text: Our processes for assessing, identifying, and managing material risks from cybersecurity threats are part of our overall enterprise risk management system and processes. Enterprise risks, including cybersecurity risks, and their associated mitigations are reviewed at least annually by senior management and the Board of Directors. Throughout the year, we regularly assess our cybersecurity program and continue to invest in hardening and maturing our cybersecurity measures as further described below.

companyName: CENTERPOINT ENERGY RESOURCES CORP


text: As a regulated financial institution, we have designed our cybersecurity program based on the requirements of the Gramm-Leach Bliley Act of 1999 ("GLBA") and the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool. Our processes for identifying, assessing and managing material risks from cybersecurity threats includes reliance on the FFIEC Cybersecurity Assessment Tool as well as recurring audits and assessments of our cybersecurity program and controls. In addition to the above, we periodically (and at least annually) conduct an overall inherent cybersecurity risk assessment based on threats, the likelihood of the threats, and the potential impact of these threats to the Company. We conduct this assessment by reviewing industry-recognized breach reports, identifying the top threats, calculating the likelihood and impact of these threats, and thereby determining our overall inherent risk. We then use the Cybersecurity Assessment Tool to establish a risk profile. Based on the risk profile, the FFIEC Cybersecurity Assessment Tool recommends a program maturity level, which we use to determine whether we have the requisite minimum security controls in place that are effective. This control evaluation then helps us to determine our cybersecurity residual risk and whether we need to implement any additional controls. In addition to using FFIEC Cybersecurity Assessment Tool, we evaluate the robustness and effectiveness of our cybersecurity program both internally and externally with periodic internal risk assessments, and internal and third-party audits. We also use third party assessments to simulate threat actors to test and evaluate our cybersecurity controls and the effectiveness of our overall program. As part of our cybersecurity program, we have developed an incident response plan based on industry-standard cybersecurity frameworks, with procedures for responding to and remediating a cyber-incident, which also includes a process to activate our business continuity plan, if necessary. We also review and test our incident response plan through simulations and assessments. Furthermore, we employ recurring security awareness training for employees and produce recurring security awareness material for our customers.

companyName: HOPE BANCORP INC

ticker: HOPE

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: majority


text: The secure maintenance and transmission of confidential information, as well as execution of transactions over the systems of our third-party service providers, is essential to protect us and our customers against fraud and security breaches and to maintain customer confidence. Information security and risk management are an integral part of our new product and service implementation and vendor relationship management to confirm that they all meet the minimum standards and policies established and approved by our Board. We have developed processes to identify and oversee risks from cybersecurity threats associated with our third-party service providers, which includes the information security team assisting with and assessing cybersecurity robustness during vendor selection and onboarding as well as risk-based monitoring of vendors on an ongoing basis.

stage1Category: Third-Party Risk

stage1Method: unanimous


text: In the ordinary course of our business, we have experienced and expect to continue to experience cyber-based attacks and other attempts to compromise our information systems, although none, to our knowledge, has had a material adverse effect on our business, financial condition or results of operations. With regards to risks from cybersecurity threats, including as a result of previous cybersecurity incidents, we have conducted assessments and have determined that we do not believe any of the identified risks have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. While we do not believe cybersecurity threats are reasonably likely to affect us, our business strategy, our results of operations or our financial conditions, like all financial institutions, we face a risks of such threats, the consequences of which could be material. See Item 1A "Risk Factors – We are subject to operational risks relating to our technology and information systems," above. In addition, given the constant and evolving threat of cyber-based attacks, we incur significant costs in an effort to detect and prevent security breaches and incidents, and these costs may increase in the future.

stage1Category: Strategy Integration


text: Cybersecurity Governance Our Board oversees an enterprise-wide approach to risk management, designed to support the achievement of organizational objectives in the areas of strategy, operations, reporting, and compliance without exposing the organization to undue risk. While our Board has the ultimate oversight responsibility for the risk management process, the Board Risk Committee also has responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. Additionally, as part of our cybersecurity governance, we annually purchase cybersecurity insurance customary for companies in our industry. While our Board and the Board Risk Committee oversee our cybersecurity program, management is responsible for implementing the program.

stage1Category: Board Governance


text: Our Chief Information Security Officer, who reports to our Chief Risk Officer, is responsible for managing our information security team, maintaining and continuing to develop and implement our cybersecurity program enterprise-wide and assessing and managing risks from cybersecurity threats, subject to oversight by and reporting to the Board Risk Committee, which in turn reports directly to the Board. In addition to the Board Risk Committee, two of our management committees are also involved in overseeing risks from cybersecurity threats: our Enterprise Risk Management Committee and our Information Security Sub-Committee. These two management committees report to the Board Risk Committee, which in turn reports directly to the Board.

stage1Category: Management Role


text: We have processes to inform the Board Risk Committee and the Board about risks from cybersecurity threats. Our management team reports its findings using the FFIEC Cybersecurity Assessment Tool and our information security team's determination as to whether our security controls, at a minimum, are in place and effective. The Chief Information Security Officer and the information security team regularly report to the Board Risk Committee and the Board regarding cybersecurity and related threats and trends, changes, control effectiveness and residual risk, the areas where our cybersecurity program may be improved and improvements made to address and remediate issues.


text: As a financial institution, cybersecurity is a high priority for us as we receive and maintain the business and personal information of our customers on a daily basis. In addition, our business operations rely extensively on the continuous operation of our information and data processing systems and related back-up systems. Accordingly, we have developed and maintain a cybersecurity program that is focused on the goals of preparing for, preventing, detecting, mitigating, responding to, and recovering from cyber threats and incidents, maintaining the privacy and protection of our customers' data, and the continuity of our information and data processing systems.


text: Cybersecurity Risk Management We believe that we have a robust cybersecurity program that is aligned to industry-standard cybersecurity frameworks. To identify and assess material risks from cybersecurity threats, our corporate risk management team considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment and management process. To implement and maintain our cybersecurity program, we have a dedicated information security team that is managed by our Chief Information Security Officer. We believe our information security team is well positioned to identify risks from cybersecurity threats based on numerous job qualifications and ongoing training.


text: As a regulated financial institution, we have designed our cybersecurity program based on the requirements of the GLBA and the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool. Our processes for identifying, assessing, and managing material risks from cybersecurity threats includes reliance on the FFIEC Cybersecurity Assessment Tool as well as recurring audits and assessments of our cybersecurity program and controls. In addition to the above, we periodically (and at least annually) conduct an overall inherent cybersecurity risk assessment based on threats, the likelihood of the threats, and the potential impact of these threats to the Company. We conduct this assessment by reviewing industry-recognized breach reports, identifying the top threats, calculating the likelihood and impact of these threats, and thereby determining our overall inherent risk. We then use the Cybersecurity Assessment Tool to establish a risk profile. Based on the risk profile, the FFIEC Cybersecurity Assessment Tool recommends a program maturity level, which we use to determine whether we have the requisite minimum security controls in place that are effective. This control evaluation then helps us to determine our cybersecurity residual risk and whether we need to implement any additional controls. In addition to using FFIEC Cybersecurity Assessment Tool, we evaluate the robustness and effectiveness of our cybersecurity program both internally and externally with periodic internal risk assessments, and internal and third-party audits. W e also use third party assessments to simulate threat actors to test and evaluate our cybersecurity controls and the effectiveness of our overall program. As part of our cybersecurity program, we have developed an incident response plan based on industry-standard cybersecurity frameworks, with procedures for responding to and remediating a cyber-incident, which also includes a process to activate our business continuity plan, if necessary. We also review and test our incident response plan through simulations and assessments. Furthermore, we employ recurring security awareness training for employees and produce recurring security awareness material for our customers.


text: In the ordinary course of our business, we have experienced and expect to continue to experience cyber-based attacks and other attempts to compromise our information systems, although none, to our knowledge, has had a material adverse effect on our business, financial condition, or results of operations. With regards to risks from cybersecurity threats, including as a result of previous cybersecurity incidents, we have conducted assessments and have determined that we do not believe any of the identified risks have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. While we do not believe cybersecurity threats are reasonably likely to affect us, our business strategy, our results of operations or our financial conditions, like all financial institutions, we face a risks of such threats, the consequences of which could be material. See Item 1A "Risk Factors – We are subject to operational risks relating to our technology and information systems," above. In addition, given the constant and evolving threat of cyber-based attacks, we incur significant costs in an effort to detect and prevent security breaches and incidents, and these costs may increase in the future.


text: Our Chief Information Security Officer, who reports to our Chief Risk Officer, is responsible for managing our information security team, maintaining, and continuing to develop and implement our cybersecurity program enterprise-wide and assessing and managing risks from cybersecurity threats, subject to oversight by and reporting to the Board Risk Committee, which in turn reports directly to the Board. In addition to the Board Risk Committee, two of our management committees are also involved in overseeing risks from cybersecurity threats: our Enterprise Risk Management Committee and our Information Security Sub-Committee. These two management committees report to the Board Risk Committee, which in turn reports directly to the Board.


text: These committees provide periodic summary reports on their activities and initiatives to appropriate senior executives, and the Executive Vice President and General Counsel and/or various members of the cyber and data privacy teams communicates updates to the Audit Committee or the Board.


text: Managing Material Risks & Integrated Overall Risk Management As a foundation of this approach, we have implemented a layered governance structure to help assess, identify, and manage cybersecurity risks. It starts with our internal Cybersecurity Operations Center (CSOC), which routinely analyzes threat information from external sources, monitors network activity, and responds to potential security incidents. In addition, our cybersecurity and privacy policies encompass incident response procedures and information security governance. As part of our ongoing assessment of our cybersecurity program, we monitor and make adjustments, as necessary, in support of compliance with current and emerging cybersecurity and privacy laws, regulations and guidance applicable to us in jurisdictions where we do business (including NERC CIP reliability standards and TSA security directives), as further described in Item 1A "Risk Factors." Our internal audit team conducts regular internal security audits and vulnerability assessments of CenterPoint Energy's systems and user data security practices.


text: In addition, CenterPoint Energy's cybersecurity program is increasingly leveraging intelligence-sharing capabilities about emerging threats within the energy industry, across other industries, with specialized vendors, and through public-private partnerships with U.S. government intelligence agencies. By engaging with utility-specific organizations, CenterPoint Energy benefits from quality analysis and rapid sharing of security information across the energy sector. Such intelligence helps allow for better detection and prevention of emerging cyber threats before they materialize. Just as it tests its policies and plans internally, CenterPoint Energy also engages in external exercises such as the bi-annual GridEx Security Exercise to evaluate and address the preparedness of the industry as a whole.


text: Oversee Third-Party Risk We conduct security risk assessments on proposed software, hardware, and third-party technology solutions used by CenterPoint Energy, including a diligence review of enterprise and security architecture, vendor security, and a privacy impact assessment when deemed appropriate. These assessments evaluate these technologies prior to deployment in CenterPoint Energy's network environment. Further, we maintain a vendor risk management program, a component of which assesses the maturity of certain third parties and their cybersecurity and data privacy programs to help protect information shared with approved third parties. We also leverage third-party cybersecurity ratings of companies to inform our risk rating when conducting these assessments. Additionally, CenterPoint Energy imposes contractual obligations on vendors and other third-party business partners related to privacy, confidentiality, and data security based on their access to our data and systems and the nature and sensitivity of the data and systems. Such contractual provisions may specify the measures and safeguards that the parties must implement to protect our data from unauthorized access use, disclosure, modification, or destruction.


text: Engage Third Parties on Risk Management We also undergo periodic external security audits, vulnerability assessments, and penetration testing of CenterPoint Energy's systems and user data security practice, conducted by third-party consultants. We also conduct tabletop exercises to test our incident response processes. Further, as discussed below, we engage third parties to provide guidance and support to our cybersecurity management team.


text: Risks from Cybersecurity Threats As described in Item 1A "Risk Factors," our operations rely on the secure processing, storage, and transmission of confidential, sensitive, and other information within our computer systems and networks. Computer viruses, hackers, employee or vendor incidents, and other external hazards could expose our information systems—and those of our third parties who process our data, provide access to systems, or that have access to our systems—to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business, reputation, results of operations and financial condition, and subject us to possible legal claims and liability. While we have experienced cybersecurity incidents in the past, to date none have materially affected us, including our business strategy, results of operations or financial condition.


text: As part of our overall risk management approach, we prioritize the identification and management of cybersecurity risks at several levels, including Board oversight, executive commitment, management support, and employee training.


text: Board of Directors Oversight As of December 2023, our Audit Committee, comprised of independent directors from our Board, oversees the Board's responsibilities relating to CenterPoint Energy's cybersecurity and data privacy programs, including cybersecurity risk management. Prior to December 2023, our Governance, Environmental and Sustainability Committee, comprised of independent directors from our Board, oversaw cybersecurity responsibilities. As part of their risk oversight responsibilities, the applicable committee received quarterly reports from our Executive Vice President and General Counsel, or representatives from our cybersecurity or data privacy groups, and periodic reports from our third party consultants. Based on these reports, the applicable committee reported to the Board regarding certain cybersecurity or data privacy related items, including, among other items, CenterPoint Energy's progress in maturing its cybersecurity program, results of audits, penetration and vulnerability testing of CenterPoint Energy's cybersecurity program, the cybersecurity landscape and emerging threats, status of ongoing initiatives and strategies, incident reports and learnings from any cybersecurity events, compliance with regulatory requirements and industry standards, data privacy matters, and the cybersecurity budget.


text: Risk Management Personnel Since January 2023, our cybersecurity program has been overseen by our Executive Vice President and General Counsel. Our Executive Vice President and General Counsel has significant risk management, governance and litigation experience. We believe these skills are needed in leadership of our cybersecurity program to help ensure that risk management, legal, disclosure and governance perspectives are considered in the design of our cybersecurity program and in evaluating and responding to potential cyber incidents. CenterPoint Energy currently engages a third-party consultant, who reports directly to the Executive Vice President and General Counsel, to provide Chief Information Security Officer (CISO) advisory services. This consultant has 15 years of experience serving in cybersecurity leadership positions, including as a CISO at a large U.S.-based power, utility, and gas company and also at a large multi-national energy products and services company. We also have management-level committees and an experienced CSOC team that support our processes to assess and manage cybersecurity risk as follows: • The Data Privacy Office, led by our Senior Vice President, Deputy General Counsel, Chief Ethics and Compliance Officer, and Data Privacy Officer, addresses the collection, storage, usage, disclosure and destruction of data for specific business purposes and addresses existing and emerging laws, regulations, trends, expectations and best practices with regards to maintaining a mature data privacy program. • The Risk Oversight Committee, which is supported by our Enterprise Risk Management function and chaired by our Executive Vice President and General Counsel, is comprised of senior executives from across CenterPoint Energy, monitors and oversees risks facing CenterPoint Energy, as well as provides risk assessments and control oversight for certain business activities, including overseeing CenterPoint Energy's cybersecurity risks. • The crisis management team, which includes senior executives across CenterPoint Energy, is alerted as appropriate to cybersecurity incidents, natural disasters, and business outages. This team has established and continually assesses CenterPoint Energy's communications plan in the event of a crisis. Additionally, as appropriate, the Audit Committee or the Board are made aware of significant cybersecurity incidents in accordance with our cybersecurity incident response playbook. • The Cybersecurity Awareness Governance Committee, which includes leaders from across CenterPoint Energy's corporate functions and business units, each with expertise in, or with specific responsibility for, managing or protecting CenterPoint Energy's assets, information and personnel. This committee provides strategic direction and oversight for CenterPoint Energy's cybersecurity awareness and training initiatives. • The Artificial Intelligence (AI) Steering Committee was established by CenterPoint Energy to provide strategic direction, oversight, and guidance in the planning, development, deployment, and management of AI initiatives within the organization. The committee's primary objective is to ensure that AI technologies are aligned with business goals, ethical considerations, appropriate security protections, and industry best practices while driving innovation and enhancing competitiveness.


text: At the employee level, we maintain an experienced information technology team that is tasked with implementing our privacy and cybersecurity programs and supporting the cybersecurity consultant in carrying out reporting, security and mitigation functions. We also hold employee trainings on privacy, cybersecurity, AI, records and information management, conduct phishing tests, and generally seek to promote awareness of cybersecurity risk through communication and education of our employee population. The Governance, Environmental and Sustainability Committee was, and now the Audit Committee will be, provided with periodic reports on our employee cybersecurity awareness efforts.


text: Our processes for assessing, identifying, and managing material risks from cybersecurity threats are part of our overall enterprise risk management system and processes. Enterprise risks, including cybersecurity risks, and their associated mitigations are reviewed at least annually by senior management and the Board of Directors. Throughout the year, we regularly assess our cybersecurity program and continue to invest in hardening and maturing our cybersecurity measures as further described below.


text: Risk Management Strategy and Processes We maintain a cybersecurity program to help us assess, identify, and manage cybersecurity risks to our systems and data, including to help us defend against and mitigate emerging and existing cybersecurity threats to our information technology and operational technology systems. Our strategies and processes for managing cybersecurity risks are informed by relevant industry frameworks and laws, regulations and standards applicable to us in the jurisdictions in which we do business, including those applicable to utilities that operate bulk electric systems or critical pipeline facilities. We maintain various policies, procedures, technologies and other controls to help prevent, detect, mitigate and manage cybersecurity threats and incidents. We also use third-party consultants and service providers to support our risk management efforts, such as services for cybersecurity intelligence, monitoring, testing and assessments.


text: Key aspects of our risk management processes include: • Threat Monitoring. We receive information on emerging cybersecurity threats and vulnerabilities from different sources, including vendors, cybersecurity organizations and U.S. government agencies, to help support our ability to detect and defend against threats to the security of our information technology and operational technology systems. We maintain several cybersecurity monitoring tools and services to help us detect unauthorized activities involving our systems and potential cybersecurity threats and vulnerabilities to our systems. • Incident Response. We maintain a Cybersecurity Operations Center that is dedicated to monitoring for cybersecurity threats to our systems and responding to potential cybersecurity incidents. We also maintain cybersecurity incident response plans that establish a cross-functional incident response team and processes to guide our response to cybersecurity incidents, including processes for reporting and escalating cybersecurity incidents to senior management and the Audit Committee or the Board, as appropriate. We conduct tabletop exercises annually to test our incident response processes. • Assessments, Testing and Audits. We conduct different types of security assessments, testing and audits to help us proactively identify and mitigate potential cybersecurity threats and vulnerabilities to our information technology and operational technology systems. For example, we conduct security-related risk assessments on proposed software, hardware, and third-party technology solutions used by CenterPoint Energy prior to deployment in our network. We also undergo periodic vulnerability assessments, penetration tests and cybersecurity reviews of our systems and security controls. We engage third parties to support certain of these assessments and tests and to provide guidance and support to our cybersecurity management team. Our internal audit team also conducts audits of certain CenterPoint Energy systems and data security controls. • Third-Party Risk Management. We maintain a vendor risk management program, a component of which assesses the cybersecurity and data privacy practices of certain third-party service providers to help us assess and manage cybersecurity risks associated with third-party access to our systems and data. To help identify and mitigate third-party cybersecurity risks, we conduct vendor security reviews and privacy impact assessments when deemed appropriate based on the nature of the systems and data that will be accessed by the third-party. We also impose contractual obligations on certain of our service providers related to data privacy, confidentiality and security based on, among other factors, their extent of access to our data and systems and the nature and sensitivity of the data and systems to which they have access.


text: • Training and Awareness. We hold regular employee trainings on privacy, cybersecurity, AI and records and information management, conduct simulated phishing tests, and generally seek to promote awareness of cybersecurity risk through communication and education of our employee population. As described in Item 1A "Risk Factors," our operations rely on the secure processing, storage, and transmission of confidential, sensitive, and other information within our computer systems and networks. Computer viruses, threat actors, employee or vendor incidents, and other external hazards could expose our information systems, and those of third parties who process our data, provide access to systems, or that have access to our systems, to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business, reputation, results of operations and financial condition, and subject us to possible legal claims and liability. While we have experienced cybersecurity incidents in the past, as of the date of the filing of this Form 10-K, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on us, including our business strategy, results of operations, or financial condition.


text: Board of Directors Oversight Our Audit Committee, comprised of independent directors from our Board, oversees the Board's responsibilities relating to CenterPoint Energy's cybersecurity and data privacy programs, including cybersecurity risk management and cybersecurity disclosures required by applicable securities laws or regulations, as appropriate. As part of its risk oversight responsibilities, the Audit Committee receives quarterly reports from our Executive Vice President and General Counsel, Senior Vice President and Chief Information Security Officer (CISO) or other representatives from our cybersecurity or data privacy groups and periodic reports from our third-party consultants. These reports include updates on certain cybersecurity or data privacy matters, including, among other items, CenterPoint Energy's progress in maturing its cybersecurity program, results of significant cybersecurity assessments and testing, the cybersecurity landscape and emerging threats, status of ongoing initiatives and strategies, incident reports and learnings from any cybersecurity events, compliance with regulatory requirements and industry standards, data privacy matters, and the cybersecurity budget.


text: We have not identified any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For a full discussion of risks from cybersecurity threats, see the section entitled "Risk Factors" in Item 1A.

companyName: Fidelity National Information Services, Inc.

ticker: FIS


text: Risk Management Personnel CenterPoint Energy's Executive Vice President and General Counsel is responsible for overseeing our cybersecurity and data privacy programs. CenterPoint Energy's CISO is responsible for the day-to-day management of our cybersecurity program and reports directly to the Executive Vice President and General Counsel. CenterPoint Energy's Senior Vice President, Deputy General Counsel, and Chief Ethics & Compliance Officer (CECO) is responsible for day-to-day management of our data privacy program and also reports directly to the Executive Vice President and General Counsel. Our cybersecurity and data privacy teams, which report directly to our CISO and CECO, respectively, are tasked with implementing our programs in support of cybersecurity and data privacy risk management. We also have management-level teams and committees, which include and/or collaborate with our CISO and CECO, that support, among other things, our processes to assess and manage cybersecurity risk. These teams and committees provide summary reports on their activities and initiatives to appropriate senior executives, including the Executive Vice President and General Counsel and the Audit Committee or the Board, as appropriate.


text: CenterPoint Energy's CISO joined the Company in September 2024 and has over two decades of experience serving in multiple global leadership roles in cybersecurity, as well as technology and industrial systems at a Fortune 500 global industrial company, for which he was responsible for, among other things, building and maintaining enterprise programs relating to cybersecurity and managing cybersecurity risk. Our Executive Vice President and General Counsel has significant risk management, governance and litigation experience, which we believe are important leadership skills to help incorporate risk management, legal, disclosure and governance perspectives into the design of our cybersecurity program and in evaluating and responding to potential cybersecurity incidents.


text: Cybersecurity Risk Management and Strategy Our company recognizes the critical importance of cybersecurity in our digital operations and has established a robust risk management program to address both internal and external cybersecurity threats. This program, guided by industry frameworks like NIST CSF and overseen by experienced leadership teams, integrates advanced security tools and practices into our broader enterprise risk management system, actively involving our Executive team and Board of Directors in its oversight. Despite our comprehensive efforts and critical resource allocation, we acknowledge the challenges posed by the evolving nature of cyber threats and the limitations in fully mitigating these risks. We have not observed any significant impacts from known cybersecurity threats or previous incidents on our operational, strategic, or financial aspects. Nevertheless, given the unpredictable nature of cyber threats, we cannot assure complete immunity against potential future impacts.

companyName: BED BATH & BEYOND, INC.

ticker: BBBY


text: The likelihood of cybersecurity incidents is influenced by frequency risk factors. External factors include market trends in cybercrime, technological advancements in hacking methods, and geopolitical developments. Internal factors are shaped by our policies, the effectiveness of employee training, and robustness of system updates and maintenance procedures. External cybersecurity incidents events may include and are not limited to service disruptions due to email borne threat activities, ransomware, or denial of service attacks against us or our suppliers, while internal events may comprise of internal threats, subcontractors, or governance failures among other events.

stage1Category: None/Other


text: Cybersecurity incident response plans are regularly updated to include structured processes encompassing identification, containment, eradication, recovery, and post-incident review. Continuous monitoring of systems and networks allows for the detection and response to potential cybersecurity threats. Response capabilities are regularly reviewed to align with the evolving cyber threat landscape and processes are fully integrated into our broader risk management system.


text: Criteria used to determine the materiality of an incident includes, but is not limited to, evaluating the scope, nature, type, systems, data, operational impact, and pervasiveness of the incident. This approach involves continuous oversight and improvement based on evolving cyber threats. Materiality also considers both quantitative and qualitative factors in determining impact.


text: Third-party engagement processes include risk evaluation across various domains such as cybersecurity, data privacy, supply chain, and regulatory compliance. We are committed to transparently disclosing material and unauthorized cybersecurity incidents involving third-party service providers, considering factors like operational technology system damages, information breaches, and interconnected attacks exploiting vulnerabilities.


text: Cybersecurity Governance Our Board of Directors plays a pivotal role in overseeing the organization's preparedness for cyber threats. This involves a comprehensive understanding of our risk profile, ensuring appropriate cybersecurity controls are in place, regularly reviewing the effectiveness of these measures, and maintaining a robust incident response plan. The Board's involvement extends beyond compliance and budget approvals to active participation in continuous cybersecurity strategy improvement. The Board enhanced its cybersecurity expertise with the addition of Joanna Burkey in March 2023. Ms. Burkey has an extensive cybersecurity background and has served as CISO at both HP and Siemens.


text: We also maintain an incident response plan, which specifies escalation and evaluation processes for cyber events. This plan is executed in close coordination with our corporate functions, including a dedicated cyber and privacy law function, external affairs, and risk management, and is designed to ensure, among other things, appropriate and timely reporting and disclosure.

companyName: PRUDENTIAL FINANCIAL INC

ticker: PRU


text: The Audit Committee, designated as the responsible body for cybersecurity oversight, ensures regular information flow about cybersecurity risks to the Board of Directors. Our cybersecurity program is led by our Chief Information Security Officer (CISO), who has over 20 years of experience in the cybersecurity field. Their expertise is supported by industry certifications, regular participation in leading advanced training programs, and advisement roles. The CISO leads a dedicated team of security professionals who provide comprehensive coverage of critical program capabilities. We prioritize transparency by providing regular reports to the Audit Committee, senior management, and relevant stakeholders, keeping them informed on evolving cyber threats, ongoing assessments, and any significant findings. This collaborative approach ensures informed decision-making and timely response to potential risks, safeguarding our critical assets and valuable information.


text: Cybersecurity Risk Management and Strategy Our company recognizes the critical importance of cybersecurity in our digital operations and has established a risk management program to address both internal and external cybersecurity threats. This program, guided by industry frameworks like NIST CSF and overseen by experienced leadership teams, integrates advanced security tools and practices into our broader enterprise risk management system, actively involving our Executive team and Board of Directors (the "Board") in its oversight. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use NIST CSF and similar frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Despite our efforts and resource allocation, we acknowledge the challenges posed by the evolving nature of cyber threats and the limitations in fully mitigating these risks. We have not observed any significant impacts from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected our operational results and strategic or financial condition. Criteria used to determine the materiality of an incident includes, but is not limited to, evaluating the scope, nature, type, systems, data, operational impact, and pervasiveness of the incident. Materiality also considers both quantitative and qualitative factors in determining impact. Nevertheless, given the unpredictable nature of cyber threats, we cannot assure that potential future impacts will not have a material impact. See "Risk Factors – If we or our third-party providers experience cyberattacks or data security incidents, there may be damage to our brand and reputation, material financial penalties, and legal liability, which would materially adversely affect our business, results of operations, and financial condition."


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: Cybersecurity Governance Our Board of Directors oversees the organization's preparedness for cyber threats as part of its risk oversight function. This involves working to understand our risk profile, reviewing our cybersecurity processes, and maintaining an incident response plan. The Board strives to engage in active participation in continuous cybersecurity strategy improvement. In March 2023, the Board enhanced its cybersecurity expertise with the addition of Joanna Burkey. Ms. Burkey has an extensive cybersecurity background and has served as Chief Information Security Officer (CISO) at both HP and Siemens.


text: The Audit Committee, designated as the responsible body for risk management and compliance oversight, endeavors to ensures information flow of risk by regularly reporting its activities to the Board, including those related to cybersecurity. Our cybersecurity program is led by our Chief Information Security Officer (CISO), who has over 20 years of experience in the cybersecurity field, and who is primarily responsible for assessing and managing material risks from cybersecurity threats. Their expertise is supported by industry certifications, regular participation in leading advanced training programs, and advisement roles. The CISO leads a dedicated team of security professionals who provide coverage of critical program capabilities. Our CISO and larger cybersecurity risk management team take steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Our CISO provides regular reports to the Audit and Technology Committees, senior management, and relevant stakeholders, for the purpose of keeping them informed on evolving cyber threats, ongoing assessments, and any significant findings. This collaborative approach is intended to support informed decision-making, and timely response to potential risks, safeguarding our critical assets and valuable information.


text: When we do experience cybersecurity incidents, like the cybersecurity incident we disclosed in February 2024, we aim to utilize that experience to inform and strengthen our information security program.

stage1Category: Incident Disclosure


text: All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. To mitigate the threat to our business and address regulatory requirements, we take a comprehensive approach to cybersecurity risk management and have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We continue to make significant investments to augment the capabilities of our people, process, and technologies in order to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are integrated into our overall risk management governance within our Global Information Security (GIS) organization. Pursuant to our current policies an update on the operations of the cybersecurity program and the risks and trends in cybersecurity are reviewed, at a minimum, annually by our Board of Directors and periodically by the Audit Committee of our Board of Directors (Audit Committee).

companyName: SYNCHRONOSS TECHNOLOGIES INC

ticker: SNCR


text: Risk Management and Strategy We have implemented a systematic approach to managing our cybersecurity risks and have adopted a comprehensive set of cybersecurity policies that include best practices based on recognized industry standards and guidelines. These policies provide guidance on roles and responsibilities of key stakeholders and promote awareness. These policies also cover cyber education and training as well as help us to align with applicable laws and regulations to meet our compliance requirements. The primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Chief Information Security Officer (CISO) within our GIS organization, who reports to our Chief Technology Officer. The CISO is also responsible for managing the risk assessment and mitigation process. Our CISO has over 13 years of experience serving in various roles in risk management as well as enterprise and cyber security, including serving as the project lead and founder of the Open Worldwide Application Security Project (OWASP) flagship project Security Shepherd, a web and mobile application security training program, and leading IBM's ethical hacking team. He was also a principal security engineer at Axway prior to joining Synchronoss where he served as product security architect and a director of product security prior to accepting the role as our CISO. Our Chief Technology Officer has over 20 years of experience in the telecommunications industry, including serving as our Chief Architect and Senior Software Engineer, during which he oversaw our GIS program, including the governance, risk and compliance management related thereto. We also engage consultants, and other service providers, to help us implement our cybersecurity policies and procedures. These service providers assist us with monitoring security threats and vulnerabilities as well as responding to identified cybersecurity incidents, including prompt escalation and timely communication of major security incidents to senior business leadership and the Audit Committee.


text: As part of our cybersecurity policies, we conduct risk assessments designed to identify and prioritize potential cybersecurity threats, assess the likelihood and impact of those threats, and develop strategies for mitigating or managing cybersecurity risks. This involves assessing, evaluating and monitoring our vulnerabilities, as well as conducting impact analysis. Additionally, we provide ongoing cybersecurity awareness training to educate employees about the potential cybersecurity threats and how employees can identify potential threats and protect our data.


text: We have an Information Security Third Party Risk Management Policy, as well as a Vendor Code of Conduct, which contractually requires each third-party service provider accessing our or our customers' information systems to comply with our information security policies, as well as to meet a minimum set of information security and data privacy and protection standards in connection with their delivery of products and/or services to us. We also engage a third-party service provider to assess our third-party suppliers for potential risks and effectiveness of controls related to information security and data privacy protection that are relevant in the context of their delivery of services.


text: Our CISO and GIS team meets regularly with our IT and cybersecurity service providers and internal teams, such as the Risk Advisory Board (RAB), about the Company's ongoing compliance and risk management. GIS also drives business continuity and crisis management through coordinating and communicating with all levels of an organization and seeks to ensure that trends and emerging issues that could impact the business are considered and communicated as appropriate. Pursuant to our current policies the GIS team also provides, at the minimum, annual briefings to our Board of Directors and periodic briefings to the Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, among other relevant topics. The RAB convenes periodically or as needed to review the cybersecurity risks in the business. The RAB consists of individuals from GIS as well as the Chief Technology Officer.


text: Cybersecurity Threat Disclosure There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Although our "Risk Factors" in Item 1A include further detail about the material cybersecurity risks we face, we are not aware of any cybersecurity threats that have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.


text: Risk Management and Strategy We have implemented a systematic approach to managing our cybersecurity risks and have adopted a comprehensive set of cybersecurity policies that include best practices based on recognized industry standards and guidelines. These policies provide guidance on roles and responsibilities of key stakeholders and promote awareness. These policies also cover cyber education and training as well as help us to align with applicable laws and regulations to meet our compliance requirements. The primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Chief Information Security Officer (CISO) within our GIS organization, who reports to our Chief Technology Officer. The CISO is also responsible for managing the risk assessment and mitigation process. Our CISO has over 10 years of experience serving in various roles in risk management as well as enterprise and cybersecurity, including serving as the project lead and founder of the Open Worldwide Application Security Project (OWASP) flagship project Security Shepherd, a web and mobile application security training program, and leading IBM's ethical hacking team. He was also a principal security engineer at Axway prior to joining Synchronoss where he served as product security architect and a director of product security prior to accepting the role as our CISO. Our Chief Technology Officer has over 20 years of experience in the telecommunications industry, including serving as our Chief Architect and Senior Software Engineer, during which he oversaw our GIS program, including the governance, risk and compliance management related thereto. We also engage consultants, and other service providers, to help us implement our cybersecurity policies and procedures. These service providers assist us with monitoring security threats and vulnerabilities as well as responding to identified cybersecurity incidents, including prompt escalation and timely communication of major security incidents to senior business leadership and the Audit Committee.


text: Our CISO and GIS team meets regularly with our information technology (IT) and cybersecurity service providers and internal teams, such as the Risk Advisory Board (RAB), about our Company's ongoing compliance and risk management. GIS also drives business continuity and crisis management by coordinating and communicating with all levels of the organization and seeks to ensure that trends and emerging issues that could impact the business are considered and communicated as appropriate. Pursuant to our current policies the GIS team also provides, at the minimum, annual briefings to our Board of Directors and periodic briefings to the Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, and activities of third parties, among other relevant topics. The RAB convenes periodically or as needed to review the cybersecurity risks in the business. The RAB consists of individuals from GIS as well as the Chief Technology Officer.


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. This process is supported by both management and our Board of Directors.

companyName: NORTHROP GRUMMAN CORP /DE/

ticker: NOC


text: The Chief Information Office, which maintains our cybersecurity function, is led by our Chief Information Officer (CIO), who reports to our CEO. The Chief Information Security Officer (CISO) reports to the CIO and generally is responsible for management of cybersecurity risk and the protection and defense of our networks and systems. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually. The Audit and Risk Committee specifically assists the Board in its oversight of risks related to cybersecurity. To help ensure effective oversight, the Audit and Risk Committee receives reports on information security and cybersecurity from the CISO at least four times a year.


text: During the period covered by this Report, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors—Operational Risk" for a discussion of risks related to cybersecurity.


text: In addition, the Company's Enterprise Risk Management Council (ERMC) considers risks relating to cybersecurity, among other significant risks, and applicable mitigation plans to address such risks. The ERMC is comprised of the Executive Leadership Team, as well as the Chief Accounting Officer, Chief Compliance Officer, Corporate Secretary, Chief Sustainability Officer, Treasurer and Vice President, Internal Audit. The CIO and CISO attend each ERMC meeting. The ERMC meets during the year and receives periodic updates on cybersecurity risks from the CIO and CISO. We have an established process and playbook led by our CISO governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the Board (including our Lead Independent Director and the Audit and Risk Committee chair).


text: Our approach to cybersecurity risk management includes the following key elements: • Multi-Layered Defense and Continuous Monitoring – We work to protect our computing environments and products from cybersecurity threats through multi-layered defenses and apply lessons learned from our defense and monitoring efforts to help prevent future attacks. We utilize data analytics to detect anomalies and search for cyber threats. Our Cybersecurity Operations Center provides comprehensive cyber threat detection and response capabilities and maintains a 24x7 monitoring system which complements the technology, processes and threat detection techniques we use to monitor, manage and mitigate cybersecurity threats. From time to time, we engage third party consultants or other advisors to assist in assessing, identifying and/or managing cybersecurity threats. We also periodically use our Internal Audit function to conduct additional reviews and assessments. • Insider Threats – We maintain an insider threat program designed to identify, assess, and address potential risks from within our Company. Our program evaluates potential risks consistent with industry practices, customer requirements and applicable law, including privacy and other considerations. • Information Sharing and Collaboration – We work with government, customer, industry and/or supplier partners, such as the National Defense Information Sharing and Analysis Center and other government-industry partnerships, to gather and develop best practices and share information to address cyber threats. These relationships enable the rapid sharing of threat and vulnerability mitigation information across the defense industrial base and supply chain. • Third Party Risk Assessments – We conduct information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties, and our standard terms and conditions contain contractual provisions requiring certain security protections. • Training and Awareness – We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees with network access participate annually in required training, including spear phishing and other awareness training. We also periodically host tabletop exercises with management and other employees to practice rapid cyber incident response. • Supplier Engagement – We provide training and other resources to our suppliers to support cybersecurity resiliency in our supply chain. We also require our suppliers to comply with our standard information security terms and conditions, in addition to any requirements from our customers, as a condition of doing business with us, and require them to complete information security questionnaires to review and assess any potential cyber-related risks depending on the nature of the services being provided.


text: While we have experienced cybersecurity incidents in the past, to date none have materially affected the Company or our financial position, results of operations and/or cash flows. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."


text: FORWARD-LOOKING STATEMENTS AND PROJECTIONS This Annual Report on Form 10-K and the information we are incorporating by reference contain statements that constitute "forward-looking statements" within the meaning of the Private Securities Litigation Reform Act of 1995. Words such as "will," "expect," "anticipate," "intend," "may," "could," "should," "plan," "project," "forecast," "believe," "estimate," "guidance," "outlook," "trends," "goals" and similar expressions generally identify these forward-looking statements. Forward-looking statements include, among other things, statements relating to our future financial condition, results of operations and/or cash flows. Forward-looking statements are based upon assumptions, expectations, plans and projections that we believe to be reasonable when made, but which may change over time. These statements are not guarantees of future performance and inherently involve a wide range of risks and uncertainties that are difficult to predict. Specific risks that could cause actual results to differ materially from those expressed or implied in these forward-looking statements include, but are not limited to, those identified under "Risk Factors" and other important factors disclosed in this report and from time to time in our other SEC filings. These risks and uncertainties are amplified by the global macroeconomic, security and political environments, including inflationary pressures, labor and supply chain challenges, which have caused and will continue to cause significant challenges, instability and uncertainty. They include:


text: Industry and Economic Risks • our dependence on the U.S. government for a substantial portion of our business • significant delays or reductions in appropriations and/or for our programs, and U.S. government funding and program support more broadly, including as a result of a prolonged continuing resolution and/or government shutdown, and/or related to the global security environment or other global events • significant delays or reductions in payments as a result of or related to a breach of the debt ceiling • the use of estimates when accounting for our contracts and the effect of contract cost growth and our efforts to recover or offset such costs and/or changes in estimated contract costs and revenues, including as a result of inflationary pressures, labor shortages, supply chain challenges and/or other macroeconomic factors, and risks related to management's judgments and assumptions in estimating and/or projecting contract revenue and performance which may be inaccurate • continued pressures from macroeconomic trends, including on costs, schedules, performance and ability to meet expectations • increased competition within our markets and bid protests


text: Legal and Regulatory Risks • investigations, claims, disputes, enforcement actions, litigation (including criminal, civil and administrative) and/or other legal proceedings • the improper conduct of employees, agents, subcontractors, suppliers, business partners or joint ventures in which we participate, including the impact on our reputation and our ability to do business • changes in procurement and other laws, SEC, DoD and other rules and regulations, contract terms and practices applicable to our industry, findings by the U.S. government as to our compliance with such requirements, more aggressive enforcement of such requirements and changes in our customers' business practices globally • environmental matters, including climate change, unforeseen environmental costs and government and third party claims • unanticipated changes in our tax provisions or exposure to additional tax liabilities


text: Business and Operational Risks • cyber and other security threats or disruptions faced by us, our customers or our suppliers and other partners, and changes in related regulations • our ability to attract and retain a qualified, talented and diverse workforce with the necessary security clearances to meet our performance obligations • the performance and viability of our subcontractors and suppliers and the availability and pricing of raw materials and components, particularly with inflationary pressures, increased costs, shortages in labor and financial resources, supply chain disruptions, and extended material lead times • impacts related to health epidemics and pandemics and similar outbreaks • our exposure to additional risks as a result of our international business, including risks related to global security, geopolitical and economic factors, misconduct, suppliers, laws and regulations • our ability to innovate, develop new products and technologies, progress and benefit from digital transformation and maintain technologies to meet the needs of our customers • natural disasters • products and services we provide related to hazardous and high risk operations, including the production and use of such products, which subject us to various environmental, regulatory, financial, reputational and other risks • our ability appropriately to exploit and/or protect intellectual property rights


text: General and Other Risk Factors • the adequacy and availability of, and ability to obtain, insurance coverage, customer indemnifications or other liability protections • the future investment performance of plan assets, gains or losses associated with changes in valuation of marketable securities related to our non-qualified benefit plans, changes in actuarial assumptions associated with our pension and other postretirement benefit plans and legislative or other regulatory actions impacting our pension and postretirement benefit obligations • changes in business conditions that could impact business investments and/or recorded goodwill or the value of other long-lived assets, and other potential future liabilities We urge you to consider the limitations on, and risks associated with, forward-looking statements and not unduly rely on the accuracy of forward-looking statements. These forward-looking statements speak only as of the date this report is first filed or, in the case of any document incorporated by reference, the date of that document. We undertake no obligation to publicly update or revise any forward-looking statements, whether as a result of new information, future events or otherwise, except as required by applicable law.


text: In 2024, our global cybersecurity function was maintained in our Chief Information Office, led by our Chief Information Officer (CIO), who reported to our CEO. In 2025, we have brought together our chief information and digital transformation offices into a newly formed Chief Information and Digital Office, led by our Chief Information and Digital Officer (CIDO), who reports to the CEO. The Chief Information Security Officer (CISO), who previously reported to the CIO, now reports to the CIDO and continues to lead our cybersecurity functions. The CISO is responsible for the assessment and management of cybersecurity risk and the resiliency, protection and defense of our networks and systems. The CISO leads a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, data protection, privacy, insider threats and regulatory compliance. The current CISO is an executive with extensive technical and operational experience in building and leading cybersecurity and resiliency teams in the industry and government.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on the company's risk management process and the risk trends related to cybersecurity at least annually. The Audit and Risk Committee specifically assists the Board in its oversight of risks related to cybersecurity. To help ensure effective oversight, the CISO briefs the Audit and Risk Committee on the company's information security and cybersecurity risk posture at least four times a year.


text: In addition, the company's Enterprise Risk Management Council (ERMC) considers risks relating to cybersecurity, among other significant risks, and applicable mitigation plans to address such risks. The ERMC is comprised of the Executive Leadership Team, as well as the Chief Accounting Officer, Chief Ethics and Compliance Officer, Corporate Secretary, Chief Sustainability Officer, Treasurer and Vice President, Internal Audit. The CISO and the CIDO (previously the CIO) attend each ERMC meeting. The ERMC meets during the year and receives periodic updates from the CIDO and CISO on cybersecurity risks. We have an established process governing our response to a cybersecurity incident from detection to mitigation, recovery, assessment, internal and external notifications and functional stakeholder engagements with legal, privacy and risk management, among others. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the Board (including our Lead Independent Director and the Audit and Risk Committee chair), as appropriate.


text: Our approach to cybersecurity risk management includes the following key elements: • Multi-Layered Defense and Continuous Monitoring – We work to protect our computing environments and products from cybersecurity threats through multi-layered defenses and apply lessons learned from our defense and monitoring efforts to help prevent future attacks. We utilize data analytics to detect anomalies and search for cyber threats. Our Cybersecurity Operations Center provides comprehensive cyber threat detection and response capabilities and maintains a 24x7 monitoring system which complements the technology, processes and threat detection techniques we use to monitor, manage and mitigate cybersecurity threats or vulnerabilities. From time to time, we engage third-party consultants or other advisors to assist in assessing, identifying and/or managing cybersecurity threats. We also periodically use our Internal Audit function to conduct additional reviews and assessments. • Insider Threats – We maintain an insider threat program, led by our Vice President, Corporate and Enterprise Security, designed to identify, assess, and address potential risks from within our company. Our program evaluates potential risks consistent with industry practices, customer requirements and applicable law, including privacy and other considerations. • Information Sharing and Collaboration – We work with government, customer, industry and/or supplier partners, such as the National Defense Information Sharing and Analysis Center and other government-industry partnerships, to gather and develop best practices and share information to address cyber threats. These relationships enable the rapid sharing of threat and vulnerability mitigation information across the defense industrial base and supply chain. • Third Party Risk Management – We conduct cybersecurity assessments before sharing or allowing the hosting or processing of sensitive data in computing environments managed by third parties, and our standard terms and conditions contain contractual provisions requiring certain cybersecurity and data protections and controls. Finally, we require these third parties to notify us promptly of cyber incidents or data breaches so that we can assess potential impact on us. • Training and Awareness – We provide annual cybersecurity and information security awareness training to our employees with network access to help identify, avoid and mitigate cybersecurity threats and insider risks. This training also includes awareness about the policies and guidance associated with data privacy and protection of personal information, and protection and security of our company, customer and other third-party data. Our employees with network access also participate in annual spear phishing exercises. We also periodically host cybersecurity and ransomware tabletop exercises with management and other company functional stakeholders to practice rapid cyber incident response. • Supplier Engagement – We provide training and other resources to our suppliers to support cybersecurity resiliency and data security principles in our supply chain. We also require our suppliers, subcontractors and third-party service providers to comply with our standard cybersecurity-related terms and conditions, in addition to any requirements from our customers, as a condition of doing business with us, and require them to complete information security questionnaires to review and assess any potential cyber-related risks depending on the nature of the services or products being provided.


text: Risk Management and Strategy We recognize the importance of developing, implementing and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of data. We have integrated cybersecurity risk management into our broader risk management framework. Our risk management team works with our digital & technology organization to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: CBRE GROUP, INC.

ticker: CBRE


text: • Third Party Cybersecurity Service Providers – We engage third party service providers to expand the capabilities and capacity of our cybersecurity program, including for design, monitoring and testing of the program's risk prevention and protection measures and process execution, including incident detection, investigation, analysis and response, eradication and recovery. Additionally, several external entities evaluate our cybersecurity program, including the U.S. Defense Contract Management Agency, the Defense Industrial Base Cybersecurity Assessment Center and a Cybersecurity Maturity Model Certification Third Party Assessment Organization, to assess and certify our cybersecurity regulatory compliance. We also engage with external auditors and consultants who conduct audits and assessments of our cybersecurity controls. • Product Security – We provide cyber threat intelligence to, and collaboration with, our product security teams and share expertise in cyber vulnerability, exploit and resilience technology that can be applied to network infrastructure and company product offerings.


text: While we have experienced cybersecurity incidents in the past, to date none have materially affected the company or our financial position, results of operations and/or cash flows. We continue to invest in the cybersecurity and resiliency of our networks and products and to enhance our internal controls and processes, which are designed to help protect our programs, systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."


text: FORWARD-LOOKING STATEMENTS AND PROJECTIONS This Annual Report on Form 10-K and the information we are incorporating by reference contain statements that constitute "forward-looking statements" within the meaning of the Private Securities Litigation Reform Act of 1995. Words such as "will," "expect," "anticipate," "intend," "may," "could," "should," "plan," "project," "forecast," "believe," "estimate," "guidance," "outlook," "trends," "goals" and similar expressions generally identify these forward-looking statements. Forward-looking statements include, among other things, statements relating to our future financial condition, results of operations and/or cash flows. Forward-looking statements are based upon assumptions, expectations, plans and projections that we believe to be reasonable when made, but which may change over time. These statements are not guarantees of future performance and inherently involve a wide range of risks and uncertainties that are difficult to predict. Specific risks that could cause actual results to differ materially from those expressed or implied in these forward-looking statements include, but are not limited to, those identified under "Risk Factors" and other important factors disclosed in this report and from time to time in our other filings with the SEC. They include:


text: Industry and Economic Risks • our dependence on the U.S. government for a substantial portion of our business • significant delays or reductions in appropriations and/or for our programs, and U.S. government funding and program support more broadly, including as a result of a prolonged continuing resolution and/or government shutdown, and/or related to the global security environment or other global events • significant delays or reductions in payments as a result of or related to a breach of the debt ceiling • the use of estimates when accounting for our contracts and the effect of contract cost growth and our efforts to recover or offset such costs and/or changes in estimated contract costs and revenues, including as a result of inflationary pressures, labor shortages, supply chain challenges and/or other macroeconomic factors, and risks related to management's judgments and assumptions in estimating and/or projecting contract revenue and performance which may be inaccurate • increased competition within our markets and bid protests • continued pressures from macroeconomic trends, including on costs, schedules, performance and ability to meet expectations


text: Legal and Regulatory Risks • investigations, claims, disputes, enforcement actions, litigation (including criminal, civil and administrative) and/or other legal proceedings • changes in procurement and other laws, SEC, DoD and other rules and regulations, contract terms and practices applicable to our industry, findings by the U.S. government as to our compliance with such requirements, more aggressive enforcement of such requirements and changes in our customers' business practices globally • the improper conduct of employees, agents, subcontractors, suppliers, business partners or joint ventures in which we participate, including the impact on our reputation and our ability to do business • environmental matters, including climate change, unforeseen environmental costs and government and third-party claims • unanticipated changes in our tax provisions or exposure to additional tax liabilities


text: Business and Operational Risks • cyber and other security threats or disruptions faced by us, our customers or our suppliers and other partners, and changes in related regulations • the performance and viability of our subcontractors and suppliers and the availability and pricing of raw materials, chemicals, parts and components, particularly with inflationary pressures, increased costs, shortages in labor and financial resources, supply chain disruptions, and extended material lead times • our ability to attract and retain a qualified and talented workforce with the necessary security clearances to meet our performance obligations • our exposure to additional risks as a result of our international business, including risks related to global security, geopolitical and economic factors, misconduct, suppliers, laws and regulations • natural disasters, epidemics, pandemics and similar outbreaks and other significant disruptions • our ability to innovate, develop new products and technologies, progress and benefit from digital transformation and maintain technologies to meet the needs of our customers • products and services we provide related to hazardous and high risk operations, including the production and use of such products, which subject us to various environmental, regulatory, financial, reputational and other risks • our ability appropriately to protect and exploit intellectual property rights


text: Our cybersecurity program is focused on the following areas: • Governance: We leverage multiple cybersecurity frameworks (e.g., ISO 27001 and NIST CSF) and regulatory requirements to form our Information Security Management System (ISMS), which is defined through policies and standards. Policies are applicable to all employees globally. These policies are reviewed periodically to ensure they remain relevant. For additional information regarding governance of our cybersecurity program, see the sections below entitled "Board Oversight of Cybersecurity Risks" and "Management's Role in Assessing and Managing Cybersecurity Risks." • Technical Safeguards: We deploy technical and procedural measures to protect our technology and data. Protection measures include, but are not limited to, network firewalls, network intrusion detection and prevention, penetration testing, attack surface management, vulnerability assessments and remediation processes, threat intelligence, anti-malware and access controls, plus data loss prevention and monitoring. • Security Awareness / Training: All employees are required to adhere to our Standards of Business Conduct, which identifies an employee's responsibility for information security. We provide annual cybersecurity training for all employees, as well as enhanced role-specific information security training for certain employees. In addition to this training, security awareness articles are disseminated periodically throughout the year. We also sponsor a "Cyber Security Awareness Month" in October each year and conduct regular phishing detection and response exercises. • Incident Response Plans: We maintain and update incident response plans that address the life cycle of a cyber-incident and routinely evaluate the effectiveness of such plans. Incident response plans focus on cyber risk issues, including detection, response and recovery; cyber threats, including external communication and legal compliance; and breach simulations and penetration testing through internal and external exercises. Each year, we engage a third-party expert to oversee a cybersecurity incident response exercise to test pre-planned response actions from our incident response plan and to facilitate group discussions regarding the effectiveness of our cybersecurity incident response strategies and tactics. • Third-Party Suppliers and Service Providers: We conduct periodic vendor security reviews and risk assessments for prospective and significant current third-party technical suppliers and service providers. Vendor security reviews evaluate numerous key security controls and the outputs of these reviews are used as part of business decisions regarding procurement and to assess a vendor's overall security posture relative to a defined set of security criteria. • Certifications: Our security program is audited on an annual basis by several independent groups including an accredited certification body, leading accounting firms and institutional clients. • Experts: We engage a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our cybersecurity program. Our collaboration with these third-parties includes periodic audits, threat assessments and consultation on security enhancements.


text: General and Other Risk Factors • the adequacy and availability of, and ability to obtain, insurance coverage, customer indemnifications or other liability protections • the future investment performance of plan assets, gains or losses associated with changes in valuation of marketable securities related to our non-qualified benefit plans, changes in actuarial assumptions associated with our pension and other postretirement benefit plans and legislative or other regulatory actions impacting our pension and postretirement benefit obligations • changes in business conditions that could impact business investments and/or recorded goodwill or the value of other long-lived assets, and other potential future liabilities You are urged to consider the limitations on, and risks associated with, forward-looking statements and not unduly rely on the accuracy of forward-looking statements. These forward-looking statements speak only as of the date this report is first filed or, in the case of any document incorporated by reference, the date of that document. We undertake no obligation to publicly update or revise any forward-looking statements, whether as a result of new information, future events or otherwise, except as required by applicable law.


text: Cybersecurity is fundamental to FIS' complex, global business. As part of our business, FIS, its vendors and technology partners electronically receive, process, store and transmit a wide range of confidential information, including sensitive customer information and consumer personal data. Our operations extend to managing payment systems, cash access and prepaid card systems. Cyberattacks on information technology systems and the vendors and technological supply chain they rely on continue to grow in frequency, complexity and sophistication. This is a trend we expect to continue. Cyberattacks have garnered significant attention from individuals, businesses, governmental entities and the media drawing the focus of a large ecosystem of criminal threat actors. The objectives of these cyberattacks include, among other things, gaining unauthorized access to systems to disrupt operations, steal information, seek ransom payments from victims, perpetrate financial fraud, or sell stolen information. Perpetrators of cyberattacks attempt to exploit technical, human, social, and organizational vulnerabilities to gain unauthorized access. There is a growing trend of identifying and exploiting vulnerabilities in widely used technologies or vendor systems, allowing a single compromise to extend unauthorized access to numerous systems.


text: FIS takes actions to assess, identify, and manage risks from cybersecurity threats to our information systems and those of our vendors and technology partners. A significant focus of our ongoing efforts is how we identify these vulnerabilities and prevent and respond to cyberattacks. Our processes include the activities of the FIS Cyber Fusion Center, which provides 24x7x365 cybersecurity monitoring and incident response. They also include structured defense-in-depth initiatives, such as perimeter security, remote access security, endpoint security, application security and identity management. In addition, we engage in extensive information security training of our employees who use and access our information systems. Our process for identification and management of risks from cybersecurity threats includes regular communication with cyber experts, engagement of cybersecurity partners to review our systems, regular audits of our information security by third-party assessors and consultants, and regular interactions with vendors and technology partners to oversee and identify material risks associated with the information systems utilized by such persons.


text: Our process of identifying and remediating cybersecurity risks has been integrated into our overall risk management system and processes. It is overseen by our Chief Information Security Officer and Chief Risk Officer, who report to our Board of Directors and its Risk and Technology Committee on a quarterly basis. The Chief Information Security Officer provides ongoing oversight for the management of cybersecurity risks across the firm leveraging a series of qualitative and quantitative risk assessment routines. Risk escalations are facilitated through the enterprise risk management framework, including the Company's Enterprise Risk Committee and the Board of Directors via the Risk and Technology Committee. Facilitated via regular updates on cybersecurity risk, our Board of Directors takes an active role in overseeing, managing, and setting risk tolerances for our cybersecurity program. Our Chief Information Security Officer has 15 years of technology and cybersecurity experience, including previous senior leadership roles at major financial institutions and possesses industry certifications such as the Certified Information Systems Security Professional (CISSP). Additional leaders and key contributors composing the cybersecurity leadership team possess specific expertise, certifications, and previous work experience aligned to their assigned domains. Our Enterprise Risk Committee, responsible for providing oversight for cybersecurity risks, is a cross-functional representation of senior leadership with requisite experience and expertise to provide risk oversight, including the Chief Risk Officer, Chief Legal Officer, Chief Technology Officer, Chief Compliance Officer, Chief Privacy Officer, and FIS Business Presidents.


text: FIS remains focused on making additional strategic investments in information security to protect our clients and our information systems from risks from cybersecurity threats. This includes both capital expenditures and operating expenses on hardware, software, staff and consulting services. These investments in the past have been and are reasonably likely to continue to be material to our results of operations. Further, notwithstanding our investments and other processes and efforts described above and elsewhere in this Annual Report on Form 10-K, we cannot guarantee that FIS will not be the subject of a cyberattack that would have a material effect on its financial condition or results of operations. See "Risk Factors."


text: The continued growth in the frequency, complexity and sophistication of cyberattacks presents both a threat and an opportunity for FIS. Using expertise we have gained from our ongoing focus and investment, we have developed and we offer fraud, security, risk management and compliance solutions to target this growth opportunity in the financial services industry. We also use certain of these solutions to manage our own risks.


text: Cybersecurity is fundamental to FIS' complex, global business. As part of our business, FIS and its vendors, technology partners, and clients electronically receive, process, store and transmit a wide range of confidential information, including sensitive customer information and consumer personal data. Our operations extend to managing payment systems, cash access and prepaid card systems. Cyberattacks on information technology systems and the vendors and technological supply chain they rely on continue to grow in frequency, complexity and sophistication. This is a trend we expect to continue. Cyberattacks have garnered significant attention from individuals, businesses, governmental entities and the media drawing the focus of a large ecosystem of criminal threat actors. The objectives of these cyberattacks include, among other things, gaining unauthorized access to systems to disrupt operations, steal information, seek ransom payments from victims, perpetrate financial fraud, or sell stolen information. Perpetrators of cyberattacks attempt to exploit technical, human, social, and organizational vulnerabilities to gain unauthorized access. There is a growing trend of identifying and exploiting vulnerabilities in widely used technologies or vendor systems, allowing a single compromise or failure to extend unauthorized access to numerous systems.


text: FIS takes actions to assess, identify, and manage risks from cybersecurity threats to our information systems and those of our vendors and technology partners. A significant focus of our ongoing efforts is how we identify these vulnerabilities and prevent and respond to cyberattacks. Our processes include the activities of the FIS Cyber Fusion Center, which provides 24x7x365 cybersecurity threat monitoring and response. They also include structured defense-in-depth initiatives, such as perimeter security, remote access security, endpoint security, application security and identity management. In addition, we engage in extensive information security training of our employees who use and access our information systems. Our process for identification and management of risks from cybersecurity threats includes regular communication with cyber experts, engagement of cybersecurity partners to review our systems, regular audits of our information security by third-party assessors and consultants, and regular interactions with vendors and technology partners to oversee and identify material risks associated with the information systems utilized by such persons.


text: Our process of identifying and remediating cybersecurity risks has been integrated into our overall risk management system and processes. It is overseen by our Chief Information Security Officer and Chief Risk Officer, who report to our Board of Directors and its Risk and Technology Committee on a quarterly basis. The Chief Information Security Officer provides ongoing oversight for the management of cybersecurity risks across the firm leveraging a series of qualitative and quantitative risk assessment routines. Risk escalations are facilitated through the enterprise risk management framework, including the Company's Enterprise Risk Committee and the Board of Directors via the Risk and Technology Committee. Facilitated via regular updates on cybersecurity risk, our Board of Directors takes an active role in overseeing, managing, and setting risk tolerances for our cybersecurity program. Our Chief Information Security Officer has over 15 years of technology and cybersecurity experience, including previous senior leadership roles at major financial institutions and possesses industry certifications such as the Certified Information Systems Security Professional (CISSP). Additional leaders and key contributors composing the cybersecurity leadership team possess specific expertise, certifications, and previous work experience aligned to their assigned responsibilities. Our Enterprise Risk Committee, responsible for providing oversight for cybersecurity risks, is a cross-functional representation of senior leadership with requisite experience and expertise to provide risk oversight, including the Chief Risk Officer, Chief Legal Officer, Chief Technology Officer, Chief Compliance Officer, Chief Privacy Officer, and FIS Business Presidents.


text: FIS remains focused on making additional strategic investments in information security to protect our clients and our information systems from risks from cybersecurity threats. This includes both capital expenditures and operating expenses on hardware, software, staff and consulting services. These investments in the past have been and are reasonably likely to continue to be material to our results of operations. Further, notwithstanding our investments and other processes and efforts described above and elsewhere in this Annual Report on Form 10-K, we cannot guarantee that FIS will not be the subject of a cyberattack that would have a material effect on its financial condition or results of operations. See "Risk Factors" in Item 1A.


text: We have not identified any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For a full discussion of risks from cybersecurity threats, see the section entitled "Risk Factors" in Item 1A.


text: The Company continuously enhances policies and procedures, and controls to mitigate against the substantial rise in the prevalence of cybersecurity risks and challenges to protect its data.

companyName: POWER SOLUTIONS INTERNATIONAL, INC.

ticker: PSIX


text: Run tabletop exercises with our executive team to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; Conduct regular third-party assessments of our cybersecurity program; Undertake regular reviews of our incident response plan and other policies related to cybersecurity; Run regular cyber penetration testing;

companyName: SENSIENT TECHNOLOGIES CORP

ticker: SXT


text: Risk Management Strategy The Company's cybersecurity risk management function is lead by the Vice President of Information Technology, who evaluates processes and activities within the Company's information technology infrastructure and automated systems. During 2023, the Company completed a detailed assessment to identify all technology and cyber tools currently in place and assessed its information technology personnel's cybersecurity capabilities and skill sets. During 2023, the Company focused on formalizing cybersecurity procedures and defining standards for risk identification and communication activities. The Company utilizes the National Institute of Standards and Technology guidance in all cybersecurity policies and procedures. Annual training for employees is required as well as ad hoc trainings for specific topics or events as deemed appropriate throughout the year. The Company also has cyber insurance to assist the Company both financially and operationally if a cyber event were to occur. Below is the basic framework used in the Company's risk management strategy: • Identify - set of procedures to identify assets to be protected, including computation, data, and integrity; • Protect - set of procedures to effectively engage and monitor adequate safeguards of critical infrastructure services; • Detect - set of activities, tools, and procedures to timely identify anomalies through continuous monitoring; • Respond - set of activities to effectively respond to and contain detected and confirmed cybersecurity events, and • Recover - set of activities and procedures to ensure any assets impaired because of a cybersecurity event are restored to use within the stated recovery point/time objectives.


text: The Company has taken steps to gain insights into how cybersecurity risk management functions have been integrated into its overall risk management systems and process. Below are the risk management activities regularly performed: • Cybersecurity, as described above; • Financial control risk assessment which is a formal part of the annual internal control program; • Management's risk assessment associated with the budgeting and strategic planning process; • Legal risk assessment associated with our response to the Department of Justice proceeding, and • A broader fraud risk assessment (also performed as part of the internal control program).


text: The Company's information technology and risk management function is highly centralized, with the Corporate Controller and Vice President of Information Technology involved in most of the risk related activities which provides a consistent input throughout risk management activities as well as aiding in identifying dependencies and duplications. The Company engaged a third party who conducted its phishing and penetration tests in 2023. The Company is in the process of implementing new processes, procedures, and tools as a result of the observations from these tests and expects all actions to be implemented during 2024.


text: The Vice President of Information Technology oversees the population of third-party service providers connected to any of the Company's networks. The Company obtains a Report on Controls at a Service Organization Relevant to User Entities' Internal Control over Financial Reporting, Type 2 Report ("SOC-1 Report") that reports on the fairness of the presentation of the service provider's description of the service organization's system and the suitability of the design and operating effectiveness of the controls to achieve the related control objectives throughout a specified period. The SOC-1 Report is reviewed by Internal Audit. The Company limits access to information based on the nature of the services performed by third party service providers which provides a significant level of risk management before third-party access to data.