text: Protective Operations includes the Security Operations Center, cyber threat intelligence, offensive security, and application security teams. New cybersecurity threats surface daily, and existing cybersecurity threats evolve constantly. Our 24x7x365 in-house Security Operations Center is organized to not only monitor for signs of intrusion but also to provide contextual threat intelligence to system and platform owners across the enterprise, empowering them to take an active role in defending the enterprise. The Security Operations Center conducts daily briefings, identifies emerging cyber threats affecting the financial and education sectors, and reviews new tactics, techniques, and procedures utilized by cyber criminals and nation-state cyber actors. The Security Operations Center is also our incident response team, and ensures that the Company is prepared to detect, analyze, contain, eradicate, and recover from cyber incidents. While we have experienced cybersecurity incidents in the past, to date none have materially affected us, including our business strategy, results of operations, or financial condition. Our offensive security team conducts continuous threat-based and risk-based red team activities, and our application security team utilizes a combination of training, tools, code reviews, and awareness to ensure that our applications are developed with security at the forefront. We also engage with professional cybersecurity firms to conduct penetration tests on specific systems and applications annually. For more information about the cybersecurity risks we face, see the factors set forth under the caption "Risk Factors" in Part I, Item 1A of this report.


text: The ERM program inventories and classifies key risk areas. We employ a methodology for scoring the risks based on the probability and impact of individual risks and discuss and implement countermeasures to address the risks.

companyName: TransDigm Group INC

ticker: TDG

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: Posture Management includes the vulnerability management, log operations, and architecture and engineering teams. Our vulnerability management team conducts regular scans of our enterprise to look for potential weaknesses and configuration-related issues. Based on the results of these scans, this team routinely patches or works with system and platform owners to resolve identified vulnerabilities. Our log operations team works closely as a bridge between the system owners and our Security Operations Center by ensuring that activities on our systems and applications are logged and monitored. Our architecture and engineering team manages security appliances and provides security architecture advice and consulting to our information technology and delivery teams throughout the enterprise. When it comes to posture management, our goal is not just to reactively resolve potential vulnerabilities discovered through the vulnerability management process; we also look for ways to ensure that vulnerabilities don't materialize through minimizing system ports, protocols, and services to only that which is necessary.

companyName: NELNET INC

ticker: NNI

stage1Method: majority


text: Governance, Risk, and Compliance includes the risk management and compliance management teams. This team manages the security awareness program, compliance with cyber and privacy regulations, security policies, and prioritizes potential cyber risks that require ongoing monitoring or remediation. Identified risks are brought to the Cyber Risk Steering Committee for treatment. The Chief Security Officer chairs the committee, which consists of the Deputy Chief Security Officer, cybersecurity managers, various subject matter experts, and (as needed) members of management from operational areas of the business.


text: The Company's business segments and support teams also work closely with cybersecurity and enterprise risk management to monitor and manage third-party risks. Managing third-party risks includes maintaining a close and effective working relationship with the information technology procurement, accounting, and legal teams. In addition to identifying risks as part of the third-party selection process, we continuously monitor our third parties using products and services that provide us insight into their attack surface, threats that can impact us through them, and real-world security posture.

stage1Category: Third-Party Risk


text: Audits are an important part of our layers of defense; they can help us to identify areas in which we have incomplete coverage or ineffective placement of controls. The Company has an independent internal audit team that conducts audits based on their own methodology and assessment and we utilize external cybersecurity auditors, where applicable. In addition, certain lines of business utilize other third-party cybersecurity auditors for PCI DSS assessments and PCI ASV scans; and we are routinely audited by our customers.


text: The Company's Board of Directors and Board Risk and Finance Committee oversee our integrated enterprise risk management and cybersecurity programs. The Board Risk and Finance Committee receive regular reports from the Chief Risk Officer and Chief Security Officer on key company risks and emerging threats. These reports also include cybersecurity monitoring and threat response metrics, industry trends and educational materials, risk mitigation strategies, regulatory requirements, corporate policies, third-party risk metrics, cybersecurity tools and resources, incident response plans, and other areas of importance.

stage1Category: Board Governance


text: The Company's enterprise-wide cybersecurity program is embedded within and integrated with the enterprise risk management function. The Chief Security Officer is part of our senior leadership team and reports to the Chief Risk Officer. Our Chief Security Officer has over thirty years of cybersecurity, technology, and leadership experience both as a career active-duty military cyber operations officer and in the private sector. The cybersecurity team is organized into three departments: Protective Operations, Posture Management, and Governance, Risk, and Compliance. Each of the three departments identifies, assesses, and manages material cybersecurity threats through specific approaches as further described below.


text: Protective Operations includes the Security Operations Center, cyber threat intelligence, offensive security, and application security teams. New cybersecurity threats surface daily, and existing cybersecurity threats evolve constantly. Our 24x7x365 in-house Security Operations Center is organized to not only monitor for signs of intrusion but also to provide contextual threat intelligence to system and platform owners across the enterprise, empowering them to take an active role in defending the enterprise. The Security Operations Center conducts daily briefings, identifies emerging cyber threats affecting the financial and education sectors, and reviews new tactics, techniques, and procedures utilized by cyber criminals and nation-state cyber actors. The Security Operations Center is also our incident response team, focused on detecting, analyzing, containing, eradicating, and recovering from cyber incidents. While we have experienced cybersecurity incidents in the past, to date none have materially affected us, including our business strategy, results of operations, or financial condition. Our offensive security team conducts continuous threat-based and risk-based red team activities, and our application security team utilizes a combination of training, tools, code reviews, and awareness designed to ensure that our applications are developed with security at the forefront. We also engage with professional cybersecurity firms to conduct penetration tests on specific systems and applications annually. For more information about the cybersecurity risks we face, see the factors set forth under the caption "Risk Factors" in Part I, Item 1A of this report.


text: Based on the information we have as of the date of this Annual Report on Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For further information about risks related to cybersecurity threats, refer to Item 1A. "Risk Factors."

stage1Category: Strategy Integration


text: Posture Management includes the vulnerability management, log operations, and architecture and engineering teams. Our vulnerability management team conducts regular scans of our enterprise to look for potential weaknesses and configuration-related issues. Based on the results of these scans, this team routinely patches or works with system and platform owners to resolve identified vulnerabilities. Our log operations team works closely as a bridge between the system owners and our Security Operations Center by logging and monitoring activities on our systems and applications. Our architecture and engineering team manages security appliances and provides security architecture advice and consulting to our information technology and delivery teams throughout the enterprise. When it comes to posture management, our goal is not just to reactively resolve potential vulnerabilities discovered through the vulnerability management process; we also look for ways to prevent vulnerabilities through minimizing system ports, protocols, and services to only that which is necessary.


text: The Company's Board of Directors and Board Risk and Finance Committee oversee our integrated enterprise risk management and cybersecurity programs. The Board Risk and Finance Committee receives regular reports from the Chief Risk Officer and Chief Security Officer on key company risks and emerging threats. These reports also include cybersecurity monitoring and threat response metrics, industry trends and educational materials, risk mitigation strategies, regulatory requirements, corporate policies, third-party risk metrics, cybersecurity tools and resources, incident response plans, and other areas of importance.


text: We have established a risk-based cybersecurity and information security program ("program") designed to assess, identify, and manage material risks from cybersecurity threats. Our cybersecurity risk management process includes policies that specify the requirements for technical security controls, monitoring systems, tools and services from third-party providers, and employee training and awareness. Our cybersecurity risk management process also includes regular independent audits across our operating units. Management oversees our cybersecurity risk management process in order to assess and manage material risks from cybersecurity threats identified by both internal and external threat intelligence. Our program monitors and evaluates risks from cybersecurity threats, and we aim to adapt our program and related processes accordingly. As adopted by our businesses, which has been overseen by our corporate executive team, we have a cybersecurity incident response plan that outlines our policies and procedures for managing a cybersecurity incident. Our businesses are required to conduct regular exercises of their incident response plan as part of our program.


text: The multi-layered framework on which our cybersecurity and information security program is built incorporates cybersecurity standards and certain requirements of the National Institute of Standards and Technology ("NIST") Special Publication 800-171—Protecting Controlled Unclassified Information in Non-Federal Systems and Organizations—along with other legal and regulatory requirements. However, this does not mean that we meet any particular technical standards, specifications, or requirements, but rather that we use NIST and other cybersecurity standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity and information security program is led by the Company's Vice President of Cybersecurity ("VPoC") who reports to our Chief Financial Officer. Our VPoC has served as a technology leader of cybersecurity, information security, infrastructure, and operational functions for over 35 years. The VPoC is supported by the Incident Response Team ("IRT"), a management committee made up of the Co-Chief Operating Officers, Chief Financial Officer, and executives in legal, finance, IT, and audit. The IRT supports the VPoC in assessing and managing risks from cybersecurity threats and in the event of a cybersecurity incident, provides oversight and leadership with respect to incident response.

stage1Category: Management Role


text: Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: UNIVERSAL TECHNICAL INSTITUTE INC

ticker: UTI


text: We have established a risk-based cybersecurity and information security program ("program") designed to assess, identify, and manage material risks from cybersecurity threats. Our cybersecurity risk management process includes policies that specify the requirements for technical security controls, monitoring systems, tools and services from third-party providers, and employee training and awareness. Our cybersecurity risk management process also includes regular independent audits across our operating units. Management oversees our cybersecurity risk management process in order to assess and manage material risks from cybersecurity threats identified by both internal and external threat intelligence. Our program monitors and evaluates risks from cybersecurity threats, and we aim to adapt our program and related processes accordingly.


text: As adopted by our businesses, which has been overseen by our corporate executive team, we have a cybersecurity incident response plan that outlines our policies and procedures to identify, respond to, and recover from cybersecurity threats and cybersecurity incidents. Our businesses are required to conduct regular exercises of their incident response plan as part of our program.


text: In the event of a potentially material cybersecurity incident, as determined by the VPoC with support from legal, as needed, the IRT is notified through an established escalation protocol. The Chair of the Audit Committee is also notified and briefed, and meetings of the Audit Committee and/or full Board of Directors would be held as appropriate. We maintain a relationship with third-party forensic vendor(s) available for incident response and investigation. Additionally, we maintain cybersecurity insurance.


text: The Company's Board of Directors oversees our enterprise risk management ("ERM") program and has delegated the primary responsibility for its oversight, which includes oversight of cybersecurity risk, to the Audit Committee. The Audit Committee is informed of material risks from cybersecurity threats through regular discussion with management regarding cybersecurity risk mitigation and cybersecurity incident management. Executive management, including our VPoC, regularly presents to the Audit Committee regarding cybersecurity matters, including program updates, key metrics, and developments.


text: The ERM program inventories and classifies key risk areas. We employ a methodology for scoring the risks based on the probability and impact of individual risks and discuss and implement countermeasures to address the risks.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: DOCUSIGN, INC.

ticker: DOCU


text: Our cybersecurity risk management program is guided by industry standards developed by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO"), and other relevant organizations.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and utilizes common reporting channels and governance processes that apply across other risk areas. While everyone at our company plays a part in managing cybersecurity risks, as discussed in more detail under "Cybersecurity Governance" below, our board of directors, both directly and through delegation to our Audit Committee (the "Audit Committee"), and our senior management team are actively involved in the oversight of our cybersecurity risk management program. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Our cybersecurity risk management and strategy includes: • Our dedicated Security team, which performs periodic risk assessments to identify and assess cybersecurity threats, vulnerabilities, their severities, and potential mitigations. The team leverages both top-down and bottom-up risk processes and technologies to identify, manage and monitor cyber threats and vulnerabilities. The team also manages our response to cybersecurity incidents. • Incident Response Playbooks and Standard Operating Procedures ("SOP") outlining procedures for detecting, responding to, and mitigating cybersecurity incidents. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the board of directors. • The use of external service providers, where appropriate, to assess, test or otherwise assist with certain aspects of our security controls and processes, as well as maturity assessments of our cybersecurity program. • Implementation of new hire and annual data privacy and cybersecurity training of all employees, including senior management; annual role-based training of employees with specific access to systems, devices, or locations, and targeted cybersecurity simulation training held on a recurring basis. • A third-party risk management process that identifies and mitigates cybersecurity threats associated with our use of third-party service providers. Such service providers are subject to risk tiering, security risk assessments, continuous monitoring including investigation of security incidents that have impacted our third party service providers, as applicable.


text: We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. While we have experienced cybersecurity incidents in the past, we believe our current processes, systems and oversight with respect to the management of risks associated with cybersecurity threats are effective. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding the risks we face from cybersecurity threats see "Risk Factors."


text: Cybersecurity Governance Securing the information of our customers, employees, contractors, and third party service providers is important to us. We have adopted physical, technological, and administrative controls on data security, and have defined procedures for data incident detection, containment, response, and remediation. While everyone at our company plays a part in managing these risks, oversight responsibility is shared by our board of directors, our Audit Committee, and management. Accordingly, our management team provides regular cybersecurity updates to our board of directors and regular updates on cyber risk management to the Audit Committee. We also maintain information security risk insurance coverage.


text: We have recently also established a Security Governance Council ("Council") that provides strategic guidance for the protection of our information, technology, and physical assets, including the definition of security risks and the prioritization of the implementation of associated controls. The Council membership is led by the Chief Information Security Officer ("CISO") and includes relevant senior executives and has begun to meet at least quarterly, and will reconvene on an emergency basis when necessary to respond to potentially material cybersecurity incidents. The CISO reports to the Chief Information Officer ("CIO") and is responsible for management of cybersecurity risks and the protection and defense of our networks, systems and data. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Our CISO has over 20 years of experience in IT and Information Security across security architecture, incident response, and threat intelligence programs. Our CISO also holds a bachelor's degree in computer science and maintains Certified Information Systems Security Professional ("CISSP") certification.


text: Members of executive leadership are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described herein, including the operation of our incident response plan. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to members of executive leadership, and the Audit Committee. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: Our cybersecurity risk management program is guided by industry standards developed by the NIST, the International Organization for Standardization ("ISO"), and other relevant organizations.


text: Our board of directors recognizes the importance of maintaining the trust and confidence of our customers, clients, business partners and employees. Our board of directors, through the Audit Committee, oversees our cybersecurity program as part of our enterprise-wide approach to risk management. Our cybersecurity policies, standards, processes and practices are fully integrated into our risk management approach and are based on recognized frameworks established by the National Institute of Standards and Technology. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and utilizes common reporting channels and governance processes that apply across other risk areas. While everyone at our company plays a part in managing cybersecurity risks, as discussed in more detail under "Cybersecurity Governance" below, our board of directors, both directly and through delegation to our Audit Committee (the "Audit Committee"), and our senior management team are actively involved in the oversight of our cybersecurity risk management program. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach by engaging teams across the business. We expect these teams to operate pursuant to our Standard Operating Procedures. Our approach is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur through shared processes.


text: Our cybersecurity risk management and strategy includes: • Our dedicated Security team, which performs periodic risk assessments to identify and assess cybersecurity threats, vulnerabilities, their severities, and potential mitigations. The team leverages both top-down and bottom-up risk processes and technologies to identify, manage and monitor cyber threats and vulnerabilities. The team also manages our response to cybersecurity incidents. • Incident Response Playbooks and Standard Operating Procedures ("SOP") outlining procedures for detecting, responding to, and mitigating cybersecurity incidents. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the board of directors. • The use of external service providers, where appropriate, to assess, test or otherwise assist with certain aspects of our security controls and processes, as well as maturity assessments of our cybersecurity program. • Implementation of new hire and annual data privacy and cybersecurity training of all employees, including senior management; annual role-based training of employees with specific access to systems, devices, or locations, and targeted cybersecurity simulation training held on a recurring basis. • A third-party risk management process that identifies and mitigates cybersecurity threats associated with our use of third-party service providers. Such service providers are subject to risk tiering, security risk assessments, continuous monitoring including investigation of security incidents that have impacted our third-party service providers, as applicable.


text: We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. While we have experienced cybersecurity incidents in the past, we believe our current processes, systems and oversight with respect to the management of risks associated with cybersecurity threats are effective. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding the risks we face from cybersecurity threats see "Risk Factors. "


text: Cybersecurity Governance Securing the information of our customers, employees, contractors, and third-party service providers is important to us. We have adopted physical, technological, and administrative controls on data security, and have defined procedures for data incident detection, containment, response, and remediation. While everyone at our company plays a part in managing these risks, oversight responsibility is shared by our board of directors, our Audit Committee, and management. To facilitate coordinated supervision of cybersecurity matters, our management team provides regular cybersecurity updates to our board of directors and regular updates on cyber risk management, which include development regarding our cybersecurity program, broader cybersecurity trends, evolving industry standards, the threat environment and other topics, to the Audit Committee. Together with management, our Audit Committee and board of directors consider this information in their review of our cybersecurity risks and response to data breaches. We also maintain information security risk insurance coverage.


text: We have recently also established a Security Governance Council ("Council") that provides strategic guidance for the protection of our information, technology, and physical assets, including the definition of security risks and the prioritization of the implementation of associated controls. The Council membership is led by the Chief Information Security Officer ("CISO") and includes relevant senior executives and has begun to meet at least quarterly, and will reconvene on an emergency basis when necessary to respond to potentially material cybersecurity incidents. The CISO reports to the Chief Information Officer ("CIO") and is responsible for management of cybersecurity risks and the protection and defense of our networks, systems and data. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Our CISO has over 20 years of experience in IT and Information Security across security architecture, incident response, and threat intelligence programs. Our CISO also holds a bachelor's degree in computer science and maintains Certified Information Systems Security Professional certification.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our board of directors and Audit Committee by CIO, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our board of directors, through the Audit Committee, oversees our enterprise-wide approach to risk management, including the risks arising from cybersecurity threats. Our Audit Committee regularly receives presentations and reports on cybersecurity risks, which address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to our third party partners. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, our Audit Committee discusses our approach to cybersecurity risk management with management.


text: Our Audit Committee, in connection with management led by CIO, works collaboratively across our Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our Information Security Team monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management when appropriate.


text: Our CIO holds an undergraduate degree in Business Administration and has served in various roles in Information Technology for over 15 years and has been overseeing the cybersecurity program for 5 years. Our VP information Security hold an undergraduate degree in Information Systems Security and has served in various roles in cybersecurity for over 15 years. Our Chief Executive Officer, interim Chief Financial Officer, and Chief Legal Officer each hold undergraduate and/or graduate degrees in their respective fields, and each has experience managing risks at our Company and at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity Threats To date, we are not aware of any cybersecurity threats, including as a result of previous cybersecurity incidents, that are reasonably likely to have a material effect on us, our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us.


text: Risk Management and Strategy As one of the critical elements of enterprise-wide approach to risk management, our cybersecurity program is focused on the following key areas:


text: Governance: As discussed in more detail under the heading "Governance" below, our cybersecurity program is overseen by our Chief Information Officer ("CIO"), who reports to our Chief Executive Officer ("CEO"), and is responsible for publishing cybersecurity policies and standards, conducting annual risk assessments and maintaining our compliance. Our CIO regularly reports to our Audit Committee on the status of the cybersecurity program.


text: Collaboration: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments, certifications, audits and cybersecurity threat intelligence.


text: Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our board of directors and Audit Committee by our CIO, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our Audit Committee, in connection with management led by our CIO, works collaboratively across our Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our Information Security Team monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management when appropriate.


text: Our CIO holds a graduate degree in Business Administration and has more than 23 years of experience across technology roles, including the past three years overseeing cybersecurity programs. Our Vice President of Information Security holds a bachelor's degree in Information Systems Security and brings over 15 years of experience in cybersecurity leadership roles. Our CEO, Chief Financial Officer, and Chief Legal Officer each hold undergraduate and/or graduate degrees in their respective fields, and each has experience managing risks at our Company and at similar companies, including risks arising from cybersecurity threats.


text: Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, end users, business partners, stockholders and employees. Our board of directors is actively involved in oversight of our risk management program, and information and product security represent an important component of our overall approach to enterprise risk management ("ERM"). Our risks from cybersecurity threats are considered in conjunction with other risks in our ERM program. In addition, we leverage a cybersecurity-specific risk assessment process and strategy based on the NIST Cybersecurity Framework to manage risks to organizational operations and assets, individuals and other organizations associated with the operation and use of systems. Risk assessments are periodically conducted to identify threats and vulnerabilities, and then used to determine the likelihood and impact for each risk using a qualitative risk assessment methodology. In general, we seek to address cybersecurity risks through a broad, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Fortinet, Inc.

ticker: FTNT


text: Third-Party Risk Management: We maintain a broad, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In addition, our Trusted Supplier Program is designed to ensure manufacturing partners undergo a selection and qualification process that adheres to NIST 800-161.


text: The Audit Committee of our board of directors (the "Audit Committee") is responsible for reviewing with management our cybersecurity and other information technology risks, controls and processes, including the processes used to prevent or mitigate cybersecurity risks and respond to cybersecurity events. Our executives with responsibility over cybersecurity provide quarterly reports to the Audit Committee as well as to the Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program and the emerging threat landscape. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Audit Committee. We also actively engage with key vendors, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. The Audit Committee also receives prompt and timely information regarding any cybersecurity threat or incident that meets established reporting thresholds, as well as ongoing updates regarding any such threat or incident until it has been mitigated, resolved or otherwise addressed.


text: We believe our systems and processes with respect to the management of risks associated with cybersecurity threats are adequate. We have experienced, and may in the future experience, adverse impacts to our operations as a result of cybersecurity incidents. However, to date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business strategy, operating results, and/or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see our risk factors, including our risk factor titled "If our internal enterprise IT networks, on which we conduct internal business and interface externally, our operational networks, through which we connect to customers, vendors and partners systems and provide services, or our research and development networks, our back-end labs and cloud stacks hosted in our data centers, colocation vendors or public cloud providers, through which we research, develop and host products and services, are compromised, public perception of our products and services may be harmed, our customers may be breached and harmed, we may become subject to liability, and our business, operating results and stock price may be adversely impacted."


text: Risk Management and Strategy As one of the critical elements of our overall ERM approach, our cybersecurity program is focused on the following key areas:


text: Governance: As discussed in more detail above under the heading, "Governance," our board of directors' oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with executives with responsibility for cybersecurity, our Chief Executive Officer, Chief Technology Officer and President, Chief Financial Officer, Chief Operating Officer/General Counsel and other members of management. Management is promptly updated regarding any significant security events and the Audit Committee regularly reviews updates from our information security and product security leaders about cyber threat response preparedness, security controls and procedures, security program maturity milestones, risk and approaches to risk mitigation and the current and emerging threat landscape. In addition, all members of our board of directors receive management's cybersecurity updates to the Audit Committee as part of their regular attendance at meetings of our board of directors.


text: Collaborative Approach: We have implemented a broad, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. In addition, we manage a cross-functional program across our engineering, manufacturing and technical services teams, together with our suppliers and channel partners, designed to ensure the proper security of our products from design through manufacture and shipment.


text: Information Security: We implement organizational, administrative and technical measures based on commercially reasonable procedures using: (i) industry standard information security measures prescribed for use by NIST; (ii) security measures aligned with the ISO/IEC 27000 series of standards, (iii) Sarbanes-Oxley and SSAE 18/ISAE 3402; (iv) privacy regulations such as the GDPR and the CCPA; (v) business continuity management measures aligned with the ISO/IEC 22301 standard; and (vi) other generally recognized industry standards, in each case, designed to safeguard the confidentiality, integrity, and availability of our infrastructure and data and the resiliency of our operations.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Education and Awareness: We provide regular, mandatory training for personnel and contractors regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats and to communicate our evolving information security policies, standards, processes and practices.


text: Incident Response and Recovery Planning: We have established and maintains broad incident response and recovery plans that help enable its effective and orderly management of, and response to, any identified security incidents, including escalation and internal and external-notification steps, allowing the incident response team to respond in a timely manner and enlist appropriate personnel and third-party experts. We maintain a process to promptly assess and assign severity levels to any identified security incidents in order to prioritize their importance and promptly direct resources to those issues of potentially greater impact. The notification plan establishes steps to alert external stakeholders as appropriate, including law enforcement, regulatory bodies, investors, customers and other business partners.


text: Education and Awareness: We provide regular, mandatory training for personnel and contractors regarding cybersecurity threats as a means to equip Fortinet personnel with effective tools to address cybersecurity threats and to communicate Fortinet's evolving information security policies, standards, processes and practices.


text: Risk and Readiness Assessments: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to identify vulnerabilities and weaknesses, address cybersecurity threats and test its readiness to respond to cyber security incidents. These efforts include a wide range of activities, including threat modeling, a variety of vulnerability and configuration scans, penetration testing, audits, tabletop exercises and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness and penetration tests. The results of such assessments, audits and reviews are reported to the Audit Committee and our board of directors and to our management, and we adjust its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. Insurance: We maintain information security risk insurance coverage.


text: Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, end users, business partners, governmental entities, stockholders and employees. Our board of directors is actively involved in oversight of our risk management program, and information and product security represent an important component of our overall approach to enterprise risk management ("ERM"). Our risks from cybersecurity threats are considered in conjunction with other risks in our ERM program. In addition, we leverage a cybersecurity-specific risk assessment process and strategy based on the NIST Cybersecurity Framework to manage risks to organizational operations and assets, individuals and other organizations associated with the operation and use of systems. Risk assessments are periodically conducted to identify threats and vulnerabilities, and then used to determine the likelihood and impact for each risk using a qualitative risk assessment methodology. In general, we seek to address cybersecurity risks through a broad, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: As a global cybersecurity provider, cybersecurity risk management is integral to our company. Historically, the Audit Committee of our board of directors (the "Audit Committee") was responsible for reviewing with management our cybersecurity and other information technology risks, controls and processes, including the processes used to prevent or mitigate cybersecurity risks and respond to cybersecurity events. However, due to the importance of cybersecurity to our company, in July 2024, our board of directors formed Cybersecurity Committee of our board of directors (the " Cybersecurity Committee "), which is solely dedicated to cybersecurity risk management. Our executives with responsibility over cybersecurity, including our Chief Information Security Officer, provide quarterly reports to the Cybersecurity Committee as well as to the Chief Executive Officer and other members of our senior management as appropriate. Each member of our board of directors is invited to attend all meetings of the committees of our board of directors, including the Cybersecurity Committee, and thus all of the members of our board of directors are apprised of cybersecurity developments. The quarterly reports to the Cybersecurity Committee include updates on cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program and the emerging threat landscape. Our cybersecurity program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Cybersecurity Committee. We also actively engage with key vendors and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. The Cybersecurity Committee also receives prompt and timely information regarding any cybersecurity threat or incident that meets established reporting thresholds, as well as ongoing updates regarding any such threat or incident until it has been mitigated, resolved or otherwise addressed.


text: Risk and Readiness Assessments: We engage in the periodic assessment and testing of our policies, standards, process es and practices that are designed to identify vulnerabilities and weaknesses, address cybersecurity threats and test its readiness to respond to cyber security incidents. These efforts include a wide range of activities, including threat modeling, a variety of vulnerability and configuration scans, penetration testing, audits, tabletop exercises and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness and penetration tests. The results of such assessments, audits and reviews are reported to the Cybersecurity Committee and our board of directors and to our management, and we adjust its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. Insurance: We maintain information security risk insurance coverage.


text: We believe our systems and processes with respect to the management of risks associated with cybersecurity threats are adequate. We have experienced, and may in the future experience, adverse impacts to our operations as a result of cybersecurity incidents. However, to date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business strategy, operating results, and/or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see our risk factors, including our risk factor titled "If our internal enterprise IT networks, on which we conduct internal business and interface externally, our operational networks, through which we connect to customers, vendors and partners systems and provide services, or our research and development networks, our back-end labs and cloud stacks hosted in our data centers or PoPs, colocation vendors or public cloud providers, through which we research, develop and host products and services, are compromised, public perception of our products and services may be harmed, our customers may be breached and harmed, we may become subject to liability, and our business, operating results and stock price may be adversely impacted."


text: Governance: As discussed in more detail above under the heading, "Governance," our board of directors' oversight of cybersecurity risk management is supported by the Cybersecurity Committee, which regularly interacts with executives with responsibility for cybersecurity, our Chief Executive Officer, Chief Technology Officer and President, Chief Financial Officer, Chief Operating Officer/General Counsel, our CISO, and other members of management. Our CISO is primarily responsible for our cybersecurity risk management program and partners with our legal team on data privacy matters at the management level. Our CISO, Dr. Carl Windsor, has over 25 years of experience in various technology and cybersecurity leadership positions, including over 18 years at our company driving product security and strategy and reports to the board Cybersecurity Committee. The CISO's leadership team members are all seasoned information security professionals, covering a wide range of security disciplines, who have worked at some of the largest well-known brand names and are experts in their fields. Our CISO monitors, and participates in, our various cybersecurity policies and procedures, and our cybersecurity team regularly updates our CISO on the current status.


text: Management is promptly updated regarding any significant security events and the Cybersecurity Committee regularly reviews updates from our CISO, information security and product security leaders about cyber threat response preparedness, security controls and procedures, security program maturity milestones, risk and approaches to risk mitigation and the current and emerging threat landscape. In addition, all members of our board of directors receive management's cybersecurity updates to the Cybersecurity Committee as part of their regular attendance at meetings of our board of directors.


text: Incident Response and Recovery Planning: We have established and maintain broad incident response and recovery plans that help enable its effective and orderly management of, and response to, any identified security incidents, including escalation and internal and external-notification steps, allowing the incident response team to respond in a timely manner and enlist appropriate personnel and third-party experts. We maintain a process to promptly assess and assign severity levels to any identified security incidents in order to prioritize their importance and promptly direct resources to those issues of potentially greater impact. The notification plan establishes steps to alert external stakeholders as appropriate, including law enforcement, regulatory bodies, investors, customers and other business partners.


text: We recognize the importance of identifying, assessing and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Two Hands Corp

ticker: TWOH


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT controls, governance, risk and compliance reviews.


text: We describe whether and how risks from cybersecurity threats are reasonably likely to materially affect us, including our results of operations and financial condition, under the heading " The Company's failure to protect personal information adequately and breaches in cyber security and data protection could have an adverse effect on its business. " in Item 1A, " Description of Risk Factors" of Part I of this report.

stage1Category: None/Other


text: We believe we maintain an information technology and cybersecurity program appropriate for a company our size, taking into account our operations and risks. We are committed to cybersecurity and vigilantly protecting all our resources and information from unauthorized access. Our cybersecurity approach incorporates external resources to manage and monitor the evolving threat landscape, effective board oversight of cybersecurity risks and knowledgeable teams responsible for preventing and detecting cybersecurity risks.


text: The Company maintains a comprehensive approach to cybersecurity and data protection, based on a risk-based, defense-in-depth strategy. We regularly assess industry best practices and standards and endeavor to implement them in our efforts to manage cybersecurity risk. We follow industry standard cybersecurity frameworks, including the National Institute of Standards and Technology's Cybersecurity Framework, to design, assess and update our cybersecurity strategy, controls and processes. Our focus is on protecting our highest-value information assets, which include manufacturing systems, financial systems, and confidential, personal, and private information.

companyName: WESTLAKE CORP

ticker: WLK


text: To safeguard our networks and systems, we have a dedicated cybersecurity organization overseen by our Chief Information Security Officer, which operates within our information technology department overseen by our Chief Information Officer. Our cybersecurity organization employs multiple security controls, such as firewalls, spam protection, web filtering, endpoint detection and response software, controlled access, vulnerability management, redundancies, patching, and regular onsite and offsite backups. Our cybersecurity organization also uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and risk-based performance monitoring.


text: Both our Chief Information Officer and our Chief Information Security Officer have extensive experience in assessing and managing cybersecurity risks, including decades of collective experience in information technology and cybersecurity roles of increasing responsibility both at the Company and in prior positions. We prioritize cybersecurity awareness among our employees and contractors through various training exercises, including formal programs and simulated phishing events. We maintain incident response plans, playbooks, and engage third-party cybersecurity firms for simulated cyberattacks and penetration testing to identify potential risks. We also have a third-party cybersecurity firm on retainer for incident assistance and response. Periodic internal self-assessments are conducted by our cybersecurity organization using the National Institute of Standards and Technology Cybersecurity Framework.


text: From time to time, we experience cybersecurity threats and attempted breaches and other incidents. We classify and track these events based on significance and implement remediation actions that we consider appropriate to address the risks relating to such incidents. Although we have not experienced material impacts to our business strategy, results of operations or financial condition from any such incidents in the past three years, we cannot guarantee that a material incident will not occur in the future. Refer to "Failure to adequately protect critical data and technology systems could materially affect our operations" under "Item 1A. Risk Factors—Legal, Government and Regulatory Risks" of this Form 10-K.


text: Our Board has charged the Corporate Risk and Sustainability Committee with assisting the Board with its oversight of cybersecurity risks, which is a component of our overall enterprise risk management program. The Corporate Risk and Sustainability Committee includes directors with cybersecurity experience and expertise, primarily through supervision of information technology departments as executive officers. The Corporate Risk and Sustainability Committee receives regular updates from senior management and our Chief Information Officer on cybersecurity risks, incidents and trends, and ongoing and planned projects. Regular status reports are also provided by the cybersecurity organization to our Chief Information Officer and other members of our senior management and incident updates are reported to senior management as the Chief Information Officer and cybersecurity organization considers appropriate depending on the severity of the incident.


text: As part of our incident response planning, we also maintain cross-functional response teams involving personnel outside of our cybersecurity organization, both globally and regionally, in order to be prepared to respond to an incident.


text: To our knowledge, we have not experienced any risks from cybersecurity threats or incidents through the date of this annual report that have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operation or financial condition. This does not guarantee that future incidents or threats will not have a material impact or that we are not currently the subject of an undetected incident or threat that may have such an impact.

companyName: GRAN TIERRA ENERGY INC.

ticker: GTE


text: We have policies, procedures, and processes for assessing, identifying, and managing cybersecurity risks, which are defined and managed by Cimpress' central security and privacy team and are designed to help protect our information assets and operations from internal and external cyber threats and secure our networks and systems. Our cybersecurity processes include procedural and technical safeguards, response plans, regular vulnerability and penetration tests on our systems, incident simulations, and routine reviews of our policies and procedures to identify risks and improve our practices. Our cybersecurity incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to assess the severity of, escalate, contain, investigate, and remediate incidents as well as to comply with applicable legal obligations. We have security policies that apply to all employees worldwide, and we conduct annual employee trainings on data protection, cybersecurity, and incident prevention, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use, and mobile security. In addition to our internal penetration testing and vulnerability management program, we engage an external party to simulate attacks on our systems to test our defenses and response. We also use a third-party vendor risk assessment platform to score vendors' cybersecurity vulnerabilities and provide suggested mitigations.

companyName: CIMPRESS plc

ticker: CMPR


text: Cybersecurity risk is integrated into our Global Risk Management process. Cybersecurity risk continues to be identified as one of our key enterprise risks. Risk owners from the Management Committee, senior leadership and the Global Risk Management function have been assigned to develop risk mitigation plans, which are tracked and reported at least quarterly to the Finance and Risk Committee of the Board and annually to the Board. See "Item 1 – Business – Global Risk Management" for more information on the Global Risk Management function.

companyName: ASSURANT, INC.

ticker: AIZ


text: The Audit Committee of our Board of Directors oversees cybersecurity risk and receives regular updates from our Vice President and Chief Security and Privacy Officer on these risks, risk management activities, incident response plans, best practices, the effectiveness of our security measures, and other related matters. Our Vice President and Chief Security and Privacy Officer, who reports to our Chief Technology Officer, leads our central security and privacy team, which works in partnership with each of our businesses and the corporate center to measure security maturity and risk and provides managed security services in a way that allows each business to address their unique challenges and become more efficient in using their resources. We have processes and policies for the escalation of cybersecurity incidents to the central security team, evaluation of the materiality of the incidents, and coordination of our response as needed across businesses and operations. Our Chief Security and Privacy Officer has more than 20 years of privacy and data security experience, including a series of roles in Cimpress over the last 15 years, the last two and a half years of which have been spent leading the central security and privacy team.


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. See Part I, Item 1A, Risk Factors, in this Annual Report for a discussion of cybersecurity risks.


text: The Company currently does not have operations in which the internet is utilized. Once operations commence we will contract with a data center that is current on their cyber security policies and practices.

companyName: Real Brands, Inc.


text: The Company's board of directors oversees, among other things, the adequacy and effectiveness of the Company's ability to assess, identify, and manage material risks from cybersecurity threats. Management has been informed as to the need to be constantly aware of the possibility of cybersecurity breaches and to inform the board of directors immediately upon receipt of any information with respect to an actual or even a potential breach. In such event, evaluation of the degree of the breach will be made and third-party experts consulted and/or retained, as necessary, to address any such situation. As a technology-based company, management believes that the security it currently has in place to protect its proprietary information, and that the personal information of its employees and customers, is sufficient and appropriate for its current level of business activities.

companyName: WORLDS INC

ticker: WDDD


text: This is a fluid situation and management and the board of directors intends to meet periodically to assess the adequacy of the then-current status and determine if any additional steps are indicated.


text: As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition.


text: We face a multitude of cybersecurity threats from a range of adversaries. Our vendors, clients, distributors and other third parties with whom we work face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business, operations, financial condition and results of operations.


text: The Board has ultimate oversight of cybersecurity risk. The Board reviews management's assessment of our key enterprise risks and its strategy with respect to each risk, including cybersecurity risks, and receives a corresponding risk management update annually. The Information Technology Committee reviews the effectiveness of our cybersecurity controls and procedures, including procedures to identify and assess internal and external risks from cybersecurity threats; controls to prevent and protect from cyberattacks, unauthorized access or other malicious acts and risks; procedures to detect, respond to, mitigate negative effects from and remediate cybersecurity attacks; and controls and procedures for fulfilling applicable regulatory reporting and disclosure obligations of the risks and costs of cybersecurity incidents. Our Chief Information Security Officer ("CISO") briefs or provides a report to the Information Technology Committee on our cybersecurity and information security posture and program at least quarterly, including penetration test results and related remediation and significant cybersecurity incidents, and also provides an annual cybersecurity update to the full Board.


text: Our CISO, who reports to our Global Technology Officer on the Management Committee, has over 20 years of information technology and security program management experience, holds a Certified Information Security Manager certification and has led our information security team, including information technology compliance and risk management, since 2009. Our Global Technology Officer joined the Company in 2016 and has over 30 years of information technology experience, including leading global digital, security, infrastructure, cloud services and application teams. Prior to joining the Company in 2016, our Global Technology Officer was chief information officer at a large, publicly-traded energy company.


text: Our CISO has implemented a management-level governance structure and process to assess, identify, manage and report cybersecurity risks, and manage our overall information security program. The Information Security Board, led by our CISO and comprised of leaders from all of our lines of business and key functional areas such as Global Risk Management, Privacy and Compliance, as well as members of our information security team, meets quarterly, and is responsible for overseeing our information security program, including our information security strategy and related policies and standards. The information security team manages cybersecurity risks and controls, and continually enhances a global security control framework with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously minimizing the business impact should an incident occur.


text: We have implemented cybersecurity policies and standards based on leading industry frameworks, including the ISO 27001 standard and the National Institute of Standards and Technology Cybersecurity Framework, and regularly assess our policies and practices, including tabletop exercises, aimed at mitigating cybersecurity risks. In the event of a cybersecurity incident, we follow our Enterprise Information Security Incident Response Plan (the "IRP"), which outlines steps from incident detection to assessment, response, mitigation, recovery and notification, including to key functional areas such as Global Risk Management, Corporate Law, Privacy and Compliance, senior leadership and the Board, as appropriate. The IRP includes quantitative and qualitative incident assessment guidance and promotes engagement with multidisciplinary teams across the enterprise to facilitate real-time information sharing during a cybersecurity incident.


text: Employees outside of our information security team as well as third-party cybersecurity experts have an important role in our cybersecurity defenses. We require employees to participate in annual cybersecurity training and provide them with additional optional training and awareness materials, and regularly engage our employees in phishing exercises, reporting results to the Information Technology Committee. In addition, we regularly engage assessors, consultants, auditors and other third parties in our management of cybersecurity risk. For example, third parties are engaged to conduct evaluations of the maturity and effectiveness of our security program, including testing the design and operational effectiveness of security controls, penetration testing, engaging in independent audits, reviewing our policies and standards, and consulting on best practices to address new challenges. We also receive threat intelligence from government agencies, information sharing and analysis centers, and cybersecurity associations.


text: We rely on our vendors and other third parties, including the continued availability of their products and services, to conduct business and provide services to our clients. A cybersecurity incident at a vendor or other third party could materially adversely impact us. We assess third-party cybersecurity controls through a cybersecurity questionnaire and a review of independent cybersecurity rating assessments. Our contracts with third parties generally include security and privacy addendums where applicable and require counterparties to meet a specific standard of data security and report cybersecurity incidents to us.


text: While we have not experienced a cybersecurity incident that resulted in a material adverse effect on our business, operations, financial condition or results of operations, there can be no guarantee that we will not experience such an incident in the future. Although we maintain cybersecurity insurance, the costs and expenses related to cybersecurity incidents may not be fully insured. See "Item 1A – Risk Factors – Technology, Cybersecurity and Privacy Risks – The failure to effectively maintain and modernize our technology systems and infrastructure and integrate those of acquired businesses could adversely affect our business", " – Technology, Cybersecurity and Privacy Risks – We could incur significant liability if our technology systems or those of third parties are breached or we or third parties otherwise fail to protect the security of data residing on our respective systems, which could adversely affect our business and results of operations" and " – Business Strategic and Operational Risks – Our inability to successfully recover should we experience a business continuity event could have a material adverse effect on our business, financial condition and results of operations" for more information.


text: Education and Awareness: We provide periodic mandatory training for personnel regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We also perform periodic email phishing tests to keep cybersecurity awareness top of mind.

companyName: ALIMERA SCIENCES INC


text: The Board has ultimate oversight of cybersecurity risk. The Board reviews management's assessment of our key enterprise risks and its strategy with respect to each risk, including cybersecurity risks, and receives a corresponding risk management update annually. The Information Technology Committee of the Board reviews the effectiveness of our cybersecurity controls and procedures, including procedures to identify and assess internal and external risks from cybersecurity threats; controls to prevent and protect from cyberattacks, unauthorized access or other malicious acts and risks; procedures to detect, respond to, mitigate negative effects from and remediate cybersecurity attacks; and controls and procedures for fulfilling applicable regulatory reporting and disclosure obligations of the risks and costs of cybersecurity incidents. Our Chief Information Security Officer ("CISO") briefs or provides a report to the Information Technology Committee on our cybersecurity and information security posture and program at least quarterly, including penetration test results and related remediation and significant cybersecurity incidents. The CISO also provides an annual cybersecurity update to the full Board.


text: Role of Management Cybersecurity risk is integrated into our Global Risk Management process. Cybersecurity risk continues to be identified as one of our key enterprise risks. Risk owners from the Management Committee, senior leadership and the Global Risk Management function have been assigned to develop risk mitigation plans, which are tracked and reported at least quarterly to the Finance and Risk Committee of the Board and annually to the full Board. See "Item 1 – Business – Global Risk Management" for more information on the Global Risk Management function.


text: Our CISO has implemented a management-level governance structure and process to assess, identify, manage and report cybersecurity risks, and to manage our overall information security program. The Information Security Board, led by our CISO and comprised of leaders from all of our lines of business and key functional areas such as Global Risk Management, Privacy and Compliance, as well as members of our information security team, meets quarterly, and is responsible for overseeing our information security program, including our information security strategy and related policies and standards. The information security team manages cybersecurity risks and controls, and continually enhances a global security control framework with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously minimizing the business impact should an incident occur.


text: Risk Management Policies and Procedures We have implemented cybersecurity policies and standards based on leading industry frameworks, including the ISO 27001 standard and the National Institute of Standards and Technology Cybersecurity Framework, and we regularly assess our policies and practices, including tabletop exercises, aimed at mitigating cybersecurity risks. In the event of a cybersecurity incident, we follow our Enterprise Information Security Incident Response Plan (the "IRP"), which outlines steps from incident detection to assessment, response, mitigation, recovery and notification, including to key functional areas such as Global Risk Management, Corporate Law, Privacy and Compliance, senior leadership and the Board, as appropriate. The IRP includes quantitative and qualitative incident assessment guidance and promotes engagement with multidisciplinary teams across the enterprise to facilitate real-time information-sharing during a cybersecurity incident.


text: Employees outside of our information security team as well as third-party cybersecurity experts have an important role in our cybersecurity defenses. We require employees to participate in annual cybersecurity training and provide them with additional optional training and awareness materials, and we regularly engage our employees in phishing exercises, reporting results to the Information Technology Committee. In addition, we regularly engage assessors, consultants, auditors and other third parties in our management of cybersecurity risk. For example, third parties are engaged to conduct evaluations of the maturity and effectiveness of our security program, including testing the design and operational effectiveness of security controls, penetration testing, engaging in independent audits, reviewing our policies and standards, and consulting on best practices to address new challenges. We also receive threat intelligence from government agencies, information sharing and analysis centers, and cybersecurity associations.


text: We rely on our vendors and other third parties, including the continued availability of their products and services, to conduct business and provide services to our clients. A cybersecurity incident at a vendor or other third party could materially adversely impact us. We assess third-party cybersecurity controls through a cybersecurity questionnaire and a review of independent cybersecurity rating assessments. Our contracts with third parties generally include security and privacy addendums where applicable and require counterparties to meet a specific standard of data security and to report cybersecurity incidents to us.


text: Additional information on cybersecurity risks we face is discussed in "Risk Factors" in Item 1A, which should be read in conjunction with the foregoing information.


text: Risks from Cybersecurity Threats While we have not experienced a cybersecurity incident that resulted in a material adverse effect on our business, operations, financial condition or results of operations, there can be no guarantee that we will not experience such an incident in the future. Although we maintain cybersecurity insurance, the costs and expenses related to cybersecurity incidents may not be fully insured. See "Item 1A – Risk Factors – Technology, Cybersecurity and Privacy Risks – The failure to effectively maintain and modernize our technology systems and infrastructure and integrate those of acquired businesses could adversely affect our business", " – Technology, Cybersecurity and Privacy Risks – We could incur significant liability if our technology systems or those of third parties are breached or we or third parties otherwise fail to protect the security of data residing on our respective systems, which could adversely affect our business and results of operations" and " – Business Strategic and Operational Risks – Our inability to successfully recover should we experience a business continuity event could have a material adverse effect on our business, financial condition and results of operations " for more information.


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. The Company has designed and implemented a Security Incident Response Plan for cybersecurity incidents and related processes which are overseen by management and cybersecurity professionals. Cybersecurity threats are identified and escalated to a Security Incident Response Team or member thereof pursuant to criteria set forth in these processes. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers, if any.


text: Our cybersecurity policies, standards, processes, and practices are integrated into the Company's overall risk management and compliance program and are overseen by the Audit Committee. The Compliance Committee, led by our Chief Compliance Officer ("CCO") and the IT Committee, led by our Chief Financial Officer ("CFO") are responsible for establishing and monitoring the integrity and effectiveness of controls and other procedures. In general, we seek to address cybersecurity risks through a cross-functional approach focused on preserving the security and availability of information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: The Company also engages consultants, auditors, and other third parties in connection with these processes to assist in the design of cybersecurity measures and employee training and to test the effectiveness of the Company's processes and measures.


text: Board of Directors The Board's oversight of cybersecurity risk management is led by the Audit Committee which interacts with our CFO, who has oversight for information technology and our CCO, as well as other members of management. The Audit Committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The board of directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident, as well as ongoing updates regarding any such incident until it has been addressed. On a periodic basis, the board of directors, through the Audit Committee, discuss our approach to cybersecurity risk management with the CFO and CCO.


text: The Audit Committee is informed of material risks, if any, from cybersecurity threats pursuant to Company policies, and at least once per quarter the Company's CCO reports to the Audit Committee generally on cybersecurity matters and material risks, if any, from cybersecurity threats.


text: The Company's management, including members of its IT and Compliance Committees, also assess and manage material risks, if any, from cybersecurity threats with the assistance of our third-party IT and cybersecurity vendors.


text: Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: We are committed to establishing and maintaining comprehensive incident response and recovery plans to address our response to a cybersecurity incident.


text: Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: We engage in the periodic assessment of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The results of such assessments, audits and reviews are reported to the Audit Committee, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. See "—Risk Management and Strategy" above.


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, including its business strategy, results of operations or financial condition. As cybersecurity threats become more sophisticated and coordinated, it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures as we pursue our business strategies. For additional information concerning risks related to cybersecurity, see Item 1.A. Risk Factors — Our internal information technology systems, or those of our third-party contract research organizations ("CROs") or other contractors or consultants, may fail or suffer cybersecurity threats or breaches, loss or leakage of data and other disruptions, which could result in a material disruption of certain parts of our business, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business.


text: Risk Management and Strategy Cybersecurity risks are classified as a Tier 1 risk within our enterprise risk management program. We are committed to protecting the security and integrity of our systems, networks, databases and applications. We routinely invest to develop and implement numerous cybersecurity programs and processes, including risk management and assessment programs, security and event monitoring capabilities, detailed incident response plans, and other advanced detection, prevention and protection capabilities, including practices and tools to monitor and mitigate insider threats. We regularly assess cybersecurity risks to identify and enumerate threats to us and vulnerabilities these threats can exploit to adversely impact our business operations. In some instances, we engage third parties to conduct or assist us with conducting cybersecurity risk assessments.

companyName: CCO HOLDINGS LLC


text: Our cybersecurity program employs various risk-tracking tools, industry data, monitoring, detection and response tools, vulnerability scanning, security dashboards and scorecards and other tools to support our continued evaluation of cybersecurity threats and regulatory requirements. Our cybersecurity program addresses the continuously evolving and extensive attack vectors and methods through layered security controls informed by constant threat analysis. Threats include a wide variety of perpetrators aiming for political, personal or financial gain, utilizing a broad set of tactics including ransomware, advanced malware, DDoS, account takeover, phishing/SMSing and social engineering, among others. These risks threaten our internal systems as well as third-party systems that we use and rely upon for the delivery of services and support of our operations. Our risk mitigation techniques include technology risk management, network segmentation, deployment of enhanced detection tools across our network, systems, databases, and applications and monitoring compliance with security standards.


text: Various security standards provide guidance to telecommunications companies in order to help identify and mitigate cybersecurity risks, including the voluntary framework released by the National Institute for Standards and Technology ("NIST") in 2014 and updated in 2018, in cooperation with other federal agencies and owners and operators of U.S. critical infrastructure. The NIST cybersecurity framework provides a prioritized and flexible model for organizations to identify and manage cyber risks inherent to their business. Our security infrastructure is comprised of multiple security capabilities designed with a defense-in-depth model informed by the NIST cybersecurity framework, as well as a variety of other industry standards and best practices. The risk-based approach of the NIST cybersecurity framework has enabled us to implement cybersecurity programs tailored to our particular network architectures, customer environments and institutional resources.


text: Our cybersecurity risk management program also attempts to assess third-party vendor, service provider, business partner and supply chain risk management issues. Our efforts aim to better understand the cybersecurity posture of our third-party vendors, service providers, business partners and suppliers by analyzing their cybersecurity risk management programs. Our third-party cybersecurity risk management processes include reviewing and revising our service provider and vendor management programs and the related agreements to require prompt notification of cyber incidents, outages and software vulnerabilities to facilitate timely assessment and disclosure of third-party cyber risks. Generally, our agreements require our third-party providers to abide by specific privacy, confidentiality and security processes, particularly for third-party data-processing activities. For vendors that offer software as a service solutions involving personal information, our third-party risk management program generally requires third-party attestation of their security practices such as a System and Organization Controls 2 report or ISO 27001 certification. Our due diligence and selection processes also require third parties to complete a cybersecurity and data privacy questionnaire that includes questions about contractor track record. Our third-party security reviews are limited by their disclosures; therefore, a risk-based approach is used in making vendor and contractual decisions based on those disclosures and the totality of the circumstances, such as whether the third party will have access to personal information or our network.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition.


text: Our organizational objectives are aligned to address our cybersecurity risks and management plays a pivotal role in assessing and managing our material risks from cybersecurity threats. Management's role in assessing and managing material cybersecurity risks includes various management positions and committees responsible for assessing such risks. Our internal processes require escalation of material cybersecurity risks to our executive leadership and Charter's Board of Directors, as well as management and committees who are tasked with the prevention, detection, mitigation and remediation of cybersecurity incidents. These processes provide guidance for consistent and effective incident handling and response and set standards for internal notifications and escalations, as well as external notification considerations with respect to a cybersecurity event or incident requiring disclosure or notification to a state and/or federal agency or affected customers.


text: Charter's Board of Directors has delegated to the Audit Committee oversight of our privacy and data security, including cybersecurity, risk exposures, policies and practices, including the steps management have taken to detect, monitor and control such risks and the potential impact of those exposures on our business, financial results, operations and reputation. Charter's Audit Committee receives quarterly updates on the enterprise risk management program, including information on cybersecurity risks and initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates or internal audit observations, if applicable.


text: We have a unified cybersecurity leadership team, composed of members of our Security Executive Steering Committee ("Security ESC") to oversee implementation of appropriate cybersecurity protections and promote accountability. The Security ESC is led by senior executives in our information technology ("IT") and network operations groups and is comprised of senior executive leaders across the organization with the goal of driving cybersecurity focus through not just technical teams, but the entire business. The Security ESC reviews and evaluates current cyber threats and risks and improvements to our program and provides quarterly updates to the Chief Executive Officer as well as ad hoc updates on urgent matters. We also have a Cyber Security Council ("CSC") and Security Operations Steering Committee that, under the direction of the Security ESC, collectively focus on cybersecurity across Charter and the overall protection of our internal network and related processes, policy, training and actions to protect customer and employee data. The CSC is comprised of senior leaders across the organization and operates under the auspices of the Security ESC, which is ultimately accountable under our enterprise risk management program for cybersecurity.


text: The executive team members overseeing our cybersecurity program are Magesh Srinivasan, Executive Vice President, Network Operations, and Jake Perlman, Executive Vice President, Software Development & IT. Our Security Operations Center and Security Compliance teams (including Software Development and IT and Network Security Operations) are unified under our Chief Information Security Officer, Greg Temm, to provide a centralized view of our risk posture to prevent vulnerabilities and more effectively manage cybersecurity threats across the enterprise.


text: Mr. Srinivasan is responsible for network operations across our 41-state footprint. He joined Charter in 2016, and most recently served as Senior Vice President in Network Operations, first in Core and Backbone Operations and most recently in Video Operations. Prior to that, he served in several senior engineering roles at Time Warner Cable Inc. ("TWC"), including as Group Vice President of Commercial Engineering and Operations, Vice President of Commercial Engineering for TWC's West Region, and Director in the Texas Region. Mr. Srinivasan began his career at Sprint Corporation in a series of engineering roles with increased responsibility. He received a bachelor of science from Anna University, a master's degree and doctorate in materials science from Kansas State University, and a master's degree in business administration from the Graduate School of Business at the University of Kansas.