text: As part of management oversight, our Chief Executive Officer (CEO) receives monthly updates from the CISO and representatives from CyberCRAFT. These updates provide a recurring overview of cybersecurity trends and status updates (e.g., security events, fraud detection, IT roadmap progress, follow-up from prior assessments, security awareness exercise results), as well as a more focused analysis on select cybersecurity topics for the month. Examples of prior topics include: recent cybersecurity legislation, cybersecurity incidents affecting external entities, and trends in cybersecurity controls and adoption. As part of our incident response processes, incidents are classified based on the incident's characteristics. For certain risk-based classifications of incidents, the CEO and other members of the executive leadership team are also informed and contribute as part of our incident response processes.


text: Our full Board of Directors provides ultimate oversight for the cybersecurity program, in addition to other significant risks of Intuit. The Board of Directors has delegated primary oversight of cybersecurity risks to the Audit and Risk Committee. On a quarterly basis, the CISO and CyberCRAFT specialists provide the Audit and Risk Committee with updates, metrics, and trends, such as the status of prior security events, existing and emerging threat landscapes, the results of audits or assessments, fraud prevention efforts, vulnerability detection and disclosure changes, and the status of projects to strengthen our security systems and improve incident readiness, and how these may affect broader enterprise risk management. Under our incident response processes' risk-based escalation protocols, the CISO, or other management, escalates certain incidents to the chair of the Audit and Risk Committee, who may then involve the broader committee or the full Board of Directors, as appropriate.

companyName: INTUIT INC.

ticker: INTU

secItem: Item 1C

stage1Category: Board Governance

stage1Method: unanimous


text: Risk Management and Strategy Our cybersecurity program framework is based on the Center for Internet Security's ("CIS") Critical Security Controls. We have policies and procedures in place based on best practices and guidelines from the National Institute of Standards and Technology ("NIST"), an agency of the United States Department of Commerce, and the Cybersecurity & Infrastructure Security Agency, an agency of the United States Department of Homeland Security. Our Information Technology ("IT") team works to protect not only our information, but also the information of third parties we may hold or control, including by implementing physical, electronic, and procedural safeguards to protect the confidentiality, integrity, and availability of Company computer systems. We also limit physical access to server, storage, and network equipment to necessary staff.

companyName: ALAMO GROUP INC

ticker: ALG

stage1Category: Risk Management Process


text: We assess the security of our networks, websites, and systems with automated vulnerability detection services from a provider that is validated by the NIST, based on the Security Content Automation Protocol ("SCAP") standard. We perform an annual review of our efforts to manage risk with controls that align with and map to key compliance frameworks, such as NIST and the ISO 27000 series of regulations. We perform quarterly IT risk assessments that include cybersecurity risk assessments focused on action plans developed through annual reviews. We also respond to risks as they are discovered real-time. We are guided by an Information Security Incident Response Policy and corresponding Information Security Incident Response Procedure we implement when handling IT security incidents.


text: Our process of assessing, identifying, and managing material risks from cybersecurity threats is integrated into our overall enterprise risk management system. Our process of managing risks from cybersecurity threats includes monitoring information channels from trusted security information sources. We review third-party service providers that manage sensitive Company information prior to engaging any such provider. Our reviews align with relevant government compliance requirements and review of System and Organization Controls reports. We establish governance, processes, and tools for managing various third-party related risks, including information security. As a condition of working with the Company, third-party service providers who access sensitive business or customer information are expected to meet certain information security requirements. Our processes for assessing, classifying, and managing cybersecurity risks were created in collaboration with consultants and auditors. We maintain consulting relationships that provide guidance for responding to evolving cybersecurity risks. We require employees to undertake data protection, cybersecurity training, and compliance programs annually. Internal and external auditors also review our adherence to established IT and cybersecurity controls.

stage1Method: majority


text: Despite our efforts, cyber attacks, unauthorized access or security breaches, or other cyber incidents such as computer viruses, malicious or destructive code, ransomware, social engineering attacks, hacking, denial-of-service attacks, and other similar attacks could materially affect us and disrupt our business. To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have, or are likely to, materially affect us, our business strategy, results of operation or financial condition. Potential consequences of a successful cyber attack or cybersecurity breaches or incidents could, however, include remediation costs, disruption of manufacturing capabilities, legal costs, increased cybersecurity protection costs, lost revenues resulting from the unauthorized use of proprietary information or the failure to retain or attract customers following an attack, litigation and legal risks including governmental or regulatory enforcement actions, increased insurance premiums, reputational damage that adversely affects customer or investor confidence, and damage to the Company's competitiveness, stock price, and long-term shareholder value. For more information about the cybersecurity risks we face, see the risk factor titled "We are significantly dependent on information technology and our business may suffer from disruptions associated with information technology, cyber-attacks or other catastrophic losses affecting our IT infrastructure" in Item 1A. Risk Factors.

stage1Category: None/Other


text: Our approach to cybersecurity is in the developmental stage, and we have not yet conducted comprehensive risk assessments, established an incident response plan or engaged with external cybersecurity consultants for assessments or services.

companyName: 60 DEGREES PHARMACEUTICALS, INC.

ticker: SXTP


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated responsibility for the periodic review and evaluation of the Company's policies and programs for identifying cybersecurity risks to the Audit Committee. In addition, the entire Board receives quarterly updates on the Company's cybersecurity action plans and annual reports containing full cybersecurity control assessments and action plans from senior management, and periodically reviews information regarding the Company's cybersecurity risks. We have an Information Technology Steering Committee ("ITSC"), comprised of the Company President and Chief Executive Officer, the Executive Vice Presidents of our Vegetation Management and Industrial Equipment Divisions, the Chief Financial Officer, and the Chief Sustainability Officer, that determines the priority of cybersecurity initiatives. The ITSC also reviews the Board's and Audit Committee's feedback and incorporates it into ongoing cybersecurity management efforts.


text: Our IT team, led by the Vice President of IT and the Director of Network and Information Systems, is responsible for day-to-day assessment and management of cybersecurity risks. Members of our IT team have undergraduate and graduate degrees in relevant fields, including information systems, information assurance, and information technology with a concentration in cybersecurity. Members of our IT team have also obtained relevant certifications, including the Director of Network and Information Systems being a Certified Information Systems Security Professional.

stage1Category: Management Role


text: We assess the security of our networks, websites, and systems with automated vulnerability detection services from a provider that is validated by the NIST, based on the Security Content Automation Protocol ("SCAP") standard. We perform an annual review of our efforts to manage risk with controls that align with and map to key compliance frameworks, such as NIST and the ISO 27000 series of standards. We perform quarterly IT risk assessments that include cybersecurity risk assessments focused on action plans developed through annual reviews. We also respond to risks as they are discovered real-time. We are guided by an Information Security Incident Response Policy and corresponding Information Security Incident Response Procedure we implement when handling IT security incidents.


text: We employ various measures to help manage our cybersecurity risks, including end-to-end email encryption, two-factor authentication for access to Company applications, strong password requirements and firewall and email protection against malware and phishing campaigns. We augment these protective technologies with security monitoring and detection capabilities to limit the impact of cybersecurity incidents. Our program includes processes designed to identify material risks related to the use of third party service providers, such as cloud service providers.

companyName: SANMINA CORP

ticker: SANM


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated responsibility for the periodic review and evaluation of the Company's policies and programs for identifying cybersecurity risks to the Audit Committee. In addition, the entire Board receives quarterly updates on the Company's cybersecurity action plans and annual reports containing full cybersecurity control assessments and action plans from senior management, and periodically reviews information regarding the Company's cybersecurity risks. We have an Information Technology Steering Committee ("ITSC"), comprised of the Company President and Chief Executive Officer, the Executive Vice Presidents of our Vegetation Management and Industrial Equipment Divisions, the Chief Financial Officer, and the Chief Sustainability Officer, that assesses and manages material risks from cybersecurity threats and determines the priority of cybersecurity initiatives. The ITSC also reviews the Board's and Audit Committee's feedback and incorporates it into ongoing cybersecurity management efforts.


text: Our IT team, led by the Vice President of IT and the Director of Network and Information Systems, is responsible for day-to-day assessment and management of cybersecurity risks, including the monitoring and detecting of cybersecurity incidents and executing our cybersecurity incident response plans. Members of our IT team have undergraduate and graduate degrees in relevant fields, including information systems, information assurance, and information technology with a concentration in cybersecurity. Members of our IT team have also obtained relevant certifications, including the Director of Network and Information Systems being a Certified Information Systems Security Professional.


text: the privacy of customer and personnel information is important to us, and we maintain security protocols and processes, including ongoing training and education for all personnel, designed to combat the risk of unauthorized access or inadvertent disclosure.

companyName: Electromed, Inc.

ticker: ELMD


text: Our business operations involve confidential information, including patient health information subject to regulation as discussed under " HIPAA, HITECH and Other Privacy Regulations " above. Our information technology infrastructure is designed to offer reliability, scalability, performance, security and privacy for our personnel, clients, and third-party contractors.


text: Risk Management and Strategy have designed and implemented a cybersecurity risk management program to help us identify, assess, and mitigate cybersecurity risks relevant to our business, based on the National Institute of Standards and Technology (NIST) Cyber Security Framework. The cybersecurity risk management program is integrated into our Enterprise Risk Management (ERM) program.


text: cybersecurity professionals who analyze cybersecurity threats, define cybersecurity policy and requirements, implement protections, and monitor and respond to cybersecurity incidents;


text: regulatory-based risk assessments for the Company's systems and applications (where formal incident response plan, in which incidents are classified based upon the severity, impact, and the potential harm that can be caused by the incident;


text: information security training program for all employees, including phishing awareness of third-party service providers to conduct assessments of the Company's cybersecurity risk management program, penetration testing, and vulnerability testing.


text: date, the Company is not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on the Company's business strategy, results of operations or financial condition. However, despite our security measures, there can be no assurance that the Company, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us.

stage1Category: Strategy Integration


text: Audit Committee and the Board of Directors provide oversight of cybersecurity risk management. The cybersecurity risk management program is co-led by senior leaders of our management and third-party service providers. Between our senior leaders, there is a combined 30+ years of experience assisting public and privately held companies in a variety of industries, leading several enterprise-wide transformation initiatives to adapt to changing cybersecurity threats. Our Director of IT leads the IT organization, reports directly to the Chief Financial Officer and works closely with the President and Chief Executive Officer to guide strategic direction and IT decisions to drive business outcomes. Our Board of Directors is engaged in the Company's Enterprise Risk Management (ERM)


text: program and receives briefings on the outcomes of the ERM program and the steps the Company takes to mitigate risks that the program identifies. The Audit Committee oversees the Company's cybersecurity strategies, systems, and controls to ensure reliability and prevent unauthorized access. The Audit Committee discusses policies with respect to risk assessment and risk management, including risks associated with the reliability and security of the Company's information technology and security systems, and the steps management has undertaken to monitor and control such exposures. The Audit Committee and Board of Directors receives regular updates on the Company's cybersecurity risk management program from the Chief Financial Officer, Director of IT and third party managed service provider CISO.


text: As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations or financial condition. However, despite our security measures, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information on our cybersecurity related risks, see "Item 1A. Risk Factors - Cyberattacks and other disruptions of our information technology network and systems could interrupt our operations, lead to loss of our customer and employee data and subject us to damages."


text: Our Board has primary responsibility for overseeing risks associated with our information technology, including cybersecurity. Our Board receives regular reports from our Chief Information Officer ("CIO") regarding our information systems and technology and associated policies, processes and practices for managing and mitigating cybersecurity and technology-related risks. Our Audit Committee oversees our SEC reporting process generally, including with respect to any required disclosures relating to a material cybersecurity event.


text: At the management level, our Vice President, IT Security leads our enterprise-wide cybersecurity program and is primarily responsible for assessing and managing our material risks from cybersecurity threats. In performing his role, the Vice President, IT Security monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents and is a key stakeholder and participant in the Company's cybersecurity and privacy incident reporting framework described above. Our Vice President, IT Security reports to our CIO who, in turn, reports directly to our Chief Executive Officer.


text: Our Vice President, IT Security is an experienced cybersecurity professional with more than 20 years of experience building and leading cybersecurity, risk management, and information technology teams, and holds industry-recognized cybersecurity certifications, including Certified Information Systems Security Professional (CISSP) certification.


text: Risk Management and Strategy We have implemented a cybersecurity risk management program based on multiple cybersecurity frameworks, primarily the National Institute of Standards and Technology Cybersecurity Framework (800-171), as well as information security standards issued by international bodies. We use this program, which is integrated into our overall enterprise risk management framework, to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: We employ various measures to help manage our cybersecurity risks, including end-to-end email encryption, two-factor authentication for access to Company applications, strong password requirements and firewall and email protection against malware and phishing campaigns. We augment these protective technologies with security monitoring and detection capabilities to limit the impact of cybersecurity incidents. Our program includes processes designed to identify material risks related to the use of third party service providers, such as cloud service providers.


text: We provide cybersecurity and information security compliance training to relevant employees at least once per year, tracking completion and requiring testing, and conduct simulated phishing campaign tests. We also provide additional specialized training for our security team and for employees with access to certain sensitive information.


text: Our SCI subsidiary has been certified under the U.S. Cybersecurity Maturity Model Certification (CMMC) program. We also engage third-party experts to improve our cybersecurity posture, including through penetration testing.


text: We have adopted a cybersecurity and privacy incident reporting framework to assess and manage cybersecurity incidents, which includes escalation procedures based on the nature and severity of the incident, assessment of public disclosure considerations and reporting to the Audit Committee and the Board.


text: The Company depends on the confidentiality, integrity and availability of information systems and data. We have systems and processes in place to assess, identify and manage cybersecurity incidents and those systems and processes are integrated into our overall risk management system.

companyName: BRAND HOUSE COLLECTIVE, INC.

ticker: TBHC


text: We execute a comprehensive approach to cybersecurity risk management, helping ensure the data customers and other stakeholders entrust to us remains safe and secure. Our board of directors (the "Board"), Compliance Committee, and Information Security Program leaders are actively involved in the oversight of our cybersecurity risk management program. As described in more detail below, we have established standards, policies, practices, and processes focused on identifying, assessing, managing, mitigating, and responding to material risks from cybersecurity threats. To date, the Company is not aware of any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, our business strategies, results of operations, financial condition, or cash flows. However, while we have devoted financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure, we cannot provide absolute assurance that any potential future cybersecurity threats or incidents will not materially affect us or our business strategies, results of operations, financial condition, or cash flows. For further discussion on cybersecurity related risks, see the "Risk Factors" section of Item 1A of this annual report on Form 10-K.

companyName: O REILLY AUTOMOTIVE INC

ticker: ORLY


text: RISK MANAGEMENT AND STRATEGY We execute a holistic approach to our standards, policies, practices, and processes for identifying, assessing, managing, mitigating, and responding to material risks from cybersecurity threats, all of which are integrated into our overall risk management program. Our cybersecurity program is informed by industry-wide recognized standards, such as The National Institute of Standards and Technology (NIST) Cybersecurity Framework.


text: We have implemented best practices and established numerous programs and controls to reduce cybersecurity risk. Our Information Security Program includes physical, administrative, and technical safeguards. Some key components of the Information Security Program include: Security awareness training for Team Members. A dedicated security operations team to monitor, analyze, and respond to security threats. Security governance to manage and maintain security processes. Intrusion, detection, and prevention systems. A vulnerability management program to identify and remediate security liabilities. A configuration management program to harden systems based on industry standards. Industry-leading email security, endpoint detection, and response platforms. Threat intelligence from multiple resources to identify and anticipate emerging threats. Network and web application firewalls. Multi-factor authentication. Network segmentation to isolate and safeguard critical systems and sensitive data.


text: On an ongoing basis we conduct cybersecurity risk assessments, including compiling, reviewing, and acting on information garnered from internal stakeholders, known security vulnerabilities, and data from external sources. The results of these assessments are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, Audit Committee, and members of management.


text: We routinely assess our systems and processes for modifications in advance of evolving state privacy regulations and other applicable industry standards and regularly update our privacy and information security policies to remain current with industry-leading practices. We are continually adapting to the ever-changing cyber risk landscape and have a dedicated team of information security professionals committed to maintaining the highest levels of systems and data security. The Company conducts and has engaged external information security firms to conduct assessments, including penetration tests, to continually improve security controls and ensure security controls. We continue to expand and grow our security team and their skillsets and make regular enhancements to our Information Security Program.


text: In addition, we engage with our third-party business partners to enforce our internal cybersecurity practices. We rely on all third-party business partners to maintain appropriate security programs; however, we cannot ensure in all circumstances that their efforts will be successful. We assess third-party cybersecurity controls through a detailed cybersecurity assessment and review and include security and privacy addendums to our contracts, where applicable. We also require that our third parties report material cybersecurity incidents to us, allowing us the ability to assess the impact of any reported incident on our operations.

stage1Category: Third-Party Risk


text: Additionally, we developed a business continuity and disaster recovery program to help minimize the impact from certain types of cybersecurity risks. The Company's incident response plans include emergency response, systems recovery, and other plans that would be enacted in the event of certain types of cybersecurity attacks. Our business continuity and disaster recovery plans are updated regularly and tested each year or as needed.


text: Risk Management and Strategy We employ a comprehensive risk management strategy for the assessment, identification and management of material risks stemming from cybersecurity threats. Our methodologies involve a systematic evaluation of potential threats, vulnerabilities, and their potential impacts on our organization's operations, data, and systems.

companyName: VORNADO REALTY LP


text: Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk. The Board receives regular reports from management about the prevention, detection, assessment, mitigation, and remediation of cybersecurity risks and incidents, including analysis of material security risks or information security vulnerabilities. Our Audit Committee directly oversees our Information Security Program. The Audit Committee is composed of Board members with diverse expertise, including risk management, technology, and finance experience, which provides them with the necessary qualifications to effectively oversee cybersecurity risks. The Audit Committee receives on a quarterly basis, or as needed, comprehensive updates from management on cybersecurity risks, including risk assessments, cybersecurity maturity assessments, progress of risk reduction initiatives, enhancements to cybersecurity programs and initiatives, business continuity planning, PCI compliance, any relevant internal or industry cybersecurity incidents, and compliance with regulatory requirements and industry standards, as applicable.


text: Management's Role A cross-functional Compliance Committee comprised of O'Reilly executive and senior leadership, including our Chief Information Officer ("CIO"), have responsibility for assessing and managing material cybersecurity risks and oversees our enterprise security, privacy, and risk priorities, including ensuring alignment on security decisions across the Company. The Compliance Committee meets quarterly, or as needed, to review security performance metrics, identify security risks, assess the status of approved security enhancements, and discuss future changes necessary to execute best practice, among other items. The Compliance Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation strategies to senior management. We have an established escalation process to help ensure senior management and the Board are timely informed of any potential cybersecurity issues or incidents. Our comprehensive monitoring, analysis, response, and communication protocols are designed to ensure the highest level of management is informed of cybersecurity risks and that the Board has comprehensive oversight and information necessary to provide guidance on critical cybersecurity issues.


text: Our Compliance Committee members have decades of business and leadership experience managing risk, including cybersecurity risks, that collectively enables them to effectively oversee comprehensive cybersecurity risks. Our CIO has served in various roles in information technology for more than 30 years, including serving as a chief information officer for a technology company, and has a degree in information management systems. Information Security Program leaders and Team Members who support our Information Security Program have relevant educational and technical certifications, such as Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP), and applicable industry experience, including cybersecurity threat assessment and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats, and regulatory compliance. For further details about our CIO's background, see the "Information About Our Executive Officers" section of Item 1 of this annual report on Form 10-K.


text: We execute a comprehensive approach to cybersecurity risk management, helping ensure the data customers and other stakeholders entrust to us remains safe and secure. Our board of directors (the "Board"), Compliance Committee, and Information Security Program leaders are actively involved in the oversight of our cybersecurity risk management program. As described in more detail below, we have established standards, policies, practices, and processes focused on identifying, assessing, managing, mitigating, and responding to material risks from cybersecurity threats. To date, the Company is not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, our business strategies, results of operations, financial condition, or cash flows. However, while we have devoted financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure, we cannot provide absolute assurance that any potential future cybersecurity threats or incidents will not materially affect us or our business strategies, results of operations, financial condition, or cash flows. For further discussion on cybersecurity related risks, see the "Risk Factors" section of Item 1A of this annual report on Form 10-K.


text: RISK MANAGEMENT AND STRATEGY We execute a holistic approach to our standards, policies, practices, and processes for identifying, assessing, managing, mitigating, and responding to material risks from cybersecurity threats, all of which are integrated into our overall risk management program. Our cybersecurity program is guided by industry-wide recognized standards, including The National Institute of Standards and Technology (NIST) Cybersecurity Framework.


text: We have implemented best practices and established numerous programs and controls to reduce cybersecurity risk. Our Information Security Program includes physical, administrative, and technical safeguards. Some key components of the Information Security Program include: Security awareness training for Team Members. A dedicated security operations team to monitor, analyze, and respond to security threats. Security governance to manage and maintain security processes. Intrusion, detection, and prevention systems. A vulnerability management program to identify and remediate security liabilities. A configuration management program to harden systems based on industry standards. Industry-leading email security, endpoint detection, and response platforms. Threat intelligence from multiple resources to identify and anticipate emerging threats. Network and web application firewalls. Identity security to include multi-factor authentication. Network segmentation to isolate and safeguard critical systems and sensitive data.


text: Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk. The Board receives regular reports from management about the prevention, detection, assessment, mitigation, and remediation of cybersecurity risks and incidents, including analysis of material security risks or information security vulnerabilities. Our Audit Committee directly oversees our Information Security Program. The Audit Committee is composed of Board members with a broad range of expertise, including risk management, technology, and finance experience, which provides them with the necessary qualifications to effectively oversee cybersecurity risks. The Audit Committee receives on a quarterly basis, or as needed, comprehensive updates from management on cybersecurity risks, including risk assessments, cybersecurity maturity assessments, progress of risk reduction initiatives, enhancements to cybersecurity programs and initiatives, business continuity planning, PCI compliance, any relevant internal or industry cybersecurity incidents, and compliance with regulatory requirements and industry standards, as applicable.


text: Management's Role A cross-functional Compliance Committee comprised of O'Reilly executive and senior leadership, including our Chief Information Officer ("CIO"), has responsibility for assessing and managing material cybersecurity risks and oversees our enterprise security, privacy, and risk priorities, including ensuring alignment on security decisions across the Company. The Compliance Committee meets quarterly, or as needed, to review security performance metrics, identify security risks, assess the status of approved security enhancements, and discuss future changes necessary to execute best practice, among other items. The Compliance Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation strategies to senior management. We have an established escalation process to help ensure senior management and the Board are timely informed of any potential cybersecurity issues or incidents. Our comprehensive monitoring, analysis, response, and communication protocols are designed to ensure the highest level of management is informed of cybersecurity risks and that the Board has comprehensive oversight and information necessary to provide guidance on critical cybersecurity issues.


text: The Company is susceptible to a variety of risks as an inherent part of serving our clients' needs, including risks related to cybersecurity, data privacy and technology. The Company maintains a cybersecurity program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The program, which balances serving the interest of our clients, their policyholders and customers, regulatory bodies, our investors, our employees and other relevant constituencies, is integrated within the Company's Enterprise Risk Management ("ERM") program.

companyName: REINSURANCE GROUP OF AMERICA INC

ticker: RGA


text: The underlying controls of the cybersecurity program are based on recognized practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the International Organization Standardization ("ISO") 27001 Information Security Management System Requirements. RGA periodically engages a third party to perform an assessment of the Company's cybersecurity risk management program against the NIST framework.


text: RGA utilizes third-party partners, including leading national and international companies specializing in cybersecurity and software development, to supplement its security operations team to provide monitoring of its global cybersecurity environment and to coordinate the investigation and remediation of alerts. The Company also engages third party partners to assist in evaluating and testing the Company's cybersecurity infrastructure. These partners are subject to the Company's third party due diligence process that includes security and privacy assessments, legal reviews, and ongoing assessments and performance reviews to ensure compliance with the Company's policies and standards.


text: Both the board of directors and management have an active and ongoing role overseeing, assessing, identifying and managing material risks from cybersecurity threats.


text: The board of directors (the "Board"), directly and through its Risk Committee and Cybersecurity and Technology Committee (the "Cybersecurity Committee"), oversees the Company's risk management strategy and cybersecurity, data privacy, and technology risks and provides oversight of ongoing investments in cybersecurity and technology. The Company's Chief Risk Officer ("CRO") provides regular reports to the Risk Committee regarding the Company's general risks, including risks relating to cybersecurity threats, and responses thereto. The Cybersecurity Committee oversees the Company's cybersecurity, customer privacy, and technology risks and monitors the Company's strategy and progress to achieve its planned cybersecurity objectives. The CRO and Global Chief Information Security and Privacy officer ("CISO") provide quarterly updates to the Cybersecurity Committee regarding cybersecurity, data privacy, and information technology strategy and programs. In addition, both the Risk Committee and Cybersecurity Committee meet as needed outside of the normal quarterly reporting cycle to discuss particular cybersecurity issues as required.


text: The Company's risk management process and strategy, including cybersecurity risks, is the responsibility of the CRO and is supported by the Company's Risk Management Steering Committee ("RMSC"), which includes senior management executives, including the President and Chief Executive Officer ("CEO"), the Chief Financial Officer ("CFO"), and the Chief Investment Officer, among others. The RMSC provides oversight and advises the CRO on the Company's enterprise risk management framework and strategic risk exposures including cybersecurity risks. The Company's CISO and CRO provide updates through quarterly meetings with the RMSC.


text: The CRO, Chief Information Officer ("CIO") and CISO each have over 15 years experience in managing cybersecurity, information technology and other risk management processes. The following is a summary of the CRO, CIO, and CISO's experience: • The CRO, a member of RGA's Executive Committee, has held various positions in the Company and is responsible for oversight of operational risks, which includes cybersecurity. The CRO has more than 30 years of experience and has held various positions including serving as the Company's Global Chief Risk Officer. In addition to overseeing the overall risk governance structure of RGA's Enterprise Risk Management program, the CRO has extensive experience leading a number of cybersecurity programs at the Company such as enhancing the Company's cybersecurity systems to ensure compliance with Privacy and Security Regulations. • The CIO, a member of RGA's Executive Committee, leads the strategic direction of the Company's information technology resources and management of RGA's global information technology operations. The CIO has held various positions of responsibility at other companies for all aspects of technology and he has deep knowledge in organizational change, digital transformation, core platform and data analytics modernization. • The CISO, who is responsible for implementing the Company's cybersecurity risk management strategy, oversees the Company's global security and privacy teams ensuring broad awareness of emerging risks and cybersecurity threats. The CISO has significant cybersecurity experience including executive management responsibility in cybersecurity, data privacy, operational risk management, and information technology, including regulatory compliance and risk quantification.


text: A cross functional team, including Finance, Legal, Risk and the Information Technology departments, in conjunction with others as needed, are involved in the materiality assessment of cybersecurity threats and incidents. The factors considered in the assessment of materiality include, but are not limited to, the probability of an adverse outcome, actual and expected direct and indirect costs stemming from the incident, the possibility of litigation or regulatory investigations, and the nature and extent of harm to policyholders, cedents, vendor relationships, and the Company's reputation and competitiveness. Conclusions are reviewed and approved by the Company's CEO, CFO and CRO.


text: We have experienced, and may in the future experience, whether directly or through third parties, cybersecurity incidents. While prior incidents, including those previously disclosed and not disclosed, have not materially affected our results of operations or financial condition, we cannot assure that they will not be materially affected in the future by such incidents. Additionally, although our processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cybersecurity incident would not materially affect our, results of operations or financial condition. For more information on our cybersecurity related risks, see Item 1A – "Risk Factors."


text: The board of directors (the "Board"), directly and through its Risk Committee and Cybersecurity and Technology Committee (the "Cybersecurity Committee"), oversees the Company's risk management strategy and cybersecurity, data privacy, and technology risks and provides oversight of ongoing investments in cybersecurity and technology. The Company's Chief Risk Officer ("CRO") provides regular reports to the Risk Committee regarding the Company's general risks, including risks relating to cybersecurity threats, and responses thereto. The Cybersecurity Committee oversees the Company's cybersecurity, customer privacy, and technology risks and monitors the Company's strategy and progress to achieve its planned cybersecurity objectives. The Chief Information Officer ("CIO") and Global Chief Information Security Officer ("CISO") provide quarterly updates to the Cybersecurity Committee regarding cybersecurity, and information technology strategy and programs. In addition, both the Risk Committee and Cybersecurity Committee meet as needed outside of the normal quarterly reporting cycle to discuss particular cybersecurity issues as required.


text: The CRO, CIO, and CISO each have over 15 years experience in managing cybersecurity, information technology and other risk management processes. The following is a summary of the CRO, CIO, and CISO's experience: • The CRO, a member of RGA's Executive Committee, has held various positions in the Company and is responsible for oversight of operational risks, which includes cybersecurity. The CRO has more than 30 years of experience and has held various positions including serving as the Company's Global Chief Risk Officer. In addition to overseeing the overall risk governance structure of RGA's Enterprise Risk Management program, the CRO has extensive experience leading a number of cybersecurity programs at the Company such as enhancing the Company's cybersecurity systems to ensure compliance with Privacy and Security Regulations. • The CIO, a member of RGA's Executive Committee, leads the strategic direction of the Company's information technology resources and management of RGA's global information technology operations. The CIO has held various positions of responsibility at other companies for all aspects of technology and he has deep knowledge in organizational change, digital transformation, core platform and data analytics modernization. • The CISO, who is responsible for implementing the Company's cybersecurity risk management strategy, oversees the Company's global security team ensuring broad awareness of emerging risks and cybersecurity threats. The CISO has significant cybersecurity experience including executive management responsibility in cybersecurity, operational risk management, and information technology, including regulatory compliance and risk quantification.


text: Risk Management and Strategy The Enterprise Risk and Return Council has delegated the power and authority to manage cybersecurity risks to the Information Security Council ("ISC"). The CISO chairs the ISC, with senior management representation from across the Company including representatives from Privacy, Legal and Technology. The ISC monitors, makes mitigating decisions about, and escalates information security risks that are outside the Company's established risk tolerance. Additionally, it provides executive sponsorship of information security controls and oversees the development and review of the information security policy and enterprise security standards.

companyName: ALLSTATE CORP

ticker: ALL


text: Allstate evaluates candidates for information security positions based on experience and qualifications. Senior leadership, team leads and subject matter experts conduct interviews to identify top candidates who represent the technical and behavioral acumen required of cybersecurity professionals at Allstate. Allstate provides cybersecurity employees with continuing education associated with their roles and responsibilities.


text: Information Security Program Allstate has implemented a robust Information Security Program to manage material risks from cybersecurity threats. The Company's Program uses a risk-based, defense-in-depth approach to identify, assess and manage cybersecurity risks to the Company's information assets and systems, enabling the business to achieve its objectives. The Information Security Program is aligned with industry best practices and standards including the ISO 27001/27002 standards, the Control Objectives for Information and Related Technologies The Allstate Corporation 31 Framework and the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF").


text: Allstate conducts risk and control assessments to proactively identify and assess the likelihood and impact of specific information security risks using the NIST CSF. The Company conducts these risk assessments at multiple levels of scope, including applications, business processes, business units, and enterprise. Allstate documents the identified risks, tracking them based on potential impact and the likelihood that harm might occur. The Company manages the risks in accordance with its Information Security Program.


text: Allstate's Information Security Program outlines the responsibilities and expectations for the security of Allstate information systems. The Program includes standards, policies and procedures requiring the implementation of technical, administrative and physical controls to manage the risk to Allstate information and systems. These standards, policies and procedures cover industry-standard information security domains, including risk assessment, third-party supplier risk management, vulnerability management, identity and access management, application security, network security, cybersecurity awareness training, encryption and incident management.


text: Allstate conducts periodic assessments, designed to evaluate effectiveness of implemented controls. The Company performs vulnerability scans and penetration tests to assess controls and proactively identify vulnerabilities for prioritization and remediation. Findings are managed and tracked in accordance with Allstate's governance, risk and compliance standards.


text: Dedicated personnel support information security operations 24 hours per day, seven days per week. Allstate's incident response program is designed to detect, respond and recover from a range of cybersecurity-related incidents.


text: The Audit Committee of the Allstate Board oversees the effectiveness of the cybersecurity program. The Audit Committee retains an external cybersecurity advisor to consult on cybersecurity matters and perform assessments of the Allstate Information Security Program (the "Program").


text: The Chief Information Security Officer ("CISO") regularly updates the Audit Committee and Allstate Board on Information Security Program status, cybersecurity risk management, the control environment, emerging threat intelligence and key risk and performance measurements.


text: Our CISO is responsible for the development and execution of the security strategy which protects Allstate's information from external and internal cybersecurity threats. He has more than 20 years of information security leadership experience.


text: Risk management and strategy The Enterprise Risk and Return Council has delegated the power and authority to manage cybersecurity risks to the Information Security Council ("ISC"). The CISO chairs the ISC, with senior management representation from across the Company including representatives from Privacy, Legal and Technology. The ISC monitors, makes mitigating decisions about, and escalates information security risks that are outside the Company's established risk tolerance. Additionally, it provides executive sponsorship of information security controls and oversees the development and review of the information security policy and enterprise security standards.


text: Information Security Program Allstate has implemented a robust Information Security Program to manage material risks from cybersecurity threats. The Company's Program uses a risk-based, defense-in-depth approach to identify, assess and manage cybersecurity risks to the Company's information assets and systems, enabling the business to achieve its objectives. The Information Security Program is aligned with industry best practices and standards including the ISO 27001/27002 standards, the Control Objectives for Information and Related Technologies Framework and the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF").


text: Allstate conducts risk and control assessments to proactively identify cybersecurity threats impacting the organization's business processes. The Company conducts enterprise threat-based risk assessments for multiple aspects of the business, including applications, infrastructure, environments and business processes. Allstate documents the identified risks, tracking them based on potential impact and the likelihood of them occurring.


text: Allstate performs control effectiveness tests, vulnerability scans and penetration tests to assess controls and proactively identify vulnerabilities for prioritization and remediation. Findings are managed and tracked in accordance with Allstate's governance, risk and compliance standards.


text: We also have a cybersecurity resiliency strategy that will enhance our ability to anticipate, withstand and recover from cybersecurity attacks and maintain the availability of our critical business operations. Cybersecurity resiliency plans improve our recovery speed to protect Allstate and its customers against adverse impacts due to ransomware and other cybersecurity events.


text: Cybersecurity Risk Management and Strategy Air Wisconsin's approach to mitigating information technology ("IT") and cybersecurity risk is comprised of a range of activities with the primary objective of maintaining the confidentiality, integrity and availability of its critical IT Systems and information related to its business. Although IT Systems are inherently vulnerable to interruption due to a variety of sources, Air Wisconsin has aligned its cybersecurity risk management program, including our processes and controls, with certain applicable and relevant guidelines, including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). Air Wisconsin assesses its cybersecurity maturity against the NIST CSF's core functions; however, this does not imply that it meets any particular technical standards, specifications or requirements, only that it uses the NIST CSF as a guide to help it identify, assess and manage cybersecurity risks relevant to its business.

companyName: HARBOR DIVERSIFIED, INC.

ticker: HRBR


text: Air Wisconsin's cybersecurity risk management processes include a cybersecurity incident response plan, and it has invested in technical and organizational safeguards intended to manage and mitigate material risks from cybersecurity threats to its IT Systems, including network security controls, employee training, internal vetting of third-party vendors and service providers with whom Air Wisconsin may share data, and regular system reviews and security exercises. Air Wisconsin's cybersecurity risk management program is a component of its overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Air Wisconsin works closely with accredited third-party cybersecurity firms to audit its security architecture. Air Wisconsin's Information Security Team, consisting of experienced cybersecurity professionals, is responsible for the day-to-day management of our cybersecurity risks, including directing its cybersecurity risk assessment processes, its security processes, and its response to cybersecurity incidents. For the year ended December 31, 2023, Air Wisconsin has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have or are reasonably likely to materially affect it, including its operations or business strategy or our results of operations or financial condition. Air Wisconsin faces certain ongoing risks from cybersecurity threats that, if realized, could materially adversely affect it, including its operations or business strategy or our results of operations or financial condition.


text: Cybersecurity Governance The Company considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to Air Wisconsin. Certain individuals within Air Wisconsin, including its Chief Financial Officer and Vice President of Information Technology ("IT Management") oversee the design, implementation and enforcement of our cybersecurity risk management program, including a cybersecurity policies and procedures manual. IT Management is supported by Air Wisconsin internal security staff and external experts as part of its continuing education on topics that impact public companies. Air Wisconsin's Vice President of Information Technology has more than 15 years of experience managing and leading IT and cybersecurity teams. IT Management is responsible for efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment. In the event of a breach or incident, the cybersecurity policies and procedures manual requires notification to Harbor's board of directors.


text: Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise IT environment; • A team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls and (iii) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, incident response personnel and senior management, including through the use of third-party providers for regular mandatory trainings; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A risk management process for third-party service providers, suppliers, and vendors. We employ rigorous vetting processes and ongoing monitoring mechanisms designed to ensure their compliance with cybersecurity standards.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board of Trustee's considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our potential cybersecurity risks and threats and receives presentations on cybersecurity topics from our Chief Information Officer. The Committee reports to the full Board of Trustees regarding its activities, including those related to cybersecurity. The full Board of Trustees also receives briefings from management on cybersecurity matters as needed.


text: Our management team, including our Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Information Officer has many years of experience leading cybersecurity oversight and overall has broad, extensive experience with information technology, including security, auditing, compliance, systems and programming.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. Our cybersecurity incident response plan governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior management and our Board of Trustees.


text: Risk Management and Strategy We employ a comprehensive risk management strategy for the assessment, identification and management of material risks stemming from cybersecurity threats. Our methodologies involve a systematic evaluation of potential threats, vulnerabilities, and their potential impacts on our organization's operations, data, and systems.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program, including legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise IT environment; • A team principally responsible for managing our (i) cybersecurity risk assessment processes, (ii) security controls and (iii) response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, incident response personnel and senior management, including through the use of third-party providers for regular mandatory trainings; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A risk management process for third-party service providers, suppliers, and vendors. We employ rigorous vetting processes and ongoing monitoring mechanisms designed to ensure their compliance with cybersecurity standards.


text: Risk management and strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: TANGER PROPERTIES LTD PARTNERSHIP /NC/


text: Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems are necessary for the operation of our business. We use these systems, among others, to manage our tenant relationships, for internal communications, for accounting to operate our record-keeping function, and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our technology department continuously identifies, evaluates and manages material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and tenant data in alignment with our business objectives and operational needs.


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors and consultants in evaluating and testing our risk management systems. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third parties include regular monitoring, threat assessments, and consultation on security enhancements. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, conducting security assessments, and conducting periodic reassessments during their engagement.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company or the Operating Partnership, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk factors" in this Annual Report, including the risk factor entitled "Cyber-attacks or acts of cyber-terrorism could disrupt our or our third-party providers' business operations and information technology systems or result in the loss or exposure of confidential or sensitive customer, employee or Company information", for additional discussion about cybersecurity-related risks.


text: The Board is focused on the critical nature of managing risks associated with cybersecurity threats. The Board has delegated to its Audit Committee oversight of management's processes for identifying and mitigating risks, including cybersecurity-related risks, to help align our risk exposure with our strategic objectives.


text: Board of Directors Oversight The Audit Committee of the Board oversees our annual enterprise risk assessment, where we assess key material risks within our Company, including technology risks and cybersecurity threats. The Audit Committee engages in regular discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. These discussions include the Company's risk assessment and risk management policies.


text: Management's Role Managing Risk Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management ("ERM") process. Cybersecurity related risks are included in the population that the ERM function evaluates to assess the top risks to the enterprise on a quarterly basis. To the extent the ERM process identifies a heightened cybersecurity related risk, management develops risk mitigation plans to minimize the risk. The ERM annual risk assessment is presented to the Audit Committee of the Board.


text: Monitor Cybersecurity Incidents The Senior Vice President of Information Technology ("SVP IT") is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The SVP IT implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we believe we have a well-defined incident response plan governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident.


text: Depending on the nature and severity of an incident, this process provides for evaluation by an executive management group to determine if the incident is material to us by evaluating the impact on our financial condition, reputation and potential litigation risk and regulatory impact. The management group is comprised of the Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, General Counsel, Chief Accounting Officer and the SVP IT to determine if escalation is necessary by the Chief Executive Officer to the Board (specifically our Lead Independent Director and the Audit Committee Chair).


text: Reporting to Board of Directors The SVP IT plays a pivotal role in informing the Audit Committee on cybersecurity-related risks. The Audit Committee holds quarterly meetings and the SVP IT provides periodic reports, on at least a quarterly basis, to the Audit Committee.


text: These reports cover a broad range of topics, including: • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards The SVP IT regularly informs our executive management group of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity environment and potential risks facing us. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Audit Committee, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: As of the date of this Annual Report, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: The Board is focused on the critical nature of managing risks associated with cybersecurity threats as well as challenges to our business from evolving information technology systems. The Board has delegated to its Audit Committee oversight of management's processes for identifying and mitigating risks, including cybersecurity risks such as network security, information and digital security, data privacy and protection, and risks related to emerging technologies such as generative artificial intelligence and machine learning, to help align our risk exposure with our strategic objectives.


text: Monitor Cybersecurity Incidents The Senior Vice President of Technology ("SVP Technology") is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The SVP Technology implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we believe we have a well-defined incident response plan governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident.


text: Depending on the nature and severity of an incident, this process provides for evaluation by an executive management group to determine if the incident is material to us by evaluating the impact on our financial condition, reputation and potential litigation risk and regulatory impact. The management group is comprised of the Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, General Counsel, Chief Accounting Officer and the SVP Technology to determine if escalation is necessary by the Chief Executive Officer to the Board (specifically our Lead Independent Director and the Audit Committee Chair).


text: Reporting to Board of Directors The SVP Technology plays a pivotal role in informing the Audit Committee on cybersecurity-related risks. The Audit Committee holds quarterly meetings and the SVP Technology provides periodic reports, on at least a quarterly basis, to the Audit Committee.


text: These reports cover a broad range of topics, including: • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards The SVP Technology regularly informs our executive management group of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity environment and potential risks facing us. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Audit Committee, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Our Audit Committee is required under its charter to periodically review our data privacy and information security programs. Our Audit Committee assists our Board in oversight and monitoring of our cybersecurity processes, including systems to collect and store confidential information, ongoing initiatives, current threats and our response readiness to cybersecurity attacks.

companyName: NVR INC

ticker: NVR


text: Our CIO and CISO communicate directly with members of the Audit Committee and Board of Directors on cybersecurity matters. In 2023, our CIO and CISO presented updates on our cybersecurity initiatives quarterly; twice to our Audit Committee and twice to our full Board.


text: The Company subscribes to a defense in depth strategy when it comes to cybersecurity and has processes in place to assist in the assessment, identification, and management of material risks from threats. The Company maintains technical and organizational safeguards, including employee training, incident response capability reviews, cybersecurity insurance and business continuity mechanisms for the protection of the Company's assets. From time to time, the Company's processes are audited and validated by internal and external experts. Semi-annually, the Company performs a risk mitigation assessment to assess and determine specific cybersecurity risks prevalent within the global information technology infrastructure and how those risks are mitigated. Further, through the use of an independent third-party service provider, the Company performs external penetration testing as well as internal network vulnerability testing to assess and identify gaps and vulnerabilities within the global information systems.

companyName: TITAN INTERNATIONAL INC

ticker: TWI


text: In the event of a cybersecurity breach, the Company would execute its incident response plan, which provides a structured response, including proper reporting and communication of the incident. When a cybersecurity incident is determined to be significant, it is addressed by Senior Director of Information Technology using processes that leverage subject-matter expertise from across the Company. Further, the Company typically will engage third-party advisors as part of our incident management processes. All cybersecurity incidents that are identified as having the potential to be highly significant to the Company are brought to the attention of SVP, Chief Financial Officer as part of our cybersecurity incident response processes. The Company's executive management would report such incidents to the Company's Board of Directors as deemed necessary based on the overall significance and impact to the Company.


text: Cybersecurity risk management is incorporated into our overall enterprise risk management program. As part of its enterprise risk management efforts, critical enterprise risks are assessed by senior management annually and discussed with the Company's Board of Directors.


text: There have been no recent incidents of cybersecurity breaches within the Company's information systems in the past three fiscal years. For additional information, refer to the section entitled "The Company may be adversely affected by a disruption in, or failure of, information technology systems" within Item 1A Risk Factors.


text: The Company subscribes to a defense in depth strategy when it comes to cybersecurity and has processes in place to assist in the assessment, identification, and management of material risks from threats. Our cybersecurity strategy is largely guided by key principles and frameworks from the National Institute of Standards and Technology (NIST). The Company maintains technical and organizational safeguards, including employee training, incident response capability reviews, cybersecurity insurance and business continuity mechanisms for the protection of the Company's assets. From time to time, the Company's processes are audited and validated by internal and external experts. Semi-annually, the Company performs a risk mitigation assessment to assess and determine specific cybersecurity risks prevalent within the global information technology infrastructure and how those risks are mitigated. Further, through the use of an independent third-party service provider, the Company performs external penetration testing as well as internal network vulnerability testing to assess and identify gaps and vulnerabilities within the global information systems.


text: Our cybersecurity team has an average of over 25 years of experience in information technology, security, and risk management, including individuals with a master's degree in business administration as well as a master's degree in cybersecurity.


text: Cybersecurity risk management is incorporated into our overall enterprise risk management program. As part of its enterprise risk management efforts, critical enterprise risks are assessed by senior management annually and discussed with the Company's Board of Directors. Our Board of Directors has ultimate oversight for risks relating to our cybersecurity program and practices and receives regular updates from management on cybersecurity risks and threats.


text: There have been no recent incidents of cybersecurity breaches within the Company's information systems in the past three fiscal years. For additional information, refer to the section entitled "The Company may be adversely affected by a disruption in, or failure of, information technology systems" within "Item 1A – Risk Factors" in Part I of this Form 10-K.


text: All information assets are inventoried, classified, prioritized, and protected based on the respective risk, with appropriate cybersecurity controls applied to each. We have also implemented and maintain a documents management program which governs the classification, protection, and use of sensitive company data within the Albemarle environment.

companyName: ALBEMARLE CORP

ticker: ALB


text: Cybersecurity Risk Management and Strategy We recognize the critical importance of maintaining the trust and confidence of patients, business partners, payors, clinical trial participants, and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our Board of Directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We generally follow the HITRUST Common Security Framework in our cybersecurity policies, standards, processes, and practices.

companyName: MYRIAD GENETICS INC

ticker: MYGN


text: To identify and assess material risks from cybersecurity threats, we maintain a cybersecurity risk management program that includes the identification, prioritization, and management of technical and non-technical risk to the confidentiality, integrity, or availability of patient, employee, clinical trial participant, payor, business partner, and company information. This program considers the risks associated with our industry and the technical and regulatory requirements related to the information systems and data involved. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process.


text: We have developed policies, standards, processes, and practices designed to protect our information systems and data from unauthorized access, cybersecurity attacks and other security incidents. The policies, standards, processes, and practices are implemented and enforced by dedicated IT and cybersecurity professionals. We utilize a variety of control measures and cybersecurity technologies that are designed to protect our availability of critical information systems and data, maintain regulatory compliance, assess, identify, and manage our material risks from cybersecurity threats, and protect against and respond to security incidents.


text: These controls and processes are reviewed periodically and include the following activities: • we monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices, and contracts (as applicable), we require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • we utilize technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, virtual private networks (VPN), Web Application Firewalls (WAF), intrusion detection systems, antivirus and endpoint detection and response software, multi-factor authentication (MFA), data encryption, encrypted backups, vulnerability scanning and patching, email anti-phishing technology, malicious URL and IP filtering, application controls, USB control and threat intelligence services; • our cybersecurity personnel include certified security professionals who are experienced in networks, computer systems, cloud cybersecurity, cybersecurity risk management, incident response, and security awareness training; • we regularly test and monitor our cybersecurity defenses to ensure that they are effective; and • we also conduct security awareness training for all employees to help them identify and mitigate cybersecurity risks.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security breaches, loss of data and other disruptions, including from cyberattacks, could compromise sensitive information related to our business, prevent us from accessing critical information or expose us to liability, which could adversely affect our business and our reputation" which disclosures are incorporated by reference herein. We did not experience any material cybersecurity incidents during the last fiscal year.


text: We have an incident response plan and processes in place for responding to cybersecurity incidents. The process includes steps to identify, contain, investigate, and remediate the impacts of the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. The plan involves the participation of a security incident response team that includes our Chief Legal Officer, our Privacy Officer, and other senior leaders in finance, communication, human resources, and legal. The plan includes procedures to communicate the incident to management and customers as appropriate and to provide information as required to state and federal law enforcement and regulatory bodies.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient, payor, business partner, and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, our data, or our facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: The Information Security teams include experienced, highly qualified architects, engineers and analysts who support all aspects of cybersecurity including security architecture, identity and access management, vulnerability management, security operations, as well as governance, risk and compliance. The majority of the Information Security staff holds at least one cybersecurity-related certification.

companyName: PATHWARD FINANCIAL, INC.

ticker: CASH


text: Role of the Board Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. In general, our Audit and Finance Committee of our Board of Directors has primary responsibility for and oversight over cybersecurity threats and our information security management program and considers specific risks, including, for example, risk associated with our strategic plan and business operations. The Audit and Finance Committee receives regular reports from our Chief Technology Officer and Senior Vice President, Technology - Enterprise IT and Engineering, on, among other things, material cybersecurity threat risks or incidents and developments, assessments of our security program and overall security posture, our incident response plan, and initiatives to strengthen our information security systems and mitigate cybersecurity risks. The Audit and Finance Committee, including Rashmi Kumar, provides insights and guidance to management on cybersecurity related matters. Ms. Kumar, who currently serves as Senior Vice President, Chief Information Officer, of Medtronic plc, is a seasoned technology leader with extensive experience in cybersecurity and information technology matters. Management, along with the chair of the Audit and Finance Committee and Ms. Kumar, regularly report to the Board of Directors on cybersecurity risks and other related matters reviewed by the Audit and Finance Committee.


text: Role of Management Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Technology Officer, who is supported by our leaders in Information Technology, Information Security, and IT Security Compliance. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, our Chief Technology Officer and Senior Vice President, Technology - Enterprise IT and Engineering regularly report to our Audit and Finance Committee about cybersecurity threat risks, among other cybersecurity related matters.


text: We have developed policies, standards, processes, and practices designed to protect our information systems and data from unauthorized access, cybersecurity attacks, and other security incidents. The policies, standards, processes, and practices are implemented and enforced by dedicated IT and cybersecurity professionals. We utilize a variety of control measures and cybersecurity technologies that are designed to protect our availability of critical information systems and data, maintain regulatory compliance, assess, identify, and manage our material risks from cybersecurity threats, and protect against and respond to security incidents.


text: These controls and processes are reviewed periodically and include the following activities: • we monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices, and contracts, as applicable, we require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • we utilize technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, virtual private networks (VPN), Web Application Firewalls (WAF), intrusion detection systems, antivirus and endpoint detection and response software, multi-factor authentication (MFA), data encryption, encrypted backups, vulnerability scanning and patching, email anti-phishing technology, malicious URL and IP filtering, application controls, USB control and threat intelligence services; • our cybersecurity personnel include certified security professionals who are experienced in networks, computer systems, cloud cybersecurity, cybersecurity risk management, incident response, and security awareness training; • we regularly test and monitor our cybersecurity defenses to ensure that they are effective; and • we also conduct security awareness training for all employees to help them identify and mitigate cybersecurity risks.


text: Pathward has a formal Enterprise Risk Management ("ERM") department. The Company's Chief Risk Officer is responsible for developing and executing the risk framework and ERM plan for the Company. The Company has implemented a three lines of defense model. The first line of defense ("1LOD") is responsible for owning, measuring, and managing the risks and controls. The second line of defense ("2LOD") is responsible for monitoring risk and controls in support of management. The third line of defense ("3LOD") is the independent audit function.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the risk factor "Security breaches, loss of data and other disruptions, including from cyberattacks and other cybersecurity incidents, could compromise personal, confidential, or other sensitive or proprietary information related to our business, prevent us from accessing critical information or expose us to liability, which could adversely affect our business and our reputation", included in Part I, Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference into this Item 1C. We did not experience any material cybersecurity incidents during the last fiscal year.


text: Role of the Board of Directors Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. In general, our Audit and Finance Committee of our Board of Directors has primary responsibility for and oversight over cybersecurity threats and our information security management program and considers specific risks, including, for example, risk associated with our strategic plan and business operations. The Audit and Finance Committee receives regular reports from our Chief Technology Officer and Senior Vice President, Technology - Enterprise IT and Engineering, on, among other things, material cybersecurity threat risks or incidents and developments, assessments of our security program and overall security posture, our incident response plan, and initiatives to strengthen our information security systems and mitigate cybersecurity risks. The Audit and Finance Committee, including Rashmi Kumar, provides insights and guidance to management on cybersecurity related matters. Ms. Kumar, who currently serves as Senior Vice President, Chief Information Officer, of Medtronic plc, is a seasoned technology leader with extensive experience in cybersecurity and information technology matters. Management, along with the chair of the Audit and Finance Committee and Ms. Kumar, regularly report to the Board of Directors on cybersecurity risks and other related matters reviewed by the Audit and Finance Committee.


text: Risk Management and Strategy We work proactively to identify, evaluate, and manage cybersecurity threats to our business. These threats include disruption and denial of critical systems and infrastructure, intellectual property theft, fraud, extortion, harm to customers and employees, legal and litigation risks, reputational risks, and the breach of confidential business data, which could include personally identifiable information. We employ both holistic and focused processes for identifying, assessing, managing, and disclosing material cybersecurity risks to our business. Our holistic review is part of our general risk management process, and involves our executive leadership team, team members from our finance, legal, tech, and operations teams, and external legal, financial, and risk advisors who are subject matter experts in identifying, assessing, mitigating and reporting material risks. Our focused review involves internal assessment by our cybersecurity team, as well as external review by a cybersecurity consulting services firm, to evaluate our cybersecurity program and our capacity to defend against and respond to potential cybersecurity threats.

companyName: COPART INC

ticker: CPRT


text: Risk Management and Strategy We have implemented systems and processes intended to secure our information technology systems and prevent unauthorized access to or loss of sensitive, confidential and personal data. These processes are implemented and overseen primarily by our Chief Information Officer (CIO) and Chief Information Security Officer (CISO). Our CIO has over 35 years of experience and in his 20 years at NVR has been responsible for the implementation and modernization of many of our key technologies across the enterprise. Our CISO has over 25 years of experience in information technology architecture, including over 18 years with NVR in progressively more senior information security roles.


text: Through strategic investments over several years, we have established and enhanced a comprehensive cybersecurity program consisting of security toolsets, people, policies, and contracted third-party service providers that provide technical, organizational, and administrative safeguards to protect against and timely respond to cybersecurity threats and incidents. Our cybersecurity strategy is based foremost on defense in depth, and secondarily on resilience. Defense in depth is a strategy of layered security, in which we employ a variety of overlapping controls, tools, and processes to defend against threat actors. Resilience is a strategy focused on business continuity and disaster recovery, with the goal of rapidly restoring, rebuilding, and recovering from any adverse cyber impacts to our business. These controls, tools and processes include technologies designed to detect and defend against unauthorized access to our systems and infrastructure, relevant corporate policies, periodic cybersecurity and privacy training programs, and incident response protocols for preventing, detecting, responding to and recovering from cybersecurity incidents. We use the National Institute for Standards in Technology (NIST) security framework to evaluate our cybersecurity controls, which we work to continuously enhance.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, financial condition, or results of operations, under the heading "Disruptions to our information technology systems, including failure to prevent outages, maintain security, and prevent unauthorized access to our information technology systems and other confidential information, could disrupt our business and materially and adversely affect our reputation, consolidated results of operations, and financial condition" included as part of our risk factor disclosures included in Item 1A of this report, which disclosures are incorporated by reference herein.


text: Our Board of Directors has delegated oversight of our cybersecurity program to our Audit Committee, and this oversight responsibility is reflected in our Audit Committee charter. Our Audit Committee receives quarterly updates from our chief information security officer on the status of these programs. Our Audit Committee also receives a detailed presentation from our chief information security officer on our cybersecurity program annually, which includes the results of an external third-party assessment. Our Audit Committee is comprised solely of independent directors, with one member who is a subject matter expert in technology and cybersecurity.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats, and has appointed a chief information security officer to lead our global cybersecurity organization for this purpose. Our executive management team and key members of our broader finance, legal, tech and operations organizations receive detailed monthly briefings from our chief information security officer on the status of our cybersecurity program and our readiness to prevent, detect, mitigate and recover from cybersecurity incidents.


text: Our chief information security officers leads our incident response team for addressing and recovering from identified cybersecurity incidents. Our incident response team includes key members of our tech, legal and executive management teams to manage our response efforts, which includes timely compliance with applicable contractual and regulatory notification obligations.


text: Risk Management and Strategy We have implemented systems and processes intended to secure our information technology systems and prevent unauthorized access to or loss of sensitive, confidential and personal data. These processes are implemented and overseen primarily by our Chief Information Officer (CIO) and Chief Information Security Officer (CISO). Our CIO has over 35 years of experience and in his 19 years at NVR has been responsible for the implementation and modernization of many of our key technologies across the enterprise. Our CISO has over 25 years of experience in information technology architecture, including over 17 years with NVR in progressively more senior information security roles.


text: Significant information technology processes that have been implemented include: - vulnerability management to help ensure security updates are effectively applied, - utilization of encryption and multi-factor authentication technologies to protect company data, - regular required training for all employees with systems access regarding matters such as cybersecurity threats and data protection, and utilization of simulated phishing tests to increase security awareness, - regular review of third-party service providers, including review of their system and organization controls (SOC) reports, - enhanced monitoring capabilities for early detection and rapid response to potential security anomalies, - documented incident response readiness process updated annually, - completion of tabletop exercises on potential cybersecurity breaches with the assistance of a third-party cybersecurity consultant, and - regular review of information technology disaster recovery and business continuity processes to help ensure the ability to resume work after an incident.


text: Review of these processes has been incorporated into our annual risk assessment and internal audits of controls performed by our Internal Audit department. Results of these audits are reported to the Audit Committee by our Vice President of Internal Audit and Corporate Governance.