text: Engagement of Third Parties: Management often engages with specialized third-party assessors, consultants, auditors, and other experts to review, validate, and enhance its cybersecurity practices. Third-party independent assessments provide an external perspective on management's cybersecurity posture, allowing it to leverage best practices from the industry and ensure its defenses remain robust. All third parties engaged for such processes are subjected to rigorous scrutiny to ensure the third parties meet management's security standards.


text: Oversight of Third-party Service Providers: Management acknowledges the potential risks associated with the use of third-party service providers. Therefore, management has established processes to oversee and identify material cybersecurity risks that may be associated with third-party service providers with whom it engages. This includes conducting thorough, risk-based due diligence before onboarding, performing security assessments, and confirming adherence to management's cybersecurity requirements. Management also maintains active communication channels with these providers to stay informed about any potential security incidents or concerns.

companyName: WILLIAMS COMPANIES, INC.

ticker: WMB

secItem: Item 1C

stage1Category: Third-Party Risk

stage1Method: unanimous


text: Disclosure of Risks: Management describes how risks from cybersecurity threats could materially affect its business strategy, results of operations, or financial condition, as part of its risk factor disclosures at Part I, Item 1A of this Annual Report on Form 10-K.

stage1Category: None/Other


text: Cybersecurity Governance Cybersecurity is an important part of the risk management processes and an area of focus for the Board of Directors and management. Each member of Williams' organization, which includes Transco and NWP, from facility operators to board members, has a responsibility to safeguard the organization's cybersecurity. The Chief Information Security Officer (CISO) is responsible for the cybersecurity strategy and execution, while the Board and the Audit Committee are responsible for oversight of cybersecurity risk.

stage1Category: Board Governance

stage1Method: majority


text: The Cybersecurity Governance Committee is led by the CISO and includes cybersecurity managers and other subject matter experts as standing members. The Cybersecurity Governance Committee is tasked with developing, implementing, and maintaining the Cybersecurity Program. The Cybersecurity Executive Advisory Board (Executive Advisory Board) is led by the CISO, with the Chief Information Officer (CIO), Chief Financial Officer, Chief Human Resources Officer, the General Counsel, and the Chief Operations Officer as standing members. The Executive Advisory Board's purpose is to ensure enterprise alignment with the Cybersecurity Program and provide executive oversight of the Cybersecurity Program.

stage1Category: Management Role


text: The Board of Directors oversees cybersecurity-related policy and strategy. As part of this oversight, the CISO provides a cybersecurity dashboard that is reviewed by the Board at every regularly scheduled Board meeting, which includes key performance indicators for cybersecurity process maturity, operational performance, and enterprise performance toward Transportation Security Administration (TSA) compliance. Additionally, the CIO and/or CISO presents to the Board bi-annually regarding the cybersecurity risks and strategies, including as part of the Board's annual long-term strategy session. The Audit Committee, comprised of independent directors, reviews the implementation and effectiveness of cybersecurity risk management protocols and reviews the effectiveness of cybersecurity as part of the Company's accounting and internal control policies. As part of this oversight, the CIO presents to the Audit Committee bi-annually, as well as periodically in conjunction with any internal audits related to cybersecurity. Additionally, management has protocols by which cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, are reported to the Board, as well as ongoing updates regarding any such incident until it has been addressed.


text: Williams' new CIO joined the company in February 2025, and will succeed the company's retiring CIO, who is retiring in March 2025. The new CIO brings over 20 years of experience in information technology and leadership within the energy industry and has extensive expertise in digital transformation, cloud strategies, enterprise AI initiatives, and cybersecurity, as well as managing large-scale system implementations and integrations. He holds an Executive MBA from the University of Texas at San Antonio, a Master of Computer Science and Engineering from the University of Texas at Arlington, and a Bachelor of Information Science and Engineering from Bangalore University.


text: The retiring CIO had been in his role at Williams for over 10 years and had over 30 years of combined information technology experience with a broad scope of responsibility. He provided senior leadership support of the cybersecurity and risk management programs since 2013. He holds a bachelor's degree in management information systems (MIS) from the University of Oklahoma and a Master of Business Administration in MIS from the University of Dallas.


text: The CISO has been at Williams for over 25 years. During that time, he has held a variety of information technology positions at multiple levels in the organization ranging from network engineering to application development and project management, as well as several IT Manager and Director roles. He has had oversight of the cybersecurity and risk management programs since 2017. Active in government and private sector partnerships, he is currently serving as the Chair of Emergency Response Working Group under the Oil & Natural Gas Subsector Coordinating Council and recently acted as the Chair of the Interstate Natural Gas Association of America security committee. He holds degrees in Business Administration and MIS from the University of Oklahoma and is certified in Leadership from Harvard Business School's executive education. In 2018, he obtained his Chief Information Security Officer certification from Carnegie Mellon University.


text: Risk Management and Strategy As described in Item 1A – Risk Factors, we are subject to various cybersecurity risks that could adversely affect our business, financial condition, results of operations, and reputation. We recognize the critical importance of assessing, identifying, and managing material risks associated with cybersecurity threats, and have integrated a comprehensive cybersecurity program into our broader Enterprise Risk Management ("ERM") framework. This integration ensures that cybersecurity considerations are an integral part of our decision-making process at every level. Our cybersecurity program includes a detailed set of policies, standards, and procedures informed by an industry-leading framework established by the National Institute of Standards and Technology ("NIST CSF"). The NIST CSF provides a model that emphasizes identification, protection, detection, response, and recovery. To identify and manage risks from third parties in relation to cybersecurity, we conduct thorough cybersecurity assessments of third party service providers and include specific cybersecurity obligations in our contracts. Additionally, we continuously monitor these providers and require prompt notification of any cybersecurity incidents to manage and monitor potential risks to our business, financial condition, results of operations, and reputation.

companyName: WINNEBAGO INDUSTRIES INC

ticker: WGO

stage1Category: Risk Management Process


text: The Audit Committee is the lead Board committee with oversight of the cybersecurity program and bears the primary responsibility for this aspect of the business. The Audit Committee is comprised of Board members with diverse professional backgrounds, such as accounting/finance, utility security, risk management, and business performance integration. The breadth of experience in this Committee enables it to be the most appropriate lead in oversight of cybersecurity risks and capability.

companyName: YORK WATER CO

ticker: YORW


text: We manage our exposure to cybersecurity risk using various methods designed to protect against, detect, and respond to cybersecurity threats. For example, we leverage threat intelligence to identify trends and inform our understanding of the cybersecurity risk landscape. In addition, our cybersecurity team, which is led by our Vice President of Information Security, performs regular assessments of our program and conducts penetration testing to identify, evaluate, and remediate potential threats and vulnerabilities. We also engage external resources to support in the design and implementation of certain program elements, and to assist us in the prevention, detection, monitoring, mitigation, and remediation of cybersecurity risks and incidents. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of material cybersecurity incidents, we maintain a documented incident response plan to manage cybersecurity events within our environment. The response plan includes procedures for identifying, containing, and responding to cybersecurity incidents. Our ability to respond to cybersecurity incidents is tested on a recurring basis.


text: We view cybersecurity as a shared responsibility. Our employees are trained through annual security training, regular phishing simulations, and frequent communications about cybersecurity threats.


text: Our cybersecurity program is led by our Vice President of Information Security and overseen by our Chief Information Officer ("CIO"). Our Vice President of Information Security, who is responsible for assessing and managing our information technology risks, including cybersecurity, joined Winnebago Industries in July 2021 and has over 25 years of experience in heavily regulated industries such as finance and healthcare. She has held multiple roles in Information Security and IT, demonstrating expertise and versatility in navigating the threat landscape of cybersecurity. Our CIO reports to our Senior Vice President, Chief Financial Officer, a member of our senior leadership team who reports to our President and Chief Executive Officer.


text: The Audit Committee of our Board of Directors provides oversight of our ERM program, of which cybersecurity is an integral component. Members of the Audit Committee receive updates on a quarterly basis, or more frequently as appropriate, from our CIO regarding existing and new cybersecurity risks, the effectiveness and continued maturity of our cybersecurity program, cybersecurity incidents (if any), and other relevant topics that help the committee provide effective oversight. In addition, the Board of Directors also receives an Information Security Services update on an annual basis from our Vice President of Information Security and our CIO. These updates cover a wide range of topics, including but not limited to, reviewing trends and program maturity, key metrics, current and emerging cybersecurity risks, and other cybersecurity developments.


text: We do not believe we have experienced any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial conditions, including in Fiscal 2024. However, cyber threats continue to evolve, and there can be no assurance that the actions and controls we have implemented and are implementing will be sufficient to protect our systems, information, or other property. While we maintain cybersecurity insurance to protect against potential losses arising from security incidents, the costs related to threats or disruption may not be fully insured.

stage1Category: Strategy Integration


text: We manage our exposure to cybersecurity risk using various methods designed to protect against, detect, and respond to cybersecurity threats. For example, we leverage threat intelligence to identify trends and inform our understanding of the cybersecurity risk landscape. In addition, our cybersecurity team performs regular assessments of our program and conducts penetration testing to identify, evaluate, and remediate potential threats and vulnerabilities. We also engage external resources to support in the design and implementation of certain program elements, and to assist us in the prevention, detection, monitoring, mitigation, and remediation of cybersecurity risks and incidents. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of material cybersecurity incidents, we maintain a documented incident response plan to manage cybersecurity events within our environment. The response plan includes procedures for identifying, containing, and responding to cybersecurity incidents. Our ability to respond to cybersecurity incidents is tested on a recurring basis.


text: Our cybersecurity program is led by our Vice President of Information Security and overseen by our Chief Information Officer ("CIO"). Our Vice President of Information Security, who is responsible for assessing and managing our information technology risks, including cybersecurity, joined Winnebago Industries in July 2021 and has over 25 years of experience in heavily regulated industries such as finance and healthcare. She has held multiple roles in Information Security and IT, demonstrating expertise and versatility in navigating the threat landscape of cybersecurity. Our CIO reports to our Senior Vice President – Chief Financial Officer, Investor Relations, Information Technology and Business Development, a member of our senior leadership team who reports to our President and Chief Executive Officer.


text: We do not believe we have experienced any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial conditions, including in Fiscal 2025. However, cyber threats continue to evolve, and there can be no assurance that the actions and controls we have implemented and are implementing will be sufficient to protect our systems, information, or other property. While we maintain cybersecurity insurance to protect against potential losses arising from security incidents, the costs related to threats or disruption may not be fully insured.


text: Our Board of Directors is responsible for general oversight of our risk environment and associated management policies and practices. The Board of Directors has delegated to its AOC the responsibility for oversight of our major risk categories and exposures, including with respect to cybersecurity, and management's processes to monitor and control them. The AOC meets regularly throughout the year and receives and reviews various risk management reports about IT/OT cybersecurity, data security, and physical security risk management reports, and discusses these matters with appropriate management and other personnel. The CEO and CAO regularly report to the AOC and the Board of Directors about cybersecurity matters and risks as well as the adequacy and effectiveness of the cybersecurity risk management program.

companyName: WEC ENERGY GROUP, INC.

ticker: WEC


text: To foster an enterprise-wide approach to risk management, we have established an ERSC chaired by our CEO and comprised of a cross-functional group of senior leaders from across our organization. The ERSC regularly reviews key risk areas and oversees the development and implementation of effective compliance and risk management practices, including the use of internal and external audits. Our Board of Directors and the AOC receive reports regarding the same. Governance of our cybersecurity risk management program is overseen by the ERSC, along with steering committees for information security, operational technology security, third-party vendor security controls, Sarbanes-Oxley security controls, and North American Electric Reliability Corporation Critical Infrastructure Protection compliance.


text: Our CAO is responsible for enterprise-wide information technology services and cybersecurity system strategy. In this capacity, the CAO oversees the cybersecurity risk management program, which is maintained and implemented by the Enterprise Security Director. Our CAO has 24 years of experience at the company, during which time she has held a number of management and leadership positions, including Chief Information Officer, through which she has developed expertise in our IT/OT cybersecurity, data security, and physical security environment and risk profile.


text: The Enterprise Security Director, in collaboration with her team, is responsible for IT/OT cybersecurity, data security, and physical security. The Enterprise Security Director identifies, evaluates, and facilitates mitigation of cyber, data, and physical security risks and reports on cybersecurity matters and risks to the ERSC and the AOC. Our Enterprise Security Director has over 26 years of experience in IT/OT cybersecurity, data security and physical security, and is a certified information system security professional. She is also a member of numerous state and national cybersecurity organizations.


text: Cybersecurity Risk Management Program Our cybersecurity-related risks are managed through monitoring, defense and response tools, audits and assessments of the program's effectiveness, industry collaboration, and employee training and awareness. Our cybersecurity risk management program utilizes the cybersecurity framework and maturity models from the National Institute of Standards and Technology and the United States Department of Energy to continually assess its maturity. This includes regular internal security audits and vulnerability assessments, as well as regular engagement with third-party security experts for external assessments of our security controls, including technical, physical, and social aspects. To better comprehend the scope and magnitude of any active threats to our industry and nation and their potential impact on our IT/OT systems, we communicate with other utility companies, government agencies, and other sectors of the economy concerning cybersecurity incidents. All employees are required to complete training annually regarding information security and acceptable use of corporate electronic resources. Annual role-based cybersecurity training as well as ongoing participation in a corporate phishing campaign program, is also required of employees and contractors. In addition, as part of the cybersecurity program, we have established controls and procedures to assess the adequacy of controls in place at third-party vendors to protect corporate information, including restricted and confidential restricted information we provide to third-party vendors, their employees, or authorized agents. These third-party vendors are also subject to a background investigation prior to being granted physical or electronic access to the company's private property, or physical access to customer premises on behalf of the company.


text: As part of the cybersecurity program, we have adopted a cybersecurity incident response plan (the "Plan") designed to identify, evaluate, respond to, and resolve cybersecurity incidents impacting IT/OT systems. Pursuant to the terms of the Plan, we have established a CSIRT Steering Committee which includes, among others, the Chief Financial Officer, CAO, and the Enterprise Security Director. The CSIRT Steering Committee is responsible for overseeing and implementing the Plan in the event of a cybersecurity threat or incident and provides updates regarding the status of the response to senior management, including the CEO, who provide updates and reports regarding cybersecurity incidents to the AOC and/or the Board of Directors at regularly scheduled meetings or more frequently, as needed. WEC Energy Group, Inc.


text: In response to an identified cybersecurity incident, or as it deems appropriate, the CSIRT Steering Committee will assemble and oversee a CSIRT, comprised of appropriate personnel and subject matter experts depending on the scope and severity of the incident, relevant or impacted business units and entities, and type of information or systems potentially compromised by the cybersecurity incident. When assembled, the CSIRT is responsible for developing and implementing an overall response strategy to contain, control, and remediate the cybersecurity incident, including securing our affected systems and/or information, mitigating harmful effects of the incident, preventing further compromises, and communicating information to affected parties, regulatory agencies and law enforcement, as necessary. The CSIRT may seek assistance from or engage external support providers including legal counsel, outside technology or forensic experts, investigation service providers, and others, as appropriate, to assist in the response to the incident, based on its nature and scope. Pursuant to the Plan and at the direction of the CAO, the Enterprise Security Director will conduct a post-incident remediation analysis and report findings to the CSIRT Steering Committee. The Plan is tested and reviewed at least annually.


text: We have been subject to attempted cybersecurity attacks from time to time, and will likely continue to be subject to such attempted attacks; however, these prior attacks have not had a material impact on our system or business operations. For information about cybersecurity risks to our business, see Item 1A. Risk Factors and the risk factor titled "Our operations are subject to risks beyond our control, including but not limited to, cybersecurity intrusions, terrorist or other physical attacks, acts of war, or unauthorized access to personally identifiable information." WEC Energy Group, Inc.


text: As a wholly-owned subsidiary of WEC Energy Group, our cybersecurity-related risks are managed by WEC Energy Group's cybersecurity risk management program.

companyName: WISCONSIN ELECTRIC POWER CO

ticker: WELPP


text: WEC Energy Group's Board of Directors is responsible for general oversight of the risk environment and associated management policies and practices of WEC Energy Group and its subsidiaries, including us. The WEC Energy Group Board of Directors has delegated to its AOC the responsibility for oversight of our major risk categories and exposures, including with respect to cybersecurity, and management's processes to monitor and control them. The AOC meets regularly throughout the year and receives and reviews various risk management reports about IT/OT cybersecurity, data security, and physical security risk management reports, and discusses these matters with appropriate management and other personnel. WEC Energy Group's CEO (who also serves as our CEO) and its CAO regularly report to the AOC and the WEC Energy Group Board of Directors about cybersecurity matters and risks as well as the adequacy and effectiveness of the cybersecurity risk management program.


text: To foster an enterprise-wide approach to risk management, WEC Energy Group has established an ERSC chaired by its CEO and comprised of a cross-functional group of senior leaders from across WEC Energy Group's organization. The ERSC regularly reviews key risk areas and oversees the development and implementation of effective compliance and risk management practices, including the use of internal and external audits. WEC Energy Group's Board of Directors and the AOC receive reports regarding the same. Governance of WEC Energy Group's cybersecurity risk management program is overseen by the ERSC, along with steering committees for information security, operational technology security, third-party vendor security controls, Sarbanes-Oxley security controls, and North American Electric Reliability Corporation Critical Infrastructure Protection compliance.


text: WEC Energy Group's CAO is responsible for enterprise-wide information technology services and cybersecurity system strategy. In this capacity, the CAO oversees the cybersecurity risk management program, which is maintained and implemented by the Enterprise Security Director. WEC Energy Group's CAO has 24 years of experience at the company, during which time she has held a number of management and leadership positions, including Chief Information Officer, through which she has developed expertise in WEC Energy Group's IT/OT cybersecurity, data security, and physical security environment and risk profile.


text: The Enterprise Security Director, in collaboration with her team, is responsible for IT/OT cybersecurity, data security, and physical security. The Enterprise Security Director identifies, evaluates, and facilitates mitigation of cyber, data, and physical security risks and reports on cybersecurity matters and risks to the ERSC and the AOC. The Enterprise Security Director has over 26 years of experience in IT/OT cybersecurity, data security and physical security, and is a certified information system security professional. She is also a member of numerous state and national cybersecurity organizations.


text: The Company has established clear lines of communication with key stakeholders, including executives, IT teams, employees, and customers, to ensure transparency and an effective response to cybersecurity incidents.

companyName: Dolphin Entertainment, Inc.

ticker: DLPN


text: Cybersecurity Risk Management Program Our cybersecurity-related risks are managed through monitoring, defense and response tools, audits and assessments of the program's effectiveness, industry collaboration, and employee training and awareness. WEC Energy Group's cybersecurity risk management program utilizes the cybersecurity framework and maturity models from the National Institute of Standards and Technology and the United States Department of Energy to continually assess its maturity. This includes regular internal security audits and vulnerability assessments, as well as regular engagement with third-party security experts for external assessments of WEC Energy Group's security controls, including technical, physical, and social aspects. To better comprehend the scope and magnitude of any active threats to our industry and nation and their potential impact on our IT/OT systems, we communicate with other utility companies, government agencies, and other sectors of the economy concerning cybersecurity incidents. All employees are required to complete training annually regarding information security and acceptable use of corporate electronic resources. Annual role-based cybersecurity training as well as ongoing participation in a corporate phishing campaign program, is also required of employees and contractors. In addition, as part of the cybersecurity program, WEC Energy Group has established controls and procedures to assess the adequacy of controls in place at third-party vendors to protect corporate information, including restricted and confidential restricted information we provide to third-party vendors, their employees, or authorized agents. These third-party vendors are also subject to a background investigation prior to being granted physical or electronic access to the company's private property, or physical access to customer premises on behalf of the company.


text: As part of the cybersecurity program, WEC Energy Group has adopted a cybersecurity incident response plan (the "Plan") designed to identify, evaluate, respond to, and resolve cybersecurity incidents impacting IT/OT systems. Pursuant to the terms of the Plan, WEC Energy Group has established a CSIRT Steering Committee which includes, among others, WEC Energy Group's Chief Financial Officer (who also serves as our Chief Financial Officer), CAO, and the Enterprise Security Director. The CSIRT Steering Committee is responsible for overseeing and implementing the Plan in the event of a cybersecurity threat or incident and provides updates regarding the status of the response to senior management, including WEC Energy Group's CEO, who provide updates and reports regarding cybersecurity incidents to the AOC and/or the WEC Energy Group Board of Directors at regularly scheduled meetings or more frequently, as needed.


text: In response to an identified cybersecurity incident, or as it deems appropriate, the CSIRT Steering Committee will assemble and oversee a CSIRT, comprised of appropriate personnel and subject matter experts depending on the scope and severity of the incident, relevant or impacted business units and entities, and type of information or systems potentially compromised by the cybersecurity incident. When assembled, the CSIRT is responsible for developing and implementing an overall response strategy to contain, control, and remediate the cybersecurity incident, including securing affected systems and/or information, mitigating harmful effects of the incident, preventing further compromises, and communicating information to affected parties, regulatory agencies and law enforcement, as necessary. The CSIRT may seek assistance from or engage external support providers including legal counsel, outside technology or forensic experts, investigation service providers, and others, as appropriate, to assist in the response to the incident, based on its nature and scope. Pursuant to the Plan and at the direction of WEC Energy Group's CAO, the Enterprise Security Director will conduct a post-incident remediation analysis and report findings to the CSIRT Steering Committee. The Plan is tested and reviewed at least annually.


text: We have been subject to attempted cybersecurity attacks from time to time, and will likely continue to be subject to such attempted attacks; however, these prior attacks have not had a material impact on our system or business operations. For information about cybersecurity risks to our business, see Item 1A. Risk Factors and the risk factor titled "Our operations are subject to risks beyond our control, including but not limited to, cybersecurity intrusions, terrorist or other physical attacks, acts of war, or unauthorized access to personally identifiable information."


companyName: WISCONSIN PUBLIC SERVICE CORP


text: The Chair of the Audit Committee is regularly informed of both material and non-material cybersecurity risks and incidents. The full Audit Committee is notified any time our incident response program has determined that a cybersecurity incident is material or requires reporting to a regulatory body.

companyName: CAVCO INDUSTRIES, INC.

ticker: CVCO


text: Cybersecurity Risk Management Program Our cybersecurity-related risks are managed through monitoring, defense and response tools, audits and assessments of the program's effectiveness, industry collaboration, and employee training and awareness. WEC Energy Group's cybersecurity risk management program utilizes the cybersecurity framework and maturity models from the National Institute of Standards and Technology and the United States Department of Energy to continually assess its maturity. This includes regular internal security audits and vulnerability assessments, as well as regular engagement with third-party security experts for external assessments of WEC Energy Group's security controls, including technical, physical, and social aspects. To better comprehend the scope and magnitude of any active threats to our industry and nation and their potential impact on our IT/OT systems, we communicate with other utility companies, government agencies, and other sectors of the economy concerning cybersecurity incidents. All employees are required to complete training annually regarding information security and acceptable use of corporate electronic resources. Annual role-based cybersecurity training as well as ongoing participation in a corporate phishing campaign program, is also required of employees and contractors. In addition, as part of the cybersecurity program, WEC Energy Group has established controls and procedures to assess the adequacy of controls in place at third-party vendors to protect our corporate information, including restricted and confidential restricted information we provide to third-party vendors, their employees, or authorized agents. These third-party vendors are also subject to a background investigation prior to being granted physical or electronic access to the company's private property, or physical access to customer premises on behalf of the company.


text: Our Board of Directors is responsible for general oversight of our risk environment and associated management policies and practices. The Board of Directors has delegated to its AOC the responsibility for oversight of our major risk categories and exposures, including with respect to cybersecurity, and management's processes to monitor and control them. The AOC meets regularly throughout the year and receives and reviews various risk management reports about IT/OT cybersecurity, data security, and physical security risk management reports, and discusses these matters with appropriate management and other personnel. The CEO and CAO regularly report to the AOC and the Board of Directors about cybersecurity matters and risks as well as the adequacy and effectiveness of the cybersecurity risk management program.


text: Integration with Overall Risk Management: Our cybersecurity processes have been integrated into our overall risk management system and processes. We consider cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process. Our cybersecurity risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.

companyName: NORTHWEST PIPELINE LLC


text: To foster an enterprise-wide approach to risk management, we have established an ERSC chaired by our CEO and comprised of a cross-functional group of senior leaders from across our organization. The ERSC regularly reviews key risk areas and oversees the development and implementation of effective compliance and risk management practices, including the use of internal and external audits. Our Board of Directors and the AOC receive reports regarding the same. Governance of our cybersecurity risk management program is overseen by the ERSC, along with steering committees for information security, operational technology security, third-party vendor security controls, Sarbanes-Oxley security controls, and North American Electric Reliability Corporation Critical Infrastructure Protection compliance.


text: Our CAO is responsible for enterprise-wide information technology services and cybersecurity system strategy. In this capacity, the CAO oversees the cybersecurity risk management program, which is maintained and implemented by the Enterprise Security Director. Our CAO has 25 years of experience at the company, during which time she has held a number of management and leadership positions, including Chief Information Officer, through which she has developed expertise in our IT/OT cybersecurity, data security, and physical security environment and risk profile.


text: The Enterprise Security Director, in collaboration with her team, is responsible for IT/OT cybersecurity, data security, and physical security. The Enterprise Security Director identifies, evaluates, and facilitates mitigation of cyber, data, and physical security risks and reports on cybersecurity matters and risks to the ERSC and the AOC. Our Enterprise Security Director has over 27 years of experience in IT/OT cybersecurity, data security and physical security, and is a certified information system security professional. She is also a member of numerous state and national cybersecurity organizations.


text: Cybersecurity Risk Management Program Our cybersecurity-related risks are managed through monitoring, defense and response tools, audits and assessments of the program's effectiveness, industry collaboration, and employee training and awareness. Our cybersecurity risk management program utilizes the cybersecurity framework and maturity models from the National Institute of Standards and Technology and the DOE to continually assess its maturity. This includes regular internal security audits and vulnerability assessments, as well as regular engagement with third-party security experts for external assessments of our security controls, including technical, physical, and social aspects. To better comprehend the scope and magnitude of any active threats to our industry and nation and their potential impact on our IT/OT systems, we communicate with other utility companies, government agencies, and other sectors of the economy concerning cybersecurity incidents. All employees are required to complete training annually regarding information security and acceptable use of corporate electronic resources. Annual role-based cybersecurity training as well as ongoing participation in a corporate phishing campaign program, is also required of employees and contractors. In addition, as part of the cybersecurity program, we have established controls and procedures to assess the adequacy of controls in place at third-party vendors to protect corporate information, including restricted and confidential restricted information we provide to third-party vendors, their employees, or authorized agents. These third-party vendors are also subject to a background investigation prior to being granted physical or electronic access to the company's private property, or physical access to customer premises on behalf of the company.


text: As part of the cybersecurity program, we have adopted a cybersecurity incident response plan (the "Plan") designed to identify, evaluate, respond to, and resolve cybersecurity incidents impacting IT/OT systems. Pursuant to the terms of the Plan, we have established a CSIRT Steering Committee which includes, among others, the Chief Financial Officer, CAO, and the Enterprise Security Director. The CSIRT Steering Committee is responsible for overseeing and implementing the Plan in the event of a cybersecurity threat or incident and provides updates regarding the status of the response to senior management, including the CEO, who provide updates and reports regarding cybersecurity incidents to the AOC and/or the Board of Directors at regularly scheduled meetings or more frequently, as needed.


text: In response to an identified cybersecurity incident, or as it deems appropriate, the CSIRT Steering Committee will assemble and oversee a CSIRT, comprised of appropriate personnel and subject matter experts depending on the scope and severity of the incident, relevant or impacted business units and entities, and type of information or systems potentially compromised by the cybersecurity incident. When assembled, the CSIRT is responsible for developing and implementing an overall response strategy to contain, control, and remediate the cybersecurity incident, including securing our affected systems and/or information, mitigating harmful effects of the incident, preventing further compromises, and communicating information to affected parties, regulatory agencies and law enforcement, as necessary. The CSIRT may seek assistance from or engage external support providers including legal counsel, outside technology or forensic experts, investigation service providers, and others, as appropriate, to assist in the response to the incident, based on its nature and scope. Pursuant to the Plan and at the direction of the CAO, the Enterprise Security Director will conduct a post-incident remediation analysis and report findings to the CSIRT Steering Committee. The Plan is tested and reviewed at least annually.


text: As a wholly-owned subsidiary of WEC Energy Group, our cybersecurity-related risks are managed by WEC Energy Group's cybersecurity risk management program.


text: The Company maintains various role-based access controls to safeguard data and systems. Data center assets are protected and monitored by badged key systems and video surveillance. Access is periodically reviewed and updated.

companyName: WOLVERINE WORLD WIDE INC /DE/

ticker: WWW


text: WEC Energy Group's Board of Directors is responsible for general oversight of the risk environment and associated management policies and practices of WEC Energy Group and its subsidiaries, including us. The WEC Energy Group Board of Directors has delegated to its AOC the responsibility for oversight of our major risk categories and exposures, including with respect to cybersecurity, and management's processes to monitor and control them. The AOC meets regularly throughout the year and receives and reviews various risk management reports about IT/OT cybersecurity, data security, and physical security risk management reports, and discusses these matters with appropriate management and other personnel. WEC Energy Group's CEO (who also serves as our CEO) and its CAO regularly report to the AOC and the WEC Energy Group Board of Directors about cybersecurity matters and risks as well as the adequacy and effectiveness of the cybersecurity risk management program.


text: To foster an enterprise-wide approach to risk management, WEC Energy Group has established an ERSC chaired by its CEO and comprised of a cross-functional group of senior leaders from across WEC Energy Group's organization. The ERSC regularly reviews key risk areas and oversees the development and implementation of effective compliance and risk management practices, including the use of internal and external audits. WEC Energy Group's Board of Directors and the AOC receive reports regarding the same. Governance of WEC Energy Group's cybersecurity risk management program is overseen by the ERSC, along with steering committees for information security, operational technology security, third-party vendor security controls, Sarbanes-Oxley security controls, and North American Electric Reliability Corporation Critical Infrastructure Protection compliance.


text: Wisconsin Electric Power Company WEC Energy Group's CAO is responsible for enterprise-wide information technology services and cybersecurity system strategy. In this capacity, the CAO oversees the cybersecurity risk management program, which is maintained and implemented by the Enterprise Security Director. WEC Energy Group's CAO has 25 years of experience at the company, during which time she has held a number of management and leadership positions, including Chief Information Officer, through which she has developed expertise in WEC Energy Group's IT/OT cybersecurity, data security, and physical security environment and risk profile.


text: The Enterprise Security Director, in collaboration with her team, is responsible for IT/OT cybersecurity, data security, and physical security. The Enterprise Security Director identifies, evaluates, and facilitates mitigation of cyber, data, and physical security risks and reports on cybersecurity matters and risks to the ERSC and the AOC. The Enterprise Security Director has over 27 years of experience in IT/OT cybersecurity, data security and physical security, and is a certified information system security professional. She is also a member of numerous state and national cybersecurity organizations.


text: Cybersecurity Risk Management Program Our cybersecurity-related risks are managed through monitoring, defense and response tools, audits and assessments of the program's effectiveness, industry collaboration, and employee training and awareness. WEC Energy Group's cybersecurity risk management program utilizes the cybersecurity framework and maturity models from the National Institute of Standards and Technology and the DOE to continually assess its maturity. This includes regular internal security audits and vulnerability assessments, as well as regular engagement with third-party security experts for external assessments of WEC Energy Group's security controls, including technical, physical, and social aspects. To better comprehend the scope and magnitude of any active threats to our industry and nation and their potential impact on our IT/OT systems, we communicate with other utility companies, government agencies, and other sectors of the economy concerning cybersecurity incidents. All employees are required to complete training annually regarding information security and acceptable use of corporate electronic resources. Annual role-based cybersecurity training as well as ongoing participation in a corporate phishing campaign program, is also required of employees and contractors. In addition, as part of the cybersecurity program, WEC Energy Group has established controls and procedures to assess the adequacy of controls in place at third-party vendors to protect corporate information, including restricted and confidential restricted information we provide to third-party vendors, their employees, or authorized agents. These third-party vendors are also subject to a background investigation prior to being granted physical or electronic access to the company's private property, or physical access to customer premises on behalf of the company.


text: As part of the cybersecurity program, WEC Energy Group has adopted a cybersecurity incident response plan (the "Plan") designed to identify, evaluate, respond to, and resolve cybersecurity incidents impacting IT/OT systems. Pursuant to the terms of the Plan, WEC Energy Group has established a CSIRT Steering Committee which includes, among others, WEC Energy Group's Chief Financial Officer (who also serves as our Chief Financial Officer), CAO, and the Enterprise Security Director. The CSIRT Steering Committee is responsible for overseeing and implementing the Plan in the event of a cybersecurity threat or incident and provides updates regarding the status of the response to senior management, including WEC Energy Group's CEO, who provide updates and reports regarding cybersecurity incidents to the AOC and/or the WEC Energy Group Board of Directors at regularly scheduled meetings or more frequently, as needed.


text: In response to an identified cybersecurity incident, or as it deems appropriate, the CSIRT Steering Committee will assemble and oversee a CSIRT, comprised of appropriate personnel and subject matter experts depending on the scope and severity of the incident, relevant or impacted business units and entities, and type of information or systems potentially compromised by the cybersecurity incident. When assembled, the CSIRT is responsible for developing and implementing an overall response strategy to contain, control, and remediate the cybersecurity incident, including securing affected systems and/or information, mitigating harmful effects of the incident, preventing further compromises, and communicating information to affected parties, regulatory agencies and law enforcement, as necessary. The CSIRT may seek assistance from or engage external support providers including legal counsel, outside technology or forensic experts, investigation service providers, and others, as appropriate, to assist in the response to the incident, based on its nature and scope. Pursuant to the Plan and at the direction of WEC Energy Group's CAO, the Enterprise Security Director will conduct a post-incident remediation analysis and report findings to the CSIRT Steering Committee. The Plan is tested and reviewed at least annually.


text: We have been subject to attempted cybersecurity attacks from time to time, and will likely continue to be subject to such attempted attacks; however, these prior attacks have not had a material impact on our system or business operations. For information about cybersecurity risks to our business, see Item 1A. Risk Factors and the risk factor titled "Our operations are subject to risks beyond our control, including but not limited to, cybersecurity intrusions, terrorist or other physical attacks, acts of war, or unauthorized access to personally identifiable information."


text: WEC Energy Group's CAO is responsible for enterprise-wide information technology services and cybersecurity system strategy. In this capacity, the CAO oversees the cybersecurity risk management program, which is maintained and implemented by the Enterprise Security Director. WEC Energy Group's CAO has 25 years of experience at the company, during which time she has held a number of management and leadership positions, including Chief Information Officer, through which she has developed expertise in WEC Energy Group's IT/OT cybersecurity, data security, and physical security environment and risk profile.


text: The Company measures its security posture through several third-party score-based cybersecurity tools. Scores from these tools are reviewed weekly and measure the Company's posture regarding securing applications, infrastructure, data and other assets from theft or loss, both internally and externally. Thresholds are in place for escalation to management.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: WORLD ACCEPTANCE CORP

ticker: WRLD


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program operates within the Company's overall enterprise risk management program and is aligned to the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of our overall enterprise risk, including legal, compliance, strategic, operational, and financial risk.


text: As part of its responsibility to oversee the management, business, and strategy of the Company, the Company's Board of Directors reviews and approves the Company's risk management framework annually through its Audit and Compliance Committee and oversees the Company's risk management processes by informing itself about the Company's key risks and evaluating whether management has reasonable risk management and control processes in place to address those risks.


text: Key elements of our cybersecurity risk management program include: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our Company, including its business strategies, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, may materially affect our business strategy, results of operations or financial condition. Despite our efforts, we cannot provide full assurance that our cybersecurity risk management processes will be fully implemented, complied with or effective in preventing or mitigating future cybersecurity risks. Refer to "Item 1A. Risk Factors" in this annual report on Form 10-K, including "We depend on secure information technology, and an attack on or a breach of those systems or those of third-party vendors could result in significant losses, unauthorized disclosure of confidential customer information, and reputational damage, which could materially adversely affect our business, financial condition and/or results of operations, and could lead to significant financial and legal exposure and reputational harm.", for additional discussion about cybersecurity-related risks.


text: Cybersecurity Governance Our Board of Directors and Audit and Compliance Committee oversee the Company's cybersecurity risk management program, which is operated by senior management. Our Board of Directors has delegated the primary responsibility to oversee cybersecurity matters to the Audit and Compliance Committee.


text: Both the Board of Directors and the Audit and Compliance Committee periodically review the measures we have implemented to identify and mitigate cybersecurity risks.


text: Our Vice President of Information Security is responsible for overseeing the Company's cybersecurity practices. He joined the Company in 2018 and has over 10 years of information security and cybersecurity experience. He has an undergraduate degree from Clemson University, and has obtained professional security certifications and trainings, including the Certified Information Systems Security Professional certification. In his role as Vice President of Information Security, he meets with the Audit and Compliance Committee and Board of Directors each quarter to discuss the Company's cybersecurity risk management program.


text: The cybersecurity team is led by the Vice President of Information Security and the Senior Vice President of IT. Our team is comprised of highly skilled analysts, all of whom hold professional certifications and have undergone extensive training to assist in safeguarding our sensitive customer data.


text: We strive to integrate cybersecurity into our corporate governance, engaging with expert third parties, managing third-party risks, and ensuring that both management and the Board of Directors are actively involved in overseeing and mitigating these risks.


text: We design and assess our program based on the NIST CSF. This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Key elements of our cybersecurity risk management program include: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • training and awareness programs for employees that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: Our Vice President of Information Security is responsible for overseeing the Company's cybersecurity practices. He joined the Company in 2018 and has over 10 years of information security and cybersecurity experience. He has the relevant education and professional security certifications and trainings, including the Certified Information Systems Security Professional certification. In his role as Vice President of Information Security, he meets with the Audit and Compliance Committee and Board of Directors each quarter to discuss the Company's cybersecurity risk management program.


text: Engage Third Parties on Risk Management To address the evolving nature and complexity of cybersecurity threats, the Company engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing its risk management systems. These partnerships enable the Company to leverage specialized knowledge and insights with respect to its cybersecurity strategies and processes. The collaboration with these third parties includes regular audits, threat assessments, penetration testing, and consultation on security enhancements.


text: Oversee Third-party Risk The Company recognizes that cybersecurity threats and risks are amplified with the addition of third-party digital service providers. In response, the Company implements stringent processes to oversee and manage these risks. It conducts thorough security assessments of all third-party providers before engagement and maintains ongoing monitoring to ensure compliance with its cybersecurity standards. This process is also intended to provide for the security and integrity of the Company's data that may be stored on third-party systems. The monitoring includes quarterly assessments made by the contracted Chief Information Officer, or CIO, and on an ongoing basis by its dedicated cybersecurity staff. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Identified Material Risks To date, the Company has not encountered cybersecurity challenges, risks, or breaches that have materially impaired its business strategy, operations, or its financial standing.


text: Board of Directors Oversight of Cybersecurity Material Risks – Governance The Board of Directors, or the Board, is keenly aware of the critical nature of cybersecurity risks, particularly in its business as a public utility providing a life sustaining product. The Board, in partnership with the Executive team, has created a robust cybersecurity program, with meaningful oversight measures and tools for tracking and managing cyber risks and threats. The Company understands the importance of its product and services to the communities that it serves and is dedicated to maintaining high stakeholder confidence in its operations.


text: The Audit Committee is the lead Board committee with oversight of the cybersecurity program and bears the primary responsibility for this aspect of the business. The Audit Committee is comprised of Board members with diverse professional backgrounds, such as accounting/finance, utility security, risk management, and business performance integration. The breadth of experience in this Committee enables it to be the most appropriate lead in oversight of cybersecurity risks and capability.


text: The Chief Administrative Officer and General Counsel has primary oversight of the IT Department and the cybersecurity program, with a direct reporting relationship to the President and Chief Executive Officer. The Chief Administrative Officer and General Counsel also reports to the Audit Committee at least two times per calendar year and presents a report to the Board at least once per calendar year. These briefings include both educational and program status information, including: Current cybersecurity risks, including qualitative rating based upon underlying objective measures; Status of ongoing cybersecurity initiatives and strategies;


text: Incident and response reports and lessons learned from any cybersecurity event; and Compliance report with regulatory requirements and industry standards. In addition to scheduled presentations described above, the IT Department contracted CIO, the Chief Administrative Officer and General Counsel, and the President and Chief Executive Officer maintain constant dialogue regarding emerging or potential cybersecurity risks and threats. The Chief Administrative Officer and General Counsel is in regular contact with the Audit Committee Chair related to these risks so that the oversight by the Board can be both proactive and responsive. The Audit Committee has the authority to actively participate in strategic decisions related to cybersecurity and offers guidance and approval for major initiatives. As a result, cybersecurity considerations can be integrated into the foundation of broader corporate objectives. The Audit Committee and the Board conduct an annual review of the Company's cybersecurity risk position and the effectiveness of its risk management strategies and measures. From this review at the Board level, the Company is able to identify areas where there exist improvement opportunities and can set goals for the following year.


text: Risk Management Personnel Primary responsibility for assessing, monitoring, and managing cybersecurity risks rests with the CIO, who has oversight over the IT Department, including one dedicated cybersecurity staff person and select specialized contractors. This group of contractors includes a Chief Information Security Officer, Chief Technology Officer, Cybersecurity Analysts, Network Engineers, and Network Administrators.


text: Monitor Cybersecurity Risks The cybersecurity team actively monitors for cybersecurity risks by employing the use of endpoint detection and response solutions with immediate alert notifications, vulnerability scanning solutions that proactively identify risks, and by monitoring the logs of network devices.


text: Reporting to the Board The Chief Administrative Officer and General Counsel has primary responsibility to report to the President and Chief Executive Officer and to the Board and presents with the CIO where appropriate for the content of the presentation and/or to facilitate a substantive discussion. The CIO, through the Chief Administrative Officer and General Counsel, ensures that the highest levels of the Company remain informed about the cybersecurity posture, potential risks, events, and response if they occur. Material cybersecurity matters, and significant strategic risk management processes and decisions are elevated to the Board by the Chief Administrative Officer and General Counsel, ensuring that the Board has effective and substantive oversight and may provide input and guidance on critical cybersecurity measures and issues.


text: Risk Management and Strategy The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard its information systems and protect the confidentiality, integrity, and availability of its data.


text: Managing Material Risks & Integrated Overall Risk Management The Company embraces risk management across the company, to include cybersecurity risk. This comprehensive approach ensures that cybersecurity considerations are an integral part of its decision-making processes at every level. The Company's risk management team works closely with its IT department to continuously evaluate and address cybersecurity risks in alignment with its business objectives and operational needs.


text: Incident Response Plan The Company maintains and tests its Incident Response Plan, or IRP, to appropriately document plans for identifying, prioritizing, containing, and communicating information related to an incident. The Company completes annual tabletop testing of its IRP, including a testing results review to identify opportunities for improvement.


text: Water utilities face several cybersecurity risks due to their critical role in monitoring and controlling water treatment and distribution processes and servicing customers. The key risks the Company has evaluated that could adversely impact system confidentiality, integrity, and/or availability include:


text: Unauthorized Remote Access: Vulnerabilities in remote access points can be exploited by attackers to gain control over systems, potentially disrupting water services. Malware and Ransomware: Malicious software can infiltrate systems, leading to operational disruptions, data breaches, or ransom demands. Cybercriminals can encrypt critical data and demand a ransom for its release, potentially disrupting water supply and treatment processes.


text: Insider Threats: Employees or contractors with access to systems might intentionally or unintentionally compromise security disrupting water supply and treatment processes or other utility services. Denial of Service Attacks: Attackers can overwhelm systems with traffic, rendering them unavailable and disrupting water services.


text: Unsecured Human Machine Interfaces: Without proper security measures, human machine interfaces can be accessed by unauthorized users, allowing them to view and adjust real-time system settings.


text: Outdated Technology: Many systems use legacy technology that lack modern security features, making them more susceptible to attacks affecting water services.


text: Network Segmentation Issues: Poorly segmented networks can allow attackers to move laterally within the system, increasing the potential impact of an attack and impact to water services.


text: Phishing Scams: Employees might be targeted with deceptive emails to steal sensitive information or gain unauthorized access to systems resulting in unintentional loss of data.


text: Identified Material Risks To date, the Company has not encountered cybersecurity challenges, risks, or breaches that have materially impaired its business strategy, operations, or its financial standing.


text: The Chief Administrative Officer and General Counsel has primary oversight of the IT Department and the cybersecurity program, with a direct reporting relationship to the President and Chief Executive Officer. The Chief Administrative Officer and General Counsel also reports to the Audit Committee at least two times per calendar year and presents a report to the Board at least once per calendar year. These briefings include both educational and program status information, including: Current cybersecurity risks, including qualitative rating based upon underlying objective measures; Status of ongoing cybersecurity initiatives and strategies; Maintenance and testing of the IRP;


text: Incident and response reports and lessons learned from any cybersecurity incident(s); and Compliance report with regulatory requirements and industry standards. In addition to scheduled presentations described above, the IT Department contracted CIO, the Chief Administrative Officer and General Counsel, and the President and Chief Executive Officer maintain constant dialogue regarding emerging or potential cybersecurity risks and threats. The Chief Administrative Officer and General Counsel is in regular contact with the Audit Committee Chair related to these risks so that the oversight by the Board can be both proactive and responsive. The Audit Committee has the authority to actively participate in strategic decisions related to cybersecurity and offers guidance and approval for major initiatives. As a result, cybersecurity considerations can be integrated into the foundation of broader corporate objectives. The Audit Committee and the Board conduct an annual review of the Company's cybersecurity risk position and the effectiveness of its risk management strategies and measures. From this review at the Board level, the Company is able to identify areas where there exist improvement opportunities and can set goals for the following year.


text: Risk Management Personnel Primary responsibility for assessing, monitoring, and managing cybersecurity risks rests with the CIO, who has oversight over the IT Department, including one dedicated cybersecurity staff person and select specialized contractors. This group of contractors includes a Chief Information Security Officer, IT Director, Cybersecurity Analysts, Network Engineers, and Network Administrators. The CIO, Chief Information Security Officer, and IT Director all have a minimum of ten years of experience in the cybersecurity and technology leadership field.


text: Reporting to the Board The Chief Administrative Officer and General Counsel has primary responsibility to report to the President and Chief Executive Officer and to the Board and presents with the CIO where appropriate for the content of the presentation and/or to facilitate a substantive discussion.


text: The CIO, through the Chief Administrative Officer and General Counsel, ensures that the highest levels of the Company remain informed about the cybersecurity posture, potential risks, events, and response if they occur. Material cybersecurity matters, and significant strategic risk management processes and decisions are elevated to the Board by the Chief Administrative Officer and General Counsel, ensuring that the Board has effective and substantive oversight and may provide input and guidance on critical cybersecurity measures and issues.


text: We have developed and implemented an enterprise-wide cybersecurity program designed to provide a structured and thorough cybersecurity risk management system and governance structure to assess, identify, and manage material risks from cybersecurity threats. The Company considers the following factors, among others, to assess whether adequate protections are in place to address risks from known and anticipated cybersecurity threats: likelihood and severity of risk, impact on the Company and others, including retail customers, suppliers, consumers, and/or employees, if a risk materializes; feasibility and cost of controls; and impact of controls on our operations.

companyName: Spectrum Brands Holdings, Inc.

ticker: SPB


text: Our cybersecurity program is aligned with various frameworks for managing cybersecurity risks, such as the National Institute of Standards and Technology Cyber Security Framework for IT systems and International Electrotechnical Commission 62443 which governs cybersecurity for Industrial Control Systems. Our cybersecurity program prioritizes, among other things, prevention of unauthorized access; protection of sensitive information; detection, assessment, and response to cyber threats; and continuous improvements to our cybersecurity measures. We seek to achieve our cybersecurity program priorities through a multi-pronged and -tiered approach to address cyber threats and incidents that includes implementation of various industry best practices, proactive monitoring of our IT systems, ongoing employee training, and regular risk assessments. We also maintain cyber insurance coverage to help mitigate a portion of the potential costs in the event of covered events.


text: Incident Response A cybersecurity incident response plan is in place that is designed to provide a framework across all functions for a coordinated identification and response to security incidents. The plan specifies the process for identifying, validating, classifying, documenting, and responding to cybersecurity events as well as determining whether reporting of an event is appropriate under regulatory standards. The plan also includes a materiality assessment framework that sets forth procedures to support our assessment of whether a security incident is "material" under the federal securities laws. Internal reporting and escalation protocols are in place to ensure the involvement of the CIO, other senior executive leaders, and the Audit Committee, as appropriate. Under the plan, regular tabletop exercises are conducted to test preparedness and incident response processes and provide ongoing training.


text: As part of the cybersecurity risk management program, the Company utilizes cybersecurity assessors, consultants, auditors, and other third parties to assist the internal team with network security, cloud security, endpoint security, data loss prevention, and security information and event management. In addition, the Company utilizes a variety of third-party technology, information systems, and service providers to help identify, isolate, and mitigate security incidents. The Information Security team retains external cybersecurity firms to review and provide feedback on improving our cybersecurity program, including in the areas of data protection, threat and vulnerability management, and end-point protection. Tabletop exercises are conducted to prepare for potential cyber incidents and assess preparedness and processes. Cybersecurity training is provided to users of the Company technology resources, regular simulated exercises are conducted to help recognize phishing emails and other social engineering tactics and provide various methods for users to report suspicious activity that may give rise to a cyber incident or threat. Significant results of such testing and reviews are communicated to our executive management team and our Audit Committee, as applicable, and are utilized in our cybersecurity program's continuous improvement process.


text: In response to the growing risks associated with third-party service providers, we have established review processes for assessing the technological and information security controls of our third-party suppliers to attempt to identify material cybersecurity risks associated with such providers, their IT systems, and their access to our IT systems that could significantly disrupt our operations. These processes encompass a range of measures, such as pre-engagement cybersecurity due diligence for providers who access our IT systems or information before their engagement, ongoing monitoring and evaluation of our providers, detailed examination of available System and Organization Controls attestation reports, and inclusion of relevant contractual provisions in our agreements with third-party service providers with respect to areas including cyber protections, notifications, auditing, and risk allocation.


text: To support incident response preparedness, the Company has developed a cybersecurity incident response plan and conducts an annual simulated incident exercise. The cybersecurity incident response plan addresses cybersecurity incidents that directly impact the Company or arise from the Company's use of third-party technology, information systems, and service providers. The Company also utilizes business continuity and disaster recovery plans to prepare for potential disruptions in technology that the Company relies upon. Further, the Company monitors novel and advanced cybersecurity threats and provides ongoing employee security awareness training.


text: Cybersecurity governance Our Board of Directors oversees the management of risks inherent in the operation of our business, with a focus on the most significant risks that we face, including those related to cybersecurity. The Board of Directors has delegated oversight of cybersecurity, including privacy and information security, as well as enterprise risk management to the Audit Committee. In connection with that oversight responsibility, our CIO provides the Audit Committee and the senior executive management team of the Company information and updates on a range of cybersecurity topics which may include our cybersecurity program and governance processes; cyber risk monitoring and management; the status of projects to strengthen our cybersecurity and privacy capabilities; recent significant incidents or threats impacting our operations, industry, or third-party suppliers; and the emerging threat landscape. Our head of Internal Audit also meets with our executive management team and the Audit Committee on a quarterly basis and reports on processes and activities, including applicable cyber risk management, pertinent to enterprise risk management.


text: Our enterprise-wide cybersecurity program is managed by a dedicated information security team, led by our CIO. Our CIO has more than 25 years of technology experience across various disciplines, including nearly 15 years of experience as a CISO in the financial, manufacturing, and the consumer packaged goods industries. He has led our global information security organization for almost four years. In addition to his employment experience in the cybersecurity field, our CIO has a Master of Computer Systems and a Bachelor's Degree in Accounting, and he has served on corporate and industry advisory boards related to cybersecurity, all of which have provided him with skills and experience to manage our global information security function. Our CIO regularly meets with other members of our executive team and provides relevant updates on our cybersecurity program.


text: Material Cybersecurity Risks, Threats & Incidents We actively monitor the evolving cybersecurity and geopolitical landscapes that could result in new or increased cybersecurity threat. As a global company, we routinely experience the threat of a wide variety of cybersecurity incidents. In the last three (3) fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from non-material cybersecurity incidents were minimal. However, despite our significant cybersecurity protocols and governance, we cannot assure that we will not experience any such event in the future. Any security breach or other significant disruption involving our computer networks and related systems could cause substantial costs and other negative effects, including litigation, remediation costs, costs to deploy additional protection strategies, compromising of confidential information, and reputational damage adversely affecting investor confidence. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See Item 1A. Risk Factors for further details on risks related to potential breaches of our information technology systems.


text: Cybersecurity Governance The Board of Directors (the "Board") has risk oversight responsibility for the cybersecurity and data privacy risk management programs of TMCC, which are administered directly and with assistance from the Cybersecurity Committee of the Board.

companyName: TOYOTA MOTOR CREDIT CORP


text: Cybersecurity governance Our Board of Directors oversees the management of risks inherent in the operation of our business, with a focus on the most significant risks that we face, including those related to cybersecurity. The Board of Directors has delegated oversight of cybersecurity, including privacy and information security, as well as enterprise risk management to the Audit Committee. In connection with that oversight responsibility, our Chief Information Officer ("CIO") provides the Audit Committee and the senior executive management team of the Company information and updates on a range of cybersecurity topics which may include our cybersecurity program and governance processes; cyber risk monitoring and management; the status of projects to strengthen our cybersecurity and privacy capabilities; recent significant incidents or threats impacting our operations, industry, or third-party suppliers; and the emerging threat landscape. Our head of Internal Audit also meets with our executive management team and the Audit Committee on a quarterly basis and reports on processes and activities, including applicable cyber risk management, pertinent to enterprise risk management.


text: Cybersecurity risk is the risk of adverse impacts to the confidentiality, integrity, and availability of data owned, stored, or processed by the Bank or the accompanying information systems. The number and sophistication of attempts to disrupt or penetrate our systems, and those of our suppliers — sometimes referred to as hacking, cybersecurity fraud, cyberattacks, or other similar names — continues to grow.

companyName: ZIONS BANCORPORATION, NATIONAL ASSOCIATION /UT/

ticker: ZION


text: Cybersecurity risk is overseen by the Board and the Bank's multiple lines of defense, including front-line bankers and operations teams, Enterprise Risk Management ("ERM"), and internal audit. Information security risk is managed in accordance with an established ERM framework, which includes elements such as key risk indicators, enterprise standards, controls, and self-assessments that comply with established ERM policies. These elements are regularly assessed, measured, and reported to Board-level and Bank senior management-level risk committees, and those committees review such reports.


text: As set forth in its charter, the ROC has the responsibility to review reports from management relating to enterprise-wide risk management efforts, including cybersecurity risks. As part of that oversight, the ROC performs an annual review and approval of information security policies and programs, and receives regular updates on key risk indicators, threat trends, risk remediation activities, and operational events. The ROC periodically provides reports regarding this oversight to the Board. Management uses multiple real-time and interval-based monitoring and reporting mechanisms to detect and respond to cybersecurity incidents. Documented escalation procedures are tested regularly as part of tabletop exercises and other activities and include notification to executive management during qualifying cybersecurity incidents.


text: Management positions directly responsible for assessing, measuring, and managing cybersecurity risks include the Chief Information Security Officer ("CISO") and the Chief Technology and Operations Officer ("CTOO"). The current CISO has more than 20 years of technology leadership experience, including a significant period directly leading cybersecurity efforts, and holds multiple industry certifications. The CTOO has more than 25 years of audit, risk, operations, and technology leadership experience, including prior assignments as the Bank's Chief Audit Executive and Director of Bank Operations. The CISO and CTOO regularly report information about cybersecurity risks to the Board or a committee of the Board.


text: We engage multiple independent third parties or cyber experts to assess information security programs and practices, including, but not limited to, framework maturity assessments, blind penetration testing, technology health checks, cyber skill and staffing assessments, externally facilitated tabletop exercises, external cyber legal counsel briefings, and strategic assessments. Findings from these assessments are regularly reviewed with management and the ROC. Additionally, we participate in various cybersecurity industry forums and have access to law enforcement analysis regarding current threats.


text: ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES Our supply chain risk management practices include risk assessments of suppliers, including with respect to cybersecurity. We monitor our suppliers using commercially available services that provide real-time security scoring of supplier technology services, threat intelligence, financial intelligence, geopolitical risk intelligence, and other considerations related to cybersecurity. Reviews are also regularly performed to monitor changes in suppliers' cybersecurity risk posture. Continuous threat intelligence monitoring is also performed to identify potential cybersecurity incidents involving third parties. We strive to negotiate appropriate provisions with respect to cybersecurity in our contracts with suppliers.


text: When a cybersecurity incident occurs, whether detected internally or from third-party cybersecurity incidents, we evaluate the incident for criticality and potential materiality and disclosure across a range of contributing indicators, including service availability, impact to operations, reputational impact, regulatory and legal considerations, data sensitivity, and direct financial impact. The potential impact of the incident, individually or in aggregate, is evaluated by the CISO continuously across these criteria. We have escalation procedures to notify members of senior and executive management, the Board (or an applicable subset), and regulators in a timely manner based on the criticality and materiality of the cybersecurity incident.


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. At December 31, 2023, management has assessed known cybersecurity incidents for potential materiality and disclosure using formal documented processes and has determined that there have been no material cybersecurity incidents, individually or in aggregate. We may nevertheless be unsuccessful in the future in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For additional discussion regarding cybersecurity risks, see "Cybersecurity Risk" in Risk Factors on page 19.


text: Cybersecurity risk is the risk of adverse impacts to the confidentiality, integrity, and availability of data owned, stored, or processed by the Bank or the accompanying information systems. The number and sophistication of attempts to disrupt or penetrate our systems and those of our suppliers continues to grow. These attempts are often referred to as hacking, cybersecurity fraud, cyberattacks, or other similar names.


text: ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES Cybersecurity risk is overseen by the Board and the Bank's multiple lines of defense, including front-line bankers, operations teams, Enterprise Risk Management ("ERM"), and internal audit. Information security risk is managed in accordance with an established ERM framework, which includes elements such as key risk indicators, enterprise standards, controls, and self-assessments that comply with established ERM policies. These elements are regularly assessed, measured, and reported to Board-level and Bank senior management-level risk committees, and those committees review such reports.


text: The ROC is responsible for reviewing reports from management related to enterprise-wide risk management efforts, including cybersecurity risks. As part of this oversight, the ROC conducts an annual review and approval of information security policies and programs, and receives regular updates on key risk indicators, threat trends, risk remediation activities, and operational events. The ROC regularly reports on this oversight, including cybersecurity, to the Board. Management employs multiple real-time and interval-based monitoring and reporting mechanisms to detect and respond to cybersecurity incidents, and may also engage third parties to assist in these efforts. Documented escalation procedures are regularly tested through tabletop exercises and other activities, including notification to executive management during qualifying cybersecurity incidents.


text: Management directly responsible for assessing, measuring, and managing cybersecurity risks include the Chief Information Security Officer ("CISO") and the Chief Technology and Operations Officer ("CTOO"). The current CISO has more than 20 years of technology leadership experience, including significant direct involvement in cybersecurity efforts, and holds multiple industry certifications. The current CTOO has more than 25 years of experience in audit, risk, operations, and technology leadership, including previous roles as Chief Audit Executive and Director of Bank Operations. The CISO and CTOO regularly report cybersecurity risk information to the Board or a Board committee.


text: We engage multiple independent third parties and cyber experts to assess our information security programs and practices. These assessments include, but are not limited to, framework maturity assessments, blind penetration testing, technology health checks, cyber skill and staffing assessments, externally facilitated tabletop exercises, external cyber legal counsel briefings, and strategic assessments. Findings from these assessments are regularly reviewed with management and the ROC. Additionally, we participate in various cybersecurity industry forums and have access to law enforcement analysis regarding current threats.


text: Our supply chain risk management practices include risk assessments of suppliers, particularly regarding cybersecurity. We monitor our suppliers using commercially available services that provide real-time security scoring of supplier technology services, threat intelligence, financial intelligence, geopolitical risk intelligence, and other cybersecurity-related considerations. Regular reviews are performed to monitor changes in our suppliers' cybersecurity risk posture. Continuous threat intelligence monitoring is also conducted to identify potential cybersecurity incidents involving third parties. We strive to negotiate appropriate cybersecurity provisions in our contracts with suppliers.


text: As indicated above, our management, with oversight from the Board, performs an annual ERA and cybersecurity is among the main risks identified by the ERA for Board-level oversight. Our full Board has oversight of our efforts in cybersecurity and meets regularly with our Vice President – Information Technology (three times during fiscal 2024) on our cybersecurity risks and programs. The Board is also updated as needed on cybersecurity threats, incidents, or new developments in our cybersecurity risk profile.

companyName: APPLIED INDUSTRIAL TECHNOLOGIES INC

ticker: AIT


text: Upon the occurrence of a cybersecurity incident, whether identified internally or through third-party cybersecurity notifications, we assess the incident's criticality and potential materiality and disclosure. This evaluation considers various factors, including service availability, operational impact, reputational consequences, regulatory and legal implications, data sensitivity, and direct financial impact. The CISO continuously monitors these criteria to determine the incident's potential impact, individually or in aggregate. We have established escalation procedures to promptly inform senior and executive management, the Board (or relevant subcommittees), and regulators, based on the incident's criticality and materiality.


text: At December 31, 2024, risks from cybersecurity threats, including those arising from any previous cybersecurity incidents, have not materially impacted our business strategy, results of operations, or financial condition. Management has evaluated known cybersecurity incidents for potential materiality and disclosure using formal, documented processes and has determined that there have been no material cybersecurity incidents, either individually or in aggregate. We acknowledge that future cybersecurity incidents could potentially have a material adverse effect on our organization, despite our efforts to prevent or mitigate such events. For additional discussion regarding cybersecurity risks, see "Cybersecurity Risk" in Risk Factors on page 19.


text: Risk Management and Strategy Our cybersecurity program is informed by various industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework, and our security management is ISO/IEC 27001:2022 certified. Our management, with oversight from our Board, performs an annual enterprise-wide risk assessment (ERA) to identify key existing and emerging risks. One of the main risks identified and assessed annually through this process is cybersecurity and data privacy, which remains a key focus for the Company, management, and our Board.


text: We maintain multiple layers of security designed to detect and block cybersecurity events, as well as employ a dedicated team of cybersecurity personnel and professionals, who assist our Vice President – Information Technology in helping to assess, identify, monitor, detect and manage cybersecurity risks, threats, vulnerabilities and incidents. Further, we have various processes and programs designed to manage cybersecurity risks associated with our use of third-party vendors and suppliers.


text: When we implement significant changes to our information systems, we conduct risk-based security and privacy impact assessments and deploy technical safeguards that are designed to reasonably protect our technology and information systems from cybersecurity threats. We actively monitor and proactively research potential cybersecurity threats to our information systems, and we use what we learned to evolve our security controls over time to mitigate risks posed by such threats.


text: We also engage third party service providers when deemed necessary to both expand our capabilities and capacity as well as evaluate the effectiveness of our cybersecurity program, including hosting regular table-top exercises meant to evaluate and improve the overall effectiveness of our cybersecurity program.


text: Our Incident Response Plan provides a framework for responding to cybersecurity incidents. The plan governs activities such as preparation, detection, coordination, eradication, and recovery, as well as appropriate escalations to the Company's senior management and Board and disclosure under applicable rules and regulations. The Incident Response Plan is routinely reviewed and updated as appropriate by our Vice President – Information Technology and other senior management members.


text: We provide recurring mandatory information security training (which includes cybersecurity training) to our associates based on access, risk, roles, and behaviors.


text: Overall, we implement, develop, and maintain systems and operate programs that seek to mitigate the impact of cybersecurity incidents. Because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage information systems or data on such systems, change frequently, we must continually monitor and update these systems and programs. See "Risk Factors" in Item 1A of Part I above for additional information on risks related to our business, including risks related to cybersecurity incidents and privacy and data protection.


text: Our Vice President – Information Technology leads management's assessment and management of cybersecurity risk. He reports directly to our President & Chief Executive Officer and is a member of our senior management team, providing cybersecurity updates to that group monthly, with more frequent updates as needed. Our Vice President – Information Technology has more than 35 years of experience within industrial distribution, spending the majority of which managing and maintaining information systems. In addition, our Vice President – Information Technology leads a team of individuals that focus on monitoring our information systems and data for intentional and unintentional actions that could cause harm to our information systems or the data on such systems.


text: Our Audit Committee, through their responsibilities designated to them in the Audit Committee Charter, oversees cybersecurity risk management as part of its risk oversight function and oversees management's implementation of our CRMP.

companyName: GRAHAM CORP

ticker: GHM


text: We also engage third party service providers when necessary to both expand our capabilities and capacity as well as evaluate the effectiveness of our cybersecurity program, including hosting regular table-top exercises meant to evaluate and improve the overall effectiveness of our cybersecurity program.


text: As indicated above, our management, with oversight from the Board, performs an annual ERA and cybersecurity is among the main risks identified by the ERA for Board-level oversight. Our full Board has oversight of our efforts in cybersecurity and meets regularly with our Vice President – Information Technology (three times during fiscal 2025) on our cybersecurity risks and programs. The Board is also updated as needed on cybersecurity threats, incidents, or new developments in our cybersecurity risk profile.


text: We recognize the increasing volume and sophistication of cyber threats and take our responsibility to protect the information and systems under our purview seriously. Our cybersecurity processes aim to provide a comprehensive approach to assess, identify, and manage material risks arising from these cybersecurity threats.


text: Comprehensive Cybersecurity Program: We have implemented a comprehensive cybersecurity risk management program (Cybersecurity Program) that is aligned with the National Institute for Standards and Technology Cybersecurity Framework. Our Cybersecurity Program provides a risk-based approach to cybersecurity, and security controls are tailored so that cost-effective controls can be applied commensurate with the risk and sensitivity of specific information systems, control systems and enterprise data. Our Cybersecurity Program incorporates best practices and industry standards from multiple sources and is designed to comply with applicable regulations. The Cybersecurity Program includes, but is not limited to, the following elements: risk assessment, policies and procedures, training and awareness, auditing, compliance monitoring and testing, and incident response.


text: In response to cybersecurity threats to our business, which include threats to our operations, critical infrastructure assets, information systems and data, we have developed a comprehensive cybersecurity risk management program.

companyName: ITC Holdings Corp.


text: Engagement of Third Parties: We often engage with specialized third-party assessors, consultants, auditors, and other experts to review, validate, and enhance our cybersecurity practices. Their independent assessments provide an external perspective on our cybersecurity posture, allowing us to leverage best practices from the industry and ensure our defenses remain robust. All third parties engaged for such processes are subjected to rigorous scrutiny to ensure they meet our security standards, and the engagements are documented and reviewed periodically.


text: Oversight of Third-party Service Providers: We acknowledge the potential risks associated with our use of third-party service providers. Therefore, we have established processes to oversee and identify material cybersecurity risks that may be associated with third-party service providers with whom we engage. This includes conducting thorough, risk-based due diligence before onboarding, performing security assessments, and confirming adherence to our cybersecurity requirements. We also maintain active communication channels with these providers to stay informed about any potential security incidents or concerns.


text: Disclosure of Risks: We describe how risks from cybersecurity threats, could materially affect us, including our business strategy, results of operations, or financial condition, as part of our risk factor disclosures at Part I, Item 1A of this Annual Report on Form 10-K.