text: The board and the risk committee receive regular presentations and reports from management as well as outside experts on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technology trends and information security considerations arising with respect to our peers and third parties. On an annual basis, the board and the risk committee discuss our approach to cybersecurity risk management with our Chief Risk Officer, Chief Compliance Officer and Chief Information Officer, among others. At each regular board meeting, the risk committee reviews and reports to the board on key cybersecurity risks. The board and the risk committee receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Impact of Cybersecurity Threats Our results of operations and financial condition have not been materially affected by cybersecurity threats or incidents to date. However, to assess, identify, and manage material risks from cybersecurity threats, including as a result of previous cybersecurity incidents, we have invested and expect to continue to invest significant resources, including maintaining cybersecurity insurance coverage, to sustain and enhance our information security and controls or to investigate and mitigate security vulnerabilities. As a result, cybersecurity threats and other technological risks involving our systems have materially affected our business strategy and processes. Although we believe that we maintain a robust program of information security and controls and that none of the cybersecurity incidents that we have encountered to date have materially affected us, we cannot be certain that the security measures and procedures we have in place to detect security incidents and protect sensitive data will be successful or sufficient to counter all current and emerging risks and threats. The impact of a material cybersecurity incident involving our systems and data, or those of our clients, partners or vendors, could have a material adverse effect on our business strategy, results of operations and financial condition.

companyName: FISERV INC

ticker: FISV

secItem: Item 1C

stage1Category: Strategy Integration

stage1Method: unanimous


text: Additional information on the impact of cybersecurity threats applicable to our business can be found in the Risk Factors section of this report under the heading "Operational and Security Risks".

stage1Category: None/Other


text: We have an information security program designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner.

companyName: CENTERSPACE

ticker: CSR

stage1Category: Risk Management Process


text: Our Board of Trustees oversees management's process for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our Senior Vice President of Information Technology (the "SVP of IT"), meets with the Board of Trustees at least annually to present and discuss strategies and cybersecurity initiatives. This meeting includes reporting of cybersecurity incidents at least annually or more often, if identified.

stage1Category: Board Governance


text: Our SVP of IT leads a team that is responsible for assessing and managing our cybersecurity risks. The SVP of IT has a B.S. in Management Information Systems, spent more than a decade with Microsoft before joining the Company, and is an active member of North Dakota State and Local Intelligence Center (NDSLIC), an affiliate of National Fusion Center Association (NFCA) and United States Homeland Security (DHS). Senior management, including the SVP of IT, conducts regular meetings to discuss technology initiatives and cybersecurity risks and strategies.

stage1Category: Management Role

stage1Method: majority


text: A comprehensive approach to assessing, identifying, and managing cybersecurity risks is part of the Company's overall risk management strategy. A combination of internal and external monitoring services help identify, manage, and assess how management responds within our enterprise risk management processes. Any known known cybersecurity incidents would be reported to our board, chief executive officer, and disclosure committee for evaluation.


text: We engage third party experts to monitor for and identify cyber threats. Both management and the third party provider receive alerts regarding cyber threats. The third party provider has the ability to act on our behalf to respond to any threats it identifies. We also use, among other things, endpoint monitoring, anti-virus software, multi-factor authentication, and data encryption to assist with managing cyber risks and identifying cyber threats. In addition, we engage a cybersecurity consultant to regularly assess cyber risks and threats and provide recommendations and plans to mitigate those risks.


text: We utilize third-party service providers for a variety of functions. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers. We look for reliable and reputable service providers that maintain cybersecurity programs based on industry standards. Depending on the nature of the services provided and the sensitivity of information processed, our vendor management process may include contractually imposed obligations on the provider and reviewing the cybersecurity practices of such provider.

stage1Category: Third-Party Risk


text: In 2021, we suffered a ransomware attack on our information technology systems. This incident did not have a material impact on our business, operations, or financial condition; however, as a result, we began work on certain information technology initiatives earlier than originally planned.

stage1Category: Incident Disclosure


text: A security breach or other significant disruption involving our computer networks and related systems could cause substantial costs and other negative effects, including litigation, remediation costs, costs to deploy additional protection strategies, compromising of confidential information, and reputational damage adversely affecting investor confidence. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See Item 1A. Risk Factors – "We face risks associated with cyber-attacks, cyber intrusions, or otherwise, which could pose a risk to our systems, networks, and services" and "Security breaches could compromise our information and expose us to liability, which would cause our business and reputation to suffer." and "Security breaches could compromise our information and expose us to liability, which would cause our business and reputation to suffer."


text: Our Board of Trustees oversees management's process for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our Board of Trustees has also delegated authority to its Audit Committee to review our internal controls relating to information technology, data privacy, including data protection and cybersecurity, including network security and cloud security. Senior leadership, including our Senior Vice President of Information Technology (the "SVP of IT"), meets with the Board of Trustees at least annually to present and discuss strategies and cybersecurity initiatives. This meeting includes reporting of cybersecurity incidents at least annually or more often, if identified.


text: A comprehensive approach to assessing, identifying, and managing cybersecurity risks is part of the Company's overall risk management strategy. A combination of internal and external monitoring services help identify, manage, and assess how management responds within our enterprise risk management processes. Any known cybersecurity incidents would be reported to our board, chief executive officer, and disclosure committee for evaluation.


text: We have not suffered any cyber incident that had a material impact on our business, operations, or financial condition. However, a security breach or other significant disruption involving our computer networks and related systems could cause substantial costs and other negative effects, including litigation, remediation costs, costs to deploy additional protection strategies, compromising of confidential information, and reputational damage adversely affecting investor confidence. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See Item 1A. Risk Factors – "We face risks associated with cyber-attacks, cyber intrusions, or otherwise, which could pose a risk to our systems, networks, and services" and "Security breaches could compromise our information and expose us to liability, which would cause our business and reputation to suffer." and "Security breaches could compromise our information and expose us to liability, which would cause our business and reputation to suffer."


text: Risk Management and Strategy BancShares maintains robust processes for assessing, identifying, and managing material risks from cybersecurity threats that are integrated with our overall risk management program. As part of its cybersecurity risk management framework, BancShares leverages a Three Lines of Defense model (the "Three Lines Model") to promote clarity of roles and responsibilities in managing risk. Under the Three Lines Model, the ECSO led by our Chief Information Security Officer (the "CISO"), acts as a first line of defense and has primary responsibility for identifying, assessing, monitoring, and managing material risks from cybersecurity threats. Our CISO reports to our Chief Information & Operations Officer ("CIOO"), who reports directly to our Chief Executive Officer. As a part of the ECSO, Enterprise Incident Management ("EIM") maintains incident response playbooks (i.e., standard operating procedures) to identify, respond, classify, and analyze incidents and events in accordance with BancShares' Enterprise Severity Matrix, and our Security Operation Center identifies, assesses, manages, and monitors potential cybersecurity events with EIM. In addition, BancShares maintains a third-party risk management team tasked with evaluating, identifying, and managing risk from all third-party engagements, including from cybersecurity threats.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: The second-line independent risk management, including compliance, enterprise risk management, and operational risk management, works with the first line ECSO to evaluate, assess, and manage material risks using an established Risk Appetite Framework that is designed to require that the cybersecurity organization appropriately document the current risk landscape and the activities undertaken to mitigate risk that falls outside of the enterprise risk tolerance. The third-line in the Three Lines Model is our internal audit team, which assesses the effectiveness of related controls.


text: We maintain processes for escalation from each line, including processes to report information to management, management-level committees and to committees of the Board and the Board as a whole, as appropriate. For example, Risk Appetite Statements, top risks, and issues are reported to the Management Committees and the Risk Committee of the Board to monitor progress, identify trends, and escalate issues.


text: BancShares follows a defense-in-depth and layered-control framework to protect the organization against cybersecurity threats and attacks. ECSO remains committed to maintaining and improving preventative and detective controls and enhancing our defenses in response to the evolving threat landscape. This mission is supported by policy, standards, and procedures which align to industry standards, including the National Institute of Standards and Technology Cybersecurity Framework, and are enforced through the firm's preventive and detective controls.


text: Additionally, BancShares has implemented a threat awareness program that includes cross-organizational information sharing capability for threat intelligence and membership and engagement with intelligence communities including the Financial Services Information Sharing and Analysis Center, Federal Bureau of Investigation, United States Department of Homeland Security, and others. BancShares also utilizes external experts and third-party assessors to maximize its risk intelligence coverage and management ability.


text: BancShares engages internal auditors, external assessors, and consultants to benchmark, scale, manage, and identify cybersecurity threats. Consultants also assess BancShares' cybersecurity systems and complete vulnerability testing. These groups assist the ECSO with cybersecurity risk management and identification.


text: The BancShares information security program continues to operate under heightened awareness due to industry threats and recent acquisitions. For more information regarding the risks we face from cybersecurity threats, refer to Item 1A. Risk Factors. Thus far, there have been no cybersecurity incidents that we have determined to have materially affected or to be reasonably likely to materially affect us, including with respect to our business, results of operations, or financial condition. The focus continues to be on monitoring the threat landscape and integration of entities.


text: The Board retains supervisory oversight responsibility for the organization and its activities, including enterprise risk management and cybersecurity threats, subject to the committee delegation described below. The Board conducts oversight of management through its subcommittees, presentations from senior leadership, and routine board-directed reporting to ensure management continues to operate and conduct business in alignment with Risk Appetite Statements.


text: Oversight of cybersecurity and the ECSO organization is the responsibility of the Risk Committee. The Risk Committee further oversees cybersecurity and other risks through a subcommittee, the Enterprise Risk Oversight Committee ("EROC"), as well as additional management-level subcommittees beneath the Risk Committee including the Technology & Security Risk Committee ("TSRC") and the Operational Risk Committee ("ORC" and, together with the EROC and TSRC, the "Management Committees"). Management Committees, which include as members the CISO and other cybersecurity leadership, have clear lines of communication with the Board and its committees. The Management Committees are designed with a purpose-driven scope and decision-making authority and are required to provide the Board with regular reporting of management's current business activities and the potential risk associated with those activities. Management Committees are informed by EIM following the incident management process as per internal policies and standards.


text: In addition, the Audit Committee of the Board (the "Audit Committee") monitors internal audit's coverage of cybersecurity governance, risks, and related controls, including any identified deficiencies, from cybersecurity or other risks, that could adversely affect the ability to record, process, summarize, and report financial data. The Risk Committee coordinates with Audit Committee for review of information security matters, as needed.


text: The Board may from time to time create informal working groups to enable deeper and more detailed discussions related to our technology needs and investments and inform the Board on cybersecurity risks, among other topics. For example, our Board recently established and authorized a Task Force on Technology (the "Task Force") to assist and support the Board in a strategic review of the role of technology in our operations, our current and future investments in technology resources, and the current board oversight of risk, governance, and controls surrounding technology and cybersecurity. The Task Force is comprised of members of the Board, working closely with management, including the CIOO.


text: The CISO is responsible for assessing and managing material cyber risks. His expertise with assessing and managing material cyber risks is based on more than 20 years of cybersecurity experience with prior roles as a CISO and Global Head of Operations. The CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity by the ECSO through regular reporting and escalations, as required. He, the CIOO, and others report information about material risks from cybersecurity threats to the Board or a committee or subcommittee of the Board, as described below.


text: The Risk Committee receives information on cybersecurity risk, including risk appetite utilization, breaches and emerging risks, and the control environment, directly or indirectly, from various sources, including each of the CISO, the EROC, Management Committees, the Task Force, the TSRC and the ORC. Additionally, the Risk Committee reviews BancShares' information security policies and program with a focus on whether they are appropriate to protect data, records, and proprietary information of BancShares as well as that of its customers and employees.


text: Risk Management and Strategy BancShares maintains robust processes for assessing, identifying, and managing material risks from cybersecurity threats that are integrated with our overall risk management program. As part of its cybersecurity risk management framework, BancShares leverages a Three Lines of Defense model (the "Three Lines Model") to promote clarity of roles and responsibilities in managing risk. Under the Three Lines Model, the ECSO, led by our Chief Information Security Officer (the "CISO"), acts as a first line of defense and has primary responsibility for identifying, assessing, monitoring, and managing material risks from cybersecurity threats. Our CISO reports to our Chief Information and Operations Officer ("CIOO"), who reports directly to our Chief Executive Officer. Within ECSO, the Cyber Security Operation Center identifies, assesses, monitors, and manages potential cybersecurity events in coordination with the Enterprise Incident Management ("EIM") team, escalating analysis and response to incidents and events in accordance with established procedures and the Enterprise Severity Matrix. In addition, BancShares maintains a third-party risk management team tasked with identifying, evaluating, and managing risk posed by all third-party engagements, including from cybersecurity threats.


text: Governance. Oversight of information security risk and information technology risk is the operational responsibility of the Information Risk Committee, which is a management committee, with additional oversight from the Enterprise Risk Management Committee, which is also a management committee, and the Risk Committee of the Board of Directors.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: The second-line independent risk management, including compliance, enterprise risk management, and operational risk management, works with the first line ECSO to evaluate, assess, and manage material risks using an established Risk Appetite Framework. The Risk Appetite Framework requires the cybersecurity organization to document the current risk landscape and the activities undertaken to mitigate risk that exceeds enterprise risk tolerance. The third-line in the Three Lines Model is our internal audit team, which assesses the effectiveness of related controls.


text: BancShares maintains processes for reporting and escalation from each line of defense through management to senior leadership, to management-level committees, and to committees of the Board and the Board, as appropriate. Reporting includes top and emerging risks, and other operational risk metrics.


text: BancShares follows a defense-in-depth and layered-control framework to protect the organization against cybersecurity threats and attacks. ECSO remains committed to maintaining and improving preventative and detective controls and enhancing our defenses in response to the evolving threat landscape. This mission is supported by policy, standards, and procedures which align to industry frameworks, including the National Institute of Standards and Technology Cybersecurity Framework, and are executed through the firm's preventive and detective controls.


text: BancShares has implemented a threat awareness program that includes cross-organizational information sharing capabilities for threat intelligence and membership and engagement with intelligence communities, including but not limited to, the Financial Services Information Sharing and Analysis Center, the Financial Services Sector Coordinating Council, the Federal Bureau of Investigation, and the U.S. Department of Homeland Security. BancShares also utilizes external experts and third-party assessors to maximize its risk intelligence coverage and to enhance risk detection and remediation. BancShares engages internal auditors, external assessors, and consultants to benchmark, scale, manage, and identify cybersecurity threats. Consultants also assess BancShares' cybersecurity systems and complete vulnerability testing.


text: The Board retains supervisory oversight responsibility for the organization and its activities, including enterprise risk management and cybersecurity risks. The Board conducts oversight of management through board committees, presentations from senior leadership, and routine Board-directed reporting to ensure management continues to operate and conduct business in alignment with Risk Appetite Statements.


text: Oversight of cybersecurity and the ECSO organization is the responsibility of the Risk Committee. The Risk Committee oversees cybersecurity and other risks through reporting from management, including the Enterprise Risk Oversight Committee ("EROC"), as well as additional management-level subcommittees beneath the Risk Committee including the Technology & Security Risk Committee ("TSRC") and the Operational Risk Committee ("ORC" and, together with the EROC and TSRC, the "Management Committees"). Management Committees, which include as members the CISO and other cybersecurity leadership, have clear lines of communication with the Board and its committees. The Management Committees are designed with a purpose-driven scope and decision-making authority and are required to provide the Board with regular reporting of management's business activities and the potential risk associated with those activities. Management Committees are informed by EIM following the incident management process as per internal policies and standards.


text: The Board may from time to time create informal working groups to enable deeper and more detailed discussions related to our technology needs and investments and inform the Board on cybersecurity risks, among other topics.


text: In addition, the Audit Committee of the Board monitors internal audit's coverage of cybersecurity governance, risks, and related controls, including any identified deficiencies, that could adversely affect the ability to record, process, summarize, and report financial data. The Risk Committee coordinates with the Audit Committee for review of information security matters, as needed.


text: The CISO is responsible for assessing and managing material cyber risks. The CISO's expertise with assessing and managing material cyber risks is based on more than 20 years of cybersecurity experience with prior roles as a CISO and Global Head of Operations. The CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity by the ECSO through regular reporting and escalations, as required. The CIOO, the CISO, and others, report information about material risks from cybersecurity threats to the Board or a committee or subcommittee of the Board, as described below.


text: The Risk Committee receives information on cybersecurity risk, including risk appetite utilization, breaches and emerging risks, and the control environment, directly or indirectly, from various sources, including the CIOO, CISO, and each of the Management Committees. Additionally, the Risk Committee reviews BancShares' information security policy and program with a focus on whether they are appropriate to protect data, records, and proprietary information of BancShares as well as that of its customers and employees.


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the "Board"). The Board, Audit and Risk Committee, and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity activities into five categories: identify, protect, detect, respond and recover. Our cybersecurity risk management program is part of our overall risk assessment. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation, and investments in a partnership with a third-party vendor whose experts further advise our processes. Our executive team, which includes the VP of IT, reviews enterprise risk management-level cybersecurity risks annually, along with other key risks to the organization. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include an IT security policy as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, malware protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.

companyName: HEARTLAND EXPRESS INC

ticker: HTLD


text: The VP of IT is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. Our VP of IT has over two decades of experience leading cybersecurity oversight. Others on our IT security team have cybersecurity experience or certifications that support these efforts. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete cybersecurity trainings at least annually and have access to more frequent cybersecurity trainings through online trainings. We employ ongoing random testing of phishing and other cybersecurity threats across our entire employee base on a weekly basis with follow-up communication on results of these tests to members of management. Failures of these random tests require team re-training efforts.


text: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also prepares a monthly cyber scorecard, regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment. Further, we conduct periodic external penetration tests, red team testing and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Our team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of the hosted applications are required to document user access reviews at least quarterly and assess the vendor-provided System and Organization Controls (SOC) 1 or SOC 2 report on an annual basis. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: The Audit and Risk Committee and the full Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. The Audit and Risk Committee performs an annual review of the Company's cybersecurity program and the Company's overall risk assessment, which includes discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation. The Audit and Risk Committee's annual review also includes review of recent enhancements to the Company's defenses and management's progress on its cybersecurity strategic roadmap. In addition, the Board receives regular cybersecurity updates, which include a review of key performance indicators, test results and related remediation, and recent threats and how the Company is managing those threats. Further, at least annually, the Board receives updates on the Company's Business Continuity Plan, which covers, among other things, potential cybersecurity incidents, and potential impacts to data privacy and compliance. To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on these topics. For example, the Board has hosted an outside expert to discuss developments in the cybersecurity threat landscape.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced potential threats to and incidents related to our data and systems, including malware and phishing attempts. For more information about the cybersecurity risks we face, see the risk factor entitled "We depend on the proper functioning and availability of our management information and communication systems and other technology assets (and the data contained therein) and a system failure or unavailability, including those caused by cybersecurity breaches internally or with third parties, or an inability to effectively upgrade such systems and assets, including operating system integration of acquired companies, could cause a significant disruption to our business and have a materially adverse effect on our results of operations" in Item 1A- Risk Factors.


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the "Board"). The Board, Audit and Risk Committee, and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity activities into five categories: identify, protect, detect, respond and recover. Our cybersecurity risk management program is part of our overall risk assessment. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation, and investments in a partnership with a third-party vendor whose experts further advise our processes. Our executive team, which includes VPs of IT, review enterprise risk management-level cybersecurity risks annually, along with other key risks to the organization. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include an IT security policy as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, malware protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.


text: The VPs of IT are responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. Our VPs of IT have extensive experience leading cybersecurity oversight. Others on our IT security team have cybersecurity experience or certifications that support these efforts. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete cybersecurity trainings at least annually and have access to more frequent cybersecurity trainings through online trainings. We employ ongoing random testing of phishing and other cybersecurity threats across our entire employee base on a weekly basis with follow-up communication on results of these tests to members of management. Failures of these random tests require team re-training efforts.


text: Additional information regarding the Company's risk management framework, including management-level and Board-level committee experience and expertise, oversight responsibilities, and information risk governance, can be found under the section captioned "Risk Management Framework" contained in Item 1. Business.


text: The Company's Chief Information Officer ("CIO") leads our Information Security Committee (a taskforce comprised of senior representatives from primary corporate functions, mortgage and title operations, IT infrastructure, IT security, and external security consultants, which is responsible for developing, updating, implementing and maintaining our cybersecurity strategy, policy (which leverages the NIST CSF framework), standards, architecture, and processes. The CIO provides annual reports to our Board of Directors, and periodic reports to our Chief Executive Office ("CEO"), Chief Financial Officer ("CFO") and Chief Accounting Officer ("CAO"), and other members of senior management, regarding existing and emerging cybersecurity risks and threats, the status of projects intended to strengthen our information security systems, and assessments of our information security program.

companyName: M/I HOMES, INC.

ticker: MHO


text: Members of senior management are notified by our Information Security Committee if any cybersecurity incident leads to a breach or loss of any data. These members of senior management are responsible for promptly determining if such an incident is material and notifying our CEO, CFO and our Board of Directors of the material incident and the impact that the incident has had, and is expected to have, on the Company's reputation, results of operations, financial condition, and business strategy. The Company engages third-party auditors and consultants to evaluate and assist the Company in responding to cybersecurity threats and incidents, and, if necessary, monitoring any exposure of confidential company or customer data. The Company also actively engages with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies, procedures and strategy, assess our security status, and align our cybersecurity practices with current and emerging cybersecurity risks.


text: We conduct thorough security assessments of all third-party service providers before engagement and perform regular monitoring of the third-party service providers' hosted applications designed to ensure compliance with our cybersecurity standards. This occurs through annual assessments by our internal audit function of the third party's System and Organization Controls ("SOC") 1 or SOC 2 report or through additional user access reviews by the internal business owner if a SOC 1 or SOC 2 report is unavailable.


text: Our CIO and his security management team possess primary responsibility for identifying, assessing, monitoring, and managing our cybersecurity risks. Our Board of Directors directly oversees cybersecurity risks, which includes conducting an annual review of the Company's cybersecurity risks, management's actions to identify and detect threats, management's action plans for response and recovery situations, and review of recent enhancements to the Company's defenses and strategic cybersecurity roadmap. In addition, the Audit Committee receives quarterly cybersecurity updates, which include a review of new processes implemented to monitor cyber risks, and a summary of any recent threats and the Company's response to those threats.


text: Our CIO has over 30 years of experience in information technology, including a deep understanding of information technology governance, regulatory compliance and familiarity with the software, tools and programs used by his security management team to identify vulnerabilities, investigate incidents and implement appropriate security measures. In addition, our security management team maintains appropriate and relevant levels of education and certifications, such as Certified Information Security Manager (CISM) and Certified Ethical Hacker (CEH). Furthermore, all employees are required to complete a biannual security awareness training course focusing on data protection, phishing prevention, and credential protection.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, we face a number of cybersecurity risks in the normal course of our business and, from time to time, experience threats to our data and systems, including malware and computer virus attacks. Notwithstanding the extensive measures we employ to address cybersecurity risks, we may not be successful in preventing or mitigating a cybersecurity incident that would be reasonably likely to materially affect us. Although we maintain cybersecurity insurance, the costs we incur related to cybersecurity threats or disruption may not be fully insured. See "Item 1A. Risk Factors" in Part I of this Annual Report on Form 10-K for more information regarding the risk factors associated with cybersecurity risks.


text: The Company's Chief Information Officer ("CIO") leads our Information Security Committee (a taskforce comprised of senior representatives from primary corporate functions, mortgage and title operations, IT infrastructure, IT security, and external security consultants), which is responsible for developing, updating, implementing and maintaining our cybersecurity strategy, policy (which leverages the NIST CSF framework), standards, architecture, and processes. The Company has integrated cyber security into its annual risk assessment process. This process identifies critical assets and assesses those assets for potential threats and vulnerabilities. Risks are prioritized based on their impact and likelihood. Controls are assessed to ensure the Company's controls are appropriate to mitigate risks. It also allows us to identify any gaps that we need to focus on. These gaps are typically part of the Information Security Committees risk register. The Information Security Committee meets quarterly and continuously monitors and re-evaluates risks through this risk register, which was initially developed using the NIST CSF framework. The CIO provides annual reports to our Board of Directors, and periodic reports to our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and Chief Accounting Officer ("CAO"), and other members of senior management, regarding existing and emerging cybersecurity risks and threats, the status of projects intended to strengthen our information security systems, and assessments of our information security program.


text: Risk Management and Strategy. The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats, and is committed to the prevention, detection, and timely response to cybersecurity threats that may impact the confidentiality, integrity, and availability of its information systems and information assets.


text: The Company has an Information Security Risk Management Program and a Technology Risk Management Program under its Risk Management Framework for the identification, assessment, measurement, mitigation, monitoring, and internal reporting of risks associated with its information systems, information assets, and third parties, including vendors and service providers. The Information Security Risk Management Program and Technology Risk Management Program align with the Company's Third-Party Risk Management Program in regard to protecting information assets.


text: The Information Security Risk Management Program and Technology Risk Management Program are managed by the Company's Corporate Information Security team, led by the Chief Information Security Officer. On average, the Corporate Information Security team members have over a decade of cybersecurity experience and hold over 100 industry-leading certifications in cybersecurity. All information security managers have attained a bachelor's degree in a related field of study, with several also having a related master's degree.


text: Zero trust principles" drive the Company's information security architecture, and the Company deploys a "defense in-depth" strategy to protect against cybersecurity threats, layering multiple levels of information security and technology controls within business processes for information assets and relationships with third parties based on the National Institute of Standards and Technology Special Publication 800-53 Framework. The Company's information systems and risk management are also subject to regulatory requirements and examination by federal banking regulators.


text: The identification of control weaknesses and vulnerabilities affecting information assets and/or relationships with third parties allows the Company to mitigate risk from, and respond to, cybersecurity threats. Initial risk assessments are performed upon the acquisition, or as part of the development of, information assets in order to evaluate the inherent risk associated with network and host environments and assess the adequacy of implemented technology operation processes and controls. Risk and control self-assessments are conducted on an annual basis to identify gaps resulting from any process changes that occurred during the year, and to evaluate whether the levels of cybersecurity risk remain within the tolerance set in the Company's Risk Appetite Statement or whether a risk needs to be mitigated.


text: Due diligence is performed prior to onboarding all third parties with access to the Company's information assets to ensure such parties maintain security controls contractually required by the Company as part of its Third Party Risk Management Program. The Company provides ongoing monitoring, including cybersecurity maturity assessments, of third parties using a risk-based approach to determine the extent and frequency of periodic assessments. Semi-annual cybersecurity maturity assessments are conducted by the Company's Corporate Information Security team on its information systems using industry-standard guidelines and tools, including the Federal Financial Institutions Examination Council Cybersecurity Assessment Tool and the Center for Internet Security Critical Security Controls.


text: Because cybersecurity threats continue to evolve, thereby increasing inherent risk, the Company's Corporate Information Security team is augmented by contracted external managed security service providers, who collectively work 24/7 to monitor cybersecurity threats through processes such as endpoint and network security, email protection, data loss prevention, vulnerability scanning and mitigation, identity and access management, logging and monitoring, and threat hunting. Independent third parties test the Company's cyber capabilities and audit its cloud security. The Company regularly tests its systems to discover and address any potential vulnerabilities. Senior and Executive management also participate in cybersecurity industry collaboration and information-sharing forums and utilize the information gained to drive protective and detective cybersecurity strategies and tactics.


text: The Company requires information security education, training at the time of hire, and annually thereafter, by its employees (including contractors and other third parties for training purposes), designed to mitigate accidental information security incidents. Phishing simulation activities are regularly conducted to assess employees' competency at identifying potential threats. Employees are assigned incremental training requirements should they fail to identify simulated phishing emails through the initial training.


text: The Company's Corporate Information Security team members are also responsible for completing additional mandatory annual training to understand the processes, procedures, and technical requirements for securing information assets across the enterprise. The Company also offers ongoing practice and specialized education for Corporate Information Security team members to stay up to date with emerging trends in cybersecurity threat protection, detection, and response.


text: The Information Security Management Program sets forth enterprise-wide coordinated responses to identified threats, ensuring timely mitigation and remediation, and facilitating awareness and communication. Tabletop exercises are held regularly at the Senior and Executive management levels, and annually at the Board of Directors level, to validate roles and responsibilities, and response protocols respective to cybersecurity threats.


text: Employees, contractors, and third parties are required to immediately report any suspected cybersecurity threats to the Corporate Information Security team for triaging. Any threat assessed by the Corporate Information Security team that could impact the safety of customers or personnel, cause damage to, or threaten the confidentiality, integrity, or availability of information assets, or bring about significant business interruption, are escalated for further assessment. In the event that the Chief Information Security Officer, in consultation with the Company's Legal and Compliance teams, determines that a material cybersecurity incident has occurred, a dedicated Crisis Incident Response Team comprised of individuals from various departments across the organization is assigned to coordinate all planned cybersecurity incident-related response activities. The Company will engage third party specialists to assist in any cybersecurity incident investigation, as needed.


text: Cybersecurity threats that are identified and deemed material are escalated and communicated directly to Senior and Executive Management and the Risk Committee of the Board of Directors. Materiality determinations are made under the Company's Disclosure Controls and Procedures to ensure timely cybersecurity incident disclosure notification in accordance with securities laws and/or regulations.


text: Material Cybersecurity Threat Risks. The Company has not experienced any material losses relating to cybersecurity threats or incidents for the year ended December 31, 2023. However, it is possible that the Company could suffer such losses in the future. Information regarding risks from material cybersecurity threats can be found under the section captioned "Information Risk" contained in Item 1A. Risk Factors.


text: The CCO is responsible for continuously monitoring and assessing the Company's cybersecurity risk management program, informing senior management regarding the prevention, detection and mitigation and remediation of cybersecurity incidents and supervising such efforts.

companyName: RELMADA THERAPEUTICS, INC.

ticker: RLMD


text: The Company has a Technology Risk Management Program (First Line), including Cyber and Information Risk Management, and an Information Risk Management Program (Second Line) under its Enterprise Risk Management Framework for the identification, assessment, measurement, mitigation, monitoring, and internal reporting of risks associated with its information systems, information assets, and third parties, including vendors and service providers. The Cyber and Information Security Risk Management Program and Technology Risk Management Program align with the Company's Third-Party Risk Management Program in regard to protecting information assets.


text: The Cyber and Information Security Risk Management Program and Technology Risk Management Program are managed by the Company's Corporate Information Security team, led by the CISO and the CIO. Our CISO has over 25 years of financial services industry experience, with varying positions in information technology, security, and risk management. She has numerous industry certifications, including Certified Information Systems Security Professional and Certified in Risk and Information Systems Controls certifications. She is a member of ISACA's global Governance of Enterprise Information & Technology Advisory Group and Securing AI Certification Working Group. Our CIO has over 25 years of relevant experience in large scale digital transformation, strategic planning, talent development, global technology delivery, and operational experience. Our CIO has deep expertise across the financial services industry and in leading organizations through change. He is a member of the CNBC Technology Executive Council, where he contributes to ongoing discussions and insights on the latest trends and challenges in technology. In addition, he is a member of the Wall Street Journal CIO Network, a collective community of leading technology experts from the world's most influential companies. Both our CISO and CIO also participate in various financial services industry committees and cybersecurity advisory boards.


text: On average, the other Corporate Information Security team members have over a decade of cybersecurity experience and hold over 100 industry-leading certifications in cybersecurity. For most of these certifications, there is a continuing professional education requirement to maintain a consistent level of learning by completing certain professional activities, such as attending conferences and workshops, completing online training courses, and participating in professional association meetings, throughout the certification cycle to maintain an active credential. Further, each employee is responsible for an effective cybersecurity defense which is enforced with mandatory cyber awareness training, periodic newsletters, and security updates.


text: Due diligence is performed prior to onboarding all third parties with access to the Company's information assets to ensure such parties maintain security controls contractually required by the Company as part of its Third Party Risk Management Program. The Company provides ongoing monitoring, including cybersecurity maturity assessments, of third parties using a risk-based approach to determine the extent and frequency of periodic assessments. Semi-annual cybersecurity maturity assessments are conducted by the Company's Corporate Information Security team on its information systems using industry-standard guidelines and tools, including the National Institute of Standards Cybersecurity Framework, the Federal Financial Institutions Examination Council Cybersecurity Assessment Tool, and the Center for Internet Security Critical Security Controls.


text: The Information Security Management Program sets forth enterprise-wide coordinated responses to identified threats, ensuring timely mitigation and remediation, and facilitating awareness and communication. Tabletop exercises are held regularly at the Senior and Executive management levels to validate roles and responsibilities and response protocols respective to cybersecurity threats. The outcomes of these tabletop exercises are reviewed annually at the Board of Directors level.


text: Employees, contractors, and third parties are required to immediately report any suspected cybersecurity threats to the Corporate Information Security team for triaging. Any threat assessed by the Corporate Information Security team that could impact the safety of customers or personnel, cause damage to, or threaten the confidentiality, integrity, or availability of information assets, or bring about significant business interruption, are escalated for further assessment. In the event that the CISO, in consultation with the Company's Legal and Compliance teams, determines that a material cybersecurity incident has occurred, a dedicated Crisis Incident Response team comprised of individuals from various departments across the organization is assigned to coordinate all planned cybersecurity incident-related response activities. The Company will engage third party specialists to assist in any cybersecurity incident investigation, as needed.


text: Material Cybersecurity Threat Risks. Risks from cybersecurity threats have not materially affected the Company, its business strategy, results of operations, or financial condition for the year ended December 31, 2024. However, it is possible that the Company could suffer such losses in the future. Information regarding risks from material cybersecurity threats can be found under the section captioned "Information Risk" contained in Item 1A. Risk Factors.


text: Governance. Oversight of information security risk and information technology risk is the responsibility of the Information Risk Committee, a management committee, with additional oversight from the Enterprise Risk Management Committee, a management committee, and the Risk and Technology Committees of the Board of Directors. On at least a quarterly basis, the Corporate Information Security team provides reports on updates to the Company's information risk profile, emerging risks and threats, results of examinations, status of remediation plans and/or results of remediation activities, risk reports and risk assessment results, and risk metric results to the Information Risk Committee, who then provides such information to the Enterprise Risk Management Committee and the Risk Committee of the Board of Directors. In addition, on at least a quarterly basis, this information, along with updates on key cybersecurity initiatives, is shared with the Technology Committee of the Board of Directors, who provides oversight on information security and information technology strategy and governance.


text: Additional information regarding the Company's risk management framework, including management-level and Board-level committee experience and expertise, oversight responsibilities, and information risk governance, can be found under the section captioned "Risk Management Framework" contained in Item 1. Business.


text: Cybersecurity Risk, Strategy and Governance The Company maintains a robust cybersecurity infrastructure to safeguard our operations, networks and data through comprehensive security measures including our technology tools, internal management and external service providers.

companyName: PILGRIMS PRIDE CORP

ticker: PPC


text: The Company's Chief Information Officer ("CIO") is responsible for assessing, identifying, and managing the risks from cybersecurity threats. Our CIO has significant experience in information technology and many of our information technology team members hold qualifications in technology security positions. We maintain a cross-functional Cybersecurity Committee, as well as a Global Security Committee consisting of the information technology professionals and security managers from each country in which we have operations.


text: We have both policies and procedures that align with the National Institute of Standards and Technology Cybersecurity Framework. Our information security program includes, among other aspects, vulnerability management, antivirus and malware protection, encryption and access control, and employee training. Our CIO, together with our Global Security Committee, reviews emerging threats, controls, and procedures as part of assessing, identifying, and managing risks. Risks identified by our cybersecurity program are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed.


text: We are a blank check company with no business operations. Since the IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates.

companyName: Chenghe Acquisition II Co.


text: In addition, we engage independent third-party cybersecurity providers for testing and vulnerability detection. We regularly engage with third-party vendors to perform external penetration testing, which identifies potential threats and reduces the impact and/or likelihood of these threats. Our employees perform similar intrusion tests and internal and external scans to help improve and harden the company's security posture. We also conduct security assessments of our IT vendors and certain business partners and maintain cyber incident response plans that are periodically reviewed and updated by our IT Security and Cyber Defense Teams and leveraged table top exercised performed by our IT teams. The incident response plan ties into our Cybersecurity Committee processes for review to ensure the required reporting of material incidents to the Board of Directors, as applicable.


text: Our Board of Directors, primarily through the Audit Committee, oversees management's approach to managing cybersecurity risks as part of its risk management oversight. The Audit Committee holds periodic discussions with management regarding the Company's guidelines and policies with respect to cybersecurity risks and receives regular reports from the CIO regarding such risks and the steps management has taken to monitor and control any exposure resulting from such risks.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: We also endeavor to apprise employees of emerging risks and require them to undergo regular security awareness trainings and supplemental trainings as needed. Additionally, we conduct periodic internal exercises to gauge the effectiveness of the trainings and assess the need for additional training.


text: The Company maintains a cybersecurity program focused on preventing, identifying and mitigating cyber threats applicable to its business as an owner and operator of commercial office properties. Our Board oversees our cybersecurity program through its Audit Committee, which meets regularly with the Company's executive officers and senior personnel from the Company's IT department, which manages the program on a day-to-day basis. The Company's cybersecurity program is integrated into its overall risk management processes.

companyName: EQC Liquidating Trust


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Lyra Therapeutics, Inc.

ticker: LYRA


text: Risk Management and Strategy The Company employs a number of cybersecurity measures intended to reduce the likelihood that cybersecurity incidents materialize, including: (i) employing a variety of reputable and recognized hardware, software and other security measures in the design and maintenance of our information technology and data security systems; (ii) conducting periodic testing and verification of information and data security systems, including engaging third-party assessors to perform penetration testing of our systems to identify vulnerabilities; (iii) confirming with our critical vendors whether they have had cyber breaches of their IT systems or otherwise involving Company information; (iv) verifying third-party IT system integrity through a review of System and Organization ("SOC") audit review reports provided by certain of our vendors; and (v) providing onboarding and other periodic employee security awareness training relating to phishing and other scams, malware and various cyber-related risks. We have also engaged third-party vendors to assist with incident detection and monitoring and to implement and maintain other cybersecurity measures specific to our operations and portfolio properties.


text: The Company has created and maintains processes that provide a playbook in the event of a cyber incident. These processes provide assessment and response tools designed to mitigate damage from attacks and integrate third-party digital forensics and legal providers and law enforcement in the Company's response plan. The Company also has instituted a variety of safeguards to counter ransomware threats.


text: The Company has integrated its cybersecurity program into its overall risk management processes by instituting corporate measures and protocols that apply to ensure ongoing operations in the event of a disaster or major business disruption affecting the corporate headquarters, infrastructure or key personnel, as well as similar processes in case of a crisis-related event at our portfolio properties. Our employee guidelines also address employee computer usage, including a variety of restrictions and protocols intended to enhance cybersecurity and reduce the risk of a successful cyber-attack.


text: Material Effects from Risks of Cybersecurity Threats We do not believe any risks from cybersecurity threats, including any past cybersecurity incidents, have materially affected the Company, including our business strategy, results of operations or financial condition. There can be no assurances, however, that we or our third-party service providers will not experience a future system disruption, attack or security breach that materially impacts the Company, our business strategy, results of operations or financial condition. For more information refer to "Item 1A. Risk Factors—Risks Related to Our Business—We rely on information technology in our operations, and any material failure, inadequacy or security failure of that technology could harm our business".


text: Board of Trustees' and Management Oversight Our Board of Trustees oversees our cybersecurity program and initiatives through its Audit Committee. The Audit Committee, in consultation with management, actively oversees and manages the Company's cybersecurity risk, including periodically reviewing our policies and procedures with respect to risk assessment and risk management.


text: As part of its cybersecurity oversight role, the Audit Committee meets regularly with the Company's executive officers and senior IT personnel to discuss the Company's policies, procedures and other measures put in place to protect its business systems and information against cyber-related attacks and risks, as well as to discuss recent cyber and IT trends.


text: Through the policies, plans, guidelines and processes the Company has implemented, any material cybersecurity incident would be reported to our executive officers as well as the Audit Committee and/or the Board.


text: Cybersecurity Personnel Resources The Company's cybersecurity program is managed by our IT department, which is led by our SVP - Information Technology, who has a Master of Business Administration degree and a Master Certification in Cybersecurity from Colorado State University. Our IT department has more than 25 years of combined experience. The members of our IT department have experience with network and system security, backup and recovery strategies and software design and implementation. Areas of substantial experience also include IT audits and anti-phishing training, as well as server installation, configuration and administration.


text: The Company maintains a cybersecurity program focused on preventing, identifying and mitigating cyber threats applicable to its business, including as a former owner and operator of commercial office properties. Our Board oversees our cybersecurity program through its Audit Committee, which meets regularly with the Company's executive officers and senior personnel from the Company's IT department, which manages the program on a day-to-day basis. The Company's cybersecurity program is integrated into its overall risk management processes.


text: We integrated our cybersecurity program into our overall risk management processes by instituting corporate measures and protocols to ensure ongoing operations in the event of a disaster or major business disruption affecting the corporate headquarters, infrastructure or key personnel. Our employee guidelines also addressed employee computer usage, including a variety of restrictions and protocols intended to enhance cybersecurity and reduce the risk of a successful cyber-attack.


text: The Company has integrated its cybersecurity program into its overall risk management processes by instituting corporate measures and protocols that apply to ensure ongoing operations in the event of a disaster or major business disruption affecting the corporate headquarters, infrastructure or key personnel. Our employee guidelines also address employee computer usage, including a variety of restrictions and protocols intended to enhance cybersecurity and reduce the risk of a successful cyber-attack.


text: Cybersecurity Personnel Resources The Company's cybersecurity program is managed by our IT department, which is led by our SVP - Information Technology, who has a Master of Business Administration degree and a Master Certification in Cybersecurity from Colorado State University along with more than 25 years of experience. Our IT department has experience with network and system security, backup and recovery strategies and software design and implementation. Areas of substantial experience also include IT audits and anti-phishing training, as well as server installation, configuration and administration.


text: Risk Management and Strategy A number of cybersecurity measures were employed to reduce the likelihood that cybersecurity incidents would materialize, including: (i) employing a variety of reputable and recognized hardware, software and other security measures in the design and maintenance of our information technology and data security systems; (ii) conducting periodic testing and verification of information and data security systems, including engaging third-party assessors to perform penetration testing of our systems to identify vulnerabilities; (iii) confirming with our critical vendors whether they experienced cyber breaches of their IT systems or otherwise involving Company information; (iv) verifying third-party IT system integrity through a review of System and Organization ("SOC") audit review reports provided by certain of our vendors; and (v) providing periodic employee security awareness training relating to phishing and other scams, malware and various cyber-related risks. We also engaged third-party vendors to assist with incident detection and monitoring and to implement and maintain other cybersecurity measures specific to our operations and portfolio properties.


text: We also created and maintained processes that provided a playbook in the event of a cyber incident. These processes provided assessment and response tools designed to mitigate damage from attacks and integrate third-party digital forensics, legal providers and law enforcement as part of the response plan. We also instituted a variety of safeguards to counter ransomware threats.


text: Management Oversight Our cybersecurity program was managed on a day-to-day basis by our IT department, which was led by our SVP - Information Technology, who has a Master of Business Administration degree and a Master Certification in Cybersecurity from Colorado State University along with more than 25 years of experience. Our IT department's experience included network and system security, backup and recovery strategies and software design and implementation. Areas of substantial experience also included IT audits and anti-phishing training, as well as server installation, configuration and administration.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: General Motors Financial Company, Inc.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is aligned to the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors – "Risks Related to Cybersecurity, Information Technology and Data Management Practices," which is incorporated by reference into this Item 1C.


text: Cybersecurity Governance The GM Board of Directors established its Risk and Cybersecurity Committee with specific responsibility for overseeing cybersecurity threats, among other things. Our Global Chief Information Security Officer provides the Risk and Cybersecurity Committee periodic reports on our cybersecurity risks and any material cybersecurity incidents. In addition, our cybersecurity team provides periodic reports to our Board of Directors.


text: Our team of cybersecurity professionals is led by our Global Chief Information Security Officer, who has over 20 years of experience in the cybersecurity space and has obtained professional security certifications and advanced training in the field of cybersecurity and technology. The cybersecurity team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our cybersecurity team also monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: g. Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management and other key business functions, as well as the members of the Board and the Audit Committee of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Axogen, Inc.

ticker: AXGN


text: Risk Management and Strategy To identify, assess and manage cybersecurity risks, we maintain an IT security/cybersecurity program (Cybersecurity Program) that is informed in part by international frameworks as well as our specific security requirements and cybersecurity risk profile. We have implemented policies, procedures, processes and administrative, physical and technical controls designed to protect, defend and mitigate effects to us from cybersecurity threats and incidents. For example, we provide recurring employee cybersecurity training to help our employees better understand cybersecurity threats, our policies, actions and approach to managing this type of risk and how they can help increase our security posture.

companyName: QUALCOMM INC/DE

ticker: QCOM


text: Our Cybersecurity Program also includes an incident response process that is overseen by our Vice President of Cybersecurity and supported by an internal team of cybersecurity specialists, with involvement from business, legal and senior management as appropriate. In the event of a cybersecurity incident, a technical cybersecurity team investigates and addresses the threat, while a cross-functional team assesses the incident to inform criticality determinations and response efforts, including escalations of the incident to senior management as appropriate.


text: We evaluate and update our cybersecurity risk profile through ongoing assessment of the cybersecurity threat landscape and security monitoring. Our cybersecurity risk profile is used as an input to identify, assess and update our Cybersecurity Program, and associated priorities are updated as new risk information becomes available. Information security, including cybersecurity, is also incorporated into our overall Enterprise Risk Management (ERM) program. Our ERM Operating Committee includes members in senior leadership positions across various functional areas that evaluate enterprise risks and develop and monitor associated mitigation plans. Cybersecurity related risks are included in the risk universe that the committee evaluates to assess top risks to the enterprise. As part of our ERM program, our executive leadership team receives annual updates on enterprise risks, including cybersecurity risks, as well as their potential impact, likelihood, potential mitigation plans and status.


text: h. Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the the Company's VP of Information Technology, Security and Business Intelligence and other members of the cyber team and management.


text: We regularly engage with assessors, consultants, auditors, and other third parties, including by regularly having third parties, including independent Qualified Security Assessors review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.

companyName: JUNIPER NETWORKS INC


text: Our Cybersecurity Program, and portions thereof, are periodically reviewed by third-party assessors, consultants, auditors or other firms. For example, we periodically conduct penetration tests and tabletop exercises to simulate attacks against our infrastructure, systems, or portions thereof, in order to validate the efficacy of our security controls and response capabilities. Such exercises are typically conducted with assistance from third-party advisors and experts. Incident response efforts are also supported by external resources such as legal advisors, cybersecurity forensic firms, communications specialists, and other outside advisors and experts as well as law enforcement support, as appropriate. We benefit from engaging third parties to provide specialized skills, knowledge, tools and resources, and such third parties may also help reduce costs, increase efficiency and/or improve the quality of our Cybersecurity Program.


text: Our supplier community (including suppliers of IT services and other third-party service providers) plays a large role in Qualcomm's success, and we believe in engaging with our suppliers to help them protect against cybersecurity threats. We operate a supplier cybersecurity assurance program, which is integrated with our procurement processes and supported by the relevant groups within the legal organization, to assess and attempt to mitigate potential cybersecurity risks across our supplier community commensurate with their cybersecurity risk. Specifically, based on a risk classification of the supplier, our third-party risk management process includes steps such as the evaluation of a supplier's security controls, posture and maturity as well as the identification and treatment of cybersecurity-related risks.


text: Notwithstanding our Cybersecurity Program as described above, we cannot anticipate, detect, repel or implement fully effective preventative measures against all cybersecurity threats, particularly because the techniques used are increasingly sophisticated and constantly evolving. Like many companies, we have encountered intrusions and attempts to gain unauthorized access to our IT systems or other attacks and incidents, and we have had third-party service providers who have encountered intrusions. However, during fiscal 2024, we did not identify any risks from cybersecurity threats that materially affected or are reasonably anticipated to materially affect our business strategy, results of operations or financial condition. For additional information about the cybersecurity risks we face, including how such risks could affect us in the future, see Part I, Item 1A, "Risk Factors" in this Annual Report, including the Risk Factors titled "Our business and operations could suffer in the event of security breaches of our IT systems, or other misappropriation of our technology, intellectual property or other proprietary or confidential information" and "Failures in our products, or in the products of our customers or licensees, including those resulting from security vulnerabilities, defects or errors, could harm our business."


text: Our Board of Directors has primary responsibility for oversight of our risk management efforts, with support from its standing committees. In particular, the Audit Committee of our Board assists the Board in fulfilling its oversight responsibilities with respect to our Cybersecurity Program. As part of its oversight of IT security/cybersecurity matters, the Audit Committee receives cybersecurity updates on a quarterly basis and an IT security/cybersecurity briefing from management, typically including our Vice President of Cybersecurity, on at least a semi-annual basis. At least annually, the full Board also receives updates on the Cybersecurity Program and cybersecurity risks. In addition to this regular reporting, significant cybersecurity threats or incidents may also be escalated on an as-needed basis through our organizational structure in accordance with our incident response process.


text: Key elements of our Cybersecurity Program, including defending against key cybersecurity threats and risks, are overseen by our Vice President of Cybersecurity, the Information Security and Risk Management (ISRM) organization, and certain legal functions under the office of the General Counsel, which includes subject matter experts focused on identifying and managing cybersecurity threats and consequences where technically feasible and commensurate with risk. Our Vice President of Cybersecurity has over 20 years of experience in cybersecurity gained across numerous leadership roles in Qualcomm's IT and Cybersecurity organization, including security architecture, risk and compliance, incident response, security operations and identity management. That experience is supplemented by the collective experience and expertise across the ISRM organization, which includes the Cyber Security Operations Center, Cyber Defense Engineering Services, Cyber Identity and Architecture, Cyber Governance Risk and Compliance, and Threat Intelligence teams, among others. The Cybersecurity Program is also supported by additional members of senior management, including our Chief Financial Officer and Chief Operating Officer, Chief Technology Officer, Chief Human Resources Officer and General Counsel, through regular reporting and review.


text: Risk Management and Strategy To identify, assess and manage cybersecurity risks, we maintain an IT security/cybersecurity program (Cybersecurity Program), which includes policies, procedures, processes and administrative, physical and technical controls designed to protect, defend and mitigate effects to us from cybersecurity threats and incidents. For example, we provide recurring employee cybersecurity training to help our employees better understand cybersecurity threats, our policies, actions and approach to managing this type of risk and how they can help increase our security posture.


text: Notwithstanding our Cybersecurity Program as described above, we cannot anticipate, detect, repel or guarantee the effectiveness of our preventative measures against all cybersecurity threats, particularly because the techniques used are increasingly sophisticated and constantly evolving. Like many companies, we have encountered intrusions and attempts to gain unauthorized access to our IT systems or other attacks and incidents, and we have had third-party service providers who have encountered intrusions. However, during fiscal 2025, we did not identify any risks from cybersecurity threats that materially affected or are reasonably anticipated to materially affect our business strategy, results of operations or financial condition. For additional information about the cybersecurity risks we face, including how such risks could affect us in the future, see "Part I, Item 1A. Risk Factors" in this Annual Report, including the Risk Factors titled "Our business and operations could suffer in the event of security breaches of our IT systems, or other misappropriation of our technology, intellectual property or other proprietary or confidential information" and "Failures in our products, or in the products of our customers or licensees, including those resulting from security vulnerabilities, defects or errors, could harm our business."


text: Our Board of Directors has primary responsibility for oversight of our risk management efforts, with support from its standing committees. In particular, the Audit Committee assists the Board of Directors in fulfilling its oversight responsibilities with respect to our Cybersecurity Program. As part of its oversight of IT security/cybersecurity matters, the Audit Committee receives cybersecurity updates on a quarterly basis and an IT security/cybersecurity briefing from management, typically including our Chief Information Officer (CIO) and Vice President of Cybersecurity, on at least a semi-annual basis. In addition to this regular reporting, significant cybersecurity threats or incidents may also be escalated on an as-needed basis through our organizational structure in accordance with our incident response process.


text: Key elements of our Cybersecurity Program, including defending against key cybersecurity threats and risks, are overseen by our CIO, Vice President of Cybersecurity, the Information Security and Risk Management (ISRM) organization and certain legal functions under the office of the General Counsel, which include subject matter experts focused on identifying and managing cybersecurity threats and consequences where technically feasible and commensurate with risk. Our CIO has over 30 years of experience in IT and telecommunications and previously held CIO or other IT leadership roles at DISH Network (now EchoStar), CenturyLink, Level 3 Communications and TW Telecom prior to joining Qualcomm. Our Vice President of Cybersecurity has over 20 years of experience in cybersecurity gained across numerous leadership roles in Qualcomm's IT and Cybersecurity organization, including security architecture, risk and compliance, incident response, security operations and identity management. This experience is supplemented by the collective experience and expertise across the ISRM organization, which includes the Cyber Security Operations Center, Cyber Defense Engineering Services, Cyber Identity and Architecture, Cyber Governance Risk and Compliance, and Threat Intelligence teams, among others. The Cybersecurity Program is also supported by additional members of senior management, including our Chief Financial Officer and Chief Operating Officer, Chief Technology Officer, Chief Human Resources Officer and General Counsel, through regular reporting and review.


text: d. Third-Party Risk Management: The Company endeavors to identify and oversee cybersecurity risks presented by third parties, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Park assesses, identifies, and manages risks from cybersecurity threats consistent with its broader risk management and operations systems, processes, and controls. Park's information security and cybersecurity operations teams have primary responsibility for guarding against cybersecurity threats. The teams employ numerous security tools such as for threat detection, alerting and monitoring, data loss prevention, vulnerability remediation, and including end-point protections, webproxy, anti-malware, and email security protections. Park uses multi-factor authentication for computer and mobile devices, encryption technology, and requires virtual private network access to Park's network for all remote employees. Park engages in annual recovery and information security tabletop exercises to simulate threats and events. Park engages third parties on an annual basis to conduct and report on penetration testing exercises. Park administers mandatory security awareness training to all associates on a monthly basis, enhanced administrator access training for security-related positions on an annual basis, and routinely administers employee email phishing testing and training. Topics of training include escalating suspicious activity, malware, insider threats, and email security.

companyName: PARK NATIONAL CORP /OH/

ticker: PRK


text: Park maintains a third-party risk management program that is designed to evaluate, monitor and control risks connected with third-party vendors, particularly those vendors with access to or possession of sensitive information. The third-party risk management program solicits diligence materials from vendors and conducts internal risk assessments for vendors, including with regard to information security policies, practices, testing, and reporting. Diligence and internal risk assessments for vendors include analysis specific to the vendor's transmission and storage of information, encryption practices, security appliances, vulnerability testing, and past security incidents. Vendor contract negotiations involve data protection terms and responsibilities regarding information breach notifications and reporting.


text: In designing and carrying out cybersecurity controls, Park follows the National Institute of Standards and Technology Cyber Security Framework for measuring readiness to respond, Sarbanes Oxley for assessment of internal controls, the Gramm-Leach-Bliley Act regarding information security, the Office of Comptroller of the Currency's Cybersecurity Supervision Work Program, Interagency Guidance on Third-Party Relationships: Risk Management, other applicable regulatory guidelines, and federal and state laws.


text: Park's Board of Directors recognizes the importance of cybersecurity in safeguarding sensitive information. The Board Risk Committee is responsible for overseeing Park's Enterprise Risk Management program which includes responsibility for cybersecurity. The Park information security and business continuity teams, both part of Park's Enterprise Risk Management, manage and oversee the Incident Response Plan and Cybersecurity Response Playbook. The Incident Response Plan and Cybersecurity Response Playbook guide Park's response to cybersecurity issues and events. The Board Executive Committee is engaged in the final determination of whether a cybersecurity issue or event is material, as discussed below. Park's Board of Directors is regularly apprised of cybersecurity risks. Park's information security team prepares and issues a quarterly report to the full Board of Directors on the status of incidents, health of program, penetration testing results, and risk assessments. Park's cybersecurity operations team also prepares and issues a quarterly report to the full Board of Directors identifying cybersecurity trends, internal data, issues, events, and key-risk indicator metrics.


text: Park's information security and cybersecurity operations teams have defined escalation paths for issues and events, which include engaging Park's Incident Response Plan, and working issues and events through Park's Cybersecurity Response Playbook. Evaluation of escalated events is performed first by the Information Security Officer and Chief Legal Officer, who track and log cybersecurity incidents across Park and Park's vendors. Any incident assessed as potentially being or becoming material is further escalated to a leadership team that includes the Chief Financial Officer, Chief Operations Officer, Chief Risk Officer, Chief Information Officer, and Chief Accounting Officer. Events that leadership determines may be material are shared with the Board of Director's Executive Committee for final review and evaluation. Park engages teams, including but not limited to information security, information technology, and fraud and security, to address and remediate cybersecurity events and issues as they arise. Park engages outside legal counsel for assistance in evaluating and remediating cybersecurity issues and events. Information regarding issues and events is also shared by Park leadership with both internal and external auditors.


text: Park's business strategy, results of operations, and financial performance have not been materially affected by risks from cybersecurity threats. Park cannot provide assurance that business strategy, results of operations, or financial performance will not be materially affected in the future by such risks or any future incidents.


text: Park maintains a third-party risk management program that is designed to evaluate, monitor, and control risks connected with third-party vendors, particularly those vendors with access to or possession of sensitive information. The third-party risk management program solicits diligence materials from vendors and conducts internal risk assessments for vendors, including with regard to information security policies, practices, testing, and reporting. Diligence and internal risk assessments for vendors include analysis specific to the vendor's transmission and storage of information, encryption practices, security appliances, vulnerability testing, and past security incidents. Vendor contract negotiations involve data protection terms and responsibilities regarding information breach notifications and reporting.


text: Park's Board of Directors recognizes the importance of cybersecurity in safeguarding sensitive information. The Board Risk Committee is responsible for overseeing Park's Enterprise Risk Management program which includes responsibility for cybersecurity. The Park information security and business continuity teams, both part of Park's Enterprise Risk Management, manage and oversee the Incident Response Plan and Cybersecurity Response Playbook. The Incident Response Plan and Cybersecurity Response Playbook guide Park's response to cybersecurity issues and events. The Board Executive Committee is engaged in the final determination of whether a cybersecurity issue or event is material, as discussed below. Park's Board of Directors is regularly apprised of cybersecurity risks. Park's information security team and cybersecurity operations team jointly prepare and issue a quarterly report to the full Board of Directors on the status of incidents, health of program, penetration testing results, risk assessments, identifying cybersecurity trends, internal data, issues, events, and key-risk indicator metrics.


text: Park's information security and cybersecurity operations teams have defined escalation paths for issues and events, which include engaging Park's Incident Response Plan, and working issues and events through Park's Cybersecurity Response Playbook. Evaluation of escalated events is performed first by the Information Security Officer and Chief Legal Officer, who track and log cybersecurity incidents across Park and Park's vendors. Any incident assessed as potentially being or becoming material is further escalated to a leadership team that includes the Chief Financial Officer, Chief Operations Officer, Chief Risk Officer, Chief Information Officer, and Chief Accounting Officer. Events that leadership determines may be material are shared with the Board of Director's Executive Committee for final review and evaluation. Park engages teams, including but not limited to information security, information technology, corporate fraud and security, and fraud prevention, to address and remediate cybersecurity events and issues as they arise. Park engages outside legal counsel for assistance in evaluating and remediating cybersecurity issues and events. Information regarding issues and events is also shared by Park leadership with both internal and external auditors.


text: Cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are integrated into the Company's enterprise risk management approach, and cybersecurity risks are one of the enterprise risks that are subject to oversight by the Company's Board of Directors (the "Board"). The Company's cybersecurity standards and practices follow industry trends, which align with frameworks established by the Center for Internet Security ("CIS"). The Company approaches cybersecurity threats through a cross-functional approach which endeavors to: (i) identify, prevent and mitigate cybersecurity threats to the Company; (ii) preserve the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.


text: Risk Management and Strategy The Company's cybersecurity program focuses on the following areas: a. Vigilance: The Company maintains cybersecurity threat operations with the goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans.


text: b. Systems Safeguards: The Company deploys system safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence.


text: c. Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks.