text: Cybersecurity Governance The Bank's cybersecurity program is managed by its Chief Information Security Officer ("CISO") with oversight from executive management and the Bank's Board of Directors. The CISO reports to both the Bank's CIO and its Chief Risk Officer ("CRO").


text: The Bank's Operational Risk Oversight Committee ("OROC"), led by the CRO, provides oversight of the Bank's operational risk, including cybersecurity risk. OROC meets quarterly and is comprised of senior leaders from the IT (including Security), Legal, Accounting, and Operational Risk Management departments, among others. In addition, matters of cybersecurity importance relating to specific IT projects are discussed and addressed in the Bank's Information Technology Steering Committee, which is led by the CIO and is comprised of senior leaders from across the Bank.

companyName: Federal Home Loan Bank of Dallas

secItem: Item 1C

stage1Category: Board Governance

stage1Method: majority


text: The Bank's CISO provides quarterly reports to OROC which include vulnerability management and security incident metrics, the status of security awareness training (including phish-testing results), and the status of any risk-accepted items and remediations. The quarterly reports also include any significant findings from audits, third-party security assessments, and penetration tests. Monthly, the CISO briefs the CRO, CIO, and the Bank's Chief Executive Officer regarding any significant IT security items.

stage1Category: Management Role

stage1Method: unanimous


text: The Bank's CISO periodically updates the Board of Directors regarding the Bank's cybersecurity program, including current risks and metrics, the evolving external threat landscape and the results of the Bank's security awareness training. The Risk Management Committee of the Board of Directors, the Board committee that is primarily responsible for the oversight of risks from cybersecurity threats, is briefed quarterly on cybersecurity risks and receives information and metrics that are similar to the information and metrics provided to OROC. In addition, the Board's Strategic Planning, Operations and Technology Committee is briefed, as needed, on security matters relating to specific IT projects.


text: Monthly, the Board of Directors receives an IT status dashboard which includes, among other things, IT security metrics regarding phish-training and vulnerability management.


text: Annually, the CISO prepares the Bank's Annual State of Security report which is provided to executive management, OROC, and the Board of Directors. The report provides data on, and insights into, the top security concerns facing the Bank, such as shifts in the threat landscape, high-priority threats, and trends affecting the banking industry, in addition to security-specific technology changes which have occurred during the current year that could impact the overall risk to the Bank. The report also includes an assessment of the upcoming threats that the Bank could potentially face over the course of the next year and includes recommendations designed to mitigate those threats.


text: The Bank relies heavily on its information systems and other technology to conduct and manage its business and, as a result, it is subject to cybersecurity threat risk. Cybersecurity threats include potential unauthorized occurrences on or conducted through the Bank's information systems that may result in adverse effects on the confidentiality, integrity, or availability of its information systems or any information residing therein. Cybersecurity threat risks include, but are not limited to, malicious software or the exploitation of vulnerabilities, social engineering (e.g., phishing), denial-of-service attacks, viruses, and/or malware. As further described below, the Bank has implemented processes for assessing, identifying, and managing material risks from cybersecurity threats that are designed to protect the confidentiality, integrity, and availability of its information technology assets and data.


text: Cybersecurity Risk Management and Strategy The Bank's approach to cybersecurity risk management relies upon having the right people, processes, and technology in place to govern, identify, protect, detect, respond, and recover from cybersecurity risks/threats/incidents. The Bank's cybersecurity program aligns with industry standards, specifically the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the NIST 800-53 control framework. The effectiveness of the Bank's cybersecurity program is measured through internal and external audits, Finance Agency regulatory oversight and other third-party control and compromise assessments such as periodic penetration tests and various security assessments. In addition, the Bank's cybersecurity program includes processes and technologies that enhance its ability to detect and respond to cybersecurity threats, including the use of automation, threat intelligence feeds, robust incident response procedures and frequent vulnerability scans and remediation. The Bank's Vulnerability Management Group, which is comprised of members from Information Technology ("IT") Security, IT Infrastructure and Operational Risk Management, meets regularly to discuss details of the Bank's vulnerability management program including, but not limited to, current threats and vulnerabilities, patching status, upcoming technology changes, and current issues or concerns, if any.

stage1Category: Risk Management Process


text: The Bank's IT Security Program and policies establish safeguards to protect data and information that is used by the Bank's employees, independent contractors, and vendors. The goal of the Bank's cybersecurity risk management processes is to maintain and safeguard the confidentiality and integrity of the Bank's data, and to ensure system availability to protect against cybersecurity threats and vulnerabilities. The Bank maintains IT security policies that are reviewed at least annually and approved by the Bank's Chief Information Officer ("CIO"), appropriate management committees and, for its critical policies, the Bank's Board of Directors. To help ensure the effectiveness of the Bank's IT security policies, all employees are required to participate in annual IT security training and to review and acknowledge the Bank's IT security policies.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: ANAPTYSBIO, INC

ticker: ANAB


text: The Bank maintains an Enterprise Risk Management Framework which is updated and approved at least annually by its Board of Directors. The framework outlines the methodology and elements that are used to manage Bank-wide risks, including cybersecurity risks, and it assigns responsibilities for the Bank's enterprise risk management. The Bank's IT Security department measures cybersecurity risks by way of risk assessments that utilize a scale which includes both the likelihood and impact of risk occurrence. The scale used to measure likelihood and impact is tied to the criteria contained in the Bank's Enterprise Risk Management Framework.


text: The Bank also maintains Incident Response policies and procedures that are invoked in the event of a security breach or incident and which provide, among other things, guidance for the purpose of managing and executing the appropriate level of communication to executive management, the Board of Directors, government agencies, and/or the Finance Agency.


text: The Bank has a Business Continuity Program that sets forth the actions that would be taken to recover business processes in a timely manner in the event of a disruption. The Bank regularly tests its Business Continuity Plan to ensure its relevance and viability. Representatives from the Bank's Business Continuity team work closely with the Bank's business units and IT to help ensure that critical resources are available in the event of an interruption. To ensure its preparedness, the Bank updates its Business Continuity Plan semiannually. In addition, the Bank evaluates and analyzes threat scenarios, and it conducts periodic exercises to demonstrate the Bank's ability to run production systems from an alternate location and to seamlessly return to using production systems at its primary operations centers.


text: The Bank's vendors are subject to a formal vendor management process which includes an assessment of vendor risks (including cybersecurity risks) and ongoing monitoring. When warranted, the Bank seeks independent third-party reports related to the performance of its vendors, such as System and Organization Controls ("SOC") reports that are issued in accordance with Statement on Standards for Attestation Engagements No. 18.


text: While risks from cybersecurity threats have not materially affected nor are they currently expected to materially affect the Bank's business strategy, financial condition or results of operations, the Bank has invested and expects to continue to invest significant resources to maintain and enhance its cybersecurity program.


text: The Bank's CISO has over 20 years of experience serving in various IT roles, and he maintains a number of technology and cloud certifications, including the Certified Information Systems Security Professional certification.


text: The Bank's IT Infrastructure team, led by the Director of Cloud Infrastructure, is responsible for the hands-on configuration and patch management of the Bank's information systems to ensure the security, reliability, and availability of those systems. The team is comprised of information system and cloud professionals that hold various certifications in systems administration and cloud computing.


text: Incident Response and Recovery Planning: We have established and maintain incident response and recovery plans to address our response to a cybersecurity incident.


text: We are highly dependent on information technology in the operation of our various businesses. Cybersecurity is an integral part of our operations and is a focus of all employees, including senior management, and our board of directors.

companyName: Fidelity National Financial, Inc.

ticker: FNF

stage1Category: None/Other


text: Risk Management and Strategy We assess, identify and manage cybersecurity risks through various processes within our Enterprise Risk Management Program and Information Security Program. We focus on all areas of cybersecurity, including threat and vulnerability management, security monitoring, identity and access management, phishing awareness, risk oversight, third-party risk management, disaster recovery and continuity management. We have established policies, including those related to privacy, information security and cybersecurity, and we employ a broad and diversified set of cybersecurity risk monitoring and risk mitigation techniques. Internal audits, external audits, and self-assessments are conducted to assess the effectiveness and maturity of our Enterprise Risk Management Program and Information Security Program.


text: Our employees are one of our strongest assets in protecting our customers' information and mitigating cybersecurity risk. We maintain comprehensive and tailored training programs that focus on applicable privacy and cybersecurity requirements. Additionally, we make strategic investments in cybersecurity to protect our customers and information systems, including both capital expenditures and operating expenses for hardware, software, personnel and consulting services.


text: Our processes to assess, identify and manage cybersecurity risks, including cybersecurity risks related to the use of third-party service providers, are fully integrated into our Enterprise Risk Management Program. In some circumstances we use third-party service providers to provide expertise and to monitor utilization of specific cyber tools, and in certain cases, to supplement staffing services. Through our vendor risk management process, these vendors undergo various assessments such as financial, reputational, contractual and informational security. These assessments are performed to ascertain that these vendors meet our policy requirements relative to the services they perform on our behalf.


text: To further reduce the residual risk associated with cybersecurity, we maintain Miscellaneous Professional Liability Insurance, which provides coverage for cybersecurity incidents. The deductible limits on these policies are determined by a corporate insurance risk management group and executive management at least on an annual basis. This group determines appropriate coverage levels and deductibles for each policy based on tolerance and weighs the coverage against the premium for the policy.

stage1Category: Strategy Integration


text: Management's Role in Assessing and Managing Cybersecurity Risk Our Corporate Information Security Group is led by our Chief Information Security Officer (CISO) who is responsible for our information security strategy. This strategy includes policy management, security engineering, identity and access management, vulnerability management and cyber threat detection and response through our Security Operations Center. Our CISO has extensive information technology and program management experience as do many of our employees in our information security group. Our CISO, as well as others in our information security group, hold certifications such the Certified Information System Security Professional certification. We believe cybersecurity is a shared responsibility throughout the organization and thus we also manage cybersecurity risks, through a cross-functional committee of members of senior management known as the Enterprise Risk Steering Committee, which includes the CISO. The diversity of this group allows for identification of key enterprise risks from strategic, operational, financial, legal, information technology, and compliance perspectives. These individuals receive reporting on our cybersecurity programs and also participate in table-top exercises relating to potential security incidents. The CISO is also the primary point of contact for reporting information security incidents and for coordinating information security activities including incident response and digital forensics. Our CISO reports to our Chief Security Officer who also has extensive experience in the information security space.


text: Board Oversight of Cybersecurity Our board has a strong focus on cybersecurity. Our approaches to cybersecurity and privacy risk are overseen by the audit committee. At each regular meeting of the audit committee of our board of directors, our Chief Risk Officer, Chief Compliance Officer, Chief Security Officer, Chief Information Security Officer and Chief Audit Officer provide reports relating to existing and emerging cyber and data security risks, as well as reports on the Company's risk assessments and security incidents. Our audit committee chairman reports on these discussions to our board of directors on a quarterly basis. "See Item 1A Risk Factors for discussion of material risks faced by the Company, including risks related to cybersecurity."


text: We have not identified or experienced any cybersecurity threats or incidents likely to materially affect our business strategy, results of operations, or financial conditions.

companyName: GREENLIGHT CAPITAL RE, LTD.

ticker: GLRE


text: We have identified and analyzed the nature and scope of the affected systems and data. We have notified our affected customers and applicable state attorneys general and regulators, and approximately 1.3 million potentially impacted consumers; are providing credit monitoring, web monitoring, and identity theft restoration services; and are fielding questions from customers. We are continuing to coordinate with law enforcement, our customers, regulators, advisors and other stakeholders. We have been named as a defendant in several lawsuits related to this incident. The Company will vigorously defend itself against any litigation filed related to this incident. At this time, we do not believe that the incident will have a material impact on the Company.

stage1Category: Incident Disclosure


text: We are highly dependent on information technology in the operation of our various businesses. Cybersecurity is an integral part of our operations and is a focus of all employees, including senior management and our board of directors.


text: Risk Management and Strategy We assess, identify and manage cybersecurity risks through various processes within our Enterprise Risk Management Program and Information Security Program. We focus on all areas of cybersecurity, including threat and vulnerability management, security monitoring, identity and access management, phishing awareness, risk oversight, third-party risk management, disaster recovery and continuity management. We have established policies, including those related to privacy, information security and cybersecurity, and we employ a broad and diversified set of cybersecurity risk monitoring and risk mitigation techniques. Internal audits, external audits and self-assessments are conducted to assess the effectiveness and maturity of our Enterprise Risk Management Program and Information Security Program.


text: Management's Role in Assessing and Managing Cybersecurity Risk Our Corporate Information Security Group is led by our Chief Information Security Officer ("CISO") who is responsible for our information security strategy. This strategy includes policy management, security engineering, identity and access management, vulnerability management and cyber threat detection and response through our Security Operations Center. Our CISO has extensive information technology and program management experience as do many of our employees in our information security group. Our CISO, as well as others in our information security group, hold certifications such the Certified Information System Security Professional certification. We believe cybersecurity is a shared responsibility throughout the organization and thus we also manage cybersecurity risks, through a cross-functional committee of members of senior management known as the Enterprise Risk Steering Committee, which includes the CISO. The diversity of this group allows for identification of key enterprise risks from strategic, operational, financial, legal, information technology and compliance perspectives. These individuals receive reporting on our cybersecurity programs and also participate in table-top exercises relating to potential security incidents. The CISO is also the primary point of contact for reporting information security incidents and for coordinating information security activities including incident response and digital forensics. Our CISO reports to our Chief Security Officer who also has extensive experience in the information security space.


text: Board Oversight of Cybersecurity Our board has a strong focus on cybersecurity. Our approaches to cybersecurity and privacy risk are overseen by the audit committee. At each regular meeting of the audit committee of our Board of Directors, our Chief Risk Officer, Chief Compliance Officer, Chief Security Officer, Chief Information Security Officer and Chief Audit Officer provide reports relating to existing and emerging cyber and data security risks, as well as reports on the Company's risk assessments and security incidents. Our audit committee chairman reports on these discussions to our board of directors on a quarterly basis. See Item 1A Risk Factors for discussion of material risks faced by the Company, including risks related to cybersecurity.


text: See "Item 1A. Risk Factors — Risks Relating to Our Business — Technology breaches or failures, including those resulting from a malicious ransomware or cyber-attack on us or our business partners and service providers, could disrupt or otherwise negatively impact our business."


text: 2023 Cybersecurity Incident On November 19, 2023, we became aware of a cybersecurity incident that impacted certain of our systems. We promptly commenced an investigation, retained leading experts to assist the Company, notified law enforcement authorities, regulatory authorities and other stakeholders and followed our incident response plans. In addition, we took containment measures such as blocking access to certain of our systems resulting in varying levels of disruption to our businesses. The incident was contained on November 26, 2023.


text: We completed our forensic investigation on December 13, 2023. We determined that an unauthorized third-party accessed certain of our systems, deployed a type of malware that is not self-propagating and exfiltrated certain data. We have no evidence that any customer-owned system was directly impacted in the incident, and no customer has reported that this has occurred. The last confirmed date of unauthorized third-party activity in our network occurred on November 20, 2023.


text: We have identified and analyzed the nature and scope of the affected systems and data. We have notified our affected customers and applicable state attorneys general and regulators, and approximately 1.3 million potentially impacted consumers; are providing credit monitoring, web monitoring and identity theft restoration services; and are fielding questions from customers. We are continuing to coordinate with law enforcement, our customers, regulators, advisors and other stakeholders. We have been named as a defendant in several lawsuits related to this incident. The Company will vigorously defend itself against any litigation filed related to this incident. This incident did not have a material impact on the Company.


text: The business of the Company is managed with the oversight of the Board of Directors. The Board of Directors has delegated to the Audit Committee the responsibility to discuss guidelines and policies governing the process by which our senior management and the relevant departments and functions of the Company assess and manage our exposure to risk. As part of that responsibility, the Audit Committee regularly reviews our exposure to cybersecurity risk, the effectiveness of our cybersecurity, and the knowledge, experience and capabilities of the Audit Committee and management with respect to cybersecurity and cybersecurity risk. The Company's Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") provide regular briefings to the Audit Committee, including on current and emerging cybersecurity threats, ongoing priorities and strategies to mitigate cybersecurity risk, and compliance with various regulations. In addition, our CIO and CISO periodically update the Board of Directors regarding the Company's cybersecurity efforts.

companyName: Brookdale Senior Living Inc.

ticker: BKD


text: The CISO who reports to the CIO has primary responsibility for assessing, monitoring, and managing our cybersecurity risks. The CIO, in turn, reports directly to our President and Chief Executive Officer. Our CISO oversees our cybersecurity governance programs, tests our compliance with standards, takes action to mitigate known risks, and leads our cybersecurity associate training program. Our CISO has over 10 years' experience leading large complex healthcare cybersecurity programs and holds Certified Information Systems Security Professional ("CISSP") and Certified Information Systems Auditor ("CISA") certifications in good standing. Our CIO is a member of our executive leadership team, having overall responsibility for all aspects of our information systems, including technology, data, and security. The focus of the CIO includes strategic use of technology to support execution on our strategic priorities and our longer-term growth plans, while also balancing risk. Our CIO has over 25 years' experience leading large complex healthcare organizations through successful transformation while developing and strengthening an effective cybersecurity program.


text: The CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques, including through attending educational programs and monitoring alerts from third-party vendors and government agencies. The CISO implements and oversees processes for the regular monitoring of our information systems. In the event of a cybersecurity incident, the CISO is equipped with a written incident response plan.


text: Failure to maintain the security and functionality of our information systems and data, to prevent a cybersecurity attack or breach, or to comply with applicable privacy and consumer protection laws, including HIPAA, could adversely affect our business, reputation, and relationships with our residents, associates, and referral sources and subject us to remediation costs, government inquiries, and liabilities, any of which could materially and adversely impact our revenues, results of operations, and cash flow. Further information is discussed in "Item 1A. Risk Factors." To date, the aforementioned cybersecurity risks and any incidents that we, or our third-party vendors, have experienced have not materially affected us, including our business, strategy, results of operations, or financial condition.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we have engaged external experts and rely on software support from third-party vendors to assist with evaluating, monitoring, and testing our information technology systems. These relationships enable us to leverage specialized knowledge and insights, to help ensure our cybersecurity strategies and processes remain effective. Our collaboration with these third parties includes regular audits, routine system monitoring, threat assessments, and consultation on potential security enhancements. We require third-party service providers with access to personal, confidential, or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.

stage1Category: Third-Party Risk


text: Risk Management and Strategy At eHealth, information security is everyone's responsibility, and we value the trust our customers and business partners place in us to protect their sensitive information. We have established policies and processes for assessing, identifying, and managing risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes.

companyName: eHealth, Inc.

ticker: EHTH


text: We are subject to various federal and state privacy and security laws, regulations, and requirements. These laws govern the collection, use, disclosure, protection, and maintenance of the individually identifiable information that we collect from consumers. We regularly assess our compliance with privacy and security requirements and conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats.


text: Early on, we identified information security as a salient risk as described in Part I, Item 1A, Risk Factors, of this Annual Report on Form 10-K. We maintain data privacy and security through a robust program of safeguards, including responsible management, appropriate use, and protection that is designed to address applicable legal and regulatory requirements. Furthermore, all employees are required to complete annual privacy and security training.


text: We engage with third party assessors, consultants, and auditors to test our cybersecurity maturity and to drive continuous monitoring and improvements. The engagement includes having independent third parties perform compliance, technical, and maturity assessments, such as (1) attack surface assessment, (2) penetration testing assessment, and (3) cybersecurity maturity assessments. We also annually engage third parties and our internal audit department to assess our information security programs, whose findings are reported to the Audit Committee of the Board.

companyName: Crocs, Inc.

ticker: CROX


text: Our security policies and procedures are reviewed and updated regularly to address regulatory, industry, and contractual requirements and recommendations and address new and emerging security threats. We also conduct regular scans of our technical infrastructure and regular penetration audits to check for vulnerabilities and meet our governance and compliance requirements. Training our employees and contractors is crucial to eHealth's governance and compliance requirements. All employees and contractors with access to an eHealth IT system are required to complete security awareness training during onboarding and annually thereafter. Due to the increased inherent risk associated with these roles, developers and privileged users are subject to additional security training requirements.


text: Every person with access to eHealth IT systems is required to undergo periodic phishing simulations and receives personalized tools to improve their security behavior. Performance is measured both individually and by functional groups to manage the maturity and improvement of eHealth's overall security posture. Employees must also acknowledge receipt and understanding of their responsibility to comply with eHealth's Code of Business Conduct, including the eHealth Information Security and Acceptable Use Policies, during onboarding and annually thereafter.


text: Despite our rigorous efforts, incidents may occur, and we are prepared to deal with them through our formal Incident Response Plan. Events such as human errors, computer viruses or other malicious code, unauthorized access, cyber-attacks, or phishing attempts concern all organizations. Our Incident Response Team is trained to contain incidents, mitigate impacts, resolve or remediate issues, and notify affected parties as appropriate. The team is made up of key security, privacy, and legal professionals who work with eHealth Technology and Business Teams and our managed security services.


text: Additionally, eHealth has engaged a guided cyber crisis response platform and conducted a mock cyber-attack exercise to build crisis management experience for our senior leadership and cybersecurity teams. We believe this voluntary skill building exercise put our teams in a better position to manage a potential cybersecurity crisis.


text: Our comprehensive data security strategy includes: • Regular critical security assessments such as advanced attack simulations and vulnerability scans. • A System Development Life Cycle (SDLC) framework to assess applications and related infrastructure before implementation to ensure our security standards are met. • Use of a Role Based Access Control (RBAC) methodology, which defines the access a user receives to eHealth's information systems based on job function. • Requirements that third-party vendors that host, transmit, or have access to eHealth data comply with our policies and undergo reviews. • Monitoring of security event data and the security industry to flag anomalies and be aware of potential threats. • Dedicated domestic and international liaisons who help ensure that business and functional area employees have easy access to experts for guidance and assistance mitigating privacy and information protection risks. • Encryption of customer data both in transit and at rest. • A broad spectrum of technical controls, including data loss prevention, role-based access, application/desktop logging, and data encryption as well as multi-factor authentication and enhanced web application firewall controls.


text: We, like any technology company, have experienced cybersecurity incidents in the past. However, as of the date of this Annual Report on Form 10-K, we have not experienced any cybersecurity incidents which have been determined to be material. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business, operating results and financial condition, please refer to Part I, Item 1A, Risk Factors, in this Annual Report on Form 10-K.


text: eHealth's Board of Directors oversees our enterprise risk management process, including cybersecurity, information security, governance, risk management, and compliance programs and strategies. The Board is responsible for monitoring and assessing strategic risk exposure, and our senior leadership team are responsible for the day-to-day management of the risks that we face. The Board administers its cybersecurity risk oversight both directly and through its Audit Committee. The Audit Committee is regularly briefed on eHealth's risk profile issues. These briefings are designed to provide visibility about identifying, assessing, and managing critical risks, audit findings, and management's risk mitigation strategies. Management briefs the Audit Committee periodically about eHealth's protection programs, focusing on current trends in the environment, incident preparedness, business continuity management, program governance, and program components, including updates on security processes, external testing, and employee training and awareness initiatives.


text: eHealth maintains an Office of the Chief Information Security Officer ("CISO"), who reports to our Chief Digital Officer ("CDO"). Our CISO focuses on information and systems technology, corporate governance, and behaviors to drive security best practices and safeguard information from unauthorized or inappropriate access, use, or disclosure. eHealth also has a Privacy Officer who advises the company on privacy-related laws and regulations, provides guidance on privacy compliance, drives privacy policy, creates, and oversees the privacy program.


text: We rely on our information technology ("IT") systems and networks in connection with our business activities. Some of these networks and systems are managed by third-party service providers and are not under our direct control. We have implemented processes to manage the cybersecurity risks associated with our use of third-party service providers through our vendor risk management program and an application governance policy.


text: Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in our information security team and through the use of technological tools and software and results from third party audits. Our CISO and CDO have extensive experience assessing and managing cybersecurity programs and risks. Our CISO has served in that position since 2019 and, before eHealth, was the Chief Information Security Officer and Vice President IT at Castlight Health where he led the company's overall security program. Before that, our CISO was the Chief Information Security Officer and Director Global Infrastructure Operations at Ooyala with similar responsibilities during rapid growth. His security experience also includes a 21-year career in the U.S. Navy where he served as a Cryptologic Officer. Our CDO joined eHealth in 2023 and was previously Chief Product Officer at M1 Finance, responsible for defining the company's product vision, strategy and roadmap to drive growth and profitability, Prior to M1 Finance, our CDO was the Chief Product Officer at Roofstock, Head of Product at LifeLock (acquired by Symantec) and Sr. Director and Head of Product, D3 Incubation Unit at Capital One. Our CISO reports directly to the Audit Committee of the Board of Directors on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues at least once annually or more frequently as determined to be necessary or advisable. In addition, we have an escalation process in place to inform senior management and the Board of Directors when it is appropriate under the circumstances.


text: Risk Management and Strategy At eHealth, information security is everyone's responsibility, and we value the trust consumers and business partners place in us to protect their sensitive information. We have established policies and processes for assessing, identifying, and managing risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes.


text: Communication of our cybersecurity values and expectations is extended to our third-party solutions through specific programs, which include monitoring and rating services and open-source intelligence risk assessments. In addition to conducting posture and intelligence reviews of our vendors, our cybersecurity teams conduct evaluations of critical vendors to assess security requirements, and we assess our service level agreements so that cyber controls and practices to the levels set out in our cybersecurity standards are embedded within.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO


text: Cybersecurity Risk Management and Strategy We have implemented a cybersecurity governance program intended to assess, identify, and manage risks from threats to the security of our information, systems, and network. Our risk-based measures aim to proactively manage threats and prove the effectiveness of our internal controls.

companyName: Titan Machinery Inc.

ticker: TITN


text: Our comprehensive data security strategy includes: • Regular critical security assessments such as advanced attack simulations and vulnerability scans. • A Software Development Life Cycle (SDLC) framework to assess applications and related infrastructure before implementation to ensure our security standards are met. • Use of a Role Based Access Control (RBAC) methodology, which defines the access a user receives to eHealth's information systems based on job function. • Requirements that third-party vendors that host, transmit, or have access to eHealth data comply with our policies and undergo reviews. • Monitoring of security event data and the security industry to flag anomalies and be aware of potential threats. • Dedicated domestic and international liaisons who help ensure that business and functional area employees have easy access to experts for guidance and assistance in mitigating privacy and information protection risks. • Encryption of consumer data both in transit and at rest. • A broad spectrum of technical controls, including data loss prevention, role-based access, application/desktop logging, and data encryption as well as multi-factor authentication and enhanced web application firewall controls.


text: We, like any technology company, have experienced cybersecurity incidents in the past. However, as of the date of this Annual Report on Form 10-K, we have not experienced any cybersecurity incidents that have been determined to be material. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business, operating results and financial condition, please refer to Part I, Item 1A, Risk Factors, of this Annual Report on Form 10-K.


text: eHealth's Board of Directors oversees our enterprise risk management process, including cybersecurity, information security, governance, risk management, and compliance programs and strategies. The Board is responsible for monitoring and assessing strategic risk exposure, and our senior leadership team is responsible for the day-to-day management of the risks that we face. The Board administers its cybersecurity risk oversight both directly and through its Audit Committee. The Audit Committee is regularly briefed on eHealth's risk profile issues. These briefings are designed to provide visibility about identifying, assessing, and managing critical risks, audit findings, and management's risk mitigation strategies. Management briefs the Audit Committee periodically about eHealth's protection programs, focusing on current trends in the environment, incident preparedness, business continuity management, program governance, and program components, including updates on security processes, external testing, and employee training and awareness initiatives.


text: eHealth's Head of Information Security reports to our Chief Digital Officer ("CDO") and, with respect to cybersecurity risks, to the Audit Committee of the Board of Directors. Our Head of Information Security focuses on information and systems technology, corporate governance, and behaviors to drive security best practices and safeguard information from unauthorized or inappropriate access, use, or disclosure. eHealth also has a Privacy Officer who advises the company on privacy-related laws and regulations, provides guidance on privacy compliance, drives privacy policy, and creates and oversees the privacy program.


text: Our Head of Information Security is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in our information security team and through the use of technological tools and software and results from third-party audits. Our Head of Information Security and CDO have extensive experience assessing and managing cybersecurity programs and risks. Our Head of Information Security has served in that position since 2024 and, before eHealth, was the interim Chief Information Security Officer at Castlight Health where he led the company's overall security program. Before that, our Head of Information Security was Senior Manager of Cyber Security at Secureworks. His security experience also includes a 12-year career at Banc of America Securities and subsequently at Merrill Lynch on their information security teams as Senior Consultant, Systems Engineering & Architecture. Our CDO joined eHealth in 2023 and was previously Chief Product Officer at M1 Finance, responsible for defining the company's product vision, strategy and roadmap to drive growth and profitability, Prior to M1 Finance, our CDO was the Chief Product Officer at Roofstock, Head of Product at LifeLock (acquired by Symantec) and Sr. Director and Head of Product, D3 Incubation Unit at Capital One. Our Head of Information Security reports directly to the Audit Committee of the Board of Directors on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues at least once annually or more frequently as determined to be necessary or advisable. In addition, we have an escalation process in place to inform senior management and the Board of Directors when it is appropriate to do so under the circumstances.


text: We maintain a Cybersecurity Incident Response Plan that is an important component of our Cybersecurity Risk Management Program, which then integrates into our Enterprise Risk Management ("ERM") Program. Our Cybersecurity Incident Response Plan is designed to facilitate a timely, consistent, and compliant response to actual or attempted cybersecurity incidents impacting the Company. The Cybersecurity Incident Response Plan is built on a framework that is aligned with publication 800-61 of the National Institute of Standards and Technology and is tailored to our people, processes, and technology. Cybersecurity Incident Response Plan phases include (1) preparation, (2) detection and analysis, which includes processes to assess the materiality of cybersecurity incidents and make timely reports, (3) containment, eradication, and recovery, and (4) post-incident activity. The Cybersecurity Incident Response Plan also defines the objectives, roles and responsibilities, and scope of our incident response program.


text: We maintain a formal information security training program for all employees that includes training on matters such as security awareness, phishing, and email security best practices. Employees are also required to complete compulsory training on compliance and data privacy.


text: Despite the security measures we have implemented, certain cyber incidents could materially disrupt operational systems. If our IT resources are compromised by an intentional attack and results in loss of trade secrets or other proprietary or competitively sensitive information; compromise personally identifiable information regarding customers or employees; delay our ability to deliver products to customers; jeopardize the security of our facilities; or cause other damage. Although the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition, such incidents could have a material adverse effect in the future as cyberattacks continue to increase in frequency and sophistication. We continuously seek to maintain a robust program of information security and controls, but the impact of a material cybersecurity incident could have an adverse effect on our competitive position, reputation, results of operations, financial condition, and cash flows. Additionally, while we have a cybersecurity program designed to protect and preserve the confidentiality, integrity, and availability of our information systems, we also maintain cybersecurity insurance to manage potential liabilities resulting from specific cyber-attacks. Although we maintain cybersecurity insurance, there can be no guarantee that our insurer(s) will cover specific claims, pay the full costs of an incident, or provide payment in a timely manner. For more information, please see "Item 1A – Risk Factors – Risks Specific to Our Company and Strategy-Our business relies significantly on the use of information technology. A significant disruption to our operational technology or those of our business partners, a privacy law violation, or a data security breach could harm our reputation and/or our ability to effectively operate our business, and our financial results."


text: The Audit Committee of the Board is responsible for monitoring and overseeing risk management from cybersecurity threats. In accordance with the Audit Committee's charter, the Audit Committee is responsible for oversight of our ERM program, which includes cyber risk management. It is the Audit Committee's responsibility to review and discuss with management the adequacy and effectiveness of our cybersecurity policies and the internal controls regarding cybersecurity and privacy related areas. To satisfy this responsibility, the Audit Committee receives periodic updates from management regarding our cybersecurity program. The updates may include information on, among other things, actual events or incidents, results of vulnerability assessments and penetration testing, results of security incident and event management monitoring, updates to the cybersecurity strategy and program, new or modified security policy recommendations, and cybersecurity risk in general. On at least an annual basis, management presents to the Audit Committee on cybersecurity strategy and framework, roadmaps for continued program maturity, key risk areas and related actions, and any significant incidents that have occurred or are reasonably likely to occur. The entire Board is invited to attend this annual cybersecurity meeting of the Audit Committee.


text: Our Executive Leadership Team is responsible for managing enterprise risk, which is inclusive of cybersecurity. The Chief Information Officer ("CIO"), a member of the Executive Leadership Team, and the Chief Information Security Officer ("CISO"), who reports to the CIO, are responsible for assessing and managing cybersecurity risk, including the prevention, detection, mitigation, and remediation of cybersecurity incidents. The CIO has over 30 years of experience in Information Technology and Operations including executive-level experience within the consumer goods industry. The CISO possesses relevant expertise in cybersecurity, including 25 years in both IT and cybersecurity.


text: The cybersecurity team reports to the CISO and has responsibility to prevent, mitigate, detect, and remediate cybersecurity incidents through various processes. These processes include regular vulnerability assessments and penetration testing, security incident and event management, continuous monitoring, and threat intelligence gathering. Additionally, we employ several third parties with expertise in specific cybersecurity risk areas. These third parties report to the CISO, who actively engages with these third parties to monitor their activities and compliance with service level agreements. Through these activities and monitoring, both internally and externally, any events or incidents identified will be escalated to the Board in accordance with our formal Cybersecurity Incident Response Plan.


text: We engage with third-party assessors, consultants, and auditors to test our cybersecurity maturity and to drive continuous monitoring and improvements. The engagement includes having independent third parties perform compliance, technical, and maturity assessments, such as (1) attack surface assessment, (2) penetration testing assessment, and (3) cybersecurity maturity assessments. We also annually engage third parties and/or our internal audit department to assess our information security programs, whose findings are reported to the Audit Committee of the Board.


text: We rely on our information technology ("IT") systems and networks in connection with our business activities. Some of these networks and systems are managed by third-party service providers and are not under our direct control. We have implemented processes to manage the cybersecurity risks associated with our use of third-party service providers through our vendor risk management program and an application governance policy.


text: Risk Management and Strategy The Company maintains a robust cybersecurity program that promotes confidentiality, integrity and availability of our corporate and customer resources throughout the life cycle of our out-of-home service offerings. Under the oversight of the Audit Committee of our Board of Directors, as more fully explained below, and with the support of the Company's compliance function and the Company's internal and external audit functions, the Company operates an enterprise-wide risk management governance framework that sets standards and provides guidance for the identification, assessment, monitoring and control of the most significant risks facing the Company, including cybersecurity. Our enterprise risk management process is guided by the COSO Enterprise Risk Management Framework three lines of defense model, and we further utilize our global Compliance department, legal teams, cybersecurity teams and privacy teams as part of our overall cybersecurity program.


text: Our cybersecurity program includes comprehensive technology and risk oversight programs designed to ensure that our technology systems and cybersecurity education programs are effective and that we are prepared to report and manage information security risks. Developed using collaboration and transparency principles, we maintain a suite of information and cybersecurity policies, standards and guides based on commonly adopted cybersecurity standards, frameworks and regulatory requirements, including ISO 27001 and publications from the National Institute of Standards and Technology and the Center for Information Security. Furthermore, we perform periodic evaluations of our security programs, information technology infrastructure and information security management systems through internal self-assessments and external independent consultations. In addition, we conduct regular security monitoring for internal and external threats to the confidentiality and integrity of our information assets, and our cybersecurity programs undergo periodic testing with the purpose of achieving swift and orderly restoration of business operations in the event of a cybersecurity incident. Cyber hygiene is integrated into our culture from employee onboarding and lasts throughout the employee life cycle, using various tools, such as frequent information security awareness messages and annual cybersecurity awareness training. As part of testing our programs, we regularly conduct internal simulated phishing campaigns. The Company also maintains comprehensive cyber insurance. However, such insurance may not be sufficient to cover all of our potential losses and may not continue to be available to us on acceptable terms, or at all.


text: Our Board of Directors has delegated oversight of risks related to cybersecurity to the Audit Committee. The Audit Committee is, therefore, charged with reviewing our cybersecurity processes for assessing key strategic, operational and compliance risks. Our Corporate Compliance Officer briefs the Audit Committee on cybersecurity risks at each of its meetings, which occur at least four times each year. These briefings include an assessment of cyber risks, an overview of the cyberthreat landscape, updates on cybersecurity incidents and reports on our investments in cybersecurity risk mitigation strategies and technologies and related corporate governance. In addition, our domestic and European chief technology officers brief the Audit Committee on cybersecurity risks at least annually. The Audit Committee then provides updates on significant cybersecurity matters to the Board periodically.


text: Regional heads of cybersecurity and chief technology officers oversee their respective cybersecurity programs, including regional Cybersecurity Steering Committees (each, a "CSSC"), which are comprised of senior executives and extended leadership, and which provide oversight of cybersecurity investments by monitoring, evaluating, approving and supporting actions related to cybersecurity risk, incident management, investment and prioritization of projects and services.


text: Each CSSC meets quarterly and reports to the Company's senior management team, including the Corporate Compliance Officer, on progress towards specific cybersecurity objectives. A strong partnership exists between our information technology, enterprise security, internal audit and legal and compliance functions so that identified issues are addressed in a timely manner and incidents are reported to the appropriate regulatory bodies as required.


text: Our Corporate Compliance Officer is Karis McLarty. Ms. McLarty is an international privacy, economic crime and corporate human rights lawyer. Ms. McLarty has 20 years of experience specializing in U.S. and cross-border protection of large companies. Her areas of responsibility cover privacy, cyber risk and data protection; COSO, COBIT and ISO governance; forensic investigations, including regarding privacy and cyber issues; and regulator reporting, economic crime, antitrust and sustainability. Ms. McLarty holds the CIPP/E certification in European Data Protection and two Master's degrees in Jurisprudence and Forensic Psychology (MA Oxon, MSc).


text: Our domestic Chief Technology Officer, Christian Aaselund, oversees the integration and security of the Company's digital products, infrastructure and all user-facing technology. Mr. Aaselund has over two decades of experience in technology leadership. His career reflects a broad spectrum of expertise, from spearheading tech solutions in startups to executing strategic initiatives in large enterprises.


text: Our domestic cybersecurity program is overseen by our Head of Cybersecurity, Louie Garcia. Mr. Garcia has over 18 years of cybersecurity experience, spanning threat perspectives, cyber exercise development and training, enterprise vulnerability assessments, defensive and offensive network solutions and operational evaluation of cyber products.


text: Our European Chief Technology/Information Officer and our European Head of Information Security each have approximately 25 years' experience in the technology industry, with our Head of Information Security having focused for the last 10 years solely on the Information Security and Cybersecurity domains.


text: Our Head of Information Technology for Latin America, who oversees Cybersecurity, has 25 years of experience in strategic IT leadership and global project management.


text: Risk Management and Strategy The Company maintains a robust cybersecurity program that promotes confidentiality, integrity and availability of our corporate and customer resources throughout the life cycle of our out-of-home service offerings. Under the oversight of the Audit Committee of our Board of Directors, as more fully explained below, and with the support of the Company's compliance function and the Company's internal and external audit functions, the Company operates an enterprise-wide risk management governance framework that sets standards and provides guidance for the identification, assessment, monitoring and control of the most significant risks facing the Company, including cybersecurity. Our enterprise risk management process is guided by the COSO Enterprise Risk Management Framework, which incorporates the three lines of defense model. In addition, we leverage our global Compliance department, legal teams, cybersecurity teams and privacy teams as key components of our overall cybersecurity program.


text: Our Board of Directors (the "Board") is responsible for overseeing our risk management program and cybersecurity is a critical element of this program. The Information Security and Privacy team leads cybersecurity risk management for our business. Effective Cyber Risk Management is foundational to our Information Security and Privacy program and is based on recognized frameworks established by the National Institute of Standards and Technology (NIST). Our Information Security and Privacy Risk Management program includes processes and controls for the business to ensure that cybersecurity risks are identified and responded to promptly. These range from formal processes that are triggered in certain circumstances, to detective controls and technology that we use to identify and manage risks. Information Security and Privacy's Risk Management process is consistent with our Enterprise Risk Management Policy, which describes how we manage risks generally. The Information Security and Privacy team also engages with external consultants to ensure best practices in our Cyber Risk Management.

companyName: Live Nation Entertainment, Inc.

ticker: LYV


text: Our cybersecurity program includes comprehensive technology and risk oversight programs designed to ensure that our technology systems and cybersecurity education programs are effective and that we are prepared to report and manage information security risks. Developed using collaboration and transparency principles, we maintain a suite of information and cybersecurity policies, standards and guides based on commonly adopted cybersecurity standards, frameworks and regulatory requirements, including publications from the National Institute of Standards and Technology and the Center for Information Security. Furthermore, we perform periodic evaluations of our security programs, information technology infrastructure and information security management systems through internal self-assessments and external independent consultations. In addition, we conduct regular security monitoring for internal and external threats to the confidentiality and integrity of our information assets, and our cybersecurity programs undergo periodic testing with the purpose of achieving swift and orderly restoration of business operations in the event of a cybersecurity incident. Cyber hygiene is integrated into our culture from employee onboarding and lasts throughout the employee life cycle, using various tools, such as frequent information security awareness messages and annual cybersecurity awareness training. As part of testing our programs, we regularly conduct internal simulated phishing campaigns. The Company also maintains comprehensive cyber insurance. However, such insurance may not be sufficient to cover all of our potential losses and may not continue to be available to us on acceptable terms, or at all.


text: Communication of our cybersecurity values and expectations is extended to our third-party solutions through specific programs, which include monitoring and rating services and open-source intelligence risk assessments. In addition to conducting posture and intelligence reviews of our vendors, our cybersecurity teams conduct evaluations of critical vendors to assess security requirements, and we assess our service level agreements to monitor whether cyber controls and practices are integrated to the levels specified in our cybersecurity standards.


text: We have experienced, and may in the future experience, whether directly or through our supply chain partners, cybersecurity incidents. While prior cybersecurity incidents have not had a material impact on the Company, future cybersecurity incidents, including breaches, could have a material impact on our business, operations and reputation. For additional information about the Company's cybersecurity risks, please refer to "Technology Risks" in Item 1A of this Annual Report on Form 10-K.


text: Our Board of Directors has delegated oversight of risks related to cybersecurity to the Audit Committee. The Audit Committee is, therefore, charged with reviewing our cybersecurity processes for assessing key strategic, operational and compliance risks. Our Corporate Compliance Officer briefs the Audit Committee on cybersecurity risks at each of its meetings, which occur at least four times each year. These briefings include an assessment of cyber risks, an overview of the cyberthreat landscape, updates on cybersecurity incidents, and reports on our investments in cybersecurity risk mitigation strategies and technologies and related corporate governance. In addition, our domestic and European chief technology officers brief the Audit Committee on cybersecurity risks at least annually. The Audit Committee then provides updates on significant cybersecurity matters to the Board periodically.


text: Each CSSC meets quarterly and reports to the Company's senior management team, including the Corporate Compliance Officer, on progress towards specific cybersecurity objectives. A strong partnership exists between our information technology, enterprise security, internal audit, and legal and compliance functions so that identified issues are addressed in a timely manner and incidents are reported to the appropriate regulatory bodies as required.


text: Our Corporate Compliance Officer is Lynn A. Feldman, the Company's Executive Vice President, Chief Legal Officer and Corporate Secretary. Ms. Feldman has over 20 years of experience leading the legal and risk management departments of public companies. Her areas of responsibility cover privacy, cybersecurity risk and data protection; governance, including with respect to cybersecurity; and global legal compliance and reporting. For additional information about Ms. Feldman's experience, please refer to the " Information About Our Executive Officers " section in this Annual Report on Form 10-K.


text: Our domestic Chief Technology Officer, Christian Aaselund, oversees the integration and security of the Company's digital products, infrastructure and all user-facing technology. Mr. Aaselund has over two decades of experience in technology leadership. His career reflects a broad spectrum of expertise, from spearheading technology solutions in startups to executing strategic initiatives in large enterprises.


text: Our domestic cybersecurity program is overseen by our Head of Cybersecurity, Louie Garcia. Mr. Garcia has almost 20 years of cybersecurity experience, spanning threat perspectives, cyber exercise development and training, enterprise vulnerability assessments, defensive and offensive network solutions, and operational evaluation of cyber products.


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management and strategy focus on several areas: • Risk Identification and Reporting: We have implemented a comprehensive, cross-functional approach to assessing, identifying, and managing material cybersecurity threats and incidents. The program includes controls and procedures to properly identify, classify, and escalate certain cybersecurity incidents to provide management visibility and obtain an assessment from management as to the public disclosure and reporting of material incidents in a timely manner. The Information Security and Privacy team's responsibilities include: Conducting privacy impact assessments; Rating cyber risk severity, coordinating remediation, and monitoring cyber risks within our enterprise risk register; Cyber threat intelligence functions, including monitoring cybercrime and geopolitical developments; Supporting mergers and acquisitions activities, including integration of newly acquired businesses; Performing security architecture reviews, both of existing enterprise systems and those of newly acquired organizations;


text: Monitoring and ensuring Payment Card Industry Data Security Standard (PCI-DSS) compliance where required across the enterprise; and Conduct and supervision of penetration testing.


text: • Technical Safeguards: We have implemented technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. The Information Security and Privacy team also manages and carries out logging, and vulnerability and application scanning, to support the identification of cyber risks. • Incident Response and Recovery Planning: We maintain comprehensive incident response, business continuity, and disaster recovery plans designed to guide our response to cybersecurity incidents. We also conduct regular tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management (TPRM): We maintain a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems. • Education and Awareness: We provide regular, mandatory training for all levels of employees regarding cybersecurity threats to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes, and practices.


text: The Board, in coordination with our Global Data Governance Board (GDGB) and the Audit Committee, oversees our risk management program, including the management of cybersecurity threats. The GDGB receives regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security.


text: The Chief Information Security and Privacy Officer (CISPO) is the risk manager overseeing the organization's information security risk management function. As the Risk Manager, the CISPO is responsible for the administration of the information security risk management program, policy, and procedures. This includes ensuring that risks are properly identified, assessed, managed, and reported as prescribed by the organization. The Risk Manager also has the responsibility of promoting an effective risk management culture through regular training across the organization. The CISPO has direct communication with senior executives regarding cybersecurity risks and works collaboratively with our leadership to respond to and manage the response to cybersecurity incidents. The CISPO has nearly 20 years of legal and data protection experience with a focus on Information Security, Privacy, and Abuse Prevention.


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including its business strategy, results of operations, or financial condition. Further information regarding cybersecurity risks can be found in Item 1A. Risk Factors - Risks Relating to Information Technology, Cybersecurity and Intellectual Property.


text: Our Chief Technology Officer and members of the Engineering Security team typically meet twice annually with the Audit Committee to review the Company's significant cybersecurity threats and risks, as well as the processes the Company has implemented to address them. The Chair of the Audit Committee, in turn, reports to the full Board.

companyName: YELP INC

ticker: YELP


text: Risk Management and Strategy We recognize the importance of protecting consumer and employee data and maintaining the safety and security of our information systems. We identify, assess and manage material risks on an enterprise basis through our global enterprise risk management ("ERM") program. We maintain a cybersecurity program designed to detect, identify, classify and mitigate cybersecurity and other data security threats, which is aligned to and informed by our ERM program. Our cybersecurity program takes into consideration, among other things, compliance requirements, risks to our revenue channels, risks posed by third-party engagements, consumer and employee data security and global enterprise security. We engage independent third parties to conduct regular penetration testing and targeted security audits of our information systems. In addition, we engage a third-party vendor to conduct 24/7 monitoring of cybersecurity alerts. In the event we identify or are notified of a potential cybersecurity, privacy or other data security incident, we have a data incident response plan that defines procedures for responding to such incidents, including when and how to engage with our executive leadership team, our Board of Directors, other stakeholders and law enforcement, as applicable. We also maintain cyber liability insurance to help defray any financial losses arising out of a cyber security incident; our insurance, however, may not cover all types of cybersecurity incidents or all losses that we incur.

companyName: Under Armour, Inc.

ticker: UAA


text: We have adopted, and periodically review and update, information security and privacy notices, policies and procedures. We maintain annual cybersecurity and data privacy training for all employees with access to our corporate systems. In addition, as part of our Payment Card Industry Data Security Standard compliance, we maintain annual role-based training on protecting payment card information for all relevant employees. We conduct proactive incident preparedness activities focused on cybersecurity risks and business continuity, such as annual table-top exercises with our senior management, as well as periodic phishing simulations to test our employees' responses to suspicious emails.


text: We utilize third-party service providers as a part of our day-to-day business operations. Certain of the networks and systems used to conduct our operations are managed by such third-party service providers and are not under our direct control. To address cybersecurity risk to our operations arising from our relationships with third-party service providers, we maintain a third-party risk management program, which includes cybersecurity and data privacy assessments during vendor onboarding to identify and classify risk based on several factors, including the type of data handled by the third-party service provider and the potential impact to our business if there were a significant disruption to the third-party service or system.


text: Our Board has delegated primary responsibility to oversee the management of risks related to information technology use and protection, including cybersecurity and data privacy, to the Audit Committee, while retaining oversight of management's overall approach to risk management. The Audit Committee receives regular reports regarding our cybersecurity risks through two annual briefings by senior management, including our Chief Information Security Officer ("CISO") and head of data privacy, and additional periodic updates as appropriate. In addition, members of our management team conduct an enterprise-wide internal risk assessment through our ERM program that is updated annually and reviewed and discussed by the Audit Committee. This risk assessment is designed to identify our most material risks, including cybersecurity risks, for evaluation and monitoring. At each Board meeting, the chairperson of the Audit Committee and the Corporate Secretary report on the Audit Committee's activities, including risk management, which provides an opportunity to discuss significant cybersecurity risks with the full Board.


text: Our CISO leads our global cybersecurity team and is responsible for our cybersecurity program. Our current CISO has served in various roles in information technology and information security for over twenty years, including at our Company since 2013. He holds an MBA and a Certified Information Systems Security Professional certification. Our CISO reports to our Chief Technology Officer, who reports to our Chief Executive Officer.


text: Impact of Cybersecurity Risks on Strategy and Results As of the date of this Annual Report on Form 10-K, we have not identified any risks from cybersecurity threats. including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business, including our business strategy, results of operations or financial condition. However, we and our third-party service providers continue to experience cyberattacks, including phishing, ransomware and other attempts to gain unauthorized access to our and their systems, that could materially affect us in the future. For additional information regarding the threats we face, see "Risk Factors—Business and Operational Risks—If we encounter problems with our distribution system, our ability to deliver our products to the market could be adversely affected"; "—We rely significantly on information technology and any failure, inadequacy or interruption of that technology could harm our ability to effectively operate our business"; and "—Legal, Regulatory and Compliance Risks—Data security or privacy breaches could damage our reputation, cause us to incur additional expense, expose us to litigation and adversely affect our business and results of operations" included in Part I, Item 1A of this Annual Report on Form 10-K.


text: Risk Management and Strategy We recognize the importance of protecting consumer and employee data and maintaining the safety and security of our information systems. We identify, assess and manage material risks on an enterprise basis through our global enterprise risk management ("ERM") program. We maintain a cybersecurity program designed to detect, identify, classify and mitigate cybersecurity and other data security threats, which is aligned to and informed by our ERM program. Our cybersecurity program takes into consideration, among other things, compliance requirements, risks to our revenue channels, risks posed by third-party engagements, consumer and employee data security and global enterprise security. We engage independent third parties to conduct regular penetration testing and targeted security audits of our information systems. In addition, we engage a third-party vendor to conduct 24/7 monitoring of cybersecurity alerts. In the event we identify or are notified of a potential cybersecurity, privacy or other data security incident, we have a data incident response plan that defines procedures for responding to such incidents, including when and how to engage with our executive leadership team, our Board of Directors, other stakeholders and law enforcement, as applicable. We also maintain cyber liability insurance to help defray financial losses arising out of a cyber security incident; our insurance, however, may not cover all types of cybersecurity incidents or all losses that we incur.


text: Our Board has delegated primary responsibility to oversee the management of risks related to information technology use and protection, including cybersecurity and data privacy, to the Audit Committee, while retaining oversight of management's overall approach to risk management. The Audit Committee receives regular reports regarding our cybersecurity risks through two annual briefings by senior management, including our Chief Information Security Officer ("CISO") and head of data privacy, and additional periodic updates as appropriate. At each Board meeting, the chairperson of the Audit Committee and the Corporate Secretary report on the Audit Committee's activities, including risk management, which provides an opportunity to discuss significant cybersecurity risks with the full Board.


text: Impact of Cybersecurity Risks on Strategy and Results As of the date of this Annual Report on Form 10-K, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business, including our business strategy, results of operations or financial condition. However, we and our third-party service providers continue to experience cyberattacks, including phishing, ransomware and other attempts to gain unauthorized access to our and their systems, that could materially affect us in the future. For additional information regarding the threats we face, see "Risk Factors—Business and Operational Risks—If we encounter problems with our distribution system, our ability to deliver our products to the market could be adversely affected"; "—We rely significantly on information technology and any failure, inadequacy or interruption of that technology could harm our ability to effectively operate our business"; and "—Legal, Regulatory and Compliance Risks—Data security or privacy breaches could damage our reputation, cause us to incur additional expense, expose us to litigation and adversely affect our business and results of operations" included in Part I, Item 1A of this Annual Report on Form 10-K.


text: Risk Management and Strategy Cybersecurity risk management is an integral part of our digital posture and enterprise risk management strategy. Cybersecurity is critical to maintaining the trust of our customers and business partners, and we are committed to protecting our and their confidential and sensitive information, including personal information, and mitigating cybersecurity risks that impact our systems and networks. We maintain technologies, programs and processes designed to assess, identify, manage and mitigate cybersecurity risks. Our efforts include regular monitoring of Leidos-managed programs for internal and external cybersecurity threats, providing cybersecurity training to our employees during the onboarding process and annually, and continually reviewing and refining formal policies and procedures designed to deter, identify and remediate cybersecurity incidents. We regularly perform evaluations of our cybersecurity program and continue to invest in our capabilities to keep our customers, partners, suppliers and information assets in our possession safe. Although we employ service provider due diligence and onboarding procedures to identify potential cybersecurity risk, our ability to monitor the cybersecurity practices of our service providers is limited and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information system, software, networks and other assets owned or controlled by our vendors.

companyName: Leidos Holdings, Inc.

ticker: LDOS


text: Our Chief Information Security Officer leads our Cybersecurity Intelligence and Response Team ("CSIRT") whose function is to stay apprised of existing and emerging cyber threats and monitor our global enterprise and proactively identify and protect against cybersecurity risk. The CSIRT uses intelligence collected from various sources, fused with intelligence collected from analysis and response actions, to proactively search for, and address adversary activity against the Leidos network. The CSIRT possesses in-depth knowledge of network, endpoint, perimeter security systems, identity, data protection, threat intelligence, forensics, penetration testing and malware reverse engineering, as well as the functioning of specific applications or underlying information technology infrastructure.


text: Leidos CSIRT owns the incident response process and provides direction and guidance to users of Leidos computing resources when responding to cybersecurity incidents. Leidos CSIRT also provides intrusion monitoring of networks and information systems and continuously monitors the Leidos computing environments and performs triage and analysis of events to identify potential incidents.


text: Our Chief Technology Officer and members of the Engineering Security team typically meet bi-annually with the Audit Committee to review the Company's significant cybersecurity threats and risks, as well as the processes the Company has implemented to address them. The Chair of the Audit Committee, in turn, reports to the full Board.


text: We employ multiple security and monitoring devices and applications throughout the Company to identify, alert, report and log all authorized and unauthorized access to the Leidos enterprise networks. We use an application that collects, correlates, and notifies CSIRT analysts regarding any item meeting an electronic intrusion event. We categorize anomalous cyber events into discrete levels in which cybersecurity matters are escalated to certain levels of management, as well as our Board, based on the severity of the incident, as appropriate. Sharing cyber threat information at these levels supports the Company's ability to integrate cybersecurity considerations into its overarching risk management system and processes.


text: We also conduct periodic internal and third-party assessments to test our cybersecurity controls, perform cyber simulations and exercises, and continually evaluate our internal governing policies and procedures to help detect and respond to cybersecurity events in order to reduce harms or impacts from breaches and other information security incidents.


text: Management's Responsibilities Our global information security program is led by our corporate Chief Information Security Officer, who works closely with key corporate functional and line of business stakeholders. The Chief Information Security Officer partners with these functions for the purpose of identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risks are monitored, implementing appropriate mitigation measures, reporting cybersecurity breaches and other information security incidents, and maintaining our cybersecurity program. The team of senior management officers, who support our information security program, have expertise with cybersecurity, as demonstrated qualifications such as by prior work experience, possession of a cybersecurity certification, degree, or other cybersecurity experience. Our management team receives regular updates on our cybersecurity posture and reviews detailed information about our cybersecurity preparedness. Additionally, we have a Leidos Security Council that is co-chaired by the Chief Information Security Officer and the Chief Security Officer to address "all security hazards" across our global enterprise to ensure cohesion and effectiveness of our combined security governance and risk mitigations.


text: Board's Roles and Responsibilities We have a Technology and Innovation Security Committee, comprised of six board members, with relevant backgrounds and experience, that oversees and advises the Board and management on matters involving the Company's overall strategic direction and significant business risks and opportunities in the areas of technology and information security.


text: At least quarterly, management provides our Board and the Technology and Information Security Committee with updates about our cybersecurity and related risk exposures, our policies and procedures to mitigate such exposures and the status of projects to strengthen our information security infrastructure and program maturity and defend against and respond to cybersecurity threats. In addition, we use a risk-based escalation process to notify the Board and the Technology and Information Security Committee outside of the regular reporting cycle should we identify a significant emerging risk or potentially material issue that should be brought to their attention.


text: Cybersecurity Threats To date, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of our operations, or our financial condition. However, despite our efforts to identify and respond to cybersecurity threats, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Cybersecurity breaches and other information security incidents could negatively impact our business and financial results, impair our ability to effectively provide our services to our customers and cause harm to our reputation or competitive position" in this Annual Report on Form 10-K.


text: Risk Management and Strategy Envestnet's Information Security Program uses a risk-based approach to assess, identify and manage material risks from cybersecurity threats and is an integral part of our enterprise risk management program and processes. The Information Security Program is complemented by our business continuity and disaster recovery planning controls. Envestnet's Group Head, Cybersecurity/Information Security Officer is a member of the firm's Risk Management Committee.

companyName: ENVESTNET, INC.


text: We regularly update our enterprise-wide Information Security Program to align with industry best practices and applicable regulations. Envestnet's Information Security Program includes a policy framework that leverages elements from National Institute of Standards and Technology Cybersecurity Frameworks, NIST 800-53 Standards, ISO 27001, Cloud Security Alliance, and other relevant industry best practices to protect the confidentiality, availability, and integrity of our data and systems.


text: Directed by Envestnet's Group Head, Cybersecurity/Information Security Officer, the Information Security team defines, implements and monitors our Information Security Program. We review and approve our security policies, procedures, and standards annually or whenever material updates are made during the year. Moreover, we undergo SOC 1 Type 2, SOC 2 Type 2, and PCI-DSS (where applicable) audits on multiple technology platforms. In addition to our Information Security team, we use third-party vendors to help address material risks from cybersecurity threats. Among other things, third parties conduct security assessments, monitor endpoint security, probe our defenses, and conduct cybersecurity exercises. We also leverage third-party providers to aid management to detect, respond and recover in the event of a cyber incident.


text: To keep information security risks related to suppliers and other third parties within an acceptable range, Envestnet has a third-party oversight program. This program categorizes our third parties, assesses the potential impact of a compromise of Envestnet data and other resources in relation to the third-party's engagement and manages the risk associated with third parties. This risk management includes understanding whether the third-party has required controls in place, whether it has vulnerabilities that need to be managed before beginning work with us and what residual risks will remain and require acceptance or further decision making.


text: Risks from Cybersecurity Threats No risks from cybersecurity threats materially affected Envestnet's business strategy, results of operations or financial condition during the year that ended December 31, 2023. Moreover, such risks do not appear to be reasonably likely to affect our business strategy, results of operations or financial condition.


text: Board of Directors' Oversight of Risks from Cybersecurity Threats Envestnet's Board of Directors maintains regular oversight of risks from cybersecurity threats. In particular, its Compliance and Information Security Committee reviews, assesses, and makes recommendations to our Board about our regulatory compliance programs and information technology security framework, including cybersecurity threats. This includes receiving regular reports from the Information Security team on audits, security issues, changes in risk postures and regulatory matters. The Compliance and Information Security Committee also oversees selection of Envestnet's independent security assessors and reviews their reports. The Committee is authorized to request that any Envestnet director, officer, employee, outside counsel or independent auditor attend a meeting of the committee or meet with any of its members or advisors.


text: The majority of the directors who serve on the Compliance and Information Security Committee must be independent. The Committee meets quarterly and on an ad hoc basis.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Envestnet's senior management assesses and manages material risks from cybersecurity threats through its Information Security Management Committee. The Information Security Management Committee provides direction, management, support and sponsorship associated with information security. Chaired by Envestnet's Group Head, Cybersecurity/Information Security Officer, the Information Security Management Committee consists of Envestnet's Executive and Senior management from Operations, Legal, Compliance, Systems, Business, Human Resources and Finance.


text: Our Group Head, Cybersecurity/Information Security Officer has a total of more than 28 years of experience in cybersecurity, technology and information technology roles with financial services, technology and consulting companies. She joined Envestnet in 2020.


text: The Information Security Management Committee's responsibilities include, but are not limited to: • Setting, reviewing and supporting the components of the Information Security Program; • Monitoring significant risk trends and proposing changes to controls and policies, as appropriate; • Ensuring that information security is resourced and prioritized; • Ensuring the proper execution of risk management activities; • Establishing and maintaining a culture that promotes information security; • Reviewing and evaluating the implementation and effectiveness of the Information Security Program through regular external and internal assessments; • Maintaining cybersecurity incident response preparedness; • Providing support for and visibility to information security initiatives; and • Coordinating with the Information Security team to provide regular reports to the Compliance and Information Security Committee of the Board of Directors about audits, security issues, changes in risk postures and regulatory matters, among other cybersecurity topics.


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. An analysis of the impact, likelihood, and management preparedness of cybersecurity threats to our strategic priorities is integrated into our enterprise risk management program and enterprise risk assessment process. This is intended to provide cross-functional visibility, as well as executive leadership oversight, to address and mitigate associated risks. Our internal IT group audits our information security programs, and the results are reported to our executive management and the Risk Committee of our Board of Directors by the Director of Information Technology. We also engage third party firms to identify, assess, and manage cybersecurity risks in alignment with cybersecurity standards. We further employ systems and processes designed to oversee, identify, and reduce the potential impact of a cybersecurity incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. We also carry cybersecurity insurance to protect against potential losses arising from a cybersecurity incident.

companyName: Calumet Specialty Products Partners, L.P.


text: Our policies and procedures also address the oversight, identification, and mitigation of cybersecurity risks associated with our use of third-party service providers. Our policy requires that each third-party service provider go through a mandatory IT Security Governance review and obtain formal approval by our IT Security Governance group before it can be used.


text: We also apply a risk-based approach to mitigate cybersecurity risks associated with our use of third-party service providers, including those in our supply chain that have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk process. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers.

companyName: Compass Group Diversified Holdings LLC


text: We have an Incident Response Plan ("IRP") that defines and documents procedures for assessing, identifying, and managing a cybersecurity incident. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process aligns with the NIST framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all personnel (including third-party partners) that perform functions or services require access to secure Company information, and to all devices and network services that are owned or managed by the Company. We also have protocols by which material cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Board of Directors.


text: Our Director of Information Technology, who has extensive cybersecurity knowledge and skills gained from over twenty years of work experience at the Company and elsewhere, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business and reports directly to the Executive Vice President — Chief Financial Officer. The Director of Information Technology receives reports on cybersecurity threats from a number of experienced information security officers responsible for various parts of the business on an ongoing basis and in conjunction with management, regularly reviews risk management measures implements by the Company to identify and mitigate data protection and cybersecurity risks. Our Director of Information Technology works with Legal to oversee compliance with legal, regulatory, and contractual security requirements.


text: Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Risk Committee. Aside from more immediate reporting of material incidents to our Board of Directors as described above, our Director of Information Technology provides our Risk Committee an update on cybersecurity at least every other quarter and more often as necessary. This update includes metrics on the effectiveness of technical and human security controls, cybersecurity training program compliance, internal and third-party cybersecurity incidents, and cybersecurity risks.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. If our systems, or our customers' or suppliers' systems, for protecting against cybersecurity incidents prove to be insufficient, a cybersecurity incident could have a material adverse effect on our business, operations, or consolidated financial condition. As part of our overall risk mitigation strategy, the Company maintains cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to cybersecurity incidents or other related breaches. Please refer to Part I, Item 1A "Risk Factors — Risks Related to Our Business" for additional information about our cybersecurity risks.