text: While we have experienced threats to our data and systems, to date, we have not experienced a cybersecurity incident that has materially affected our business strategy, results of operations, or financial condition. That said, a significant cybersecurity incident may materially impact our business strategy, results of operations and financial condition in the future. For further information regarding cybersecurity risks, see Item 1A, "Risk Factors" in this Annual Report.

companyName: METHODE ELECTRONICS INC

ticker: MEI


text: We have a Written Information Security Program ("WISP") to protect personal and proprietary information in compliance with applicable federal and state requirements. WISP is designed to: • Ensure the security and confidentiality of personal information; • Protect against any anticipated threats or hazards to the security or integrity of personal information; and • Protect against unauthorized access to or use of such personal information in a manner that creates a substantial risk of identity theft or fraud. For more information about these risks, see the risk factor titled "Our business is subject to the risk of terrorism, cyberattacks, or failure of key information technology systems," "Breaches of our information systems could adversely affect our reputation, disrupt our operations, and result in increased costs and loss of revenue," and "If our efforts to protect the security of personal information related to any of our customers, consumers, vendors, or employees are unsuccessful and unauthorized access to that personal information is obtained, or we experience a significant disruption in our computer systems or a cyber security breach, we could experience an adverse effect on our operations, we could be subject to costly government enforcement action and private litigation, and our reputation could suffer" under Item 1A.

companyName: American Outdoor Brands, Inc.

ticker: AOUT

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: Our Board of Directors has assigned oversight of cybersecurity risk management to the Audit Committee. The Audit Committee regularly receives reports from management, including information technology ("IT") leadership, and third parties on cybersecurity matters. In addition, our full Board of Directors receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates.

stage1Category: Board Governance


text: IT leadership is responsible for developing appropriate cybersecurity programs, including as may be required by applicable law or regulation. This includes the coordination and creation of an Incident Response Policy, Incident Response Team, and Incident Response Plan in the event of a cybersecurity event. The AOB incident response policy covers our internal program and guidelines. The incident response team is composed of various stakeholders from all necessary aspects of the business, and the plan includes the steps to follow and communications necessary if/when a cybersecurity event occurs. The individual incident response team members represent expertise in IT, cybersecurity, and operations that has been obtained generally from a combination of education and awareness, including relevant degrees and/or certifications, and work experience. The head of IT has served in various roles in information technology and information security for over 28 years, including serving in technical management and leadership positions in multiple verticals for 19 years. The head of IT holds undergraduate and graduate degrees in computer science and has attained the several recognized network and security certifications throughout their career. The individual incident response team members are informed by their respective cybersecurity teams about, and monitor, the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.

stage1Category: Management Role


text: Information regarding cybersecurity risks may be elevated by IT leadership through a variety of channels, including discussions between or among key leaders and our management and reports to the Company's Board of Directors and/or certain Board committees. As noted above, the Audit Committee regularly receives reports on cybersecurity matters from senior IT leadership.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.

stage1Category: Strategy Integration


text: Risk management and strategy We depend on information systems and technology in substantially all aspects of our business, including running our manufacturing operations and communicating among our employees, suppliers and customers. Such uses of information systems and technology give rise to cybersecurity risks, including risk of system disruption, security breach, ransomware, theft, espionage and inadvertent release of information. We have a risk-based cybersecurity program, dedicated to protecting our data and information technology systems. These cybersecurity threats and related risks make it imperative that we remain vigilant and apprised of developments in the information security field, and we expend considerable resources on cybersecurity. With Board of Directors and Audit Committee oversight, as part of our annual enterprise-wide risk management process, we assess and manage the material risks associated with cybersecurity.


text: We work with industry-leading third parties that assist us to identify, assess, and manage cybersecurity risks, including professional services firms, legal advisors, threat intelligence service providers, and penetration testing firms. We conduct periodic internal and third-party assessments to evaluate our cybersecurity posture and test and assess our incident response plan, incident roles and responsibilities, material impact evaluation, and decision-making processes in the event of a cybersecurity incident. We use our risk and security assessments to enhance our information security capabilities.


text: We rely heavily on our supply chain to deliver our products and services to our customers, and a cybersecurity incident at a supplier, subcontractor or third-party partner could materially adversely impact us. To address this, our vendor management process involves different levels of assessment depending on the services provided by the vendor, the sensitivity of the related information systems and data, and the identity of the provider. It is designed to help identify cybersecurity risks associated with a vendor and work with the vendor to address or mitigate those risks.

stage1Category: Third-Party Risk


text: Our Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks, including cybersecurity. The Audit Committee of the Board of Directors is responsible for regularly reviewing with management our cybersecurity practices and policies. The Audit Committee regularly reports risks and compliance actions to the Board. As part of its oversight role, the Audit Committee receives regular reporting about our strategy, programs, incidents and threats, and other developments and action items related to cybersecurity regularly throughout the year, including through quarterly updates from the Chief Information Officer ("CIO") who is also our Chief Information Security Officer. In addition, on at least an annual basis, the full Board of Directors receives reports, summaries or presentations related to cybersecurity threats, risk, mitigation and related processes from our CIO.


text: Our cybersecurity program and related initiatives are managed by the CIO, and our IT team is responsible for enterprise-wide informational technology, coordinating with various functions and business groups to ensure they are following best practices.


text: Our CIO, who has more than 25 years of experience in technology and information security risk management across a number of organizations, is responsible for overseeing the risks related to cybersecurity. He is responsible for cybersecurity incident preparedness, approving cybersecurity processes, reviewing security assessments and other security-related reports, and providing the senior leadership with regular updates on cybersecurity-related matters.

stage1Method: majority


text: Our security operation center monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: In the event of a suspected incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying the CIO and functional areas (e.g. legal) as appropriate. The CIO will make any required communications to the Chief Executive Officer (CEO) and other senior leadership, with the CIO making any required communications to the Board and Audit Committee. Our CEO, Chief Financial Officer, General Counsel and CIO are responsible for assessing such incidents for materiality, ensuring that any required notification, disclosure or communication occurs and determining, among other things, whether any prohibition on the trading of our common stock by insiders should be imposed prior to the disclosure of information about a material cybersecurity event.


text: Risk Management and Strategy We are committed to protecting the confidentiality, integrity, and availability of our systems and information. Our security program is intended to assess, identify, and manage risks from cybersecurity threats, and is aligned with the National Institute of Standards and Technology Version 2.0 Cybersecurity Framework ("NIST CSF"). The NIST CSF provides a flexible model for identifying and managing cybersecurity risks. Our security infrastructure uses a layered controls approach, incorporating various capabilities guided by the NIST CSF and other industry standards and best practices. We routinely invest in our security processes and capabilities, including those related to our risk management and assessment programs, vulnerability and intrusion detection, incident response plans, and other advanced detection, prevention, and protection capabilities.

companyName: PAYCHEX INC

ticker: PAYX


text: We conduct regular assessments of cybersecurity risks to identify threats to us and potential vulnerabilities that could negatively affect our business operations if exploited. We track cybersecurity risks within our enterprise risk management system with cybersecurity threats considered to be among the top-priority risks to us. In addition, our Enterprise Security Organization (the "ESO") conducts technical risk assessments, and, in some instances, we engage with third-party experts to assist with or perform technical risk assessments. The results of these risk assessments are reported to management. Our processes require escalation of significant cybersecurity risks to management and Paychex's Audit Committee derived from the Board of Directors (the "Board").


text: The ESO is led by our Chief Information Security Officer ("CISO") and seeks to maintain a consistent, resilient, and secure infrastructure by partnering with resources across the Company. The ESO implements numerous cybersecurity processes and capabilities, which include but are not limited to: assessing risk associated with significant infrastructure or operational changes and the introduction of new technologies; administering our third-party service provider risk management program; managing secure software development and change management; managing access management and logical access controls, identifying security vulnerabilities through automated scanning technologies; performing penetration testing and due diligence assessments; and protecting the confidentiality, integrity, and availability of the Company's data in transit. The ESO includes the activities of the Paychex Cyber Fusion Center, which provides 24x7x365 cybersecurity monitoring and incident response. We maintain incident response plans which outline the escalation, investigation, reporting, and overall response procedures depending on the type and severity of incidents.


text: As part of our security program, we require all employees to take information security awareness training upon hire and annually thereafter. We provide additional ongoing training to our employees about security best practices and awareness, including internal phishing simulations.


text: We maintain a program designed to assess and manage the cybersecurity-related risk associated with third-party service providers that we rely on as part of providing services to our clients. This program incorporates a risk-based approach based on service criticality and type of information. Vendor risk assessments are performed and documented within our vendor management system. As part of the vendor risk assessment, we conduct an information security program evaluation of critical third-party providers before engagement and, based on our assessment of the vendor's risk, contractually require certain third parties we engage to implement security programs commensurate with their risk profile.


text: As of May 31, 2024, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, and financial condition. We continue to invest in cyber-resilience and cyber-threat response preparedness as we anticipate ongoing risks from cybersecurity threats. Refer to the "Risk Factors" section contained in Item 1A of this Form 10-K for more information on our cybersecurity-related risks.


text: Cybersecurity risks are overseen by the Audit Committee of our Board. Annually, the Audit Committee reviews an assessment of our risk management processes with the Board. The Audit Committee is responsible for reviewing significant cybersecurity risk exposures and the steps management has taken to monitor, control, and report such exposures. The Audit Committee receives quarterly updates from our CISO regarding our cybersecurity risk management program. These updates include a status of current capabilities, ongoing initiatives, and the evolving cybersecurity threat landscape.


text: Our management is responsible for implementing our security program, which is overseen by our Security Governance Council (the "SGC") that regularly reports to our CEO and Audit Committee. The SGC is chaired by our CISO and is comprised of senior leaders and key personnel throughout the Company to support cross-functional representation. The members of the SGC are comprised of our executives and managers who understand our business operations, including but not limited to individuals from the following departments: Operations, Information Technology, Finance, Internal Audit, Legal, Human Resources and Organizational Development, and Risk Management. The SGC meets on a quarterly basis with the mission to develop, coordinate, and sustain the organization's enterprise security program; coordinate and respond to security risks and incidents; and develop, implement, and maintain the organization's enterprise security strategy in alignment with, or in support of, business goals and objectives. The recommendations of the SGC are considered when updating the information security policies, procedures, and standards at Paychex.


text: Our CISO has over two decades of experience in various roles involving information security: developing and implementing cybersecurity programs to protect the confidentiality, integrity, and availability of information systems and data. Our CISO has earned relevant degrees and holds several information security certifications, including the Certified Chief Information Security Officer certification. Prior to joining Paychex in September 2019, he served as VP and CISO at a publicly traded company in the HCM industry. Before that, he held security leadership positions at several banks, insurance companies, and professional services firms.


text: Our CISO reports to our Senior Vice President of Information Technology and Product Development ("SVP of IT and PD"). Our SVP of IT and PD has over 45 years of experience in the field of information technology and has earned a relevant degree. Prior to joining Paychex in November 2008, he held senior leadership positions at several technology, financial services, and HCM companies.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information with the aim to continually improve security to keep pace with the evolving cyber threat landscape.

companyName: KalVista Pharmaceuticals, Inc.

ticker: KALV


text: Our strategy toward managing cybersecurity risk in our business is informed by and aligned with the core principles and methods outlined within the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, while including elements of the International Organization for Standardization's ISO/IEC 27001 publication and industry best practices. This does not mean that we seek to meet any particular technical standards, specifications, or requirements, only that we intend to use the NIST CSF or ISO 27001, and other resources as guides to help us identify, assess, and manage cybersecurity risks relevant to our business. Inclusive in these frameworks and our program are components for continuous improvement through feedback, self-review and external testing.


text: Our cybersecurity program leverages people, processes and technology to identify and respond to cybersecurity threats in a timely manner. As part of our cybersecurity program, we maintain various protections designed to safeguard against cyberattacks, including but not limited to firewalls, endpoint detection and response, anti-malware, immutable backups, multi-factor authentication schemes, data encryption, and security system information event monitoring to detect and respond quickly to any emergent threats. In addition, we periodically conduct intrusion and penetration testing through third parties to evaluate our cybersecurity response capability.


text: The audit committee assists the board of directors in fulfilling its oversight responsibilities with respect to the management of risks arising from cybersecurity threats, and our security team provides written reports to the audit committee for its review. The audit committee is responsible for reporting findings related to its review of these matters to the board of directors.

companyName: HUBSPOT INC

ticker: HUBS


text: We also maintain a security awareness program with mandatory semi-annual training content and perform automated e-mail based phishing tests. Results of testing help to inform and provide continuous improvement of our security awareness training materials, approaches and strategies. We routinely communicate with employees about the potential for cybersecurity threats, including the latest adversary trends and social engineering techniques, and how to avoid them, and the best use of our established communications channels.


text: We perform a formal cybersecurity risk assessment each year. As part of our risk assessment, we consider the potential for cybersecurity threats, including but not limited to interruptions, outages and breaches to our operational and financial systems. We have policies, processes, internal controls and tools to assess, identify, and manage material risks from potential cybersecurity threats. We engage third-party service providers, with significant information technology and cybersecurity experience, to assist with designing, implementing and managing our information technology infrastructure and cybersecurity program.


text: In addition, we engage external third-party information security consultants to periodically conduct information security testing and assessments designed to identify, assess, and manage cybersecurity risks, and to evaluate our overarching information security program and specific incident response procedures. We perform diligence on our vendors and prospective vendors regarding their cybersecurity posture. Although we continue to invest in this diligence regarding our critical vendors, our control over the security posture of our vendors is limited, and there can be no assurance that we can prevent or significantly mitigate the risk of any compromise or failure in the information assets owned or controlled by such vendors.


text: The Director of IT is responsible for implementing and maintaining the information security program. The Director of IT role is currently held by an individual who has over 20 years of experience in enterprise-level IT operations and management, cybersecurity operations and management and IT/Cyber architecture and strategy. The Director of IT reports to our VP of Finance, who together are responsible for coordinating information security risk assessments and overseeing periodic testing of our cybersecurity controls. Our VP of Finance meets with the Audit Committee of our board of directors periodically for the audit committee to provide guidance on the prioritization of the risk remediation and ongoing implementation of cybersecurity improvements across our organization.


text: The Director of IT engages with our managed service providers to proactively address emerging threats based on industry reports and respond to any threats and incidents. Our managed service providers also provide continuous support and coverage of our environment. We utilize threat intelligence services from multiple organizations, allowing us to proactively respond to emerging cybersecurity threats.


text: Our board of directors considers cybersecurity risk part of its risk oversight function and has delegated to the Audit Committee of our board of directors oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The relevant members of management regularly update the Audit Committee with respect to cybersecurity risk, also on an ad-hoc basis as necessary, regarding any material cybersecurity incidents and any incidents with lesser impact potential. The Audit Committee periodically reports to the full board of directors regarding its activities, including those related to cybersecurity.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, we are subject to various cybersecurity risks that may adversely affect our business, financial condition and results of operations. See Item 1A. Risk Factors, "Our business and operations would suffer in the event of system failures, cyberattacks or a deficiency in our cybersecurity" for further discussion.


text: Our Board of Directors (the "Board") recognizes the importance of cybersecurity and safeguarding our information systems and data assets. It is imperative that we maintain the trust and confidence of our customers, business partners and employees. Protecting our data and the data of our customers, business partners and employees is critical to maintaining that trust. As such, the Board is actively involved in overseeing our cybersecurity risk management program.

companyName: CULP INC

ticker: CULP


text: Risk Management and Strategy We manage cybersecurity risks as part of our broader enterprise risk management framework, which allows us to leverage existing, robust processes for assessing the effectiveness and coverage of our controls.


text: Our CISO, who reports to the Executive Vice President – Chief Digital and Information Officer and Chief Transformation Officer, leads our information security team and has responsibility for overseeing FedEx's cybersecurity program. The CISO, who has over 25 years of experience at FedEx and has received industry-recognized information security certifications, oversees an information security organization of more than 400 security, risk, and compliance professionals based in the U.S. and internationally across the FedEx enterprise. The leadership team of our information security organization has extensive experience in IT and cybersecurity and possess certifications in cybersecurity and related fields.

companyName: FEDEX CORP

ticker: FDX


text: Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. We seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information we collect and store, including information regarding our customers, suppliers and employees. As part of our enterprise risk management program, we actively work to identify, prevent, and mitigate cybersecurity threats, and take steps to be prepared to effectively respond to cybersecurity incidents when they occur. Our approach includes using select third-party resources, including external cybersecurity consultants, auditors, and technologies, along with our internal staff, to benchmark, measure, and improve our cybersecurity risk management systems and processes, and ensure alignment with industry best practices.


text: We have established a robust cybersecurity governance framework to manage and mitigate risk. Our approach includes: • Security Operations Program - a security operations program to bolster real-time cybersecurity incident detection and response capabilities; • Third-Party Risk Management – regular evaluation and monitoring of our network of external partners, vendors, suppliers and service providers, which includes monitoring of third parties, securing vendor remote access, and implementation of protections against cyber threats that may arise through business-to-business system integrations; • Security Control Framework - a security control framework that aligns with industry accepted best practices and prioritizes implementation of critical cybersecurity controls; • Incident Response Plan - a cybersecurity incident response plan, designed to effectively address cybersecurity incidents while promoting cross-functional coordination across the organization; • Assessments – annual cybersecurity assessments, administered by a third-party specialist, which focus on identifying and remediating vulnerabilities that present the most significant organizational risks; • Training - security awareness training for all salaried personnel that highlights critical organizational risks through monthly phishing simulation campaigns, "lunch and learns," and annual cybersecurity learning modules; • Insurance - cybersecurity insurance policies and periodic reviews of our policies and coverage levels; and • Monitoring Legal/Regulatory Developments - review of emerging data protection, data privacy, and other relevant cybersecurity laws and regulations to determine appropriate changes to cybersecurity controls and processes.


text: Through the aforementioned processes, we did not identify risks from current or past cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect business strategy, results of operations, or financial condition. See "Risk Factors—Increasing dependence on information technology systems comes with specific risks, including cybersecurity breaches and data leaks, which could have an adverse effect on our business."


text: Our Board of Directors has delegated to its Audit Committee primary responsibility for overseeing our management of risks arising from cybersecurity threats. The Audit Committee receives quarterly presentations on our cybersecurity program, including regular presentations regarding our cybersecurity risks; our efforts to address evolving standards; vulnerability assessments, including results of third-party penetration testing; and external audits of our cybersecurity IT controls. Management and the Board also receive prompt and timely information regarding any significant or potentially significant cybersecurity incident and our remediation efforts.


text: Our Vice President of Information Technology and our Director of Technical Infrastructure, in coordination with management, work to implement our program to protect the Company's information systems from cybersecurity threats. These individuals work to promptly evaluate and address any cybersecurity incidents, and work with management to assess the impact and any necessary remediation efforts following a cybersecurity incident. In addition, the Vice President of Information Technology provides updates to the Audit Committee and the Board on a regular basis and as needed in response to specific incidents. To facilitate the success of our cybersecurity risk management program, we have assigned our Director of Technical Infrastructure and his team to monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and provide reports to management.


text: Our Vice President of Information Technology and Director of Technical Infrastructure have a combined 65 years of experience designing, implementing, and supporting information technology systems with a security-first mindset. In particular, prior to joining Culp, our Director of Technical Infrastructure gained experience leading cybersecurity teams at a managed security service provider, where he provided cybersecurity support to outside organizations.


text: Our ability to attract and retain customers, efficiently operate our businesses, execute our DRIVE transformation, including Network 2.0, and compete effectively increasingly depend in part upon the sophistication, security, and reliability of our technology network, including our ability to provide features of service that are important to our customers, to protect our confidential business information and the information provided by our customers, and to maintain customer confidence in our ability to protect our systems and to provide services consistent with their expectations.


text: As appropriate, the board of directors also receives information regarding cybersecurity incidents as well as ongoing updates regarding mitigation of any such incidents until they have been resolved.


text: Cybersecurity Risk Management and Strategy FedEx has an information technology ("IT") risk management process designed to identify and manage risk within its IT environment, including cybersecurity. The IT risk management process is based on an established framework for identification, measurement, and monitoring of cybersecurity and other risk areas and supplements our Enterprise Risk Management ("ERM") process and framework. Our IT risk management, ERM, and compliance teams collaborate to regularly evaluate and manage cybersecurity-related risks using various tools and services. Leveraging components from multiple industry frameworks and best practices such as the International Organization for Standardization 27001 and National Institute of Standards and Technology ("NIST") standards, including the NIST Cybersecurity Framework, our cybersecurity program prioritizes governance, identification, protection, detection, response, and remediation measures.


text: We regularly assess our cybersecurity program's capabilities and tools to help us enhance reliability and scan our environment for vulnerabilities. Our IT risk management team, including our Corporate Vice President – Chief Information Security Officer ("CISO"), communicates with senior management on the cybersecurity risk posture of our IT assets, strives to ensure consistent risk remediation activities, and monitors the effectiveness of our IT-related controls. In addition, our internal audit team performs reviews of our information security organization to help ensure controls are operating effectively and as designed.


text: Enterprise-wide information security training (including with respect to cybersecurity), supplemented by awareness programs, is crucial for risk reduction and safeguarding customer, employee, and company information. We provide training to employees and certain third-party contractors based on access to our network, risk, roles, policies, standards, and behaviors, which is updated to address emerging technology and security issues.


text: We periodically engage with assessors, consultants, auditors, and other third parties to review and improve our cybersecurity program. Compliance with regulatory requirements involves regular third-party assessments. Our processes are also designed to address cybersecurity risks associated with third-party service providers, including risk assessment and due diligence during selection and oversight. Key third parties undergo regular assessments to gauge cybersecurity control effectiveness, with heightened review of those with access to non-public data.


text: We conduct table-top simulation exercises to regularly test our cybersecurity incident response processes with the aim of enhancing effectiveness against evolving threats. Our incident response procedures guide our preparedness, detection, response, and recovery actions. Additionally, we maintain cyber insurance designed to address certain aspects of cyber risks.


text: In the last three fiscal years to date, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations, or financial condition. While we have significant security processes and initiatives in place, we may be unable to detect or prevent a breach or disruption in the future. For more information about cybersecurity-related risks, please see Item 1A. "Risk Factors" of this Form 10-K. See "Item 1A. Risk Factors" of our Annual Report on Form 10-K for the year ended May 31, 2021, for information regarding the 2017 NotPetya cyberattack at TNT Express.


text: Cybersecurity Governance The FedEx Board of Directors has delegated to the Cyber and Technology Oversight Committee of the Board of Directors ("CyTOC") responsibility for overseeing the company's cyber and technology-related risks, including network security, information and digital security, data privacy and protection, and risks related to emerging technologies such as artificial intelligence and machine learning; the technologies, policies, processes, and practices for managing and mitigating such risks; and the company's cyber incident response and recovery plan. The CyTOC also oversees the cybersecurity, cyber-resiliency, and technology aspects of the company's business continuity and disaster recovery capabilities and contingency plans. Several of our Board members, including certain members of our CyTOC, have technological, digital, and/or cybersecurity experience.


text: The CyTOC receives regular updates from our CISO, Executive Vice President – Chief Digital and Information Officer and Chief Transformation Officer, and other members of management on risks related to these matters. Specific topics may include updates to FedEx's cyber risks and threats, the status of existing or new strategies and associated projects intended to strengthen FedEx's information security systems, assessments of FedEx's cybersecurity program, and the emerging threat landscape. The CyTOC also receives regular updates on key metrics related to our cybersecurity-related risks. The results of the IT risk management process are also presented annually to the CyTOC. Additionally, members of the CyTOC participate in certain of the simulation exercises conducted by management. The Chair of the CyTOC briefs the full Board on certain of these matters. In addition, the Board periodically receives cybersecurity updates directly from management. Separately, through our ERM program, risks appropriate for Board-level awareness, including with respect to cybersecurity, are communicated to the Board and its Audit and Finance Committee at least annually, while significant risks are reported on a quarterly basis.


text: The FedEx Information Technology Risk Council ("ITRC"), which is sponsored by the CISO, oversees the execution of FedEx's comprehensive IT risk management program. The ITRC, which receives quarterly reports on FedEx's IT risk management, is responsible for assessing the overall risk framework on an annual basis, setting acceptable risk tolerance levels, approving risk prioritization and associated risk mitigation activities, and monitoring the changing risk landscape and posture.


text: Both our CISO and other members of our cybersecurity leadership team participate in threat intelligence briefings provided by various government and industry entities. Moreover, our Executive Vice President – Chief Digital and Information Officer and Chief Transformation Officer is a member of the FedEx Executive Committee, which oversees our business risk, with cybersecurity threat risks being a regular topic of discussion. Our cybersecurity incident response plan includes processes for communicating cybersecurity incidents to relevant levels of management, including the ITRC, Executive Committee, the CyTOC, and the full Board of Directors, as appropriate.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: DIH HOLDING US, INC.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework Special Publication 800-53, 800-61, rev 2 ("NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements. We use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes the following: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls;


text: cybersecurity awareness training of our employees, incident response personnel, and senior management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition


text: Cybersecurity Governance Our Board considers cybersecurity risks as part of its risk oversight function of cybersecurity and other information technology risks.


text: The Chief Financial Officer oversees our information security programs, including cybersecurity initiatives, and is integrated into our Cybersecurity Incident response process. We assess and prioritize risks based on potential impact, implement technical controls, and monitor third-party vendors' security practices.


text: The Audit Committee oversees management's implementation of our cybersecurity risk management program and receives updates on the cybersecurity risk management program from management at least annually. In addition, management updates the Audit Committee regarding any material or significant cybersecurity incidents, as well as incidents with lesser impact potential as necessary. The Audit Committee oversees cybersecurity risk management activities, supported by Company management, the Board of Directors, and external consultants.


text: The Audit Committee reports to the full Board annually regarding cybersecurity. The full Board also receives annual briefings from external experts on cybersecurity as part of the Board's continuing education on topics that impact public companies.


text: We have not experienced any material cybersecurity incidents. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: OLD MARKET CAPITAL Corp

ticker: OMCC


text: The Company is in the process of establishing a cybersecurity policy which will implement protocols to evaluate, recognize, and address significant risks, including those posed by cybersecurity threats. This strategy encompasses the utilization of standard traffic monitoring tools, educating personnel to identify and report abnormal activities, and partnering with reputable service providers capable of upholding security standards equivalent to or exceeding our own.


text: These measures are to be seamlessly integrated into our broader operational risk management framework aimed at minimizing exposure to unnecessary risks across our operations. For cybersecurity, we collaborate with expert consultants and third-party service providers to implement industry-standard strategies aimed at identifying and mitigating potential threats or vulnerabilities within our systems. Additionally, the policy will have a comprehensive cyber crisis response plan to manage high severity security incidents, ensuring efficient coordination across the organization.


text: Cybersecurity threats haven't significantly impacted our operations, and we don't anticipate such risks materially affecting our business, strategy, financial condition, or results of operations. However, given the escalating sophistication of cyber threats, our preventive measures may not always suffice. Despite well-designed controls, we acknowledge the inability to foresee all security breaches, including those stemming from third-party misuse of AI technologies, and the potential challenges in implementing timely preventive measures.


text: Our cyber-security risk strategy includes policies and procedures for assessing, identifying and managing material cybersecurity threats. Our program is based on the U.S. National Institute for Standards and Technology (NIST) cybersecurity framework and other applicable industry frameworks. Our cybersecurity posture is risk based, focused on the areas of higher risk to the company and associates. Our cybersecurity policies, standards and practices are integrated into our enterprise risk management approach, and cybersecurity risks are among the enterprise risks that are subject to oversight by the Board of Directors acting through the Audit Committee of the Board of Directors.

companyName: RPM INTERNATIONAL INC/DE/

ticker: RPM


text: We use third party vendors to perform ongoing security monitoring, reporting and forensic analysis, as necessary including annual external penetration testing. Security standards are established and defined with respect to administrator accounts, backups, encryption, passwords, website certifications, antivirus software, endpoint management, firewalls, wi-fi networks, vulnerability scanning, server protection, patching, privacy by design, and data breach reporting. We perform ongoing employee cybersecurity awareness and training activities, which includes frequent phishing testing, and we maintain cyber insurance to provide coverage in the event a material cybersecurity incident arises.


text: We conduct annual internal audits to ensure compliance with its technology policies, security procedures and controls. Our third-party technology providers, consultants and vendors are vetted by our information security teams to assess cybersecurity risk and mitigation measures, where applicable.


text: We have significantly increased our cybersecurity investments over the last few years and continue to implement additional cybersecurity safeguards designed to detect and prevent cybersecurity incidents. Notwithstanding our increased cybersecurity investments and preparedness activities, threat actors and cybersecurity incidents still pose a risk to the security of our systems, facilities, and networks and to the confidentiality, availability and integrity of our data, including but not limited to intellectual property, confidential information and personal data. For more information on how a cybersecurity incident may impact the Company, refer to the risk factor titled "Data privacy, cybersecurity, and artificial intelligence considerations could impact our business," in Item 1A of this Form 10-K.

stage1Category: None/Other


text: While we have experienced data security incidents that have disrupted our operations in the past, to date, no data security incidents have had or are materially likely to have, a material impact on RPM.


text: Cybersecurity incidents are investigated and remediated in accordance with our incident response procedures and other policies and procedures. Cybersecurity is overseen by the Audit Committee of the Board of Directors. The Senior Director - Information Security coordinates with and directs cybersecurity initiatives through information technology and cybersecurity personnel throughout RPM.


text: The Senior Director - Information Security has over 15 years' experience in the information technology and cybersecurity field, including previous roles in security architecture, audit and governance. The Senior Director - Information Security recently completed a CISO Academy Workshop, where he gained valuable insights to help improve our cybersecurity posture and program while also better aligning it to our overall business strategy and operating model. He received a BA in math and computer science from Ohio Wesleyan University and holds an Information Systems Auditor certification.


text: Management's role in assessing and managing cybersecurity risk: Our risk management program for cybersecurity is led by the HubSpot Security & Privacy Committee, which we refer to as the Committee. The Committee oversees our information and technology risk management, compliance, and control functions, and serves as a forum for the discussion of issues involving information security and risk management.


text: The Audit Committee regularly receives information and reports from the Senior Director - Information Security and other executives responsible for identifying and assessing the scope, nature and impact of cybersecurity risks, incidents and mitigation efforts. In addition to the Audit Committee, the full Board of Directors receives regular annual reports on the status of our cybersecurity risk, incidents and mitigation efforts. We utilize a technology-based reporting system to identify and log data-related events.


text: Cybersecurity incidents are assessed for actual or potential impact on the business and any relevant data subjects. Materiality of cybersecurity incidents is assessed and determined by the Cybersecurity Team, which has been assigned this responsibility by our Disclosure Committee. The Cybersecurity Team consists of the Chief Financial Officer, the General Counsel, the Vice President - Commercial Excellence, the Vice President - Global Systems and the Senior Director - Information Security. The Senior Director - Information Security reports regularly to our Disclosure Committee. In the event a cybersecurity incident is determined to have, or is likely to have, a material impact on RPM, the Chair of the Audit Committee of the Board of Directors is directly notified by the General Counsel in coordination with the Chief Financial Officer and Senior Director - Information Security.


text: Risk Management and Strategy We utilize a combination of manual processes, specialized software and automated tools, and third-party assessments to assist with our cybersecurity efforts. We engage third-party service providers, with significant information technology and cybersecurity experience, to assist with designing, implementing and managing our information technology infrastructure and cybersecurity program. We consider the cybersecurity practices of our third-party service providers, including through a general security assessment and contractual requirements, as appropriate, before engaging them in order to help protect us from any related vulnerabilities.

companyName: HeartSciences Inc.

ticker: HSCS


text: Our third party service provider, alongside our senior management leads the operational oversight of the company-wide cybersecurity strategy, policy, standards and processes. As a smaller reporting Company, we do not have an employee who has significant and demonstrated professional IT management experience and possesses the requisite education, skills and experience expected to perform such a duty. The audit committee of the board of directors intends to provide oversight of our cybersecurity risk as part of its periodic review of enterprise risk management. Additionally, the board of directors intends to review our enterprise risk management processes and will be notified by management between management updates regarding significant new cybersecurity threats or incidents.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. No matter how well designed or implemented our internal controls are, we will not be able to anticipate all cybersecurity threats, and we may not be able to implement effective preventive or detective measures against such security breaches in a timely manner. While we maintain insurance that may cover certain liabilities in connection with certain disruptions, security breaches, and incidents, there can be no guarantee that our insurance coverage will be adequate to compensate us for the potential losses.


text: We rely on several information systems throughout our company, as well as those of our third-party business partners, to provide access to our web-based products and services, keep financial records, analyze results of operations, process customer orders, manage inventory, process shipments to customers, store confidential or proprietary information, and operate other critical functions. Our information systems and our business partners' and suppliers' information systems may be vulnerable to attacks by hackers and other security breaches, including computer viruses and malware, through the internet, email attachments, and persons with access to these information systems, such as our employees or third parties with whom we do business. These risks have increased as information systems and the use of software and related applications become more cloud-based. We have implemented various programs, processes, and systems designed to mitigate these risks.

companyName: NEOGEN CORP

ticker: NEOG


text: Risk Management and Strategy We have a comprehensive cybersecurity risk assessment program designed to assess, identify, and manage material risks associated with cybersecurity threats and vulnerabilities and to mitigate the potential impact of any cybersecurity incidents on our operations and financial condition. We routinely review, modify, and update this program as necessary to address emerging risks. Our process for addressing risk is based on industry best practices outlined in CIS Critical Security Controls. Although this program is integrated within the Company's overall risk management system, the implementation of this program requires a unique and specialized level of expertise and experience, which has led us to create a cybersecurity team and various processes designed to address these specific risks, as discussed more below.


text: We describe the risks from cybersecurity threats, including previous cybersecurity incidents, in section "Risk Factors" (Part I, Item 1A of this Form 10-K). As of the date of this Form 10-K, we do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our results of operations or financial condition. However, the cybersecurity threat environment is increasingly challenging, and we, along with the entire digital ecosystem, are under constant and increasing threat. As discussed above, our business strategy is tied to the SFI and we are committed to continuously monitoring cybersecurity threats, enhancing the security of our products, investing in our cybersecurity infrastructure, and collaborating with peers, customers, service providers, regulators, and governments to advance our and the entire digital ecosystem's cybersecurity defenses and resiliency.

companyName: MICROSOFT CORP

ticker: MSFT


text: We regularly engage consultants, auditors, and other third parties to assist in developing, maintaining, and enhancing our cybersecurity risk assessment program. These third-party engagements supplement our internal capabilities and help ensure the robustness of our program. Examples of these engagements include penetration testing of our customer facing domains, quarterly cybersecurity briefings with outside counsel, and an annual assessment of our overall cybersecurity program. We maintain policies and procedures to identify and monitor cybersecurity risks associated with these third-party service providers, particularly those with access to customer, employee, or other sensitive data. Our selection and oversight of these providers includes diligence reviews, contractual protections, and other measures to mitigate these risks over the entire lifecycle of the relationship, including through implementation of the CIS Critical Security Controls. In addition to these prevention measures, we work proactively to detect and minimize the impact of cybersecurity incidents. We have a written incident response plan designed to ensure the appropriate internal and, if necessary, external resources are employed to promptly and effectively respond to potential breaches, minimize any related damage, and avoid disruption to our operations. We routinely test our incident response process through simulated incidents. No risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. While we have not experienced any cybersecurity incidents or threats that have materially impacted us or our business, we have encountered incidents in the past, which we have used to improve our program and defenses. Since it is possible we could experience a material cybersecurity incident in the future, we remain diligent in maintaining and continuously improving our program in an effort to prevent such incidents and, if one was to occur, to manage it effectively.


text: Board of Directors Oversight The Governance and Sustainability Committee of our Board of Directors (the "Governance Committee") is responsible for providing oversight and policy direction on our risk management policies and programs, including those relating to cybersecurity. The Charter of the Governance Committee specifically requires the committee to periodically review the Company's enterprise cybersecurity strategy and framework, including the Company's assessment and management of cybersecurity threats and risks, data security programs, applicable laws and regulations, and the Company's management and mitigation of cybersecurity and information technology risks and potential breach incidents, including our incident response plan. The Governance Committee is also tasked with reviewing any significant cybersecurity incident that occurs.


text: The Governance Committee is required by its Charter to consist of not fewer than three independent directors, and the committee currently consists of five independent directors. The Governance Committee typically meets on a quarterly basis. At each meeting, a written cybersecurity brief from IT leadership is provided. These reports include a review of emerging cybersecurity risks and developments and updates to our cybersecurity risk assessment program. The Governance Committee provides regular reports to the full Board of Directors on its oversight of the Company's cybersecurity risks and risk management system.


text: Management's Role Our management team is primarily responsible for assessing and managing material risks to the Company from cybersecurity threats. We have a cross-functional cybersecurity team led by our cybersecurity manager and comprised of personnel from our information technology group, including the head of IT, and senior leadership. We have established a robust framework for preventing, identifying, evaluating, and mitigating cybersecurity risks.


text: Our cybersecurity manager is designated as the senior executive responsible for cybersecurity and reports directly to the head of IT. Our cybersecurity manager has a comprehensive information technology background and over ten years of service in managing or assisting in managing cybersecurity risks.


text: To support the head of IT and cybersecurity manager in managing cybersecurity risks, we established a cross-functional cybersecurity team that includes experts in various aspects of information security. Combined, this team of employees includes individuals with over 30 years of prior work experience in cybersecurity and data protection. These individuals are responsible for the day-to-day implementation of our cybersecurity program.


text: We employ a comprehensive set of processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. These processes include: • Continuous monitoring of network traffic and information technology systems for signs of potential threats; • Regular vulnerability assessments and penetration testing to identify and address weaknesses; • Implementation of cybersecurity measures, such as firewalls, intrusion detection systems, and data encryption; • Employee training and awareness programs to educate all staff about cybersecurity risks and prevention measures; and • Incident response plans to ensure swift, effective, and adequate disclosure of cybersecurity incidents to the appropriate individuals within the Company.


text: These processes are regularly reviewed and updated to adapt to evolving cybersecurity threats and any changes in our systems or business operations.


text: Our head of IT, cybersecurity manager, and other members of our cybersecurity team provide quarterly updates and reports to the Governance Committee of our Board of Directors on cybersecurity risks and our risk management systems. Our cybersecurity team is also required to provide senior management and the Governance Committee with more frequent updates on major developments regarding cybersecurity matters or as otherwise appropriate. As noted above, the Governance Committee provides regular updates to the Board on these matters so that the Board remains adequately informed about this important aspect of the Company's overall risk management.


text: There have not been any breaches at the Sponsor or the Trust during the year ended September 30, 2024. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.

companyName: Grayscale Horizen Trust (ZEN)

ticker: HZEN


text: RISK MANAGEMENT AND STRATEGY Microsoft plays a central role in the world's digital ecosystem. We have made it the top corporate priority to protect the computing environment used by our customers and employees and to support the resiliency of our cloud infrastructure and services, products, devices, and our internal corporate resources from determined adversaries. In response to the evolving cybersecurity threat landscape, we launched the Secure Future Initiative ("SFI") in November 2023 and expanded the scope of SFI in May 2024. The SFI focuses our business strategy and efforts on continual improvement in cybersecurity protection, and is aligned around three security principles: • Secure by Design: Security comes first when designing any product or service. • Secure by Default: Security protections are enabled and enforced by default, require no extra effort, and are not optional. • Secure Operations: Security controls and monitoring will continuously be improved to meet current and future threats.


text: We operate a cybersecurity program and governance framework designed to protect our computing environments against cybersecurity threats, and we have controls, policies, and procedures to identify, manage, and mitigate cybersecurity threats. Annually, we assess our cybersecurity program's alignment with the National Institute of Standards & Technology's Cyber Security Framework ("NIST") and other applicable industry standards. We also undertake integrated planning and preparedness activities to support business continuity and operational resiliency. We assess our program's effectiveness through various exercises, including tabletop simulations and production environment tests, penetration and vulnerability tests, red team exercises, and other related activities. We conduct mandatory cybersecurity training, provide employees with tools to report suspected incidents and assess their own security posture, and conduct real-time simulated employee education exercises, such as phishing email campaigns designed to emulate real-world attacks. We also engage in robust cybersecurity assessments and remediation efforts for acquired companies.


text: Our computing environments, products, and services are reviewed by our internal audit teams as well as independent third-party assessors. We are committed to managing the most significant risks to our strategies and ambitions, including cybersecurity risks. The Enterprise Risk Management ("ERM") organization supports management in this commitment by facilitating the semiannual risk assessment, which documents the priority and status of these risks and aligns them with our strategic mitigation efforts. ERM is structured using a framework based on the Committee of Sponsoring Organization ("COSO") guidance on Enterprise Risk Management Integrating Strategy with Performance and it also aligns with the International Organization for Standardization 31000:2018 Risk Management Standard.


text: We continuously monitor our computing environments, products, and services for vulnerabilities and signs of compromise, and we utilize our own security products to combat cybersecurity threats. We integrate security into our computing environments, products, and services through our Security Development Lifecycle ("SDL"). Our SDL introduces security and privacy considerations throughout all phases of our development process and through the adoption of zero-trust end-to-end architecture. We utilize machine learning and AI-powered security tools to gain insights from over 78 trillion signals per day and over 135 million managed devices. We track over 300 unique threat actors, including 160 nation-state actors and 50 ransomware groups. To support our efforts, we operate a Cyber Defense Operations Center connected to over 10,000 security and threat intelligence experts, including engineers, researchers, data scientists, cybersecurity experts, threat hunters, geopolitical analysts, investigators, and frontline responders across the globe.


text: When appropriate, we utilize external service providers to assess, test, or otherwise assist our program. We also leverage third parties by working with external researchers, operating bug bounty programs, and managing coordinated vulnerability disclosure programs with security organizations. We maintain a systematic approach to assessing and controlling the cybersecurity risks presented by third-party service providers. We require third-party service providers to manage their cybersecurity risks in defined ways, undergo cybersecurity reviews, notify us of cyber events, and satisfy additional contractual requirements.


text: We seek to improve the entire cybersecurity ecosystem through multistakeholder diplomacy to set and uphold expectations for state behavior, advancement of government policy that strengthens cybersecurity and resiliency, disruption and deterrence of cybercrime, protection of national security interests, and disruption of digital threats to democracies. We also establish processes and innovate solutions for us and our customers to address the growing number and complexity of cybersecurity regulations.


text: When we experience a cybersecurity incident, we utilize our well-established incident response plans that operate both across the company and at the product and services level. Incidents are first triaged for severity, and then more deeply assessed to establish a plan of record and activate internal and external notification, disclosure, and communication plans, as applicable. Engineering and development resources are mobilized to resolve or remediate the incident. After the incident is resolved, a comprehensive post-incident review process is conducted.


text: Our cybersecurity program's effectiveness is based on recognized best practices, standards, and frameworks for cybersecurity and information technology, including periodic evaluation against established quantifiable goals and other external benchmarks, including the Center for Internet Security (CIS), the National Institute of Standards and Technology (NIST) and several other security frameworks. The evaluation is conducted through periodic internal and external risk assessments and compliance audits. We regularly engage third parties in order to help conduct evaluations and assessments and to advise us on the effectiveness of our cybersecurity program.

companyName: WORTHINGTON ENTERPRISES, INC.

ticker: WOR


text: Our Board of Directors oversees cybersecurity risk. Cybersecurity reviews by the Board are scheduled to occur at least quarterly, or more frequently as determined to be necessary or advisable. Presentations to the Board of Directors are made by senior management, including our Chief Information Security Officer ("CISO"), our EVP of Microsoft Security, and the head of our Customer Security and Trust organization. The presentations address topics such as cybersecurity threats, incidents, top risks and related remediation efforts, results from internal and third-party assessments, progress towards risk-mitigation goals, the functioning of our incident response program, regulatory developments, and digital diplomacy efforts. In addition, we have an escalation process in place to inform senior management and the Board of significant issues. Cybersecurity issues are also considered during separate Board meeting discussions regarding important matters like ERM, audit issues, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our CISO leads the strategy, engineering, and operations of cybersecurity across the company, and reports to the EVP of Microsoft Security. Our CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Before joining Microsoft, our CISO served in a prior Chief Technology Officer role as well as in senior leadership, engineering, and operational roles within multiple organizations. In addition to the Board's oversight of cybersecurity risk, to support the CISO, we have established a Cybersecurity Governance Council ("CGC") charged with overseeing initiatives that safeguard Microsoft's infrastructure. The CGC is comprised of an executive-level team of Deputy CISOs with cybersecurity backgrounds and expertise relevant to their roles. The CGC responsibilities include approving our enterprise security risk assessment process and results, determining the appropriate cybersecurity risk level and mitigations, reviewing the NIST CSF alignment, and supporting compliance with cybersecurity regulations. Our cybersecurity efforts are supported directly by Microsoft's security and threat intelligence experts and our employees across the company, all of whom receive cybersecurity awareness training and education and are expected to support our efforts.


text: We have developed a cybersecurity program for identifying and mitigating risks to our information and information systems, including guarding against increased cybersecurity threats. We have a comprehensive cybersecurity program which includes risk management to identify cybersecurity threats that could adversely affect our information systems and compliance.


text: The Audit Committee has primary responsibility for oversight of cybersecurity matters. The Audit Committee receives quarterly updates on compliance and cybersecurity from the CIO and CISO. These updates, cover a range of topics, including the performance of our cybersecurity program against established goals and external standards, insights into the evolving cybersecurity landscape, current events and recent cybersecurity threats, and enhancements to our cybersecurity program.


text: The CIO has extensive leadership experience with 25 years of experience in information technology, project management, business applications including manufacturing. The CISO is responsible for overseeing our cybersecurity risk management program, in coordination with the CIO and our other business leaders, including in the legal, internal audit, finance and risk management departments. The CISO has extensive cybersecurity knowledge and skills gained from over 25 years of technical and business experience in the cybersecurity and information security fields. The CISO reports directly to the CIO who in turn reports directly to the Chief Financial Officer. The CISO receives reports on cybersecurity threats on an ongoing basis and, regularly reviews risks to identify and mitigate data protection and cybersecurity risks. The CISO and CIO also work closely with our legal department to oversee compliance with applicable legal, regulatory and contractual security requirements.


text: We actively maintain an enterprise risk management program that includes information technology and cybersecurity risk management. Management's role is to identify, mitigate, guide and review the efforts of our business units, consider whether the residual risks are acceptable, and approve plans to address potentially material risks. Cybersecurity is a key risk management category within our enterprise risk management program.


text: Our cybersecurity program is designed to safeguard against an evolving threat landscape through effective identification, prevention, detection, response and recovery processes. Our cybersecurity risk management processes include frequent assessment of our top cybersecurity risks and mitigations.


text: Our cybersecurity and risk management program encompasses several key areas consisting of threat and vulnerability management that help to identify, prioritize and reduce cybersecurity gaps or weaknesses. We regularly educate and share best practices with our employees to raise awareness of cybersecurity threats creating a culture where everyone shares responsibility to help protect our sensitive data and information. All employees are regularly provided cybersecurity training and involved in phishing prevention campaigns to raise awareness. Our identity and access management program involves access controls for least privileged access and additional authentication methods. We have many cybersecurity systems including firewalls, intrusion detection systems, continuous monitoring by a full time Security Operation Center to defend against unauthorized access. Incident response exercises are performed using our response and ransomware playbooks ensuring our readiness to response to cybersecurity events. We have a risk management program for our critical third-party vendors focusing on mitigating risks from external sources. Those third-party applications are monitored and access is reviewed including evaluating System and Organization Controls (SOC) reports.


text: To date, the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and are not reasonably likely to materially affect us or our strategy, financial condition, liquidity or results of operations. It is possible that we may not implement appropriate controls if we do not detect a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate the risks. Even when a risk is detected, disruptive events may not always be immediately and thoroughly interpreted and acted upon.


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for assessing, identifying and managing cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and to facilitate coordination across different departments of our company. Our processes include steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and the Board of material cybersecurity threats and incidents. Our cybersecurity team also engages third-party security experts for risk assessment and system enhancements. In addition, our cybersecurity team provides training to all appropriate employees.

companyName: Worthington Steel, Inc.

ticker: WS


text: The Board has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee of the Board. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee also reports material cybersecurity risks to the Board. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Vice President of Transformation and Chief Information Officer ("CIO") who receives reports from our Senior Cybersecurity manager who monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. The dedicated personnel of information system security professionals are overseen by an information security manager with 15 years of experience in cybersecurity. Management, including the CIO and our cybersecurity manager, regularly update the Audit Committee on our cybersecurity programs, which includes cybersecurity risks and mitigation strategies, a third-party risk program, vulnerability management, and on-going cybersecurity projects.


text: In fiscal 2024, we did not identify any cybersecurity incidents that materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. It is possible that we may not implement appropriate controls if we do not detect a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate the risks. Even when a risk is detected, disruptive events may not always be immediately and thoroughly interpreted and acted upon. For more information about these risks, please see "Risk Factors – Risks Related to our Business" in Item 1A of this Form10-K.


text: Risk Management and Strategy We are focused on the growing threat of cybersecurity risks we face in today's global business environment and have identified cybersecurity as an important enterprise risk. Our cybersecurity risk management program is part of our overall enterprise risk management program, and focuses on identifying, assessing, managing, and remediating material risks from cybersecurity incidents. We rely on risk-based security controls, including access limitations and contractual requirements on third-party service providers, as part of our overall approach of protecting the integrity, availability and confidentiality of our important systems and information.

companyName: RICHARDSON ELECTRONICS, LTD.

ticker: RELL


text: The Company follows the U.S. National Institute of Standards and Technology ("NIST") Cyber Security Framework to structure protocols for identifying, assessing and managing cybersecurity risks. In accordance with NIST guidance, we maintain documented information security policies and standards to protect operations, assets, data and services and to defend against, respond to and recover from potential cyber attacks.


text: These policies and standards include both preventive measures and reactive processes. Preventive measures include, but are not limited to, protective and detective cybersecurity systems, security monitoring, threat hunting and mandatory, enterprise-wide employee training. Our reactive processes are captured primarily by a cyber incident response plan (the "IRP"), which is comprised of an evolving set of procedures developed by cross-functional experts, and external consultants, who draw upon technical proficiency and learnings from past experiences. All of these procedures and practices are tailored to our technology environment and are refined iteratively. Further, we have an information risk management program that includes a vendor risk assessment process, whereby we systematically oversee and identify risks from cybersecurity threats related to its use of third-party service providers.


text: The Committee's members include senior members of management who are responsible for and collectively have experience in information security, information technology, data protection, risk management and compliance. This collaboration helps us incorporate cyber risk management across all of our significant risk management programs.


text: The IRP is executed by an Incident Response Team ("IRT"), led by our Information Systems Director. The exact composition of the IRT varies depending on the severity and potential impact of an incident and will typically include internal IT professionals and stakeholders across corporate and business functions. The team collaborates with internal experts and may engage external resources to assess and contain a threat if deemed necessary. Such external resources may potentially include forensic investigation and response firms, law firms, forensic accountants, and consultants who are on retainer contracts for expedited availability.


text: While cybersecurity threats remain a risk to the Company's business operations, our risk mitigation strategies have been effective. Accordingly, no such threats have materially affected our business strategy, results of operations or our financial condition. For more information regarding how cybersecurity threats could materially affect our business strategy, results of operations or financial condition, see We rely heavily on information technology systems that, if not properly functioning, could materially adversely affect our business in Item 1A, Risk Factors.


text: Our Board of Directors has overall responsibility for enterprise risk management and has delegated the oversight of cybersecurity risks to the Audit Committee. The Company's Chief Financial Officer ("CFO") immediately updates the Audit Committee on any significant cybersecurity incidents and/or threat that may require an 8-K filing. Furthermore, the CFO reports quarterly to the Audit Committee on any significant cybersecurity incidents, threats, mitigation strategies and controls at each Audit Committee meeting. The Audit Committee then updates the full board on significant matters raised and discussed during these sessions.


text: The Audit Committee delegates day-to-day management of cybersecurity risks to the Company's senior management, which includes our CFO, who reports directly to the Chief Executive Officer. Our CFO leads a team of dedicated professionals who are responsible for a wide range of risk assessment and management and leads specialized teams of internal and external experts focusing on distinct categories of threats.


text: The identification, detection, prevention and remediation of known or potential IT security vulnerabilities, including those arising from third-party hackers, hardware or software, is extremely costly and time consuming. We do not have the manpower, expertise or financial resources to effectively identify, detect, prevent or remediate cybersecurity risks. No assurance or guarantee whatsoever can be given that we will not be seriously damaged by the exploitation of our cybersecurity vulnerabilities.

companyName: Peak Bio, Inc.


text: During the year ended December 31, 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.


text: Cybersecurity Risk Management and Strategy We recognize the importance of establishing governance and oversight over cybersecurity risks, and we have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: DZS INC.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF, and the MITRE ATT&CK Framework. This does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST CSF and the MITRE ATT&CK as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key aspects of our cybersecurity risk management program include the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls and processes; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers and vendors.


text: The Audit Committee receives regular reports from our Chief Information Security Officer ("CISO") regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential. The Chief Information Officer ("CIO") and CISO periodically report to the full Board regarding cybersecurity risks and our cyber risk management program. Board members periodically receive presentations on cybersecurity topics from our CIO, our CISO, or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: EXTREME NETWORKS INC

ticker: EXTR


text: The landscape of cyber threats is constantly evolving, making it increasingly challenging to effectively defend against them or implement sufficient preventative measures. We have observed a rise in the volume, frequency, and sophistication of cyber-attacks. To date, no risks from cybersecurity threats or previous cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise. See Item 1A "Risk Factors – Cyberattacks or other security incidents that disrupt our operations or compromise data, may expose us to liability, harm our reputation or otherwise adversely affect our business."


text: Cybersecurity Governance This risk management approach informs decision-making processes related to the company's strategic priorities, the allocation of resources, and the establishment of oversight mechanisms. Our Board considers cybersecurity risk as part of its risk oversight function, and the governance of this program resides with our Board, which bears the ultimate responsibility for the oversight of cybersecurity risks. Supporting the Board, the Audit Committee plays a pivotal role by engaging in regular reviews of our cybersecurity efforts in collaboration with management and providing periodic updates to the Board. These assessments are conducted regularly, with additional sessions convened as needed to address emerging issues or refine strategies. In addition, management updates the Board, as necessary, regarding any significant cybersecurity incidents.


text: Our Chief Operations Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. He/She stays informed about and monitors the prevention, detection, mitigation and remediation of key cybersecurity risks and incidents through various means, which may include briefings with internal and external security team members, threat intelligence and other information obtained from public or private sources and alerts and reports produced by security tools deployed in the IT environment.


text: Our cybersecurity management team includes our corporate global applications director, who leads the operational teams responsible for enterprise security, data governance and enterprise incident response, and global operations, and our senior vice president of cloud edge and engineering operations, who leads the operational teams responsible for product and cloud security, data governance and product security incident response. Our operational cybersecurity teams are comprised of members with decades of collective experience in IT security systems, tooling, operations, and governance, and hold various IT security industry certifications and have received specialized cybersecurity training.


text: Risk Management and Strategy We rely upon information technology networks and systems to process, transmit, and store electronic information, and to manage or support virtually all of our business processes and activities. Accordingly, we maintain a comprehensive Information Security Program, anchored in a multi-tiered, defense-in-depth strategy designed to identify and mitigate risks from cybersecurity threats. We believe that our Information Security Program aligns with industry frameworks and assesses security trends, and facilitates identification and reduction of vulnerabilities. Our cybersecurity strategy considers existing risks to our company and those that we are likely to encounter based on our industry, company profile, and business objectives. Consideration of risks from cybersecurity threats is a key component of our overall enterprise risk management strategy.

companyName: Performance Food Group Co

ticker: PFGC


text: We have implemented a risk management program to identify and track information risks, including cybersecurity threats, from many different sources, including third parties, technology projects, acquisitions, risk assessments, technical assessments, and internal/external audits, and assesses them based on severity. Our annual information technology general control testing, which is conducted in connection with our internal control over financial reporting review process, and periodic reviews of risks and controls related to cybersecurity threats that may impact financial reporting control objectives also serve to identify and track information risks. Additionally, we partner with independent third-party service providers to perform cybersecurity assessments, such as network and application penetration testing.


text: To emphasize the importance of cybersecurity awareness, advise of cybersecurity threats, and provide examples of how to mitigate such threats in their use of PFG systems, we also maintain an information security training program that combines several forms of training, including routine phishing exercises, across our workforce.


text: We acknowledge the potential cybersecurity risks inherent in our relationships with third parties. Accordingly, PFG has implemented a third-party risk management program to identify and oversee such risks. Our third-party risk assessment framework evaluates the cybersecurity practices and controls of third parties. Activities undertaken in relation to third parties may include due diligence inquiries, reviewing security policies and program capabilities, reviewing security certifications and results of independent audits. Review and establishment of contractual requirements is performed in accordance with the level of risk presented by a third party.


text: We maintain a regularly revised Cybersecurity Incident Response Plan and Cybersecurity Incident Notification Policy, which provide protocols for evaluating and responding to cybersecurity incidents, including escalation of information to senior leadership, including the Board of Directors, as appropriate, and meeting external reporting obligations. We periodically perform tabletop exercises where we perform walkthroughs of cybersecurity incident situations to test our response plans. To date, we have not experienced any cybersecurity incidents that materially affected, or are likely to materially affect, our business strategy, results of operations, or financial condition, but future incidents cannot be predicted. See "Item 1A. Risk Factors" for additional information regarding cybersecurity-related risks that could impact our business.


text: Our Board of Directors executes its cybersecurity risk oversight function as a whole and by delegating responsibility to the Technology and Cybersecurity Committee of our Board of Directors, which oversees our management of risks relating to information technology security and our cybersecurity policies, controls and procedures. The Audit and Finance Committee of our Board of Directors oversees our enterprise risk management program as a whole and risk management regarding major financial risk exposure, including the potential financial impact of cybersecurity incidents. The Technology and Cybersecurity Committee receives quarterly presentations and reports on cybersecurity and information security risks from management, including our Executive Vice President and Chief Information Officer ("CIO") and Vice President, Chief Information Security Officer ("CISO"). These presentations and reports address a broad range of topics, including progress of security initiatives, strategy, key performance indicators, cybersecurity risks, and notable cybersecurity incidents. In addition, the Technology and Cybersecurity Committee and the Board of Directors receive briefings from time to time from outside experts for an independent view on cybersecurity risks, including best practices and current trends in cybersecurity.


text: Our CIO's experience includes over 25 years of experience in information technology leadership roles, including ProBuild Holdings, the nation's largest supplier of building materials; Gates Corporation, a manufacturer/distributor of automotive parts; and Nupremis Inc., a start-up that provided hosting and managed services. We also have a dedicated CISO, whose team is responsible for management of PFG's Information Security Program, policies, compliance with internal/external mandates, strategy, security incident planning and response. Our CISO reports to our CIO and has more than 20 years of cybersecurity, technology assurance and controls experience, including 17 years as a Certified Information Systems Security Professional (CISSP) and 12 years at PFG in information security and compliance. Our CISO joined PFG following several years of experience working in information security consulting, including Big 4 Accounting and Assurance, as well as working in industries including banking and finance.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program, include, but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – System security risks, data breaches, and cyberattacks could compromise our proprietary information, disrupt our internal operations, impact services to customers, and harm public perception of our products, which could materially adversely affect our business, financial condition, operating results, and future growth prospects".