limits; and • overseeing the preparation of the Company's disclosures in its reports filed with the Securities and Exchange Commission relating to the Company's cybersecurity systems.


text: The Cybersecurity Committee also has authority to retain cybersecurity and other consultants and advisors to assist and advise the committee in its evaluation of the Company's cybersecurity program.


text: The Cybersecurity Committee receives regular reports from Company management regarding the Company's cybersecurity systems and programs, and the committee from time to time also receives updates from external cybersecurity specialists on cybersecurity trends and incidents, including those that may be particularly relevant to the Company's industry or operations. In addition, in exercising its oversight responsibilities, the Cybersecurity Committee has full access to Company management and may inquire into any matter that it considers to be of material concern to the committee or the full Board of Directors.


text: The Cybersecurity Committee reports regularly to the full Board of Directors, with respect to such matters as are relevant to the committee's discharge of its responsibilities and with respect to such recommendations as the committee deems appropriate for consideration by the Board of Directors. The Cybersecurity Committee also refers to the Audit Committee any matters that come to the attention of the Cybersecurity Committee that fall within the purview of the Audit Committee, including any matters related to the Company's internal control over financial reporting.


text: APA's Executive Vice President, Administration, is primarily responsible for identifying, assessing, and managing the material risks associated with cybersecurity threats and the incidents identified from time to time thereunder. He manages the Company's Information Security Team, which comprises cybersecurity professionals responsible for the day-to-day operation of the Company's cybersecurity program and managing the Company's threat intelligence, vulnerability management, forensics, and security architecture systems. APA's Executive Vice President, Administration, has 35 years of experience managing data and technology in the energy industry, including serving as the Company's CIO from 2015-2020. He receives regular updates from external cybersecurity specialists on emerging trends, threats, and technologies in the cybersecurity industry. The Executive Vice President, Administration, reports directly to APA's Chief Executive Officer and presents all relevant information to the Cybersecurity Committee.

stage1Category: Management Role


text: Additionally, the Company's CyberSmart Defender Network, which is a multi-disciplinary team that includes representatives from across the Company's various departments, is responsible for raising awareness of cybersecurity issues, sharing learnings, and gaining access to advanced cybersecurity information and training.

stage1Category: Risk Management Process


text: Under the direction of the Executive Vice President, Administration, management's responsibilities with respect to the Company's cybersecurity program include (i) identifying and managing cybersecurity risks, (ii) coordinating cybersecurity incident response, (iii) assessing the health and maturity of the Company's cybersecurity policies, procedures, and plans, including the program, and (iv) reporting overall progress to the Cybersecurity Committee and to the full Board of Directors.


text: Our Board of Directors, primarily through the Audit Committee, oversees management's approach to managing cybersecurity risks. The Audit Committee holds periodic discussions with management regarding the Company's guidelines and policies with respect to cybersecurity risks and receives regular reports regarding such risks and the steps management has taken to monitor and control any exposure resulting from such risks. Our CISO also leads an annual review and discussion with the full Board of Directors dedicated to the Company's cyber risks, threats, and protections and provides updates throughout the year, as warranted.

companyName: Primo Brands Corp

ticker: PRMB


text: We have processes and a risk-based approach that align with the National Institute of Standards and Technology Cybersecurity Framework. Our information security program includes, among other aspects, vulnerability management, antivirus and malware protection, encryption and access control, and employee training. The CISO reviews emerging threats, controls, and procedures as part of assessing, identifying, and managing risks. This review aids in the identification of material breaches at other companies, including our third-party service providers. The CISO also discusses trends in cyber risks and our strategy to defend our information against cybersecurity incidents with our Audit Committee and executive leadership team on a regular basis, in addition to the annual review and discussion with the full board. In addition to our dedicated information security and technology teams monitoring our daily operations, we engage independent third-party cybersecurity providers for managed systems security, endpoint detection and response, and threat and vulnerability management. Regular communication with these providers aids in the identification and remediation of potential threats, and we regularly review our relationships with and services from these providers against industry standards and evolving cybersecurity threats.


text: We also endeavor to apprise employees of emerging risks and require them to undergo annual security awareness trainings and supplemental trainings as needed. All employees undergo annual training and there are additional trainings for certain roles and functions. Additionally, we conduct periodic internal exercises to gauge the effectiveness of the trainings and assess the need for additional training.


text: Material cybersecurity incidents are required to be reported to the Board of Directors and to the SEC on Form 8-K. Our systems and services are vulnerable to interruptions or other failures resulting from cybersecurity attacks, such as computer viruses, ransomware, phishing, hackers, or other security issues. In addition, the rapid evolution and increased adoption of new technologies, such as artificial intelligence, may intensify our cybersecurity risks. An interruption or cybersecurity breach, disruption or misuse of our information systems, or the information systems of our third-party service providers, could have a material negative effect on our business, financial condition and results of operations but we have processes in place to mitigate these risks. As of the date of this report, in the past twelve months, we have not experienced material business disruption, monetary loss, and/or data loss as a result of phishing, business email compromise or other types of attacks, and we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, we cannot guarantee that material incidents will not occur in the future.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and employee and other personal data ("Information Systems and Data").

companyName: Lionsgate Studios Corp.

ticker: LION


text: The Company's information security team, led by our Chief Information Security Officer ("CISO"), helps identify, assess and manage the Company's cybersecurity threats and risks. The information security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example with automated and manual tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of certain environments, evaluating threats reported to the Company, conducting cybersecurity audits, vulnerability assessments, and threat assessments, conducting response exercises, and coordinating with law enforcement.


text: Depending on the environment, systems, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, incident detection and response processes, vulnerability management policy, disaster recovery and business continuity plans, risk assessments, encryption of certain data, data segregation for certain data, network security and access controls, physical security controls, asset management, tracking and disposal, monitoring for certain systems, vendor risks management processes, penetration testing, employee training, cybersecurity insurance, and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the CISO works with management, including the Chief Information Officer ("CIO"), to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit & Risk Committee of the Board of Directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, threat intelligence service providers, penetration testing providers, dark web monitoring services, forensic investigators, and professional services firms, including legal counsel.


text: We use third-party service providers to perform a variety of functions throughout our business, application providers, hosting providers, supply chain resources and data back-up service providers. We have a vendor management program designed to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process involves different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. Components of the vendor risk management program include, for example, conducting risk assessments for certain vendors, reviewing certain vendors' written security programs, reviewing security assessments and responses to security questionnaires, auditing of certain vendors, vulnerability scans related to vendors, and the imposition of certain contractual information security obligations for certain vendors.

stage1Category: Third-Party Risk


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Service disruptions or failures, security incidents impacting Lionsgate or its third-party service providers' information systems, data and networks may disrupt its businesses, damage its reputation, expose it to regulatory investigations, actions, litigation, fines and penalties or have a negative impact on its results of operations including but not limited to loss of revenue or profit, loss of customers or sales and other adverse consequences."

stage1Category: None/Other


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit & Risk Committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CIO and CISO. Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CIO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing certain security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the CISO and CIO. Our CISO, CIO and other senior executives work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the Audit & Risk Committee for certain cybersecurity incidents.


text: The Audit & Risk Committee receives regular reports from our CIO concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit & Risk Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: The Company has established security practices and safeguards designed to help identify and protect against intentional and unintentional misappropriation or corruption of its information technology systems, data, and operational continuity. The Company conducts risk assessments to identify potential cybersecurity threats, which include evaluating the likelihood and potential impact of these threats, identifying system and network vulnerabilities, and assessing the effectiveness of the Company's existing controls. Upon identification and assessment of risks, the Company develops and implements what management believes to be appropriate measures in order to manage these risks, which may involve enhancing security controls, implementing new technologies, training employees, or changing business processes. The Company maintains change management processes, monitoring practices, and data protection measures designed to mitigate cybersecurity risks and regularly test its systems for potential threats. Such processes and practices to assess, identify, and manage cybersecurity incidents are integrated into the Company's overall enterprise risk assessment process.

companyName: EVI INDUSTRIES, INC.

ticker: EVI


text: The Company's information security team, which is led by the Company's Director of Information Technology and also includes the Company's Chief Financial Officer and other members of the Company's internal audit and finance departments, is responsible for assessing and managing the Company's cybersecurity risks and data protection practices. The Company's Director of Information Technology has over 10 years of experience in managing cybersecurity risks and advising on cybersecurity matters.


text: The Company's Board of Directors is responsible for the oversight of management's efforts to address cybersecurity risks. The Board of Directors has designated the Audit Committee with the responsibility of overseeing and reporting to the Board on management's handling of cybersecurity risk management and on the adequacy and effectiveness of the Company's cybersecurity risk management strategy. Management also updates the Audit Committee and the Board on an on-going basis concerning any significant cybersecurity incidents or risk exposures that have come to management's attention during the conduct of their assessments, the steps management has taken to mitigate such exposures, and any changes to the processes of identifying, assessing, and monitoring cybersecurity threats.


text: During the fiscal year ended June 30, 2025, the Company did not identify any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.