text: Overall, the Company has implemented tactical processes for assessing, identifying, and managing material risks from cybersecurity threats to the company including governance at the Board level and accountability in our executive management for the execution of the Company's cyber risk management strategy and the controls designed to protect its operations. In addition, we maintain cyber insurance that is designed to protect us against certain losses related to cyber risks, and we believe the amount and scope of this insurance are customary for similarly situated companies in the telecommunications industry. See Item 1A. "Risk Factors" for additional information regarding the Company's cybersecurity risks. Those sections of Item 1A should be read in conjunction with this Item 1C.


text: Risk Management and Strategy Abbott's cybersecurity risk management process is designed to identify and assess internal and external cybersecurity threats and vulnerabilities to and within Abbott's business and operations, and analyze and prioritize risks from cybersecurity threats to inform strategies and action plans aimed at mitigating and managing these risks.

companyName: ABBOTT LABORATORIES

ticker: ABT

secItem: Item 1C


text: Abbott's cybersecurity program utilizes a variety of technical and process controls that are designed to identify, protect against, detect, respond to, and recover from cybersecurity threats, including: • dedicated cybersecurity professionals who are responsible for analyzing cybersecurity threats, defining cybersecurity policy and requirements, implementing protections, and monitoring and responding to cybersecurity incidents; • periodic cybersecurity awareness training for relevant employees and contractors on Abbott policies and emerging cybersecurity threats, including phishing awareness training; • internal and third party cybersecurity testing, including penetration testing of Abbott's information systems and hardware; • cybersecurity risk assessments for Abbott's systems and applications; • cybersecurity monitoring and response processes intended to identify, assess, escalate, investigate, contain, and remediate incidents; and • disaster recovery plans.


text: In addition, risks from cybersecurity threats are integrated into Abbott's enterprise risk management (ERM) program. The ERM program establishes a risk management framework that seeks to identify and assess risks that could materially impact Abbott's business and operations.


text: As part of Abbott's cybersecurity program, Abbott regularly engages with assessors and third party advisers to perform various services, including assessments of process design and operating effectiveness; security testing and attestation; periodic assessment of enterprise cybersecurity maturity; industry benchmarking; and thought leadership related to continuous improvement of processes, training, technology, and data.


text: Abbott's cybersecurity program also aims to identify and assess cybersecurity risks associated with its use of third party service providers with access to Abbott's systems and data, as well as such third party service providers' adherence to certain cybersecurity standards and processes. As appropriate, Abbott requires such third party service providers to agree to be subject to cybersecurity evaluations by Abbott.


text: A discussion of how Abbott's business, results of operations, and financial condition could be materially adversely affected by risks from cybersecurity threats is contained in Item 1A. Risk Factors under "Abbott depends on sophisticated information systems and maintains protected personal data, and a significant cybersecurity incident or other disruption affecting these information systems or protected personal data could have a material adverse effect on Abbott's business, financial condition and results of operations."


text: The board of directors has risk oversight responsibility for Abbott, which it administers directly and with assistance from its committees. Throughout the year, the board and its committees engage with management to discuss a wide range of enterprise risks.


text: The audit committee assists the board of directors in fulfilling its oversight responsibilities with respect to ERM, including risks from cybersecurity threats, and the steps management has taken to monitor and mitigate those risks. The audit committee receives reports semiannually from Abbott's Chief Information Officer (CIO) and Chief Information Security Officer (CISO) on Abbott's cybersecurity strategy and program. In addition, the audit committee conducts an annual review of the ERM process, including the program structure, risk assessment, and risk mitigation.


text: The public policy committee assists the board of directors in fulfilling its oversight responsibility with respect to product cybersecurity, and receives reports at least annually on this topic from the CIO and CISO.


text: The CISO leads Abbott's cybersecurity strategy and program and its cybersecurity and privacy incident response team that is responsible for monitoring the detection of cybersecurity incidents and executing Abbott's cybersecurity incident response process, as needed. Pursuant to the process, the team is responsible for the investigation and resolution of cybersecurity incidents, including reporting to an Abbott senior management-level committee on detection, mitigation, and remediation of significant cybersecurity incidents. The CISO reports to the CIO, who has overall responsibility for the cybersecurity program and organization.


text: Abbott has two cross-functional senior management-level committees that assess Abbott's material risks from cybersecurity threats – one that oversees Abbott's cybersecurity program and another that oversees the cybersecurity incident response process.


text: Risk Management and Strategy. Kellanova has established a cybersecurity program (the "program") that is designed based on reviewing industry common practices and recognized frameworks (i.e., NIST and ISO, among others). The Company works to evolve its program to address material risks from cybersecurity threats. The program is developed from a top-down strategic risk management approach.

companyName: KELLANOVA


text: The program includes processes that identify how security measures and controls are developed, implemented, and maintained, as well as cybersecurity and information security training and awareness. The program includes a risk management process designed to identify internal and external cybersecurity threats and vulnerabilities to the Company's business and operations, assess the likelihood and potential impact of the threats and vulnerabilities to the Company, and assess and prioritize the risks from cybersecurity threats and vulnerabilities to inform action plans and strategies to mitigate and manage these risks. The program's risk assessment process, based on a method and guidance from a recognized national standards organization, is conducted annually. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: recognized frameworks, likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others.


text: Third-party security firms are used in different capacities to provide or operate some of these controls and technology systems, including cloud-based services and platforms. For example, third parties are used to conduct assessments, such as vulnerability scans and penetration testing. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and performance monitoring.


text: The Company, as a part of its program has a documented cybersecurity incident response plan and conducts tabletop exercises to enhance incident response preparedness. Business continuity and disaster recovery plans are used to prepare for a potential disruption in technology we rely on. The Company is a member of cybersecurity intelligence and risk sharing organizations. Employees undergo security awareness training.

stage1Category: Risk Management Process

stage1Method: unanimous


text: The Company has an Enterprise Risk Management ("ERM") program to address enterprise risks, and cybersecurity is a risk category evaluated and identified by that function. One of the leaders of the ERM process is Kellanova's Vice President, Internal Audit, and the process includes individuals with designated areas of focus and subject matter experts across Kellanova, including cybersecurity leaders. As the enterprise risk owner for cybersecurity, the Chief Digital and Information Officer supports the Chief Information Security Officer ("CISO") and the information security team, which includes a Governance, Risk, and Compliance (GRC) function, to manage cybersecurity risk. The information security team collaborates on privacy and security governance.


text: Our computer systems have been and will likely continue to be subjected to cybersecurity threats. To date, we have not experienced a cyber security threat that has materially affected the Company, including its business strategy, results of operations, or financial conditions.


text: Additionally, in Item 1A Risk Factors under the headings of "Risks Related to Our Intellectual Property and Technology", and "Technology failures, cyber incidents, privacy breaches or data breaches could disrupt our operations or reputation and negatively impact our business", forward-looking cybersecurity threats that could have a material impact on the Company are discussed. Those sections of Item 1A should be read in conjunction with this Item 1C.


text: Governance. The Kellanova Board of Directors has risk oversight responsibility for Kellanova, which it administers directly and with assistance from its committees. Oversight of the information security program sits with the Audit Committee. The Audit Committee has oversight responsibilities with respect to ERM, including cybersecurity, information security and data protection risk exposures, and the steps management has taken to monitor and control these exposures. In addition to periodically providing the Executive Management Team with information and cybersecurity briefings, the Chief Digital and Information Officer ("CDIO") and Chief Information Security Officer ("CISO") provide at least biannual updates to the Audit Committee regarding cybersecurity, including on strategy and the Company's cybersecurity program. For cybersecurity incidents, the Company's cybersecurity incident response plan includes a process for incidents to be evaluated for material impact. The escalation protocol includes reporting of security incidents to members of the Kellanova Executive Management Team and reporting of any cyber incidents that could have a material impact on the Company to the Audit Committee.


text: As mentioned above, the CISO is the management position with primary responsibility for the development, operation, and maintenance of our information security program. The Company's CISO has work experience in various roles in risk management, including developing information and cybersecurity strategy/programs, information security audit and assessments, cybersecurity operations focused on identification, mitigation and response to cybersecurity threats. The CISO has experience leading enterprise global efforts to align systems to industry-accepted standards and practices, as well as regulatory compliance requirements. The CISO has degrees in the areas of management of information systems and cybersecurity, and also maintains several information security and technology certifications, including as a Certified Information System Security Professional ("CISSP") and Boardroom Certified Qualified Technology Expert ("QTE").


text: Our program includes controls and procedures to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner.

companyName: HUMBL, INC.

ticker: HMBL


text: The CISO reports directly to the CDIO, who is a member of the Kellanova Executive Management Team. The Company's CDIO has technology experience overseeing and executing technology strategies in complex, global, and matrixed environments. The CDIO has been in role since February 2019, bringing experience from overseeing and executing technology as European CIO at the Company, and over 20 years of experience leading IT strategy and change initiatives in the consumer packaged goods and manufacturing industries.


text: Risk Management and Strategy We have established information designed to identify, assess, and manage cybersecurity risks that could impact our critical information systems and confidential data. Our information security team employs a variety of methods to identify and evaluate material risks from cybersecurity threats, including risk and control self-assessments, vulnerability assessments and penetration testing, breach and attack simulations, ransomware table-top assessments, cyber threat intelligence reviews, as well as internal and external cybersecurity assessments.

companyName: ONITY GROUP INC.

ticker: ONIT


text: To mitigate and manage these risks, we have implemented various technical, physical, and organizational safeguards. Depending on the environment or system, these safeguards include, for example, information security policies and procedures, perimeter security controls such as firewalls and intrusion prevention systems, network security controls including multi-factor authentication and role-based access controls, and server and endpoint security controls such as anti-malware. Additionally, depending on the environment or system, we utilize certain application security controls, data security controls including encryption, data loss prevention controls, immutable data backups, and security awareness programs for our personnel.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our broader enterprise risk management strategies. Cybersecurity risks are categorized according to our enterprise risk assessment guidelines and are tracked in a centralized enterprise risk system. Cybersecurity risks are periodically reviewed by our IT Risk Committee and Enterprise Risk and Compliance Committee (discussed further below). We also engage third-party service providers for assistance in identifying, assessing, and managing cybersecurity risks. In the past, these third parties have provided us with services that include external penetration testing, cybersecurity audits, legal counsel, threat intelligence information, forensic investigations, and managed security service.


text: In addition, we have processes in place for assessing and managing cybersecurity risks associated with third-party service providers. Vendors are categorized based on a set of criteria that assess the importance of their services and the sensitivity of the information and systems they have access to. Depending on the nature of the services provided, the sensitivity of information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with the provider, such as due diligence questionnaires and periodic assessments, and we track the status of reported third party risks within our centralized risk governance framework.

stage1Category: Third-Party Risk

stage1Method: majority


text: In 2023 and 2024, cybersecurity incidents occurred involving our vendors and other contractual counterparties that did not materially and adversely impact our operations. However, we cannot assure that future third party incidents will not materially and adversely impact us. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this annual report on Form 10-K, including "Cybersecurity risks and the failure to maintain the security, confidentiality, integrity, and availability of our information technology systems or data, and those maintained on our behalf, could result in a material adverse impact to our business, including without limitation regulatory investigations or actions, a material interruption to our ability to provide services to our customers, damage to our reputation and/or subject us to costs, fines and penalties or lawsuits and otherwise adversely affect our operations."

stage1Category: Strategy Integration


text: Cybersecurity Governance Our Board of Directors addresses Onity's cybersecurity risk management as part of its general oversight function. The Risk and Compliance Committee of the Board of Directors is responsible for overseeing Onity's overall risk management processes, including cybersecurity-related risks, and receives periodic updates from the Chief Information Security Officer (CISO) concerning Onity's significant cybersecurity threats and the processes Onity has implemented to address them. The Chair of our Risk and Compliance Committee and our Lead Independent Director have each received training and certification from the National Association of Corporate Directors Cyber-Risk Oversight Program.

stage1Category: Board Governance


text: Our cybersecurity risk assessment and management processes are implemented and maintained by the CISO and the information security team. The CISO is responsible for cybersecurity staffing and maintaining an up-to-date cybersecurity policy and processes framework designed to promote a strong cybersecurity resilience, drive security awareness, and facilitate a coordinated response to cybersecurity incidents. The IT Risk Committee, which is chaired by the Chief Information Officer (CIO) and includes the CISO, Chief Risk and Compliance Officer (CRCO) and other executive leadership team members, reviews cybersecurity risks and initiatives on a periodic basis. In addition to their decades of experience and qualifications in finance and management, our CIO holds a Bachelor's Degree in Computer Engineering and Master's Degree in Computer Science, our CISO holds a Bachelor's Degree in Electronics Engineering and has completed industry certifications including Certified Information Security Auditor, Certified Information Systems Security Professional, and ISO 27001 Lead Auditor, and our CRCO has received training in financial services cybersecurity risk management for legal professionals. In addition, all Onity executives, along with employees generally, are required to refresh their cybersecurity and IT threat-recognition training annually or more frequently if circumstances warrant.

stage1Category: Management Role


text: Cybersecurity-related risk events are reported to Onity's Enterprise Risk and Compliance Committee, an executive level management committee designed to assist the Chief Executive Officer and CRCO in executing our Enterprise Risk Management Program, including with respect to cybersecurity. The Enterprise Risk and Compliance Committee provides a formal governance and oversight infrastructure for identifying and monitoring cybersecurity risks and compliance-related issues facing Onity, which includes escalation to the Risk and Compliance Committee of the Board as appropriate.


text: In addition, our cybersecurity incident response processes are designed to escalate material cybersecurity incidents to members of management as part of the enterprise level Crisis Management Framework. The CISO, CIO, CRCO and senior operating unit leaders are part of the crisis management team in an effort to promote the prompt investigation of and response to cybersecurity incidents.


text: Our management recognizes the critical importance of addressing cybersecurity threats and risks to our business and operations. Therefore, we have established a comprehensive framework to assess, respond to, and manage material risks arising from cybersecurity threats.

companyName: ARBOR REALTY TRUST INC

ticker: ABR


text: Our chief technology officer and the Cybersecurity Incident Response Team ("IRT") are responsible for assessing and managing cybersecurity risks. The IRT is comprised of individuals with expertise in information security, technology, legal and risk management. The IRT continually monitors cybersecurity incidents and potential threats. It liaises with external cybersecurity experts and industry partners to stay current on emerging threats and best practices. The diverse expertise of the IRT members enables comprehensive risk assessment and swift responses to mitigate the potential impact of breaches or other cybersecurity incidents.


text: We actively engage consultants, outside counsel and other technology experts to enhance our cybersecurity risk management processes, who perform regular assessments and evaluations of the effectiveness of our cybersecurity measures. In addition to third party engagements, we maintain rigorous oversight of cybersecurity risks associated with our use of third party service providers. Vendor management processes are employed to evaluate vendors' cybersecurity practices, assess risk position and implement measures to mitigate potential threats arising from these external relationships.


text: The Board of Directors has been designated to oversee cybersecurity risk management. Its members possess diverse expertise, which enables them to effectively evaluate the adequacy of our cybersecurity measures and challenge management's approach when necessary. The chief technology officer provides regular updates to our chief executive officer and Board of Directors on cybersecurity risks, ongoing initiatives, incidents, response activities and strategies. The Board of Directors acknowledges cybersecurity as a strategic risk and a priority for the Company. The Board of Directors is actively involved in the oversight of our cybersecurity risk management efforts, ensuring alignment with our overall business objectives.


text: Our commitment to cybersecurity resilience is rooted in the collaborative efforts between management, the IRT and the Board of Directors. We continuously strive to strengthen our cybersecurity measures to protect our systems, data, customers and stakeholders from evolving threats. To date, cybersecurity incidents and risks have not materially affected us, including our business strategy, results of operations, or financial condition.


text: We assess, identify and manage risks from cybersecurity threats through our Global Cybersecurity and Compliance Program (Cybersecurity Program). Cybersecurity risks identified in the Cybersecurity Program are integrated into our Enterprise Risk Management Program. In addition, the Cybersecurity Program seeks to incorporate consideration of cybersecurity risk into our product development, business strategy, financial planning and capital allocation decisions.

companyName: BAXTER INTERNATIONAL INC

ticker: BAX


text: The Cybersecurity Program is currently overseen by the Board of Directors (Board) and is managed by a dedicated Chief Information Security Officer (CISO), who in turn reports to the Chief Information Officer (CIO), who currently reports to the CEO. The CISO's organization has oversight responsibilities for cybersecurity strategy, policy, standards, architecture and processes for the security of our corporate and manufacturing enterprise network, information assets and medical device technologies. Our current CISO has over 20 years of experience in cybersecurity and risk and technology management, and has held numerous positions in the cybersecurity sector, including serving as Global Cyber Risk Officer at another Fortune 500 medical products and equipment company and CISO at other healthcare companies and health care delivery organizations. Our current CIO has over 30 years of experience in information technology and has served in a number of professional services leadership roles, including as CIO over the past 15 years at three companies. The CISO's organization monitors and manages, and works to identify and assess, cybersecurity risk through various technologies, resources, processes and policies that are updated as necessary to align with the changing threat landscape, our evolving business needs as well as global regulatory requirements. In addition, from time to time, we also utilize external auditors and assessors to help evaluate our Cybersecurity Program, including conducting penetration testing and vulnerability, risk and maturity assessments. We also actively engage with industry experts, regulatory agencies, advocacy groups, industry peers, intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our Cybersecurity Program and to stay abreast of the emerging cybersecurity landscape.


text: We have processes in place to identify, review and evaluate cybersecurity risks associated with our use of third-party service providers. These reviews are conducted at onboarding and periodically throughout the tenure of the service provider based on risk tier rating of each service provider. We believe these processes enable us to evaluate a third-party service provider's security posture, identify risks that may arise out of our use of the third party's service, and make decisions regarding acceptable levels of risk and risk mitigation.

companyName: Block, Inc.

ticker: XYZ


text: We use a range of defenses to help protect against cybersecurity threats and to work to secure our assets, reduce the time it takes to detect a cybersecurity threat and improve our recoverability capabilities. These defenses include the ongoing monitoring of our systems (including with the assistance of third-party vendors), conducting response and recovery exercises with employees and senior management (including our executive officers) to promote awareness of related matters and improve internal processes, and engaging with external cybersecurity rating agencies that assess our cyber risk. In addition, to help promote privacy and security awareness throughout the company, the CISO maintains a Cyber Awareness and Engagement Program. As part of this program, all employees with a Baxter email address receive annual training on the recognition and prevention of cybersecurity threats as well as training on how to report suspicious activity or potential breaches through the appropriate channels. Our Cyber Awareness team communicates cybersecurity best practices to our employees through internal communications, including the company intranet, newsletters and global virtual seminars, and also hosts ongoing cybersecurity awareness campaigns, including phishing simulations. Further, our Third-Party Risk Management Program utilizes a managed service that uses a standard framework to help identify, assess and monitor potential cybersecurity risks posed by third parties. Third-party cybersecurity risks (including reputational ones) are assessed by evaluating the third party's security practices (including those associated with data protection), compliance with applicable regulations and planning associated with business continuity and incident detection and response.


text: The Cybersecurity Program maintains a cybersecurity governance and oversight framework that seeks to drive accountability for all levels of employees, including senior management and executive officers. Cybersecurity matters are generally managed by a combination of working groups that report to the cybersecurity compliance committee and ultimately the cybersecurity executive oversight committee, as appropriate. Our cross functional cybersecurity compliance committee, which is led by the CISO, is composed of members of senior management, including the CIO, and reviews matters such as cybersecurity escalations, critical remediations and disclosure recommendations. The output from the cybersecurity compliance committee meetings is discussed at meetings of Baxter's cybersecurity executive oversight committee, which is led by the CISO and includes the CIO and other members of management.


text: In February 2024, we amended the charters of the Audit Committee and Quality and Regulatory Compliance (QRC) Committee of our Board to provide for the realignment of oversight over the company's innovation strategy and cybersecurity to the full Board, as these responsibilities now sit within the vertically integrated segments and are part of the business strategies themselves. The Board oversees information technology functions generally, including product related cybersecurity matters (which had previously been subject to the oversight of the QRC Committee). The Audit Committee is responsible for the oversight of certain significant cybersecurity incidents, including ones related to our products and services and receives related updates from management on those incidents. Consistent with this oversight responsibility, the Audit Committee is responsible for reviewing proposed disclosures in connection with any material cybersecurity incident consistent with our disclosure obligations under Item 1.05 of Form 8-K. The full Board receives periodic updates on information technology and cybersecurity matters from company management (including the CIO and CISO) and external advisors from time to time and the Audit Committee receives periodic updates (including as part of continuing director education) on the evolving cybersecurity landscape and regulatory reporting requirements.


text: The CISO maintains and annually updates a Cybersecurity Incident Response Plan which is a guide for our Cyber Security Incident Response Team and business to respond to cybersecurity incidents in a coordinated manner. Additionally, the CISO, in partnership with a third-party consultant, facilitates periodic cyber-crisis tabletop exercises with members of senior management (including our executive officers) to help us prepare for the occurrence of a significant cybersecurity event and our related response activities. Cybersecurity risks and threats, including any previous cybersecurity incidents, have not materially impacted us or our operations to date. However, we cannot provide any assurance that we will not be subject to a material cybersecurity incident in the future. See "Risks Relating to Our Operations—Breaches and breakdowns affecting our information technology systems or protected information, including from cyber security breaches and data leakage, could have a material adverse effect on our business, results of operations, financial condition, cash flows, reputation and competitive position" in Item 1A. Risk Factors of this Annual Report on Form 10-K for a discussion of cybersecurity-related risks.


text: Cybersecurity is a critical part of our enterprise risk management. The Board, through its Audit Committee, oversees enterprise risk management, including cybersecurity. To more effectively address cybersecurity threats, we have numerous security layers within our least privilege network approach which is managed by our Information Technology ("IT") department. Our cybersecurity programs align with numerous standards and continues to grow and develop as new technologies emerge. Further, we have regular user awareness testing and trainings in place which helps keep all end users and executive leadership up-to-date on the most current threats. The global head of our IT department has responsibility over cybersecurity management globally and reports directly to the Chief Financial Officer. He has degrees in both management information systems and cybersecurity - and has held a number of progressing roles, including management of global infrastructure, information security and technology operations at Balchem, in addition to managing a global team of information technology and cybersecurity experts. The IT department provides regular updates to senior management. Additionally, he provides at least an annual update, or more frequently if necessary, to both the Audit Committee and the full Board regarding the current threat landscape at Balchem, cybersecurity technologies, mitigation strategies, industry trends and best practices that we follow, major cybersecurity incidents (if any), and other areas of importance. Additional activities to maintain and enhance information security are discussed below.

companyName: BALCHEM CORP

ticker: BCPC


text: • Reliable, Scalable Systems and Infrastructure Our information security systems, infrastructure, and processes are built on and follow the U.S. National Institute of Standards and Technology ("NIST") framework for information security, which is a set of guidelines, accepted standards, and best practices for mitigating organization cybersecurity risks published by NIST. We continue to make significant investments in industry-leading and advanced technologies as part of our strategy to strengthen our security posture, business continuity capabilities, and ability to protect and safeguard systems and stakeholder data. Our Information Security Program and systems are tested and assessed annually by an independent third party. • Automation and Artificial Intelligence We have implemented automated systems to proactively test attack vectors by emulating inside and outside threats resulting in the validation of our ability to detect and defend against a cyber attack. Artificial intelligence is used as part of early warning systems designed to detect, alert, and respond to potential cyber threats. • Training


text: Recognizing that information security, stakeholder data, and privacy principles involve more than just systems and infrastructure, we provide semi-annual cybersecurity education and training to all users with access to IT systems, devices, or applications. Internal social engineering phishing campaigns are conducted regularly with the goal of building a culture of cybersecurity, as well as raising awareness and reinforcing best practices across the organization.


text: Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls.


text: We apply a risk-based approach to mitigate cybersecurity risks associated with our use of third-party service providers and cybersecurity considerations affect the selection and oversight of these third-party service providers. We perform due diligence on third parties that have access to our most critical systems, data or facilities that house such systems or data.


text: While we have experienced cybersecurity threats in the past in the normal course of business and expect to continue to experience such threats from time to time, to date, none have had a material adverse effect on our business, financial condition, results of operations or cash flows. Even with the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. "Risk Factors - Operational Risks - Disruptions or breaches of our information systems could adversely affect us" for a discussion of cybersecurity risks.


text: In the event of a possible cybersecurity incident, we would immediately implement our crisis management plan, which includes the following steps: (1) Internal reporting and review of the incident or development (2) Gathering and assessing information (3) Developing and implementing a communications strategy (4) Monitoring and evaluating a response


text: (5) Debrief and recovery As part of the gathering and assessment of information in step 2, we will consider various factors to make a materiality determination of the incident, including business impact, potential costs, impacted data, scope of the incident, possible litigation or regulatory implications, and reputational damage.


text: Risk Management and Strategy We have a cybersecurity risk management program consisting of policies and procedures for assessing, identifying, and managing material risk from cybersecurity threats, and we have integrated these policies and procedures into our overall risk management systems and processes. Our cybersecurity policies and procedures are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. We routinely assess material risks from cybersecurity threats and regularly assess and update our cybersecurity risk management program in response to emerging trends and changes in our operations.


text: Identification: We aim to proactively identify sources of risk, areas of impact, and relevant events that could give rise to cybersecurity risks, such as changes to our infrastructure, service providers, or personnel.


text: Assessment: We conduct periodic risk assessments to identify cybersecurity threats. We also conduct likelihood and impact assessments with the goal of identifying reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Management: Following our risk assessments, we design and implement reasonable safeguards to address any identified gaps in our existing processes and procedures. Our employees participate in cybersecurity training and awareness upon hire and at least annually thereafter.


text: We engage third parties, including consultants and auditors, to evaluate the effectiveness of our risk management program, control environment, and cybersecurity practices through security audits, penetration testing, and other engagements.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Board and Management's Role in Data Privacy and Cybersecurity Oversight Our board of directors recognizes the oversight of risk management as one of its primary responsibilities and central to maintaining an effective, risk-aware and accountable organization. While the board of directors maintains ultimate responsibility for the oversight of our data privacy and cybersecurity program and risks, it has delegated certain oversight responsibilities to our audit and risk committee. Our board of directors and audit and risk committee's principal role is one of oversight, recognizing that management is responsible for the design, implementation, and maintenance of an effective program for protecting against and mitigating data privacy and cybersecurity risks. The audit and risk committee assists the board of directors in enhancing its understanding of data privacy and cybersecurity issues by overseeing our data privacy and information security programs, strategy, policies, processes, and material risks, as well as overseeing responses to security and data incidents, as appropriate.


text: The full board of directors receives an annual information security update by our Chief Information Security Officer ("CISO") and an annual privacy update, which covers, among other matters, our privacy and cybersecurity programs and risks. Our audit and risk committee receives updates, at least quarterly, on significant data privacy and security risks, including any significant incidents, relevant industry developments, threat vectors and significant risks identified in periodic penetration tests or vulnerability scans. The updates also include significant legal and legislative developments concerning data privacy and security, our approach to complying with applicable law, and significant engagement with regulators concerning data privacy and cybersecurity. Our audit and risk committee provides regular updates to the board of directors on such reports.


text: Our CISO oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our data security governance, infrastructure security, product security, applied security engineering and security operations teams report directly to our CISO and provide regular updates on significant or potentially significant threats and incidents. Additionally, we have an incident response team and an incident response plan that outlines the roles and responsibilities of key personnel, including representatives from information security, compliance, and counsel, that are involved in responding to, remediating and escalating such incidents to the CISO, as appropriate. Our CISO reports directly to our Technology + Engineering Lead and indirectly to our audit and risk committee. Our CISO provides updates on significant or potentially significant threats and incidents to our Block Head and leadership team, in addition to the audit and risk committee and our board of directors as appropriate and in accordance with the processes detailed in the prior paragraph.


text: Our CISO is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our CISO has over 20 years of experience in information security, including serving as head of cybersecurity and privacy response at a global public company and information security leadership positions with the United States government. Our CISO holds undergraduate and graduate degrees in computer information systems and computer science with an information security focus and possesses various certifications, including the Information Systems Security Professional (NSTISSI No. 4011) and Information Systems Security Officer (CNSSI No. 4014) certifications.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is involved in the oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management. The Company's cybersecurity policies, standards, processes, and practices are being integrated into the Company's enterprise risk management program and are based on recognized frameworks and other applicable industry standards, including without limitation the National Institute of Standards and Technology Cybersecurity Framework 2.0, Center for Internet Security controls and American Institute of Certified Public Accountants framework. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: FARO TECHNOLOGIES INC


text: Risk Management and Strategy As part of our overall enterprise risk management approach, the Company's cybersecurity program framework is focused on the following key areas:


text: Governance: As discussed in more detail under the heading "Governance" below, the Board receives presentations and interacts with management on cybersecurity readiness.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: A determination that a cybersecurity incident has, or is reasonably likely to have, a material impact on the Company is reported by the Assessment Committee to the CEO and the Board's Audit Committee without delay. The Assessment Committee also provides a summary of all incidents that are determined to be immaterial to the Board's Audit Committee at the next scheduled meeting.

companyName: Lazard, Inc.

ticker: LAZ


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We also utilize a managed security provider (the "Security Provider") to identify and assess vulnerabilities. Our Security Provider monitors our network, conducts vulnerability scanning, provides event logging services, and raises potential and actual threats with the Company's security operations center when appropriate.


text: Incident Response Plan: The Company has established and maintains an incident response plan that governs the Company's response to a cybersecurity incident, and such plan is evaluated annually. Potentially material cybersecurity risks and incidents are escalated to management and the Board as applicable.


text: Third-Party Risk Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. On occasion, the Company engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Board and Audit Committee, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our Board and Audit Committee oversee the Company's cybersecurity risk management. Management presents to, and discusses with, the Board the security of our systems and applications. Our Chief Digital Officer ("CDO") and our Information Security Senior Director provide strategic and technical leadership for the Company's cybersecurity program and lead teams across the Company that support the cybersecurity functions. Our CDO has 30 years of experience in IT, including being accountable for IT compliance and security, and previously served as Chief Information Officer for a publicly traded company for 5 years. Our Information Security Senior Director has nearly 30 years of experience in software development and IT, and, for 17 of those years, was responsible for security, compliance and privacy. These executives regularly report to the Chief Executive Officer and Chief Financial Officer with regards to our cybersecurity program and readiness.


text: Although we experience cybersecurity incidents from time to time as part of operations, these incidents have not had, and are not reasonably likely to have, a material impact on our business strategy, results of operations or financial condition. Any breach of our security measures, or those of our third-party service providers, could result in unauthorized access to and misappropriation of our information, corruption of data or disruption of systems, operations or transactions, any of which could have a material adverse effect on our business strategy, results of operations or financial condition. See "Risk Factors" on page 13 of this Form 10-K for further discussion of the risks related to cybersecurity threats.


text: Our business is highly dependent on electronic information resources used for the collection, processing, maintenance, use, sharing, dissemination, or disposition of our and our clients' information, which we refer to as "information systems", including our computer systems, hardware, software and networks and those of our third-party vendors and service providers. Our operations rely on the secure processing, storage and transmission of confidential and other information by our information systems and those of third parties.


text: Lazard maintains a formal, robust cybersecurity and information security program that is aligned with the National Institute of Standards and Technology Cybersecurity Framework ("CSF") and integrated into our overall risk management process. Our Information Security Program, Policies and Standards are also designed to comply with the financial regulations and cybersecurity laws in the jurisdictions in which we operate. By focusing on the following four interconnected pillars, we aim to reduce the impact of cybersecurity incidents, safeguard our digital assets and foster a proactive and comprehensive approach to cybersecurity within our organization.


text: For additional information regarding how cybersecurity threats or incidents are reasonably likely to materially affect our business strategy, results of operations or financial condition, see "Risk Factors—A failure in or breach of our information systems or infrastructure, or those of third parties with which we do business, including as a result of cybersecurity incidents or threats, could disrupt our businesses, lead to reputational harm and legal liability or otherwise impact our ability to operate our business" and "Risk Factors—Other operational risks may disrupt our businesses, result in regulatory action against us or limit our growth."


text: • Risk assessments and mitigation strategies Conduct regular risk assessments to identify and prioritize critical assets and vulnerabilities, both internally and with respect to third-party risks. Develop and implement appropriate mitigation strategies based on risk assessments. Monitor and evaluate the effectiveness of risk mitigation measures. • Professional cybersecurity staff Retain and recruit skilled cybersecurity professionals. Provide regular training and development opportunities. Foster collaboration and knowledge sharing among cybersecurity team members. • Security-aware organizational culture Maintain policies and procedures for reporting and responding to cybersecurity incidents. Empower employees to take ownership of their cybersecurity responsibilities. Promote a security-aware culture throughout the organization through regular training and awareness programs. • Security technology Implement and maintain robust cybersecurity technologies, including advanced threat detection, prevention and response tools. Regularly evaluate and update our suite of cybersecurity technology to address emerging threats and vulnerabilities. Integrate cybersecurity technologies with other systems and processes.


text: Third-Party Monitoring and External Reviews As noted above, our business regularly uses and relies on third-party information systems and services to process, store and transmit confidential and other information. To support our cybersecurity oversight of third-party information technology providers, we have integrated automated processes to manage third-party cloud security. We also use an enterprise-wide third-party technology provider to assist in our identification and assessment of cybersecurity risks to the Company presented by third parties, and our contracts are vetted by our internal legal and compliance departments as part of a process designed to ensure that we are provided the right to audit and test the security and quality of each of our vendors. As part of our screening and evaluation processes, we conduct due diligence on our potential vendors, as well as regular assessments of current vendors, regarding compliance with law (including financial regulations, sanctions regimes and data privacy regulations) and cybersecurity standards, including background checks and system tests.


text: Our Chief Information Security Officer ("CISO") regularly engages independent third parties to assess the performance of our cybersecurity risk management systems and procedures and to help test and identify cybersecurity risks to the Company. Annually, we engage an independent third-party to perform a comprehensive review of our cybersecurity programs, with the aim of ensuring alignment with the current version of the CSF. In addition, we engage several other third parties at regular intervals for targeted assessments of specific cybersecurity risk management systems, tools, vendors and processes. Among other things, tests include simulations of communications shared with affected stakeholders on security events and identification of vulnerabilities. These third-party audits and assessments are used by management to review, update and improve our cybersecurity risk management systems and identify vulnerabilities. Results and recommendations are reported to our CISO, who reports to our General Counsel. Material findings are presented to the Global Risk Committee ("GRC"), Audit Committee and the full Board as discussed below.


text: Cybersecurity Management Team and Board Oversight Lazard's cybersecurity program, which includes information security, is the primary responsibility of our CISO, who oversees our global information security strategy and program and is supported by our Information Technology and Information Security departments. The Company's current CISO has held the position since 2015 and has been working in technology risk management since 1991. The CISO holds a bachelor's degree from New York Institute of Technology and is an accredited Certified Information Systems Security Professional. Our CISO leads our Cybersecurity Incident Handling Team ("CSIHT"), to which cybersecurity threats and cybersecurity incidents are reported. The CSIHT manages the Company's response to cybersecurity threats and cybersecurity incidents, including the prevention, detection, analysis, containment, eradication and recovery thereof.


text: The CISO reports monthly to the GRC, which includes our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and General Counsel, among other members of senior management, regarding cybersecurity incidents from the preceding month.


text: Our Internal Audit department regularly assesses and reports to the Audit Committee on the effectiveness of our cybersecurity and information technology controls. Our Audit Committee reviews the Company's cybersecurity risk profile and risk management strategies at regular intervals. Management reviews with the Audit Committee categories of risk the Company faces, including cybersecurity risks, as well as the likelihood of the occurrence of cybersecurity risks, the potential impact of those risks and the steps management has taken to monitor, mitigate and control such risks. In addition, our CISO reports at least annually to the Board, and at least quarterly to the Board's Audit Committee, with respect to cybersecurity risks, including those identified through review of our business, of rising threats in the industry, and of the current state of Lazard's cybersecurity program. Updates on cybersecurity risks are reviewed at regular meetings of the Audit Committee and reported to the full Board.


text: Incident Response and Assessment Policies and Procedures Lazard has implemented policies and procedures to protect the firm from any interruptions to the availability of our data and our systems and to protect the firm's and our clients' data from intentional and unintentional disclosure, including disclosure arising from a range of cybersecurity threats. These policies and procedures outline actions to be taken after identifying suspected cybersecurity threats and cybersecurity incidents and designate the persons responsible for managing those actions.


text: Our disclosure controls and procedures provide for the CSIHT to report high severity cybersecurity incidents to an Assessment Committee, consisting of our CFO, CISO and General Counsel, among others, for an assessment of materiality. The Assessment Committee in consultation with third-party experts, as warranted, makes the incident materiality determination consistent with SEC guidance.


text: Cybersecurity and Data Privacy Our commitment to cybersecurity risk management and sound governance of cybersecurity and other information security-related risks is reflected at the highest levels of our company. This commitment begins with our Board of Directors, which plays a key role in providing oversight of our business practices and related risks, while remaining informed as we evolve and new risks emerge over time.

companyName: WORLD KINECT CORP

ticker: WKC


text: Governance – Roles of our Board of Directors and Management Our Board has delegated both the Audit Committee and Technology & Operations Committee with responsibility for monitoring and oversight of the information technology and cybersecurity components of our risk assessment and risk management programs. The independent directors comprising our Audit Committee and our Technology & Operations Committee: • regularly review our cybersecurity and related information technology risks, controls and procedures, including data protection and privacy and our plans to mitigate cybersecurity risks and to respond to cybersecurity incidents; • oversee technology and operations processes that relate to or affect our internal control systems, information security, data protection and privacy, fraud and cybersecurity risks; and, • assist management in developing our risk management methodologies and the steps taken to identify, monitor and control such exposures.


text: Our Chief Information Officer ("CIO") and our Chief Information Security Officer ("CISO") are responsible for our company's overall information security activities and cyber risk programs. Our CISO reports to the CIO and leads our cyber and data-related incident response activities. Our current CIO and CISO have more than 40 years of combined experience in the digital and information technology field.


text: We have a cross-functional approach to addressing cybersecurity risk, with our information technology, legal, and internal audit functions regularly presenting to the Audit Committee and Technology & Operations Committee on key cybersecurity topics. Our CISO, together with our CIO and other members of the senior leadership in our information technology organization, also provide the Audit Committee and Technology & Operations Committee with these updates on at least a quarterly basis, and more often as needed. These reports include topics such as analyses of recent cybersecurity threats and incidents across the industry, as well as a review of our own security controls, assessments and program maturity, and risk mitigation status.


text: Cybersecurity Risk Management & Strategy We have strategically integrated cybersecurity risk management into our broader enterprise risk management program to ensure cybersecurity risks are identified, evaluated and addressed alongside our operational objectives. Overall, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of our data and information by identifying, preventing and mitigating cybersecurity threats and being prepared to effectively respond to cybersecurity incidents when they occur. As a global company, we are also committed to respecting individual privacy and complying with applicable data privacy laws throughout the world, such as the European Union's General Data Protection Regulation ("GDPR"), U.K. Data Protection Act and the California Consumer Privacy Act ("CCPA").


text: Our cybersecurity policies, standards, processes, and practices are designed to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We have achieved ISO 27001 certification. Our cybersecurity program also includes a detailed control catalog that maps to several other frameworks, providing a broad approach to managing cyber risks. However, we use NIST and other cybersecurity frameworks solely as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.


text: We conduct internal vulnerability scans, penetration tests, and breach simulation exercises, reinforcing our controls and our readiness to respond to potential threats. Recognizing the complexity and evolving nature of cybersecurity threats, we regularly engage with a range of external experts, including cybersecurity consultants, auditors and advisers, in evaluating and testing our risk management systems. Our collaboration with these third parties includes cybersecurity audits and testing, threat assessments and tabletop exercises, along with regular consultation on security enhancements.


text: We have implemented processes designed to mitigate risks related to data breaches or other security incidents originating from third parties. With our vendors, we conduct security assessments of key third-party providers before engagement and maintain ongoing monitoring to ensure their compliance with our cybersecurity standards.


text: Through our cybersecurity training program, employees and contractors are provided with cybersecurity training upon hire and thereafter on an annual basis. In addition, training and awareness campaigns continue throughout the year, where we employ various methods such as conducting mock phishing tests, live training sessions and informational articles.


text: Based on the information we have as of the date of this Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or cybersecurity incidents may not be fully insured. See Item 1A. – Risk Factors for additional information regarding cybersecurity threats.


text: Risk Management Strategy. Our cybersecurity program is focused on the following key areas: • Governance. As discussed in more detail below under "Board Oversight of Cybersecurity Risks," the Board's oversight of cybersecurity risk management is supported by the Audit Committee and Compliance and Quality Committee, each of which regularly interacts with the Company's enterprise risk management function, our Chief Technology Officer ("CTO"), Chief Information Security Officer ("CISO"), Chief Legal Officer ("CLO"), and Chief Ethics, Compliance and Risk Officer together with other members of management with responsibility for risk management and cybersecurity. • Collaborative Approach. We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards. We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. We have established and maintain incident response and recovery plans that address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. We provide regular, mandatory training for personnel regarding cybersecurity threats to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: agilon health, inc.

ticker: AGL


text: Cybersecurity Processes and Risks. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We maintain processes for identifying, assessing and managing material risks from cybersecurity threats including: • Ongoing development of our understanding of cybersecurity risk and its impact our systems, data, employees and capabilities through assessment of business context of information security, cybersecurity access management, information security governance and risk management strategy such as vulnerability assessments. • Ongoing development and implementation of appropriate technical safeguards to ensure delivery of critical infrastructure services through access control, awareness and training, data security, information protection policies and procedures, proactive maintenance and protective technology such as firewalls, intrusion prevention and detection systems, and anti-malware functionality. • Ongoing development and implementation of appropriate activities to identify the potential occurrence of a cybersecurity event and actions necessary to address a detected cybersecurity event through anomaly and event detection, continuous monitoring of information security and ongoing detection processes. • Ongoing development and implementation of appropriate activities necessary to address a potential detected cybersecurity event through incident response planning, communications, analysis and mitigation. We regularly assess and test our policies, standards, processes, and practices designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. • Ongoing development and implementation of appropriate activities to maintain plans for cybersecurity resilience, remediation of the effects of a potential cybersecurity event and restoration of any capabilities that could be potentially impaired due to a cybersecurity event through incident recovery planning and communications preparedness.


text: Our processes for identifying, assessing and managing material risks from cybersecurity threats are integrated into our overall risk management systems and processes and include cybersecurity risk assessment surveys, interviews of our personnel responsible for cybersecurity and ongoing development of cybersecurity risk mitigation plans based on program assessment.


text: We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to senior management and the Board, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: The risks from cybersecurity threats have not to date materially affected us or are not reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Like other companies in the healthcare industry that handle protected health information and companies in all industries that rely on technology to run their operations, a material cybersecurity incident could potentially impact our results of operations and financial condition. Refer to the risk factor titled "Security breaches, cybersecurity attacks, loss of data and other disruptions to our information systems could compromise sensitive information related to our business and expose us to liability, which could adversely affect our operations, financial condition, cash flows and results of operation" in Item 1A of this Report for additional information about the risks associated with cybersecurity threats.


text: Cyber Governance Board Oversight of Cybersecurity Risks. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management. Our Board, Audit Committee, and Compliance and Quality Committee provide oversight of risks from cybersecurity threats through the following activities: • Cybersecurity risk governance including high-level guidance and oversight for us gleaned from each Director's extensive senior level operational management experience; and assessment of whether risks are being appropriately considered, evaluated and managed by management. • Oversight of cybersecurity risk ownership through assessment of our requirements and resources; and identification and evaluation of cybersecurity risks impacting our business. • Oversight of our cybersecurity risk mitigation operations through deployment of information technology, assessment of our cybersecurity risk management framework and review of our programs to meet business requirements. • Our Board, Audit Committee, and Compliance and Quality Committee receive regular presentations and reports on cybersecurity risks from management that address a wide range of topics, including: • recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technical trends and information security considerations arising with respect to our peers and third parties; • integrating cybersecurity oversight into the work of the Board, Audit Committee and Compliance and Quality Committee, allocating oversight responsibilities and leveraging Director skill sets; and • the role of the Board, Audit Committee, and Compliance and Quality Committee in potential incident response and recovery. • Oversight of the management of vendor and third-party service provider cybersecurity risks. • Oversight of data governance, automated intelligence and machine learning as applied to the Company's operations. • The Board, Audit Committee, and Compliance and Quality Committee, also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Management's Role in Cybersecurity Risk Management. Our management is responsible for assessing and managing our material risks from cybersecurity threats. The CISO, CTO, and Chief Ethics, Compliance and Risk Officer work collaboratively across the company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and CTO monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee and Compliance and Quality Committee when appropriate.


text: • Our CTO and CISO lead our management of cybersecurity risks. Our CTO and CISO have a combined over 50 years of experience in managing large company technology operations and extensive expertise in the management of cybersecurity defense. • The CTO holds an undergraduate degree in computer science and a master's degree in business administration and has served in various roles in information technology for over 27 years, including serving as either the Chief Technology Officer or Chief Information Officer of large companies. The CISO has served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Security Officer of large companies. The CISO holds a CISSP certification and spent several years in law enforcement addressing computer crimes. • Our technology group management uses numerous processes to become informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Management regularly reviews the Company's cybersecurity risk management program with the Board, Audit Committee and Compliance and Quality Committee.


text: At Lucid, cybersecurity risk management is an integral part of our overall enterprise risk management program. We have made significant investments in people, processes, and technology to protect Lucid's connected vehicles, services, confidential business information, and employee and consumer personal data. We have implemented multiple and varied processes and technologies for the avoidance, identification, assessment, mitigation, and remediation of risks from cybersecurity threats and incidents designated to protect against the cybersecurity risk landscape. We regularly assess and enhance our protection, detection, response, and recovery capabilities and engage with the cybersecurity communities including Auto-ISAC, third-party cybersecurity and compliance partners, internal stakeholders, and organizations leading best practices, to support our goals and objectives. Our cybersecurity risk management program integrates multiple teams across the organization, including our IT, digital and physical product, infrastructure, and legal teams, with leadership and oversight by executive management, the Audit Committee of the Board of Directors ("Audit Committee"), and the Board of Directors ("Board").

companyName: Lucid Group, Inc.

ticker: LCID


text: To date, Lucid is not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Lucid, including our business strategy, results of operations or financial condition. See Item 1A. "Risk Factors" of this Annual Report for further information about our cybersecurity risk.


text: Board and Committee Oversight Our Board has oversight responsibility for our overall enterprise risk management and delegates cybersecurity risk management oversight to the Audit Committee. The Audit Committee oversees Lucid's policies and practices with respect to risk assessment and risk management, including discussing with management (i) Lucid's major financial, cybersecurity, privacy and other information technology risk exposures; (ii) the steps that have been taken to monitor and control such exposures; and (iii) any material cybersecurity threats or incidents. The Audit Committee and the Board receive regular reporting from Lucid's management, including the leadership of our enterprise IT security and product cybersecurity departments ("Cybersecurity Leaders") on the status of our cybersecurity program and ad hoc reporting on material cybersecurity threats and incidents.


text: Management's Role At the management level, our Information Security Steering Committee ("ISSC"), with oversight by our VP of IT and General Counsel, is responsible for leading our cybersecurity risk management program and enterprise cybersecurity matters. Under the ISSC, we have various cybersecurity working committees, led by our Cybersecurity Leaders, which are primarily responsible for operational review of cybersecurity threats and incidents as part of our incident response process. Cybersecurity Leaders receive reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents. For potentially material cybersecurity threats and incidents, we escalate these to the ISSC, which, with additional oversight and support from our interim CEO, would raise such threats and incidents to our Audit Committee Chair and, as appropriate, to our Board as they arise. If the cybersecurity incident is determined to be material, disclosure would be filed with the SEC within four business days of determination.


text: Our Cybersecurity Leaders and the dedicated personnel on their teams have industry-recognized certifications such as Certified Information Security Manager, Certified Information Systems Security Professional, and Boardroom qualified Technology Expert, and experienced information systems security professionals and information security managers with many years of technical cybersecurity management experien ce.


text: Management of Cybersecurity Risk Our Cybersecurity Risk Management Processes Our cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents by identifying and escalating risks, issues, and key decisions to management, the Audit Committee, and our Board. We designed our program to protect our products and services, confidential business information (including intellectual property), and employee and consumer data and includes steps for detecting and monitoring cybersecurity threats and incidents, assessing the severity of such threats or incidents, identifying the source of such threats or incidents, including whether such threats or incidents are associated with a third-party vendor or service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management, the Audit Committee, and our Board of potentially material cybersecurity threats and incidents. In addition, our cybersecurity team provides cybersecurity training to employees during the onboarding process and on a periodic basis thereafter, with specialized training and tabletop exercises for our core incident response teams and executive management on at least an annual basis.


text: Under the oversight of the ISSC, our cybersecurity risk management program is implemented day-to-day by our cybersecurity team, who identifies, considers, and assesses risks from cybersecurity threats and incidents on a regular basis; establishes processes to monitor such cybersecurity risks; provides mitigation and remediation measures; engages in policy review and development; provides product support and deployment; and maintains our cybersecurity program. Our cybersecurity team also implements data loss prevention tools and capabilities, customer security measures, incident response measures, and processes for management of third-party vendors and service providers. Our cybersecurity incident response is driven by our Lucid Data and Security Incident Response Plan. Based upon the severity assessment and ranking, incidents are handled by the relevant teams for technical, operational, and legal risk management.


text: In addition, Lucid has implemented processes to integrate our cybersecurity risk management processes into our overall enterprise risk management system including within our greater product management, personnel management, and third-party vendor and service provider management processes.


text: Third-Party Auditors and Consultants in Cybersecurity Risk Management Our cybersecurity team also periodically engages third-party cybersecurity experts for risk assessment and system enhancements. We utilize third-party auditors and assessors in connection with our cybersecurity risk management program to identify gaps and develop policies, procedures, and strategies designed to improve the cybersecurity program. We also use third-party consultants to obtain and will use them to maintain relevant organizational cybersecurity certifications, including UN Regulation 155 Vehicle Cybersecurity Approval. As a general matter, we have from time-to-time utilized third-party cybersecurity consultants on an ad hoc basis in specific instances, including (i) to address potential cybersecurity threats and incidents, (ii) to conduct cybersecurity assessments and penetration testing on high-value systems and applications; and (iii) to develop internal capabilities to improve our cybersecurity defense.


text: Cybersecurity Risk Management of Third-Party Vendors and Service Providers We have also implemented risk management practices designed to minimize cybersecurity risks that arise from utilizing third-party vendors and service providers that receive or have access to Lucid confidential information or personal data. In order to oversee and identify such risks, we have implemented the following processes: (i) a third-party security risk management program designed to assess security risk of new third-party vendors or service providers and develop countermeasures to manage unacceptable risks; (ii) provisions in our third-party vendors and service provider contracts with added security requirements; (iii) training procurement teams on management of third-party vendor and service providers; (iv) role-based access controls for third-party personnel; and (v) data transfer mechanisms for the sharing of data with third parties. While we are in the process of increasing the resiliency of these capabilities across the board, our control over and ability to monitor the security posture of third-party vendors and service providers remains limited and there can be no assurance that we can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. In addition, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.


text: Cybersecurity threats have become significantly more numerous and sophisticated over time, and the oil and gas industry in particular is highly targeted by malicious actors seeking to attack oil and gas infrastructure to disrupt operations. Because we are focused on mineral and royalty interests, we do not maintain any material physical infrastructure; nonetheless, being an industry participant increases our exposure to external attacks. We are committed to safeguarding our information technology systems and data and managing the risks associated with cybersecurity threats and implemented governance structures, processes, and technologies designed to prevent, detect, investigate, and mitigate any incident that could pose a cybersecurity risk.

companyName: Black Stone Minerals, L.P.

ticker: BSM


text: Our Vice President, Information Technology ("VP IT"), with support from our Information Technology Infrastructure Team ("Infrastructure Team" and, together with the VP IT, the "Cybersecurity Team"), has primary responsibility for the assessment and management of risks from cybersecurity threats. Collectively, the four members of the Cybersecurity Team have over 75 years of cybersecurity-related experience in both the private and public sectors, including perimeter and internal network security, secure email gateway, B2B and B2C eCommerce, on-premises and cloud storage environment security, and ransomware protection solutions. In addition, members of the Cybersecurity Team have multiple network-security certifications relevant to the technologies we deploy.


text: Our Board of Directors provides oversight of our enterprise-wide risk management, which includes cybersecurity risk-management, and the Audit Committee assists the Board with oversight of cybersecurity matters. The VP IT reports on cybersecurity matters to senior management on a regular basis and to the Audit Committee at least annually, and more often if needed. The Audit Committee, in turn, makes periodic reports to the Board on relevant cybersecurity matters.


text: Our VP IT, the Director of the Infrastructure Team, and our General Counsel make up the Information Security Committee, which has the initial responsibility for the assessment of and response to cybersecurity incidents consistent with our formal incident-response plan. Pursuant to the incident-response plan, more serious incidents are escalated to other senior members of management, including the Chief Executive Officer, Chief Financial Officer, and Chief Accounting Officer, as well as to the Audit Committee and our external auditors, as appropriate.


text: We maintain the following processes to assess, identify, and manage risks from cybersecurity threats: • Ongoing Threat Assessment. We maintain multiple threat intelligence subscriptions, and we monitor relevant cybersecurity resources on an ongoing basis to identify and anticipate potential threats to our network infrastructure. • Layered Security. We use multiple tiers of security as part of our efforts to reduce our exposure to cyberattacks. We leverage and maintain perimeter network defense solutions to discourage network-intrusion attempts. Within our network, we leverage endpoint security and ransomware detection and prevention solutions, and we use continuous monitoring of alerts and activities to identify and respond to any irregularities that could be associated with threats. • Training and Awareness. We conduct awareness training for our employees as part of our efforts to enable them to identify and report cybersecurity threats. We require cybersecurity training during employee and contractor onboarding, and we seek to reinforce the training through phishing tests on at least a quarterly basis as part of our efforts to reduce the potential for successful phishing and social-engineering attacks. • Cybersecurity Tool and Processes and Industry Standards. We refer to industry standards, such as those issued by National Institutes of Standards and Technology ("NIST") and International Organization for standardization ("ISO"), as part of our efforts to maintain best practices across our environment and we use various cybersecurity tools and processes designed to manage cybersecurity threats including network and systems authentication, network and infrastructure architecture security, endpoint security, and operating system patching. • Third-Party Network Security Assessments. We engage a third-party consultant to conduct external penetration testing at least annually. Our cybersecurity processes are adjusted as needed based on the results of these assessments. The assessment results are reported to the Audit Committee and Board, and our external auditor reviews our cybersecurity solutions and posture on at least an annual basis. • Third-Party Risk Management. We conduct information-security assessments before allowing sensitive data to be hosted by third parties. We also ensure SOC-1 or SOC-2 compliance for our third party providers, including our banking, payroll, and stock-plan administration relationships.


text: While we and our service providers have experienced cybersecurity incidents in the past, as of the date of this Annual Report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operation, or financial condition. For more information regarding the risks we face, please read Part I, Item 1A. "Risk Factors—General Risk Factors—Various security risks, including cybersecurity threats, data breaches, and other disruptions, could significantly affect us."


text: The Company's cybersecurity measures are primarily focused on ensuring the security and protection of its IT systems and data. The Company's information security program is managed by a dedicated Chief Information Security Officer (CISO), whose group is responsible for leading enterprise-wide cybersecurity risk management, strategy, policy, standards, architecture, and processes. The CISO has worked in the cybersecurity and national security fields for more than 30 years. He has a Master of Science in Telecommunications and Computers. He has served as a board member of the Health Information Sharing and Analysis Center for 10 years. Oversight of the information security program has been integrated into the Company's overall enterprise risk management program.

companyName: Merck & Co., Inc.

ticker: MRK


text: The CISO provides periodic reports to the Audit Committee (Audit Committee) of the Board of Directors (Board), the full Board, as well as to the Company's Chief Executive Officer and other members of senior management, as appropriate. These reports include updates on the Company's cybersecurity risks and threats, the status of projects intended to strengthen its information security systems, assessments of the information security program (including remediation, mitigation, and management of identified vulnerabilities), and the emerging threat landscape. The information security program is regularly evaluated by internal and external consultants and auditors with the results of those reviews reported to senior management and the Audit Committee, which is comprised entirely of independent directors and has oversight responsibility for these risks.


text: The Company's information security group monitors the Company's information systems to prevent, detect, mitigate, and remediate cybersecurity incidents. The Company uses tools and techniques to continually assess and monitor, manage and mitigate cybersecurity threats to its IT systems in a manner consistent with industry practice. The Company engages with key vendors, industry participants, and intelligence and law enforcement communities as part of its continuing efforts to obtain current threat intelligence, collaborate on security enhancements, and evaluate and improve the effectiveness of its information security program. As part of this program, the Company conducts periodic tabletop and red-teaming exercises to assess its cybersecurity incident response processes and defenses. The Company also maintains vendor management diligence and oversight processes to identify and monitor potential risks from cybersecurity threats attendant to its use of third-party service providers. Additionally, the Company monitors cybersecurity threat intelligence received from key third-party service providers associated with the Company.


text: In the event of a cybersecurity incident, the Company has a process in place whereby members of the information security group will alert the CISO and the CISO will alert the appropriate levels of management, including an incident assessment team, as well as the legal and finance departments so that the materiality of any such event can be assessed in furtherance of fulfilling any reporting requirements. If warranted, senior management will notify the Audit Committee or the full Board, as appropriate.


text: The Company has been and continues to be the target of cyber-attacks and network disruptions. To date, the risks posed by such cybersecurity threats have not materially affected the Company and its business strategy, results of operations and financial condition, and as of the date of this report, the Company is not aware of any material risks from cybersecurity threats that are reasonably likely to do so, but there can be no assurance that the Company will not be materially affected by such risks in the future. For further information, see Item 1A. "Risk Factors — The Company is increasingly dependent on sophisticated software applications and computing infrastructure. The Company continues to be a target of cyber-attacks that could lead to a disruption of its worldwide operations, including manufacturing, research and sales operations."


text: Board of Directors, through the Audit Committee, has primary oversight of responsibility for cybersecurity risks. Cybersecurity matters are reviewed at least annually, or more frequently if needed, in connection with strategic planning and risk management discussions.

companyName: Eva Live Inc

ticker: GOAI


text: Risk Management and Strategy. The Company manages cybersecurity risk as part of our overall enterprise risk management strategy, overseen by the Audit Committee and the Board of Directors. The Company has developed an information security program to address material risks from cybersecurity threats. The program includes processes identifying how security measures and controls are developed, implemented, and maintained.

companyName: WK Kellogg Co


text: Our cybersecurity processes align with the National Institute of Standards and Technology (NIST CSF) Framework. The Company conducts regular risk assessments on systems and applications to help detect potential risks, threats, and vulnerabilities. Additionally, annual assessments are conducted to evaluate the effectiveness of controls. Risk assessment, risk-based analysis, and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Several controls are employed to differing extents, encompassing but not restricted to endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring utilizing security information and event management (SIEM), multi-factor authentication (MFA), firewalls, intrusion detection, and prevention, as well as vulnerability and patch management.


text: Third-party security firms are used in different capacities to provide or operate some of these controls and technology systems. For example, third parties conduct assessments, such as vulnerability scans, penetration testing, and overall risk assessments, and third-party tools are utilized to identify potential vulnerabilities. The Company employs a variety of processes to address cybersecurity threats related to third-party technology and services, including privacy, solution and vendor risk assessments, imposition of contractual obligations, and performance monitoring. The Company also currently relies on services provided by Kellanova, under the Transition Service Agreement.


text: To support our preparedness, the Company has a written incident response preparedness plan that we update as business needs and the security landscape change. In the event of a cybersecurity incident, our incident response team refers to the plan, and the Company conducts tabletop exercises to enhance incident response preparedness. The plan sets out clear response procedures on how to define roles, categorize incidents, determine materiality, record responses, comply with regulatory standards, assist in public disclosure, and defines the process for assessing impact for materiality purposes. It is designed to enable a prompt, uniform, and efficient strategy to reduce the financial, operational, legal, and reputational risks associated with cybersecurity incidents. Business continuity and disaster recovery plans are used to prepare for the potential disruption of technology we rely on. The Company has implemented a user awareness program to enhance cybersecurity measures. These include phishing, malware, data handling, device security, cybersecurity education, password security, internet browsing and defenses to physical threats. As part of our overall risk mitigation strategy, the Company also maintains cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related breaches.


text: The Company (or third parties it relies on) may not be able to fully, continuously, and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement, and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks and events, when detected by security tools or third parties, may not always be immediately understood or acted upon. For further discussion of these risks, see "Risk Factors—Risks Related to Our Intellectual Property and Technology—Technology failures, cyber-attacks, privacy breaches or data breaches could disrupt our operations or reputation and negatively impact our business."