text: While the Board of Directors has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, discussing with management, and overseeing the Company's data privacy, information technology and security and cybersecurity risk exposures, including: (i) the potential impact of those exposures on the Company's business, financial results, operations and reputation; (ii) the programs and steps implemented by management to monitor and mitigate any exposures; (iii) the Company's information governance and cybersecurity policies and programs; and (iv) major legislative and regulatory developments that could materially impact the Company's data privacy and cybersecurity risk exposure. On a quarterly basis, our General Counsel, Chief Financial Officer ("CFO") and CIO have been and are responsible to report to the Audit Committee on information technology and cybersecurity matters, including key risks, a detailed threat assessment relating to information technology risks, as applicable, the potential impact of those exposures on the Company's business, financial results, operations and reputation, the programs and steps implemented by management to monitor and mitigate exposures, and significant legal developments that could materially impact the Company's cybersecurity risk exposure.


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall Enterprise Risk Management ("ERM") process. As part of our ERM process, department leaders identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity. While we believe we maintain an effective cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors; A failure of our information technology infrastructure and cybersecurity threats may adversely affect our business and operations."

companyName: MADRIGAL PHARMACEUTICALS, INC.

ticker: MDGL

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our own systems, networks, and technology.

stage1Category: Strategy Integration


text: Since January 1, 2021 (the first date covered by the financial statements presented in this Form 10-K), we have not experienced any material cybersecurity incident.


text: Our cybersecurity plan, strategy, policy, standards, and processes are aligned with common security risk management framework and practices, including detailed tasks, plans and initiatives, which are reviewed and updated annually and periodically.

companyName: Dine Brands Global, Inc.

ticker: DIN


text: Our cybersecurity program is risk-based with an underlying threat modeling framework to enable us to track and measure our progress based on five pillars: strategy and foundation, teach and communicate, build and enhance, risk reduction and maturity, and security compliance. Our program framework and foundation are based on common security standards and frameworks, including ISO/IEC 27001/2:2022 and NIST Cyber Resiliency Framework and Model, in alignment with PCI DSS, privacy laws and regulatory requirements.


text: Our Chief Information Security Officer ("CISO") leads our cybersecurity team and is generally responsible for management of cybersecurity risk and the protection and defense of our networks and systems. Our CISO has 25 years of experience serving in various roles related to cybersecurity and information security. Our Security Steering Committee ("SSC"), chaired by our CISO, is comprised of executive level representatives from our Information Technology ("IT"), legal, enterprise risk management and internal audit teams and is responsible for oversight, evaluation and coordination of activities related to safeguards, security risk, controls, remediation activities, policy governance and other factors. Our cybersecurity plan, strategies, policies, standards, and processes are aligned with common security risk management frameworks and practices including detailed tasks, plans and initiatives. Our program also incorporates incident response plans and notification protocols, to assess and manage incidents and threats, including their materiality.

stage1Category: Management Role

stage1Method: majority


text: Our cybersecurity program uses layered security defenses, cyber resiliency and automation capabilities for our security functions and operations. Our cybersecurity roadmap outlines and defines the security initiatives, projects and tasks. All security efforts and projects are discussed by the SSC. Security events are identified via multiple channels, including without limitation security detection mechanisms, near real-time system alerts, out-of-bound channels and dark web monitoring. Our employees and vendor partners are also trained to report any security events to the cybersecurity team, who will escalate and notify the legal team, senior executives, and Board of Directors as needed.


text: Our cybersecurity risk management program is based on legal and regulatory requirements and considerations. Cybersecurity risks are included as an integral part of our broader Enterprise Risk Management ("ERM") program and reviewed quarterly by internal stakeholders comprised of cross-functional team to assess the risk level and strength of our mitigation strategies. Our cybersecurity risk assessment is performed regularly throughout the year, and may include: • Regular cybersecurity program, risk and incidents reporting to the Board of Directors; • Quarterly cybersecurity risk reporting to the Enterprise Risk Committee, which includes the Company's Chief Executive Officer, Chief Financial Officer, Senior Vice President, Legal, General Counsel & Secretary, Internal Audit, Chief Information Officer and CISO; and • Monthly Security Steering Committee meetings with members from the Company's cybersecurity, ERM, IT, internal audit and legal teams.


text: We engage with a range of third-party cybersecurity service providers, assessors and auditors to evaluate and enhance the effectiveness of our cybersecurity program. Services provided by these third parties include 24/7 security logging, network and endpoint monitoring, vulnerability scanning, penetration testing, security incident response tabletop exercises and security and compliance posture assessments. Vendor security monitoring is an important component of our cybersecurity program to ensure our vendors are securing and protecting our critical infrastructure, data, and information, integrated with our contract management process, including security addenda and vendor security risk assessments for new contracts and annual vendor security risk assessments for critical vendors.


text: Our security incident response plan provides guidelines and requirements for reasonable and consistent responses to security incidents to limit damage while preserving the confidentiality, integrity and availability of Company systems and information, and reducing recovery time and cost, including but not limited to, escalation of security incidents to appropriate team members for investigation and response and documenting the required steps for investigation and remediation taken during the security incident response. We perform an annual tabletop exercise led by third-party security experts with participation from executive management and technical internal teams.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.


text: The Board of Directors recognizes the importance of cybersecurity in safeguarding the Company's sensitive data. The Board of Directors is responsible for overseeing overall risk management for the Company. The Audit Committee receives reports from the CISO regarding the cybersecurity program. The presented topics include, but are not limited to, the status of ongoing cybersecurity initiatives, incident reports and compliance with industry standards. Members of the Board of Directors also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

stage1Category: Board Governance


text: Cybersecurity Risk Management and Strategy We have designed and maintain a cybersecurity risk management program that is integrated into our overall enterprise risk management program and with other related functions, such as information technology, or IT, system architecture and vendor management; that leverages best practices and standards and that is designed to assess, identify and manage risks from cybersecurity and other information security threats. As part of this program, we periodically evaluate risks from cybersecurity threats as part of our broader risk management activities and as a component of our internal control system. In the course of our evaluation, we consider risks that may be associated both with our internally managed information technology, or IT, systems and key business functions and with sensitive data operated or managed by third-party service providers, vendors and collaborators with whom we engage.

companyName: Mersana Therapeutics, Inc.


text: We use the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF, as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. We have designed and assessed our program based on the NIST CSF. This does not imply that we meet any particular technical standards, specifications or requirements.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other relate breaches.


text: Key aspects of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, and information; • dedicated personnel principally responsible for managing our cybersecurity risk assessment processes, our security controls and our response to cybersecurity incidents; • the conduct of regular exercises and tests of our own systems to help discover potential vulnerabilities; • the use of external service providers, where appropriate, overseen by our IT team, to assist with assessing our systems, monitoring cybersecurity threats, including the proactive identification of vulnerabilities in our systems with threat intelligence, and our defenses against cyberattacks and providing timely cybersecurity threat alerts; • new-hire, annual and ad hoc cybersecurity awareness training for our employees, incident response personnel and senior management; • a cybersecurity incident response plan, or the Response Plan, that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process, overseen by our IT team, for key service providers, vendors and collaborators, including a due diligence process that involves the completion of security questionnaires and risk assessments, as appropriate, on third parties who maintain material data or information to help us evaluate and verify third party information security capabilities.


text: In addition, our cybersecurity policies, standards, processes and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness.

companyName: APi Group Corp

ticker: APG


text: Our Response Plan sets forth our response protocol for cybersecurity threats and cybersecurity events and incidents and is maintained by our cybersecurity incident response team, or CSIRT, which reviews the Response Plan on at least an annual basis. The CSIRT is comprised of IT department leaders, including our Vice President, Information and Technology, who reports to our Senior Vice President, Chief Operating Officer and Chief Financial Officer, as well as members of our executive team and other senior management. Our Response Plan is designed to provide a framework for how we identify, evaluate, escalate, respond and recover in the event of a data security breach and designates personnel who are responsible for these functions. Our IT team, utilizing the support of external vendors and software products, evaluates security alerts received from various sources, and any alert or threat that the CSIRT identifies as a cybersecurity incident is promptly evaluated and escalated in accordance with the Response Plan for further assessment. Upon confirmation that a cybersecurity incident has occurred, our CSIRT will establish an incident response team, which may include representatives from our internal departments, as well as internal or external legal counsel or other external cybersecurity consultants or service providers. The CSIRT aims to develop a coordinated response strategy, including with respect to risk containment, notification processes, system restoration, incident documentation and assessment, data preservation and forensic analysis.


text: Our Response Plan is designed to ensure that cybersecurity incidents that have had or are reasonably likely to have a material effect on our business strategy, financial condition, and results of operations are promptly escalated to relevant executive officers, including our Senior Vice President, Chief Legal Officer, for further assessment of potential materiality and, if appropriate, notification to other members of our senior management team, the chairperson of the audit committee of our board of directors, or the Audit Committee, and the full board of directors, as needed, and preparation and dissemination of public disclosure.


text: Cybersecurity threats have not materially affected our business strategy, results of operations or financial condition to date, but we, our collaborators and our third-party vendors and service providers may in the future be the target of cybersecurity threats, any of which could have a material adverse effect on our business. For a description of the cybersecurity risks we face and potential related impacts on us, see "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance and Oversight Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's ongoing activities related to our cybersecurity risk management program.


text: Our Audit Committee receives and provides feedback regarding periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding significant cybersecurity threats or incidents.


text: Our Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives briefings from our executive team, informed by our Vice President, Information & Technology, on our cybersecurity risk management program, on a periodic basis.


text: Our executive team, including our Senior Vice President, Chief Operating Officer and Chief Financial Officer and our Senior Vice President, Chief Legal Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The executive team has primary responsibility for our overall cybersecurity risk management program. Our Senior Vice President, Chief Operating Officer and Chief Financial Officer supervises our Vice President, Information and Technology, who leads the operational oversight of our company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare our company and our internal cybersecurity personnel and retained external cybersecurity advisors to address cybersecurity risks. Our Vice President, Information & Technology has over 25 years of experience managing IT and cybersecurity programs, including two decades of experience implementing endpoint security, network security, incident response plans and end user training programs. Our internal cybersecurity personnel collectively have experience in cybersecurity, information security, data protection, privacy, regulatory compliance and risk management within complex and international business verticals, such as pharmaceuticals/biotechnology, technology, telecommunications and financial services, and hold several related third-party certifications related to information systems management and security.


text: Our executive team is informed about and monitors the prevention, detection, evaluation, mitigation, and remediation of key cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external advisors engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management & Strategy Cybersecurity is identified as a top enterprise risk given the company's reliance on information technology systems and networks for business and operational activities. Linde has taken steps to address these risks and concerns by implementing cybersecurity and risk management processes that include advanced security technologies, internal controls, network and data center resiliency and disaster recovery processes.

companyName: LINDE PLC

ticker: LIN


text: Linde is implementing a series of security enhancements based on the Zero Trust principle. Linde maintains a Standard Operating Procedure for Global Security Incident Response that defines how Linde responds to cyber incidents, including escalation, reporting and remediation procedures. Dedicated cybersecurity teams conduct surveillance for potential threats and implement both procedural and technological controls to protect data and to maintain safe, uninterrupted operations. The company engages third parties in connection with these efforts to provide independent analysis and advice on cybersecurity risks, incidents and other cyber security related matters. In addition, to help our people recognize information and cybersecurity concerns and respond accordingly, Linde conducts mandatory trainings and cybersecurity awareness programs for employees.


text: Third party software providers that facilitate Linde's business activities are also sources of cybersecurity risk for the company. Linde performs risk assessment procedures including evaluation of the overall health of the control environment for certain third-party providers.

stage1Category: Third-Party Risk


text: Despite these steps, however, our information technology systems have in the past been and in the future will likely be subject to increasingly sophisticated cyber attacks. Operational failures and breaches of security from such attempts could lead to the loss or disclosure of confidential information or personal data belonging to Linde or our employees and customers or suppliers. These failures and breaches could result in business interruption or malfunction and lead to legal or regulatory actions that could result in a material adverse impact on Linde's operations, reputation and financial results. To date, such attempts have not had any significant impact on Linde's operations or financial results.


text: Information and cybersecurity risk management fall under the oversight of the Audit Committee. The Audit Committee receives an annual review, followed by quarterly updates, of the Company's cybersecurity systems, enhancements, strategies and risk management efforts, and the Chair of the Audit Committee will be promptly notified of any material cybersecurity breach incident. In addition, the full Board reviews cybersecurity as part of its regular risk reviews. Linde has appointed a Global Chief Information Officer (CIO) reporting to the Chief Financial Officer (CFO). A Chief Information Security Officer reports to the CIO and is supported by a global IT security team.


text: Enterprise Risk Management Gulfport increasingly relies on digital technology to optimize our business. As our reliance on technology expands, we are exposed to additional cyber-risks, which we focus on assessing, identifying, and managing. These risks include, but are not limited to: financial risks, operational risks, safety concerns, employee and owner personal information and violation of data privacy or security laws.

companyName: GULFPORT ENERGY CORP

ticker: GPOR


text: Managing Material Risks & Integrated Overall Risk Management We take an integrated approach to assessing and identifying cybersecurity risks and threats. At the corporate level, cybersecurity is identified as a key risk within our Enterprise Risk Management (ERM) program. Our management of cyber risk is based on the National Institute of Standards and Technology's (NIST) cybersecurity framework. While the NIST cybersecurity framework is our foundation, we combine that with the Center for Internet Security's (CIS) control framework.


text: We utilize a defense-in-depth approach, layering security starting with cloud-based tools through our perimeter all the way to the client and server end points with End Point Detection and Response solutions. We continue to invest and align advances in technology to strengthen our security posture. This year, for example, we implemented additional protections against phishing attacks by utilizing artificial intelligence to further strengthen our defense. Cyber risks and incidents are categorized by severity, evaluated for materiality, responded to based on defined incident response playbooks and then remediated accordingly. We perform organized tabletop exercises to test these practices and identify areas where opportunities for improvement can occur.


text: We acknowledge that—even with advanced security tools—we are only as strong as the people that use our technology. That is why we design phishing simulations and require multiple security trainings for every employee annually. Our partnerships with law enforcement, the Oil and Natural Gas Information Sharing Center and our third party partners continually mature our cyber program as threats evolve.


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity risk, we leverage strategic external partnerships to assess and mitigate cybersecurity threats to us. For example, in addition to our security analysts, we partner with third parties that provide 24/7 security operations monitoring, enhancing our response time. We are also audited by third parties for compliance with information security standards and assess vulnerabilities annually, providing additional expertise that strengthens our security posture.


text: Managing Third Party Risk We also recognize the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems, and we have processes in place to oversee and manage these risks. We maintain ongoing monitoring to ensure compliance with our cybersecurity standards.


text: Committee reports to the Board regarding its activities, including those related to cybersecurity. The Board also receives briefings from management on our cybersecurity risk management program.

companyName: Alset Inc.

ticker: AEI


text: Risk Management Personnel Cybersecurity remains a top identified enterprise-wide risk for our business and is overseen by our Chief Information Officer who is responsible for identifying and mitigating information security risks. Our current CIO has 20 years of industry experience and over 10 years of experience with the development, training and controls of effective global enterprise cybersecurity programs. The CIO's responsibilities include but are not limited to: (i) reviewing our enterprise risk register and functional risk register; (ii) maintaining adequate processes to manage the identified risks under our cybersecurity program; (iii) analyzing logs of cybersecurity threats and vulnerabilities; (iv) overseeing prevention, detection, mitigation and remediation efforts; and (v) developing, maintaining, and ensuring team familiarity with the above mentioned incident response plan. Additionally, we maintain an experienced information technology team at the employee level that supports our Chief Information Officer in implementing our cybersecurity program and internal reporting, security and mitigation functions.


text: Board of Director Oversight The Audit Committee receives a detailed cybersecurity update annually from the Chief Information Officer and receives a cybersecurity update quarterly through the ERM program as a key risk.


text: We recognize the critical importance of maintaining the safety and security of our information systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. This process is supported by our senior leadership team, the Audit Committee, and our Board of Directors.


text: The responsibilities of the Chief Information Officer ("CIO") include overseeing cybersecurity measures with the global Chief Information Security Officer ("CISO"). The CIO's background includes nearly 18 years of IT leadership at a major medical technology company and experience in various industries such as financial services, manufacturing, oil and gas, and chemicals. He holds an undergraduate degree in Management Information Systems from Augsburg University and a Master of Business Administration from Carlson School of Management at the University of Minnesota.


text: The CISO, who reports to our CIO, is generally responsible for management of cybersecurity risk and the protection and defense of our networks and systems. The CISO manages a team of professionals with broad cybersecurity experience and expertise. Our CISO has served in various roles in information technology and information security for over 20 years and holds an undergraduate degree in Information Systems from Xavier University and an MBA from Michigan State. The CISO and his regional security leaders have a combined total of over 25 Information Technology and Cybersecurity certifications, including Certified Information Systems Security Professional, Certified Cloud Security Professional, and Certified Information Security Manager.


text: The CISO and the cybersecurity team are committed to ongoing education and professional development, regularly participating in training programs and industry conferences to stay abreast of the latest cybersecurity trends, threats, and mitigation strategies.


text: The CISO has appointed experienced security leaders over the North America and International regions to create additional alignment and collaboration.


text: Risk Management and Strategy Our cybersecurity risk management program primarily leverages the National Institute of Standards and Technology Cybersecurity framework (NIST CSF). We routinely assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our risk management program also assesses third party risks to attempt to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. As part of our cybersecurity risk management program, we also gather Threat Intelligence through our multiple security partners and tools. This intelligence (including tactics, techniques and procedures used by cyber criminals) provides insights into potential threats and vulnerabilities, which helps us to defend against cyber-attacks.


text: As part of our cybersecurity risk management system, our incident management teams track and log privacy and security incidents across the Company. Significant incidents are reviewed by a cross-functional and multi-disciplinary working group to determine whether further escalation is appropriate. Any cybersecurity incident that meets certain pre-established criteria is reported to our Executive Crisis Management Team ("ECMT"), which includes members of the Company's senior leadership team. The ECMT maintains an ongoing relationship with third-party advisors, such as forensic and incident management, crisis communications, and legal advisors, which we engage as necessary based on the specific facts of an incident. Incidents are evaluated to determine materiality for external reporting purposes as well as operational and business impact.


text: Assessment of our Program We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third parties. Our IT security team monitors alerts and meets as needed to discuss threat levels, trends, and remediation.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.

companyName: G1 Therapeutics, Inc.


text: Our commitment to cybersecurity begins at the Board, includes our Audit Committee, and extends to our senior leaders across the company. Our Audit Committee oversees our enterprise risk management process. The Audit Committee's responsibilities include regular review of policies and practices with respect to risk assessment and risk management – including in the areas of cybersecurity and other information technology risk and privacy. The Audit Committee performs an annual review of the Company's cybersecurity program and reports to the Board on the results of that review. Material cybersecurity incidents are discussed with our Audit Committee and Board of Directors.


text: Cybersecurity Risk Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: Risk management and strategy We rely on information technology and data to operate our business and develop and advance our pipeline of product candidates. Our critical information technology includes computer networks, third-party hosted services, communications systems, software and infrastructure, and our critical data includes confidential, personal, proprietary and sensitive data (collectively, Information Assets). Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring and assess potential material impact to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity and availability of our Information Assets and mitigate harm to our business.

companyName: Lyell Immunopharma, Inc.

ticker: LYEL


text: Risks from cybersecurity threats are among those that we review and address in our general risk management program. We identify such threats by, among other things, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting threat assessments for internal and external threats and conducting vulnerability assessments to identify vulnerabilities.


text: We rely on a multidisciplinary team (including from our information security function, management and third party service providers, as described further below) to assess how cybersecurity threats could impact our business. We routinely assess the likelihood that such threats could result in a material impact to our Information Assets, business and clinical operations, core business functions, personnel, reputation and identified critical business objectives.


text: Based on our assessment process and depending on the environment, we implement and maintain various technical, physical and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Assets, including, for example: policies and procedures designed to address cybersecurity threats, including an incident response plan, disaster recovery and business continuity plans; incident detection and response; internal and/or external audits to assess our exposure to cybersecurity threats, compliance with risk mitigation procedures and effectiveness of relevant controls; documented risk assessments; background checks on our personnel; encryption of data; network security controls; access controls; physical security; asset management; systems monitoring; employee training; penetration testing; and cyber insurance. We prioritize our efforts based on the threats that we believe are more likely to lead to a material impact to our business, such as ransomware, theft of intellectual property and interruption of services and processes on which we rely.


text: We work with third parties that assist us to identify, assess and manage cybersecurity risks, including professional services firms, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers and penetration testing firms.


text: To operate our business, we utilize certain third party service providers to perform a variety of functions, such as outsourced business functions, professional services, software-as-a-service platforms, managed services, property management, cloud-based infrastructure, data center facilities, encryption and authentication technology and corporate productivity services. Depending on the nature of the services provided, the sensitivity and quantity of information processed and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, conducting on-site inspections and requiring their completion of written questionnaires regarding their cybersecurity programs. For service providers that provide particularly critical services to us or process particularly sensitive information for us, we engage industry leaders with robust and documented cybersecurity programs.


text: For additional information about the risks from cybersecurity threats that may materially affect us and how they may do so, see the section entitled "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K, including "If our information technology systems or those third parties upon which we rely, or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm and other adverse consequences."

stage1Category: None/Other


text: Our cybersecurity risk management strategy relies on input from management, including our Chief Operating Officer, Mr. Stephen Hill, to help us understand cybersecurity risks, establish priorities and determine the scope and details of our cybersecurity program and to implement it. Mr. Hill has held senior management positions at numerous pharmaceutical companies for over a decade. Management is responsible for hiring appropriate personnel, integrating cybersecurity considerations into our overall risk management strategy and for communicating key priorities to employees and other stakeholders. Our cybersecurity incident response and vulnerability management processes involve management, who participate in our disclosure controls and procedures.


text: Management meets regularly to discuss cybersecurity risk and to review our cybersecurity program. Management is also responsible for approving budgets, helping prepare for cybersecurity incidents, responding to cybersecurity incidents, approving cybersecurity policies and procedures, reviewing audit reports and reporting to our board of directors, testing incident response plans and engaging vendors that provide cybersecurity services. Management participates in cybersecurity incident response efforts by being members of the incident response team and helping direct our response to cybersecurity incidents.


text: Our board of directors has overall responsibility for evaluating key business risks faced by us, including cyber security and information technology. The audit committee of our board of directors assists the board of directors in the oversight and assessment of risks relating to data privacy, technology and information security, including cybersecurity.


text: Our audit committee holds regular meetings to discuss issues including our cybersecurity threats and has a dedicated agenda during such meetings that are designed to assist our board of directors and our audit committee in exercising their oversight function. The meetings involve presentations and reports from our management and specifically includes updates of current cybersecurity threats faced by us and steps we are taking to address them.


text: We recognize the critical importance of maintaining the trust and confidence of customers, patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST") and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our board of directors provides oversight of our cybersecurity risk management and strategy processes, which are led by our General Counsel and Chief Compliance Officer, Vice President, Information Technology and Associate Director of Information Technology Operations, and Chief Operations Officer.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST, as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; • provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; • conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • conduct at least annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • conduct annual tabletop exercises facilitated by a third party to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • review and revise our incident response plan at least annually to ensure that it is current with respect to our technology and current risks; • leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; • review privileged network and application accounts every three (3) months for appropriate access privileges, and review user accounts every six (6) months; and • review and test our disaster recovery plan annually to confirm effective and efficient recovery processes are in place to support business continuity in the event of a disaster.


text: we are still in the process of developing a formal incident response plan, our team is trained and had practical experience to cover all phases of the incident management process, including identification, containment, eradication, recovery, and post-incident analysis.

companyName: DNA X, Inc.

ticker: SONM


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. When we identify a vendor who may pose a cybersecurity threat risk, we will require those third parties to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Our business and operations could suffer in the event of system failures, cyberattacks, or deficiency in our cyber security," which disclosures are incorporated by reference herein.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents. We did not incur any expenses related to penalties and settlements.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, our board of directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks, including those from cybersecurity threats, to its audit committee.


text: On an annual basis, our board of directors receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our board of directors generally receives materials that include a cybersecurity scorecard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Vice President, Information Technology. Our board of directors also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Members of our board of directors may also engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Vice President, Information Technology, Associate Director of Information Technology Operations, General Counsel and Chief Compliance Officer, and Chief Operations Officer. Such individuals have collectively over 30 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, our Vice President of Information Technology and Associate Director of Information Technology Operations report to our board of directors about cybersecurity threat risks, among other cybersecurity related matters, on an annual basis.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. These risks affect us, as well as our suppliers, customers, and ultimately their consumers.

companyName: Luminar Technologies, Inc./DE

ticker: LAZRQ


text: We also maintain an incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: While we have not experienced any material cybersecurity threats or incidents in recent years, there can be no guarantee that we will not be the subject of future threats or incidents. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See "Risk Factors" for a discussion of cybersecurity risks.

companyName: Cardiff Oncology, Inc.

ticker: CRDF


text: We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things: • adoption of frameworks established by the National Institute of Standards and Technology ("NIST") and International Organization for Standardization ("ISO") for a flexible, tailored, and risk-based approach to cybersecurity, helping to ensure a continuous process of identifying, protecting, detecting, responding, and recovering from cyber incidents; • alignment with ISO 21434 (automotive security) and ISO 27001 (information security management) standards, addressing cybersecurity aspects of automotive products and the broader information security management system to establish, implement, maintain, and continually improve confidentiality, integrity, and availability, as well as meeting the cybersecurity standards and product requirements established by our OEM customers; • conducting regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems; • providing cybersecurity training programs for employees, management, and directors, including conducting periodic phishing tests to promote awareness for all employees and all contractors with access to corporate email systems; • leveraging industry best practices for incident handling to help identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident, and participating in an industry information sharing and analysis center; • employing threat intelligence monitoring processes to model, research, and respond to cyber threats in a proactive manner; • closely monitoring emerging data protection laws and implementing changes to our processes accordingly; • undertaking a periodic review of public-facing policies and statements related to cybersecurity; • carrying information security risk insurance that may provide some protection against the potential losses arising from a cybersecurity incident; and • tracking key performance indicators pertaining to cybersecurity incidents, response and recovery, vulnerabilities, and risks. These approaches vary in maturity across the business and we work to continually improve them.


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall enterprise risk management assessment process, covering all company risks. As part of this process appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.


text: We conduct regular internal reviews of our cybersecurity program which are overseen by our executive management, and material issues are presented to the board of directors. Our cybersecurity department also participates as part of our regular quarterly Disclosure Committee to review risks requiring disclosures in financial reporting.


text: Our processes also address oversight and identification of cybersecurity threat risks from our use of third-party service providers, including those in our supply chain. This involves, among other things, conducting pre-engagement risk-based diligence and ongoing monitoring as needed. We also engage third-party service providers from time to time to assist in risk assessment and implementation of monitoring tools, and we review our cybersecurity controls with auditors.


text: Our business strategy, results of operations and financial condition have not been materially affected by cybersecurity risks, threats, or incidents in the past, and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none. We continue to invest in the cybersecurity and resiliency of systems and products and to enhance our internal controls and processes, which are designed to help protect our systems, products, and the information they contain. Nevertheless, we cannot guarantee that we will not be materially affected in the future by such risks or experience future material incidents.


text: We more fully describe whether and how risks from identified cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under Item 1A. of this Form 10-K. See the risk factors captioned "We may experience difficulties in managing our growth and expanding our operations," "We are subject to cybersecurity risks to our and our suppliers' operational systems, security systems, infrastructure, integrated software in our LiDAR solutions and customer data processed by us or third-party vendors or suppliers and any material failure, weakness, interruption, cyber event, incident or breach of security could prevent us from effectively operating our business" and "Failures, or perceived failures, to comply with privacy, data protection, and information security requirements in the variety of jurisdictions in which we operate may adversely impact our business, and such legal requirements are evolving, uncertain and may require improvements in, or changes to, our policies and operations."


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management.


text: The Audit Committee of our Board ("Audit Committee") is responsible for the oversight of cybersecurity, including assessment, prevention, detection, and remediation of cyber risks, threats and incidents. Multiple times per year, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards predetermined risk-mitigation-related goals, our incident response plan, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives materials including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks, and describing the Company's ability to mitigate those risks, and discusses such matters with our Vice President of IT, who is responsible for cybersecurity and is supported by our Chief Legal Officer. Members of the Audit Committee also regularly engage in ad hoc conversations with management on cybersecurity-related matters and news events and discuss any updates to our cybersecurity risk management and strategy programs. When incidents occur, depending on the nature and severity, the Audit Committee Chair is notified immediately, and incidents are further reviewed periodically with the Audit Committee. Material cybersecurity matters are also periodically reviewed with the full Board of Directors.


text: Management of Material Risks & Integration into Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity awareness and risk management and have incorporated cybersecurity considerations into our decision-making processes. Our risk management team works closely with our IT department to identify, evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Our risk management team also provides regular reporting to management on our enterprise cybersecurity risk posture.

companyName: National Storage Affiliates Trust

ticker: NSA


text: Engagement of Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage a range of external experts, including cybersecurity assessors and consultants in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, so that we can better understand the current and evolving cybersecurity risks and strategies. Our collaboration with these third-parties includes periodic audits, threat assessments, and consultation on security enhancements.


text: Risks from Cybersecurity Threats We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K, including "Security breaches through cyber-attacks, cyber-intrusions, or other methods could disrupt our information technology networks and related systems", for additional discussion about cybersecurity-related risks.


text: The board of trustees is acutely aware of the critical nature of managing risks associated with cybersecurity threats and oversees the Company's cybersecurity risk management activities.


text: Board of Trustees Oversight The audit committee of our board of trustees is central to the board of trustees's oversight of cybersecurity risks and bears the primary responsibility for this domain. The members of the audit committee have a variety of expertise, including financial, regulatory and risk management. The audit committee reviews our policies with respect to risk assessment and risk management related to cybersecurity. The audit committee and the board of trustees receive updates on the Company's cybersecurity risks and initiatives periodically. In addition, cybersecurity matters are reported to the audit committee or board of trustees so that the board of trustees and audit committee can effectively carry out their oversight role.


text: Management's Role Managing Risk Our risk management committee is comprised of a cross section of the Company's management team. The risk management committee has identified cybersecurity as a key risk to the Company's operations and established a cybersecurity sub-committee, which is comprised of members of the risk management committee and other personnel, to focus on this key risk.


text: The cybersecurity sub-committee plays a pivotal role in informing the risk management committee on cybersecurity risks. They provide comprehensive briefings to the risk management committee on a regular basis. These briefings encompass a broad range of topics, including: • Awareness of cybersecurity landscape, emerging threats, trends and developments; • Status of ongoing cybersecurity initiatives and strategies • Incident reports and learnings from any cybersecurity events • Compliance with regulatory requirements and industry standards; and • Education in cybersecurity and associated risk management frameworks.


text: The risk management committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are a consistent focus of the Company and that the Company's cybersecurity efforts are aligned with the overall risk management framework. We have also implemented cybersecurity training at all levels of our organization and conduct periodic phishing assessment for our employees to reinforce that training.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the cybersecurity sub-committee. With over a combined 45 years of experience in the field of cybersecurity, the cybersecurity sub-committee brings a wealth of expertise to their role. Their in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our cybersecurity sub-committee oversees our cybersecurity strategies, tests our compliance with standards, remediates known risks, and leads our employee training program.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise information technology ("IT") environment; • a cybersecurity team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls and respond to cybersecurity incidents as needed; • cybersecurity awareness training of our employees, cybersecurity incident response team and senior management; • a cyber incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors.

companyName: FIGS, Inc.

ticker: FIGS


text: Monitor Cybersecurity Incidents The cybersecurity sub-committee stays apprised about the latest developments in cybersecurity, including potential threats and innovative risk management techniques, which is important for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The cybersecurity sub-committee implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the cybersecurity sub-committee is equipped with a well-defined incident response plan, which provides a framework to mitigate the impact of cybersecurity incidents The cybersecurity sub-committee regularly informs the risk management committee of matters related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the board of trustees, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity policies and procedures, which are integrated into the Company's overall risk management framework. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: Empire State Realty Trust, Inc.

ticker: ESRT


text: We partner with third parties to implement and assess the effectiveness of our cybersecurity prevention and response systems and processes. We have a Managed Security Services provider (MSSP) that provides a 24 x 7 x 365 Security Operations Center (SOC) and works with our information technology (IT) team to employ a variety of monitoring technologies to detect and be alerted to potential cyber threats, as well as establish and implement procedures for the mitigation and remediation of any cybersecurity incidents. We conduct an annual penetration test, regular phishing tests, and annual cybersecurity training for our employees.


text: Additionally, the management team of the Company has developed a cyber incident response plan to deploy in the event of a cyber threat. This plan is reviewed and updated at least annually and tested from time to time through tabletop exercises involving management and other key personnel, and may also include participation from the Board and outside experts. As part of regular business continuity planning, department heads are required to consider key technology systems used by their respective teams and the impact to the Company and other stakeholders in the event that such systems become compromised or unavailable. Additionally, we monitor and identify cybersecurity risks posed by third-party vendors who provide software and/or hardware to the Company or otherwise have access to our Company systems and have a cyber review process that is part of vendor onboarding.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Refer to the risk factor captioned "Cyberattacks and any failure to comply with related laws could negatively impact us." in Part I, ITEM 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: Our Board of Directors oversees our risk management process, including with respect to cybersecurity risks, directly and through its committees. The Audit Committee of the Board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports on our enterprise risk profile on a quarterly basis. Our Chief Technology Officer is responsible for leading the assessment and management of cybersecurity risks and reports at least quarterly or more frequently as needed to the Audit Committee on cybersecurity strategy and risks.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a written information security program, cybersecurity policy, cyber incident response policy and cyber incident response plan.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall strategic risk management program, and shares common methodologies, reporting channels and governance processes that apply across the strategic risk management program to other legal, compliance, strategic, operational and financial risk areas.


text: When engaging third-parties, we have procedures and protocols designed to protect our information technology systems and our confidential information. For example, before we grant third-parities access to our information technology systems, we require agreements with such third-parties, we require such third parties to complete cybersecurity training and we typically require specific contract terms in our agreements with such third-parties.

companyName: COMPASS Pathways plc

ticker: CMPS


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. See Item 1A. "Risk Factors—Risks Related To Information Technology, Cybersecurity and Data Privacy—System interruptions that impair customer access to our website or other performance failures in our or our third-party vendors' technology infrastructure could damage our business, reputation and brand and substantially harm our business, financial condition and results of operations."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives regular reports from management, including our Chief Technology Officer ("CTO") and Director of Information Security. These reports encompass a broad range of topics, such as our cybersecurity risks, the current cybersecurity landscape and the status of ongoing cybersecurity initiatives. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management team, including our CTO and Director of Information Security, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for the day-to-day operation and implementation of our overall cybersecurity risk management program and supervises both our internal cybersecurity team and our retained external cybersecurity consultants. Our management team, including our CTO and Director of Information Security, also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Our CTO's background includes 13 years of experience leading technology at several eCommerce companies and our Director of Information Security has 15 years of experience in the field of cybersecurity, including extensive experience as head of information security at public and private companies. Their combined in-depth knowledge and experience are instrumental in developing and executing our cybersecurity risk management program.


text: Our industry is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations. While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. See Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the section titled "Risk Factors—Risks Relating to Regulation" for additional information regarding the risks related to cybersecurity threats.

companyName: Marqeta, Inc.

ticker: MQ


text: Our Chief Information Security Officer ("CISO") is responsible for Marqeta's information security posture and cybersecurity program. We believe our CISO is qualified to assess and manage our material risks from cybersecurity threats based on 15 years of cybersecurity and risk management expertise as a security and risk management leader at various public and private companies and as a cyber threat intelligence analyst for a branch of the United States military. Our CISO reports to our Chief Product and Technology Officer and oversees a team of cybersecurity professionals in areas including Governance, Risk, and Compliance, Product and Infrastructure Security, Security Operations, and Identity Security.


text: Our cybersecurity program is designed to align with certain industry standards and best practices, such as ISO 27001 and the National Institute of Standards and Technology Cybersecurity Framework. We have a Cyber Incident Response Plan which defines roles and responsibilities in the event of a cybersecurity incident, as well as the processes for keeping the CISO, senior management, and the board of directors informed about the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee. Our CISO provides quarterly and as-needed briefings to the audit committee regarding cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, and activities of third party consultants. Our audit committee provides quarterly and as-needed updates to the board of directors on such reports and management provides annual and as-needed updates to the board of directors regarding our cybersecurity program.


text: We have policies and processes in place for assessing, identifying, and managing material cybersecurity risks, and integrate these processes into our overall risk management systems. We conduct periodic risk assessments to identify reasonably foreseeable internal and external cybersecurity risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: AUDACY, INC.


text: Following these risk assessments, we develop strategies, policies, standards, and action plans to minimize identified risks and reasonably address any identified gaps in existing safeguards. These steps include vulnerability management, shift-left secure product design, data encryption, endpoint security, network security, limiting and authorizing access controls, and multi-factor authentication for access to systems with data. We also employ system monitoring, logging, and alerting to retain and analyze the security state of our corporate and production infrastructure. As part of our overall risk management system, all employees are required to complete annual cybersecurity training and relevant employees are trained at least annually on applicable safeguards.


text: We engage consultants in connection with our risk assessment processes to help us design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We manage third party service providers using a risk-based approach intended to determine if the relevant third parties have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of their security measures that may affect our business.


text: The maturation and scaling of our cybersecurity program is ongoing and despite our investments in our cybersecurity program, there will always be residual risk and the potential for control failure or bypass by a determined cyber threat actor.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity policies and procedures, which are integrated into the Company's overall risk management framework. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: Empire State Realty OP, L.P.

ticker: ESBA


text: We partner with third parties to implement and assess the effectiveness of our cybersecurity prevention and response systems and processes. We have a Managed Security Services provider (MSSP) that provides a 24 x 7 x 365 Security Operations Center (SOC) and works with our information technology (IT) team to employ a variety of monitoring technologies to detect and be alerted to potential cyber threats, as well as establish and implement procedures for the mitigation and remediation of any cybersecurity incidents. We conduct an annual penetration test, regular phishing tests, and annual cybersecurity training for our employees.


text: Additionally, the management team of the Company has developed a cyber incident response plan to deploy in the event of a cyber threat. This plan is reviewed and updated at least annually and tested from time to time through tabletop exercises involving management and other key personnel, and may also include participation from ESRT's Board and outside experts. As part of regular business continuity planning, department heads are required to consider key technology systems used by their respective teams and the impact to the Company and other stakeholders in the event that such systems become compromised or unavailable. Additionally, we monitor and identify cybersecurity risks posed by third-party vendors who provide software and/or hardware to the Company or otherwise have access to our Company systems and have a cyber review process that is part of vendor onboarding.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Refer to the risk factor captioned "Cyberattacks and any failure to comply with related laws could negatively impact us." in Part I, ITEM 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: ESRT's Board of Directors oversees our risk management process, including with respect to cybersecurity risks, directly and through its committees. The Audit Committee of ESRT's Board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports on our enterprise risk profile on a quarterly basis. Our Chief Technology Officer is responsible for leading the assessment and management of cybersecurity risks and reports at least quarterly or more frequently as needed to the Audit Committee on cybersecurity strategy and risks.


text: Cybersecurity risk management and strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal risks. This includes cybersecurity, a critical component of our broader enterprise risk management program given the increasing reliance on technology by customers, vendors, agents, and our own employees and the ever-evolving risk of cyber threats. Our Chief Information Security Officer leads the Information Security team that administers the Company's information security program, which covers cybersecurity risk. The Chief Information Security Officer reports to the Chief Digital & Innovation Officer, and works alongside the Chief Risk Officer who provides an effective second line of defense on technological and security risk management. Our cybersecurity program aims to address risks through a cross-functional approach that focuses on confidentiality, security, and availability of information vital to protecting our customers, employees, stakeholders, and the Company as a whole.

companyName: PROVIDENT FINANCIAL SERVICES INC

ticker: PFS


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt, or misuse our critical systems or gain unauthorized access to sensitive information. The structure of our information security program is designed to address applicable laws, regulatory guidance, and industry best practices, including Section 501 (b) of the Gramm-Leach-Bliley Act and its implementing regulations, the Federal Financial Institutions Examination Council ("FFIEC") Information Technology Examination Handbook, FFIEC Business Continuity Planning Handbook, FFIEC Cybersecurity Assessment Tool, and the Center for Internet Security Critical Security Controls. In addition, we leverage certain industry and government associations, vendors, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Chief Information Security Officer, Chief Digital & Innovation Officer, and our Chief Risk Officer, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends, issues, and emerging risks and identify best practices.


text: We employ a "defense in depth" methodology, which focuses on protecting information systems, products and services by deploying multiple layers of security controls in order to mitigate risks. We leverage human capital, customer input, responsive processes, and effective technology as part of our efforts to manage and maintain cybersecurity controls, data access standards, risk management standards, and encryption standards. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cybersecurity risk, including an acceptable-use policy and terms of acceptance that all employees must review and abide by, regular and on-going education and training for employees, information notices, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, network architecture, and data repositories, using internal cybersecurity experts and external specialists and vendors. We require critical third-party vendors to establish incident response and reporting to our information security team and to maintain business continuity plans. We also actively monitor our e-mail gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. Remote workers are required to login to our network through a secure virtual private network with password and multi-factor authentication in order to minimize security risks while working outside the office. The Information Security Department consistently identifies vulnerabilities with our systems, implements protective updates and patches, and monitors the status of remediation efforts. Regular reports on these activities are provided to management committees to ensure transparency and oversight of our cybersecurity practices.


text: We maintain a Corporate Incident Response Plan ("CIRP") that provides a documented set of protocols for responding to actual or potential cybersecurity incidents, including timely detection and analysis, containment and elimination, and recovery and improvement following an incident. The CIRP provides for notification of appropriate information breach or cybersecurity incidents and escalation to the Company's appointed Incident Management Team, which would be composed of an Incident Response Lead and team members from information technology, information security, enterprise risk management, corporate security, compliance, and legal teams, among others. The Incident Management Team would leverage the expertise of team members to work together to respond to the incident and take appropriate measures. The Senior Risk Committee would oversee the team and receive quartelry reporting on the incident and any relevant updates. The CIRP is coordinated through Incident Management Teams that involve the Bank's Incident Management Lead, Chief Digital & Innovation Officer, Chief Information Security Officer, and other key departments.


text: The CIRP facilitates coordination across multiple parts of our organization and is evaluated by the Chief Risk Officer and legal department at least annually.


text: Board and management governance Our Chief Information Security Officer is accountable for managing our enterprise information security department and administering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity governance administration, third-party risk management, and business resilience to ensure confidentiality, availability, and integrity of technological assets, as well as maintenance of policies, procedures, and standards. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Chief Information Security Officer and Chief Risk Officer, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Risk Officer. The department as a whole, consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. Our Chief Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.


text: Our board of directors has approved committees including the Risk Committee, which oversees overall risk management activities and policies including those related to technological and cybersecurity risks, and the Technology Committee, which oversees the Company's technology strategy and approach to technology-related risks. The Risk and Technology Committees of the board are comprised of independent directors and receive regular reports from management, including the Chief Information Security Officer and Chief Risk Officer, on risk management, cybersecurity risks, actions taken to mitigate them, and technology and risk strategies. The Technology Committee reviews and approves our information security and technology budgets, policies, and strategies quarterly. The Risk Committee reviews our technology and cybersecurity risk profile on a regular basis.


text: We are committed to combating the threat of cyber-attacks and to securing our business through our information security programs and developing a deep understanding of cybersecurity risks, vulnerabilities, mitigations, and threats. We have a global cybersecurity process applicable to all subsidiaries and business lines.

companyName: BGC Group, Inc.

ticker: BGC


text: The Company has also formed management committees including the Management Risk Committee, which focuses on multiple aspects of risk management including information technology, and the Technology Steering Committee, which focuses on technology and cybersecurity policy within the Bank. These management committees provide oversight and governance of our technology and information security programs. The management committees are chaired by managers within the information technology and information security departments and include the Chief Risk Officer, Chief Information Security Officer, and Chief Digital & Innovation Officer as well as their direct reports and other key departmental managers from throughout the entire company. The management committees meet at least quarterly to provide oversight of key risk management strategies, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks, especially those related to cybersecurity and technology risks. More frequent meetings occur from time to time in accordance with the CIRP in order to facilitate timely informing, monitoring, and response efforts. The Chief Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Technology Steering Committee of the board on a monthly basis (or more frequently as may be required by the CIRP).


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks remains elevated. Our internal systems, processes, and controls are designed to mitigate loss from cyberattacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not to our knowledge materially affected the Company. For further discussion of risks from cybersecurity threats, see the section captioned "Risks Related to Technology and Security" in Item 1A. Risk Factors.


text: Information Security Program The mission of our information security organization is to design, implement, and maintain an information security program that protects our systems, services, and data against unauthorized access, disclosure, modification, damage, and loss. The information security organization is comprised of internal and external security and technology professionals. We continue to make investments in information security resources to mature, expand, and adapt our capabilities to address emerging cybersecurity risks and threats. The information security organization is overseen by the Information Security Advisory Team, further detailed under the caption "Cybersecurity Governance" below.

companyName: MARA Holdings, Inc.

ticker: MARA


text: Cybersecurity Risk Management and Strategy Cybersecurity risk management is one component of our information security program that guides continuous improvement to, and evaluates the confidentiality, integrity, and availability of our critical systems, data, and operations.


text: Our approach to controls and risk management is based on guidance from the National Institute of Standards and Technology ("NIST") and the CryptoCurrency Security Standard ("CCSS"). This does not mean that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST and CCSS as a guide to help us identify, assess, and manage cybersecurity controls and risks relevant to our business.


text: Our cybersecurity risk management program includes: • Identifying cybersecurity risks that could impact our facilities, third-party vendors/partners, operations, critical systems, information, and broader enterprise IT environment. Risks are informed by threat intelligence, current and historical adversarial activity, and industry specify threats; • Performing a cybersecurity risk assessment to evaluate our readiness if the risks were to materialize; and • Ensuring risk is addressed and tracking any necessary remediation through an action plan.


text: While we face a number of ongoing cybersecurity risks in connection with our business, such risks have not materially affected us to date, including our business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated the oversight of cybersecurity and other information technology risks to the Board's Audit Committee. As part of this oversight, we created the Information Security Advisory Team (the "Task Force"). The Task Force is comprised of senior managers and executives from multiple departments within the Company, including the IT, finance, legal and operations departments. The Task Force oversees our information security program and our strategy, including management's implementation of cybersecurity risk management. The Task Force meets at least quarterly to discuss matters involving cybersecurity risks.


text: The Task Force ultimately provides information to our Audit Committee regarding its activities, including those related to cybersecurity risks. The Audit Committee also receives a briefing and continuing education from a member of the Task Force relating to our cyber risk management program at least annually. The Task Force is responsible for notifying the Audit Committee of material cybersecurity incidents.


text: To date, we have not identified any risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents experienced by us or, to our knowledge, by any of our third-party service providers, that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. Refer to the risk factor captioned "Our business and operations would suffer in the event of computer system failures, cyber-attacks or deficiencies in our cyber security or cyber security of our collaborators, vendors and other partners." in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks.


text: Cybersecurity Risk Management and Strategy CRH leverages its Enterprise Risk Management (ERM) framework to identify, assess, respond, monitor and report material cybersecurity risks facing the Company. CRH manages cybersecurity risk at multiple levels within the Company. Given CRH's wide geographic spread, the frequency and possible scale of acquisition activity, the diversity of the types of IT systems operated by CRH companies and the decentralized nature of its operations, CRH implements an amalgam of centralized and decentralized processes for IT management. Under this model, Company-level management and the management of CRH's operating subsidiaries and business units share responsibility for cybersecurity management and collaborate on assessing, identifying, and managing material risks.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: CRH's operating subsidiaries and business units use a variety of tools and processes to identify and manage material cybersecurity risks. Across the Company, CRH utilizes multiple monitoring tools and practices to identify and detect unusual activities and/or potential cybersecurity incidents, including potential system breaches, and to verify the effectiveness of protective measures. CRH's operating subsidiaries and business units implement various risk mitigation strategies, including continuously strengthening security measures, improving incident response plans through post-incident evaluations and assessments, investing in security technologies, providing regular and focused employee training, and transferring risk through cybersecurity insurance.


text: At the Group level, CRH conducts a semi-annual bottom-up risk assessment focused on CRH's operating subsidiaries and business units, including cybersecurity-related risks, which evaluates the impact and likelihood of the identified cyber risks and the effectiveness of existing security measures, policies, and procedures. CRH also requires that each operating subsidiaries completes a self-assessment regarding its cyber controls and risk, including user awareness training, email security protection, multi-factor authentication, system patch management, identity management, network segregation, antivirus and web protections, asset inventory, privileged access management, logging, monitoring, and incident response capabilities. As described further below under "Cybersecurity Governance", CRH's Board and senior management receive regular briefings on cybersecurity risks facing CRH and are closely involved in identifying cybersecurity risks, developing CRH's plan for managing such risks, and continuously refining CRH's cyber defenses in response to the information gathered through the above-mentioned risk assessments.


text: To manage the risk of a material impact on CRH's operations or financial performance due to a cybersecurity incident, CRH has implemented a mandatory Cybersecurity Incident Escalation Standard as part of its Company-wide Information Security Policy. This Standard, which is supported by relevant guidelines and procedural documentation, provides a structured approach adapted to the systems of each CRH operating subsidiary and business unit to manage the incident response process through a series of pre-defined phases, including triage, containment, eradication, recovery, and post-incident analysis.


text: CRH also provides regular and focused training to aid employees in understanding and complying with relevant Company policies and applicable regulations, including those related to cybersecurity.