text: If a potentially material cybersecurity threat or incident is identified or discovered, the Company's Information Technology Team will notify our Chief Executive Officer, Chief Financial Officer, General Counsel and other relevant business executives. Our Chief Information Officer will work with the appropriate leaders and employees in any impacted business groups, as well as appropriate personnel in our finance, legal and other impacted departments, to assess the risks to the Company and potential impact while determining appropriate remediation steps.


text: If management determines that a cybersecurity threat or incident could be material to the Company, our management will notify the Audit and Compliance Committee, who will then escalate the risk to our full Board of Directors, depending on management's assessment of the risk.

companyName: Ventas, Inc.

ticker: VTR

secItem: Item 1C

stage1Category: Board Governance

stage1Method: majority


text: Our business is subject to risk from cybersecurity threats and incidents. Cybersecurity threats and incidents include attempts to gain unauthorized access to our systems and networks, or those of our managers, tenants, borrowers, investments in unconsolidated entities, vendors, suppliers, service providers or other third parties with whom we do business, to disrupt operations, corrupt data or steal confidential or personal information and other cybersecurity breaches. Ventas considers cybersecurity risk a serious threat to our assets and our people and has put processes in place designed to mitigate the risk and impact of any such cybersecurity threat or incident.

stage1Category: Risk Management Process


text: Risk Management and Strategy As part of our cybersecurity risk management process, we: • Periodically review and implement procedures that endeavor to follow the cybersecurity standards set forth by the National Institute of Standards and Technology, including procedures with respect to evaluation and monitoring of cybersecurity threats and incidents; • Implement, maintain and regularly review incident response plans to manage cybersecurity threats and incidents and further improve our preparedness and response infrastructure. Such plans are informed by our testing and monitoring activities and set forth actions to be taken in responding to and recovering from cybersecurity incidents which include procedures for assessing the severity of such threats and incidents, escalating and disseminating information and containing, investigating and remediating threats and incidents; • Engage third-party security firms to monitor and respond to cybersecurity threats and incidents, including those associated with our use of third-party vendors and service providers, and conduct periodic penetration tests with the aim of identifying and remediating vulnerabilities; • Periodically evaluate and assess cybersecurity risks associated with our use of key third-party business partners, vendors and service providers. However, we do not control the cybersecurity plans and systems put in place by such third parties and we may have limited contractual protections with such third parties, such as indemnification obligations to us, which could cause us to be negatively impacted as a result; • Provide employees with the training, tools and resources designed to protect the Company from cybersecurity threats and incidents and to identify and report such threats and incidents. Our employees receive training and testing on cybersecurity protocols throughout the year, including regular anti-phishing campaigns, periodic live training programs and mandatory annual training and assessments with passing requirements. Each employee periodically acknowledges that they have read, understood and will abide by the Company's cybersecurity policies; and • Seek to minimize the amount of personal information collected to support business needs and use storage and transfer protocols leveraging encryption of critical information, including confidential or personal information.

stage1Method: unanimous


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including professional services firms; cybersecurity consultants; and managed cybersecurity service providers.

companyName: Beta Bionics, Inc.

ticker: BBNX


text: Our processes for assessing, identifying, and managing material risks from cybersecurity threats and incidents are integrated into our multi-disciplinary enterprise risk management ("ERM") process. Our ERM process is managed through our ERM Committee, which we have established to assess, identify and manage enterprise-wide risks to the Company, and is comprised of personnel from our senior leadership team. The ERM Committee is convened at least quarterly to review and update our top risks, including cybersecurity risks. Existing risks are evaluated for changes, and mitigation strategies are discussed as needed. New risks are discussed and evaluated for consideration as a top risk. Results are discussed with our Board of Directors at quarterly Board meetings as needed.


text: As of December 31, 2024, the Company is not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including with respect to our business strategy, results of operations or financial condition. While we have implemented measures designed to help mitigate the risk from cybersecurity threats and incidents, we cannot guarantee that we or our managers, tenants, borrowers, investments in unconsolidated entities, vendors, suppliers, service providers or other third parties with whom we do business will be successful in preventing a cybersecurity incident, or mitigating or remediating a cybersecurity threat, which could result in a data center outage, disrupt our systems and operations or the systems and operations of our managers, tenants, borrowers, investments in unconsolidated entities, vendors, suppliers, service providers or other third parties with whom we do business, compromise the confidential or personal information of our employees, partners or the residents in our senior housing communities and damage our business relationships and reputation. Although we have implemented various measures designed to manage risks relating to these types of events, these measures and the systems supporting them could prove to be inadequate and, if compromised, could become inoperable for extended periods of time, cease to function properly or fail to adequately secure confidential or personal information. See "Risk Factors—Our Legal, Compliance and Regulatory Risks—Cybersecurity threats and incidents could disrupt our operations or the operations of the third parties with whom we do business, invest in or lend to, result in the loss of or unauthorized access to confidential or personal information or damage our or their business relationships and reputation" included in Part I, Item 1A of this Annual Report.

stage1Category: Strategy Integration


text: Role of our Board of Directors and the Audit and Compliance Committee As part of our Board of Directors' role in overseeing the Company's ERM program, which includes our cybersecurity risk management, our Board is responsible for overseeing management's identification, assessment and management of material cybersecurity risks which may reasonably be expected to impact the Company. While our Board has overall responsibility for enterprise risk oversight, our Board has delegated to the Audit and Compliance Committee responsibility for overseeing risks from cybersecurity threats and incidents. The Audit and Compliance Committee is responsible for overseeing the effectiveness of the Company's cybersecurity risk management initiatives, taking into account the Company's risk exposures. Management briefs the Audit and Compliance Committee at least once a year and our Board as appropriate on cybersecurity controls, protocols, risk assessments and mitigation measures.


text: Role of our Management Our management has primary responsibility for identifying, assessing and managing our exposure to cybersecurity threats and incidents, subject to oversight by our Board of Directors of the processes we establish to assess, monitor and mitigate that exposure.

stage1Category: Management Role


text: Our Chief Information Officer oversees our Information Technology Team and is responsible for the development and implementation of strategy for our information systems, networks, infrastructure, cybersecurity and data analytics. She has more than 25 years of experience in the field of information technology and is a member of our senior leadership team. Prior to joining Ventas, she spent approximately 12 years at a multinational hospitality public company where, in her most recent role, she was responsible for application management and support of enterprise-wide systems. This role also had responsibility for global service desk support for more than 100,000 employees.


text: If a potentially material cybersecurity threat or incident is identified or discovered, the Company's Information Technology Team will notify our Chief Executive Officer, Chief Financial Officer, General Counsel and other relevant business executives. Our Chief Information Officer will work with the appropriate leaders and employees in any impacted business groups, as well as appropriate personnel in our finance, legal and other departments, to assess the risks to the Company and potential impact while determining appropriate remediation steps.


text: If management determines that a cybersecurity threat or incident could be material to the Company, our management will notify the Audit and Compliance Committee, who will then escalate the risk to our full Board of Directors, depending on management's assessment of the risk. As discussed above, management also provides regular reports to the Audit and Compliance Committee and to our Board as appropriate.


text: RISK MANAGEMENT AND STRATEGY We have a cybersecurity program that is intended to assess, identify, and manage material risks from cybersecurity threats to our business. Our program includes policies and procedures for detection, assessment, response, mitigation, remediation, and reporting of cybersecurity incidents and threats. Overall, our cybersecurity program is a strategic component of our company-wide risk management framework and activities.

companyName: ROSS STORES, INC.

ticker: ROST


text: Our cybersecurity program is led by our Information Technology (IT) team. The IT team is principally responsible for developing, managing, and implementing our cybersecurity risk assessment processes, maintaining and implementing our incident response plans, selecting and implementing security controls, providing cybersecurity training, performing ongoing threat analysis, and responding to cybersecurity threats and incidents. The cybersecurity program also draws upon a combination of industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework, that are designed to help companies measure their security posture, reduce cybersecurity risks, and provide guidance for implementing effective security controls.


text: The Audit Committee receives quarterly cybersecurity reports and engages directly with our management team, including our Chief Capability Officer (CCO), Chief Information Officer (CIO) and Chief Information Security Officer (CISO), on cybersecurity risk management and related risk topics, including incident response and recovery protocols, associate trainings and awareness, recent Company and industry developments, and our related compliance programs and practices. Our cybersecurity program and practices are also evaluated through various internal and third-party audits and assessments, with the results reported to the Audit Committee.


text: Our CIO and CISO are principally responsible for assessing and managing our material risks from cybersecurity threats, reporting to our CCO. They lead efforts to prevent, identify, detect, mitigate, and remediate material cybersecurity risks and incidents through various means, including by receiving alerts and reports produced by security tools deployed in our IT systems. Together, our CIO and CISO have decades of experience in cybersecurity and in retail, including leadership experience in cybersecurity risk management, incident response and recovery, compliance, governance, IT systems and technology, and overall cyber defense methodologies.


text: Our risk management approach and processes for cybersecurity extend to assessing and managing risks from cybersecurity threats associated with our use of third-party service providers, by employing vetting processes, including the conducting of security assessments and monitoring activities, to verify that third-party service providers adhere to our policies and contractual requirements.


text: In addition, we engage and work with a range of third-party advisors, including cybersecurity consultants, legal counsel, and auditors, to help us assess, test, and otherwise assist in the development and review of our cybersecurity processes. These relationships enable us to benefit from specialized knowledge and insights to help inform our cybersecurity strategies.


text: As of the date of this filing, to our knowledge, our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats or previously identified cybersecurity incidents, but there is no assurance that we will not be materially affected in the future by such risks or future incidents. For more information on our cybersecurity related risks, see ITEM 1A. RISK FACTORS.


text: Our Board of Directors exercises general oversight of our risk management activities, including our cybersecurity program. With respect to risks related to cybersecurity, our Board of Directors has delegated the primary oversight responsibility to the Audit Committee. The Audit Committee, along with management, reports to the full Board of Directors on these matters throughout the year.


text: The Audit Committee receives quarterly cybersecurity reports and engages directly with our management team, including our Chief Information Officer (CIO) and Chief Information Security Officer (CISO), on cybersecurity risk management and related risk topics, including incident response and recovery protocols, associate trainings and awareness, recent Company and industry developments, and our related compliance programs and practices. Our cybersecurity program and practices are also evaluated through various internal and third-party audits and assessments, with the results reported to the Audit Committee.


text: Our CIO and CISO are principally responsible for assessing and managing our material risks from cybersecurity threats. They lead efforts to prevent, identify, detect, mitigate, and remediate material cybersecurity risks and incidents through various means, including by receiving alerts and reports produced by security tools deployed in our IT systems. Together, our CIO and CISO have decades of experience in cybersecurity and in retail, including leadership experience in cybersecurity risk management, incident response and recovery, compliance, governance, IT systems and technology, and overall cyber defense methodologies.


text: Additionally, the A&FC has general oversight over Unisys' cybersecurity as it relates to responsibility for Unisys' internal audit function, including cybersecurity practices, compliance with legal and regulatory requirements and internal control over financial reporting. In November 2023, the A&FC charter was amended to ensure that it, in conjunction with the S&RC, reviews Unisys' cybersecurity and other information technology controls and procedures no less than annually. Management's Role in Assessing and Managing the Company's Material Risks from Cybersecurity Threats.

companyName: UNISYS CORP

ticker: UIS


text: Cybersecurity Risk Management and Strategy We have a multilayered framework for detecting, and responding to reasonably foreseeable cybersecurity risks and threats. To protect our information technology ("IT"), systems from cybersecurity threats, we use various tools that help prevent, detect, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. In the event of a material change to our systems or operations, we would assess the internal and external threats to the security, confidentiality, integrity, and availability of our data and systems, along with other material risks to our operations. We leverage technical safeguards intended to protect the Company's information systems from cybersecurity threats, including firewalls, threat monitoring, intrusion prevention and detection systems, anti-malware, access controls, privilege management, network segmentation, asset and end point management, and ongoing system security assessments. We oversee third-party service providers by conducting vendor diligence and reviews on a regular basis. We monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular network scans, system audits, and assessing intelligence feeds. The results of these assessments are used to improve our security posture through remediation efforts.

companyName: TaoWeave, Inc.

ticker: TWAV


text: We have developed an incident management process designed to coordinate the activities to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate any reputational damage.


text: Our business strategy, results of operations, and financial condition have not been materially affected as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity-related risks, see "Item 1A, Risk Factors" in this Annual Report.


text: Oblong's IT team is responsible for assessing and managing cybersecurity risks and has a depth of experience focused on increasing the organization's resilience to security threats and stays current on new developments through monitoring of the cybersecurity landscape. Oblong's IT environment is monitored for potential security threats and security events are investigated and acted on to minimize potential risk to the environment.


text: Oblong's Audit Committee engages in oversight of Oblong's cybersecurity risks and receives regular updates from management on technology and security updates and Oblong's assessment of cybersecurity threats and mitigation plans. The Audit Committee oversees the processes over internal controls and financial reporting that includes controls and procedures that are designed to ensure that significant cybersecurity incidents are communicated to both senior management and the Audit Committee. In the event of a material cybersecurity incident affecting our IT systems or data management, the Audit Committee would promptly work to formulate a mitigation plan and review compliance with such plan, as well as to ensure compliance with any external regulatory or disclosure requirements, including any disclosures of material cybersecurity incidents.


text: Protecting information, including information of our clients, is a top priority. We have expertise, dedicated resources and technology to identify, assess, respond to and mitigate material risks from cybersecurity threats. Our Global Information Security organization (GIS), led by our Chief Information Security Officer (CISO), establishes and maintains our company-wide information security management program and provides guidance for information security activities and controls at Unisys. Through our GIS, we: • establish and maintain corporate information security policies and procedures for identifying, assessing and addressing cybersecurity events; • track and analyze data as it moves through the information systems; • analyze the overall cybersecurity risk to information and systems (including the physical security and cybersecurity); • remediate known cybersecurity vulnerabilities; and • follow evolving information security regulatory guidance for countries in which we operate and adjust internal policies, processes and remediation actions, as necessary.


text: Our process for integrating cybersecurity risk management into our overall risk management system Our overall cybersecurity and privacy strategy is to protect and enable the business. We aim to protect ours and our customers' information and assets to enable agility in the business. Our GIS manages Unisys' cybersecurity risk identification, assessment, response, remediation and mitigation processes, and interfaces with other departments, including business units, the information technology department and enterprise risk management, to facilitate the risk processes and ensure the policies and procedures established by the GIS are integrated into our overall enterprise risk management system. The GIS's processes also work in tandem with the processes maintained by our Global Privacy Office (GPO). Through our GPO, we deploy functional and business unit-specific approaches to data and privacy compliance. Taking into consideration the processes established by the GIS, our GPO has developed a framework of policies, procedures and other initiatives that are implemented across Unisys to help meet data privacy requirements.


text: Our GPO: • is supported by a network of data protection officers, attorneys and privacy specialists across Unisys; • manages privacy management software that is used across Unisys to facilitate privacy impact assessments, record data processing activities and map data flows; and • follows evolving privacy regulatory guidance for countries in which it operates and adjusts standards, as necessary.


text: Other non-technical protocols include securing of documents and work areas that could contain personal, nonpublic information and independent verification of information changes by outside vendors.

companyName: PermRock Royalty Trust

ticker: PRT


text: We have also adopted physical, technological and administrative cybersecurity controls including, among other items: • a dedicated cybersecurity incident response team, the Security Incident Response Team (SIRT), which is comprised of internal resources and an external vendor, Managed Security Services Provider (MSSP). The MSSP triages based on a combination of predetermined rules. When the MSSP has validated a true positive event, it is communicated to the internal SIRT team for deeper investigation and response; • a written policy provided to all associates regarding identification, classification of severity and escalation of cybersecurity incidents; • perimeter and endpoints firewalls, intrusion prevention systems, endpoint detection and response, Attack Surface Management, multi-factor authentication and email protection; • annual and ongoing cybersecurity awareness training for our associates — including regular training on information security and data privacy policies. • routine testing of and training on our IT systems, including test phishing emails and awareness training opportunities; • cybersecurity policies, standards and practices that follow recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards, and follow evolving information security regulatory guidance for countries in which we operate; • automation and alerts via embedded tools and procedures to monitor data and notify us of threats or other potential unauthorized occurrences on or conducted through our systems; • sharing threat intelligence daily with each business unit; • multiple mechanisms by which employees can report cybersecurity and data privacy concerns, including a "Report Phish" button in the email application; • internal audits on our cybersecurity and data privacy practices; • a vulnerability management program designed to protect our external and internal networks and critical assets; • an ongoing process of identifying, assessing, reporting on, managing and remediating cybersecurity vulnerabilities across endpoints, workloads and systems; and • a level of cybersecurity insurance that Unisys believes is appropriate, taking into consideration the material risks from cybersecurity threats.


text: We engage third-party service providers to assist us with our cybersecurity risk management system Third-party cybersecurity experts regularly supplement our cybersecurity risk management efforts, including those we engage to conduct periodic cybersecurity risk assessments. During 2023, Unisys engaged cybersecurity risk experts and external legal counsel to conduct a review of, and advise us on, our cybersecurity risk management processes, current cybersecurity risk environment, leading board governance practices, strategic cyber reporting and cyber resiliency. Following the review, we have further revised our processes for identifying material cybersecurity incidents and enhanced our written policy regarding identification, classification of severity and escalation of cybersecurity incidents.


text: In 2023, Unisys engaged a leading cybersecurity firm to consult on several technical matters relating to cyber resiliency. This resulted in significant changes to our security technical stack and improvements to our processes and organization.


text: Our processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers Unisys recognizes the importance of overseeing and identifying material risks from cybersecurity threats associated with our use of third-party service providers. We have a Third Party Risk Management (TPRM) program, which is integrated into our procurement process and involves cybersecurity risk oversight and identification components. Our TPRM program includes policies and standards requiring that we perform cybersecurity due diligence reviews on our vendors based on the risk profile of a particular supplier or service provider or the service they provide. We also monitor certain of our principal suppliers and service providers on an ongoing basis by conducting additional periodic reviews. Whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect Unisys, including its business strategy, results of operations, or financial condition and if so, how.

stage1Category: Third-Party Risk


text: The information set forth under "Risk Factors" (Part I, Item 1A of this Form 10-K) — "We have been and could be vulnerable to disruption in our IT systems, cybers incidents, security breaches and loss of data (associate and client) that have occurred, and may continue to occur, and have resulted in and could continue to result in the incurrence of significant costs and harm to our business and reputation." — on page 14 of this Annual Report on Form 10-K is hereby incorporated by reference. As of December 31, 2023, our financial condition, results of operations or business strategy have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.


text: Cybersecurity Governance Board Oversight of Risks from Cybersecurity Threats Cybersecurity risk oversight continues to remain a top priority for the Board of Directors. The Board of Directors is responsible for oversight of Unisys' information security program, including compliance and risk management, and the review of cybersecurity risks. The Security and Risk Committee (S&RC), a Board committee comprised entirely of independent directors, assists the Board in these oversight responsibilities.


text: The S&RC's responsibilities include: • reviewing crisis preparedness and incident response plans; • monitoring Unisys' enterprise risk profile and its ongoing and potential exposure to risks of various types; • reviewing summaries of any incidents or activities; • reviewing reports or presentations from management or advisors, including third-party experts, regarding the management of enterprise risk programs; • periodically meeting with the CISO and Chief Privacy Officer (CPO); and • periodically briefing the full Board of Directors on cybersecurity matters.


text: Our S&RC chair previously served as the Chief Information Officer of a large healthcare company from 2011 to 2020 and as a Global Chief Information Officer at another company from 2004 to 2011. Other members of the S&RC have over forty years of executive and operational leadership experience at several global technology and telecommunications companies.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. The Audit Committee of our Board of Directors is responsible for the oversight of risks from cybersecurity threats.

companyName: ASPEN AEROGELS INC

ticker: ASPN


text: The Disclosure Committee assists in fulfilling our obligations to maintain disclosure controls and procedures and coordinates and oversees the process of preparing our periodic securities filings with the Securities and Exchange Commission. Cybersecurity incidents, based on their severity, are escalated to the Disclosure Committee by the SIRT. The Disclosure Committee is comprised of the Chief Executive Officer (CEO), Chief Operating Officer (COO), Chief Financial Officer, General Counsel, Chief Compliance Officer and Chief Accounting Officer. The COO represents the business units of the company and the CISO reports to the COO. The Disclosure Committee meets on a quarterly basis and more often, if necessary, and invites subject matter experts to meetings, as appropriate. We have policies and procedures in place designed to provide appropriate information of any matters to our Disclosure Committee that should be considered in advance of applicable public filings, including cybersecurity matters, and to address the proper handling and escalation of information to management and the Board of Directors or a committee of the Board of Directors. In addition to the oversight of the Board of Directors, members of our management are responsible for assessing and managing material cybersecurity risks.


text: Our CISO served as the CISO for Hertz Global Holdings, Inc. (Hertz), and prior to joining Hertz, held progressively senior information security roles at Hitachi Vantara LLC, Hewlett-Packard Company, Symantec Corp. and Marketo, Inc.


text: Our CPO previously served as the Global Data Privacy Officer for Hitachi Vantara LLC and prior to that practiced at the law firm of Littler Mendelson, P.C. as an attorney specializing in data privacy among other areas.


text: Our Chief Information Officer (CIO) has over 20 years at Unisys with experience and knowledge of IT infrastructure, systems and operations; and previously our CIO spent two years as the CIO for Whitney, Bradley & Brown, Inc. (n.k.a. Serco Inc.). At Unisys, the CIO partners with our CISO and CPO on cybersecurity risk management matters.


text: Protecting information, including that of our clients, is a top priority. Our overall cybersecurity and privacy strategy is to protect our customers' information and assets as well as ours to enable agility in the business. We have expertise, dedicated resources and technology to identify, assess, respond to and mitigate material risks from cybersecurity threats. Our Global Information Security organization (GIS), led by our Chief Information Security Officer (CISO), manages Unisys' cybersecurity risk identification, detection, assessment, response, mitigation and remediation processes, and interfaces with other departments, including business units, the information technology and legal departments, and enterprise risk management, to facilitate the risk management processes and ensure the policies and procedures established by GIS are integrated into our overall enterprise risk management system. GIS processes also work in tandem with the processes maintained by our Global Privacy Office (GPO).


text: Through our GPO, we deploy functional and business unit-specific approaches to data and privacy compliance sharing threat intelligence daily and collaborate closely with the Corporate Information Technology (CIT) organization to build process and playbooks for cyber-resiliency. Taking into consideration the processes established by GIS and CIT, our GPO has developed a framework of policies, procedures and other initiatives that are implemented across Unisys to help meet data privacy requirements. Our GPO is supported by a network of data protection officers, attorneys and privacy specialists; and manages privacy software that is used across Unisys to facilitate privacy impact assessments. The GPO also records data processing activities, maps data flows and follows evolving privacy regulatory guidance for countries in which we operate and adjusts standards as necessary.


text: Our dedicated cybersecurity incident response team, the Security Incident Response Team (SIRT), is comprised of internal resources and an external vendor, Managed Security Services Provider (MSSP). The MSSP triages and validates true positive events and then communicates to the internal SIRT team for deeper investigation and response.


text: Our physical and technological cybersecurity controls include, among other items: • perimeter and endpoints firewalls, intrusion prevention systems, endpoint detection and response, Attack Surface Management, multi-factor authentication and email protection; • routine testing of and training on our IT systems, including test phishing emails and awareness training opportunities; • automation and alerts via embedded tools and procedures to monitor data and notify us of threats or other potential unauthorized occurrences on or conducted through our systems; • multiple mechanisms by which employees can report cybersecurity and data privacy concerns, including a "Report Phish" button in the email application; • a vulnerability management program designed to protect our external and internal networks and critical assets; • bug bounty capability, enabling ethical hackers to simulate real-world attacks to identify and report vulnerabilities; • secure coding and development; and • security and operations framework and tools.


text: We design and assess our cybersecurity policies, standards and practices following recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. We have established written policies that are provided to all associates regarding identification, classification of severity and escalation of cybersecurity incidents and we provide annual and ongoing cybersecurity awareness training for our associates — including regular training on information security and data privacy policies. We also perform internal audits on our cybersecurity and data privacy practices.


text: Unisys recognizes the importance of overseeing and identifying material risks from cybersecurity threats associated with our use of third-party service providers. We have a Third Party Risk Management (TPRM) program, which is integrated into our procurement process and involves cybersecurity risk oversight and identification components. Our TPRM program includes policies and standards requiring that we perform cybersecurity due diligence reviews on our vendors based on the risk profile of a particular supplier or service provider or the service they provide. We also monitor certain of our principal suppliers and service providers on an ongoing basis by using an outside-in, hacker perspective of a company's cybersecurity posture through an external service provider. Whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect Unisys, including its business strategy, results of operations, or financial condition and if so, how.


text: The information set forth under "Risk Factors" (Part I, Item 1A of this Form 10-K) — "We have been and could be vulnerable to disruption in our IT systems, cyber incidents, security breaches and loss of data (associate and client) that have occurred, and may continue to occur, and have resulted in and could continue to result in the incurrence of significant costs and harm to our business and reputation." — on page 15 of this Annual Report on Form 10-K is hereby incorporated by reference. As of December 31, 2024, our financial condition, results of operations or business strategy have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.


text: Cybersecurity Governance Board Oversight of Risks from Cybersecurity Threats Cybersecurity risk oversight continues to remain a top priority for the Board of Directors. The Board of Directors is responsible for oversight of Unisys' information security program, including compliance and risk management, and the review of cybersecurity risks. The Security and Risk Committee (S&RC), a Board committee comprised entirely of independent directors, assists the Board of Directors in these oversight responsibilities. Additionally, the Audit and Finance Committee has general oversight over Unisys' cybersecurity as it relates to responsibility for Unisys' internal audit function, including cybersecurity practices, compliance with legal and regulatory requirements, and internal control over financial reporting.


text: The S&RC's responsibilities include monitoring Unisys' enterprise risk profile and its ongoing and potential exposure to risks of various types and reviewing crisis preparedness; incident response plans; summaries of any incidents or activities; and reports or presentations from management or advisors, including third-party experts, regarding the management of enterprise risk program. The S&RC periodically meets with the CISO and Chief Privacy Officer (CPO) and briefs the full Board of Directors on cybersecurity matters.


text: Our S&RC chair has previously served in the role of Chief Information Officer at two large companies for over 15 years. Other members of the S&RC have extensive years of executive and operational leadership experience at several global technology and telecommunications companies. Management's Role in Assessing and Managing the Company's Material Risks from Cybersecurity Threats.


text: The Disclosure Committee, a senior executive leadership committee, assists in fulfilling our obligations to maintain disclosure controls and procedures and oversees the process of preparing our periodic securities filings with the Securities and Exchange Commission. Cybersecurity incidents, based on their severity, are escalated to the Disclosure Committee by the SIRT. The Disclosure Committee is comprised of the Chief Executive Officer, Chief Operating Officer, Chief Financial Officer, General Counsel, Chief Compliance Officer and Chief Accounting Officer. The Disclosure Committee meets on a quarterly basis and more often, if necessary, and invites subject matter experts to meetings as appropriate. We have policies and procedures in place designed to provide appropriate information of any matters to our Disclosure Committee that should be considered in advance of applicable public filings, including cybersecurity matters, and to address the proper handling and escalation of information to management and the Board of Directors or a committee of the Board of Directors. In addition to the oversight by the Board of Directors, members of our management are responsible for assessing and managing material cybersecurity risks. Our CISO has over 34 years of experience in cybersecurity, applications, infrastructure and networks in information security.


text: Our CPO has over 8 years of experience serving as a Global Data Privacy Officer and practicing law specializing in data privacy among other areas.


text: Our Chief Information Officer (CIO) has over 20 years at Unisys with experience and knowledge of IT infrastructure, systems and operations. At Unisys, the CIO partners with our CISO and CPO on cybersecurity risk management matters.


text: We have implemented a layered cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems, networks, and data systems. Our cybersecurity program is generally aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Information Security Team and Governance.

companyName: GARTNER INC

ticker: IT


text: The execution of the ISP relies on our committed investment in people, processes, and technology. We have invested in market-leading technology and award-winning security partners to execute key processes that ensure the confidentiality, integrity, and availability of company assets.

companyName: FINANCIAL INSTITUTIONS INC

ticker: FISI


text: The Audit Committee has the primary responsibility of assisting our Board of Directors in overseeing risk related to cybersecurity matters. The Board and/or the Audit Committee receive quarterly cybersecurity-related reports from our Chief Information Officer (CIO), which may address a wide range of topics, such as: cybersecurity strategy, the threat environment, the status of ongoing information security program initiatives, and information security program metrics. Additionally, we have documented protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported to the Board and/or the Audit Committee.


text: At the management level, our CIO, who reports directly to the CEO, has over 20 years of experience serving in IT management, software development, and technology-based roles across a variety of industries, including publishing, media and entertainment, and financial and insurance services. Our Chief Information Security Officer (CISO), who reports directly the CIO, has extensive cybersecurity knowledge and skills gained from over 15 years of work experience serving in security roles for the Company and a variety of financial service firms. Our CISO is responsible for understanding, managing, and communicating cybersecurity risk internally to our management, and works closely with Legal to oversee compliance with legal, regulatory, and contractual security requirements.


text: Our CISO heads the Information Security Team, which is responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across our business. The Information Security Team covers a wide range of cyber and information security responsibilities. Our CISO also receives reports on cybersecurity threats on an ongoing basis and regularly reviews risk management measures implemented by the Company to identify and mitigate cybersecurity risks. In addition to our internal capabilities, we also engage external consultants, legal counsel, or other third-party advisors to assist with assessing, identifying, and managing cybersecurity risks. Risk Management and Strategy.


text: Cybersecurity risk management, which involves resource commitments and management attention, is overseen both as a critical component of our overall risk management program and as a standalone program. We have implemented a risk-based, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents.


text: Our cybersecurity program uses a layered strategy, relying on technology and human processes to safeguard our client's data at all layers. We embed controls within our business processes and technology development, starting with design and engineering and extending to operations. Our defense-in-depth strategy utilizes numerous layers of security controls, processes, and procedures across our information systems and networks, including but not limited to, vulnerability management, multi-factor authentication (MFA), identity access management (IAM), endpoint security, mobile security, application security, encryption, network security, web security, and event monitoring and logging. Aspects of our program undergo several independent third-party audits and reviews on a regular basis.


text: We maintain a written Information Security Policy, which establishes the foundational components of our cybersecurity program and our high-level security responsibilities over all technologies, facilities and data. When engaging service providers and third-party vendors, we perform due diligence to assess whether these providers have appropriate privacy and security controls, and we generally require these providers to implement appropriate protective measures, and to use confidential information solely for the purposes of performing their services.


text: Additionally, we have adopted a documented Incident Response Plan that applies in the event of a cybersecurity incident to provide a standardized framework for response. In general, our incident response process follows the NIST 800-61 framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation.


text: We have implemented a security training and awareness program for all Gartner employees and third-party contractors. Employees receive security training in connection with onboarding as well as annual awareness and training activities throughout their employment. Further, Gartner carries cybersecurity insurance covering the company and its subsidiaries. Material Cybersecurity Risks, Threats & Incidents.


text: While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Report under the heading "Strategic and Operational Risks – We are exposed to risks related to cybersecurity," which should be read in conjunction with the foregoing information.

stage1Category: None/Other


text: information about these risks, see the risk factor titled "The Company relies on its information and communications systems in its operations. Security breaches and other disruptions could adversely affect its business and results of operations" under Item 1A.

companyName: STURM RUGER & CO INC

ticker: RGR


text: At the management level, our CIO, who reports directly to the CEO, has over 20 years of experience serving in IT management, software development, and technology-based roles across a variety of industries, including publishing, media and entertainment, and financial and insurance services. Our Chief Information Security Officer (CISO), who reports directly to the CIO, has extensive cybersecurity knowledge and skills gained from over 15 years of work experience serving in security roles for the Company and a variety of financial service firms. Our CISO is responsible for understanding, managing, and communicating cybersecurity risk internally to our management, and works closely with Legal to oversee compliance with legal, regulatory, and contractual security requirements.


text: Risk Management and Strategy We have developed, implemented and maintained robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. These measures are included within our overall risk management process. As part of this process, all detected cybersecurity threats and incidents are logged and escalated to the Chief Information Security Officer ("CISO") and Chief Compliance Officer, who report to our Chief Legal Officer.

companyName: Light & Wonder, Inc.

ticker: LAWIL


text: We have designated our Chief Information Officer who reports to our Chief Executive Officer and Chairman of the Board to manage the assessment and response to material risks from cybersecurity threats. Our Chief Information Officer's cybersecurity expertise includes over 18 years of experience in information security and technology.

companyName: TETRA TECH INC

ticker: TTEK


text: We follow a formal cybersecurity incident response policy, which provides for use of third-party service providers where circumstances dictate it is necessary. Our cybersecurity incident response policy is aligned with the standards set forth by the International Organization for Standardization ("ISO") and the National Institute of Standards and Technology ("NIST"), and it includes proactive steps to prepare for attempts to compromise our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats and to protect against, detect and respond to cybersecurity incidents, we undertake the below activities: • closely monitor emerging data protection laws and implement changes to our processes designed to comply; • undertake an annual risk assessment and review of our consumer facing policies, business changes and statements related to cybersecurity, or more frequently as needed; • proactively inform our customers of substantive changes related to customer data handling; • conduct annual customer data handling and use requirements training for all our employees and contingent workers; • conduct annual cybersecurity management and incident training for employees and contingent workers involved in our systems and processes that handle sensitive data; • conduct regular phishing email simulations for all employees and all contingent workers with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data in accordance with local laws and regulations; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; and • use an internal well-tested incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident. Where circumstances dictate the use of third-party service providers, such services include regular assessments of our cybersecurity program including cyber maturity assessments and penetration tests; evaluation and approval of our critical business partners and vendors; and participating in incident response processes. As part of our cybersecurity incident response policy, we identify, evaluate and mitigate any risks posed from engaging with any third-party service provider. In 2023 we did not experience any cybersecurity incident that materially affected or was reasonably likely to materially affect our operations, business, results of operations, cash flows or financial condition.


text: Governance and Oversight The Board of Directors is central to oversight of cybersecurity risks. The Board of Directors is composed of members with diverse expertise, including risk management, technology, finance and legal, and they have appropriate access to management and third parties (as deemed necessary), equipping them to oversee cybersecurity risks effectively. Day-to-day cybersecurity monitoring and oversight activities are delegated to management.


text: Our CISO is primarily responsible for assessing, monitoring and managing cybersecurity risks as well as overseeing employee training programs. Our CISO has served in this role since July 2019, has a Master's Degree in Information Security from the University of London, has been working in technology risk management since the early 1990s, holds Certified Information Systems Security Professional status and is a member in good standing of the Institute of Electrical and Electronics Engineers ("IEEE") and the International Information System Security Certification Consortium ("ISC2"). The CISO reports at least annually to the Board of Directors on material cyber risks, including those identified in our business and rising threats, and the current state of L&W's information security and will continue to do so on a regular basis as needed.


text: The CISO and his team evaluate quantitative and qualitative factors to determine if a cybersecurity threat or incident needs to be escalated to other members of management and ultimately to the Board of Directors. The factors evaluated include but are not limited to: actual or potential monetary damages, number of impacted employees or customers, nature of the records compromised, potential impact on customer relationships, public knowledge and likely effect on L&W's reputation. Depending on the severity of the impact on these factors, management, including the CISO, Chief Compliance Officer, Chief Accounting Officer ("CAO") and Chief Legal Officer, meets as part of a management committee to determine if an incident is material. In the event the management committee determines that a cybersecurity incident or threat is material, the incident or threat is elevated and reviewed with our Board of Directors. The management committee reports all incidents requiring a materiality assessment to the Chief Legal Officer, regardless of whether such committee ultimately determines a cybersecurity incident to be material.


text: For additional information regarding how cyber security threats could materially affect or are reasonably likely to materially affect our business strategy, results of operations or financial condition, see the risk factors captioned "Our success depends on the security and integrity of the systems and products we offer, and security breaches, including cybersecurity breaches, or other disruptions could compromise our information or the information of our customers and expose us to liability, which would cause our business and reputation to suffer," "We rely on information technology and other systems, and any failures in our systems or errors, defects or disruptions in our products and services could diminish our brand and reputation, subject us to liability and have disrupted and could disrupt our business and adversely impact our results," and "If we or a company we acquire sustains cyber-attacks or other privacy or data security incidents that result in security breaches, we could suffer a loss of sales and increased costs, exposure to significant liability, reputational harm, regulatory fines or punishment and other negative consequences" under the heading "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K for additional information.


text: Risk Management and Strategy We have developed, implemented and maintained robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. These measures are included within our overall risk management process. As part of this process, all detected cybersecurity threats and incidents are logged and escalated to the Chief Information Security Officer ("CISO") and Chief Compliance Officer, who report to our Chief Legal Officer. Annually or more frequently if needed, the CISO meets with the other stakeholders to assemble the company's Risk Register. Cyber risks are an integral part of this process and the CISO and their team regularly assess the current cyber risk landscape, assess L&W's susceptibility to those cyber risks, and use that analysis as feedback to the overall Risk Register.


text: As of the date of this filing, we are not aware of any current cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. For further discussion of the risks related to cybersecurity, see Item 1A. Risk Factors - Risks Relating to Our Business - Information Technology and Data Privacy Risks.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: We follow a formal cybersecurity incident response policy, which provides for use of third-party service providers where circumstances dictate it is necessary. Our cybersecurity incident response policy incorporates recommendations from the International Organization for Standardization ("ISO") and the NIST, and it includes proactive steps to prepare for attempts to compromise our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and to protect against, detect and respond to cybersecurity incidents, we undertake the below activities: • closely monitor emerging data protection laws and implement changes to our processes designed to comply; • undertake an annual risk assessment and review of our consumer facing policies, business changes and statements related to cybersecurity, or more frequently as needed; • proactively inform our customers of substantive changes related to customer data handling; • conduct annual customer data handling and use requirements training for all our employees and contingent workers; • conduct annual cybersecurity management and incident training for employees and contingent workers involved in our systems and processes that handle sensitive data; • conduct regular phishing email simulations for all employees and all contingent workers with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data in accordance with local laws and regulations; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; and • use an internal well-tested incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident. Where circumstances dictate the use of third-party service providers, such services include regular assessments of our cybersecurity program including cyber maturity assessments and penetration tests; evaluation and approval of our critical business partners and vendors; and participating in incident response processes. As part of our cybersecurity incident response policy, we identify, evaluate and mitigate any risks posed from engaging with any third-party service provider. As of December 31, 2024, we are not aware of any cybersecurity incident in the past year that materially affected or was reasonably likely to materially affect our operations, business, results of operations, cash flows or financial condition.


text: Our CISO is primarily responsible for assessing, monitoring and managing cybersecurity risks, including those presented by third-party service providers, as well as overseeing employee training programs. Our CISO has served in this role since July 2019, has a Master's Degree in Information Security from the University of London, has been working in technology risk management since the early 1990s, holds Certified Information Systems Security Professional status and is a member in good standing of the Institute of Electrical and Electronics Engineers ("IEEE") and the International Information System Security Certification Consortium ("ISC2"). The CISO reports at least annually to the Board of Directors on material cyber risks, including those identified in our business and rising threats, and the current state of L&W's information security and will continue to do so on a regular basis as needed.


text: The CISO and his team evaluate quantitative and qualitative factors to determine if a cybersecurity threat or incident needs to be escalated to other members of management and ultimately to the Board of Directors. The factors evaluated include but are not limited to: actual or potential monetary damages, number of impacted employees or customers, nature of the records compromised, potential impact on customer relationships, public knowledge and likely effect on L&W's reputation. Depending on the severity of the impact on these factors, management, including the CISO, Chief Compliance Officer and Chief Accounting Officer ("CAO"), meets as part of a management committee to determine if an incident is material. In the event the management committee determines that a cybersecurity incident or threat is material, the incident or threat is elevated and reviewed with our Board of Directors. The management committee reports all incidents requiring a materiality assessment to the Chief Legal Officer, regardless of whether such committee ultimately determines a cybersecurity incident to be material.


text: For additional information regarding how cybersecurity threats could materially affect or are reasonably likely to materially affect our business strategy, results of operations or financial condition, see the risk factors captioned "Our success depends on the security and integrity of the systems and products we offer, and security breaches, including cybersecurity breaches, or other disruptions could compromise our information or the information of our customers and expose us to liability, which would cause our business and reputation to suffer," "We rely on information technology and other systems, and any failures in our systems or errors, defects or disruptions in our products and services could diminish our brand and reputation, subject us to liability and have disrupted and could disrupt our business and adversely impact our results," and "If we, our third-party vendors or service providers, our customers or a company we acquire sustains cyber-attacks or other privacy or data security incidents that result in security breaches, we could suffer a loss of sales and increased costs, exposure to significant liability, reputational harm, regulatory fines or punishment and other negative consequences" under the heading "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K for additional information.


text: Cybersecurity Risk Management and Strategy The Company has developed and implemented a comprehensive cybersecurity risk management program that is intended to protect the secure processing, transmission and storage of confidential information in its computer systems and networks. The Company's cybersecurity risk management program, a component of the Company's Enterprise Risk Management ("ERM") Program, is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance and other industry standards. The Company's process for identifying, assessing, managing and prioritizing cybersecurity risks throughout the Company includes: • A third party risk assessment program for the Company's third party vendors that access the Company's data (each, a "Vendor") to ensure that all Vendors meet the Company's cybersecurity requirements, including, periodic risk assessments of Vendors, monitoring Vendor compliance with the Company's cybersecurity requirements, and a requirement that all contracts with Vendors include provisions requiring the Vendor to notify the Company of any cyber incident, and/or to maintain minimum levels of cybersecurity insurance; • A security awareness program that includes training employees on best practices for securing the Company's data, as well as regular social engineering testing to keep employees informed of cybersecurity threats and to train them to look for malicious emails and other potential cybersecurity threats; • A dedicated information security team that monitors threats and vulnerabilities that arise, and regularly performs threat intelligence and vulnerability management; • The Company's engagement of a third party to conduct periodic independent testing of the Company's cybersecurity defenses to confirm that the defenses are effective; • A Managed Detection and Response ("MDR") service that continuously monitors the Company's systems and alerts the Company's information security team of any detected anomalies or suspicious activity and stops any event that is deemed dangerous to the Company's systems or networks; • An Incident Response Plan ("IRP") and Business Continuity Plan ("BCP") which outline steps to be taken during a cyber incident and to recover systems and continue business operations following a cyber incident; and • A Cybersecurity Incident Response Team ("CSIRT") that tracks cyber incidents, including those that affect third parties that are handling the Company's data.

companyName: CAMDEN NATIONAL CORP

ticker: CAC


text: Cybersecurity Governance Board of Directors' Oversight. The Company's Board of Directors oversees the Company's cybersecurity program, including the oversight of risks related to cybersecurity through various committees that are responsible for monitoring and testing the Company's information security. The Board of Directors conducts an annual review of the Company's cybersecurity- related policies. Quarterly, the Company's Senior Vice President, Director of Information Security ("DIS") presents reports to the Audit Committee on vulnerability management and cybersecurity testing effectiveness, emerging threats and industry and regulatory changes that affect cybersecurity, and responds to inquiries from the Audit Committee. In addition, the Technology Committee receives and evaluates quarterly updates from the DIS on cybersecurity performance and on cybersecurity trends and strategies. The Board of Directors receives quarterly updates from the EVP, Chief Risk Officer ("CRO") on cybersecurity metrics and the cybersecurity risk management program's performance.


text: Management Oversight. While the Board of Directors and its Audit and Technology Committees oversee management's processes related to cybersecurity risks, management is responsible for identifying, monitoring and mitigating the material cybersecurity risks that face the Company. The Company's CRO is directly responsible for the overall cybersecurity risk management program which is a part of the Company's ERM Program. The CRO and the DIS oversee the information security department's implementation and maintenance of the cybersecurity security risk management program, including oversight of Vendors and regular reporting to the Board of Directors and its Audit and Technology Committees on the effectiveness of the cybersecurity risk management program. The DIS updates the CRO as appropriate, including as new developments or information related to cyber incidents arise.


text: The Company's CRO has over 27 years of experience in cybersecurity and information technology. The CRO joined the Company in 2011 and became CRO in July 2023. Prior to becoming CRO, he served as SVP and Director of Information Security & ERM for six years and prior to that served five years as Vice President and Senior Information Security Officer of the Company. Prior to joining the Company, the CRO had a ten year career in information technology and began his career serving with the United States Air Force, specializing in information technology, cybersecurity, risk mitigation, and encrypted communications.


text: The Company's DIS joined the Company in 2023 and has over 20 years of experience in information technology and cybersecurity. The DIS has held senior management positions in information security for the past ten years. The DIS holds several industry certifications including Certified Information Systems Security Professional ("CISSP"), Certified Information Systems Auditor ("CISA"), Certified in Risk and Management Systems Controls ("CRISC") and Certified Data Privacy Solutions Engineer ("CDPSE").


text: Cybersecurity Threats During the fiscal year ended December 31, 2024, the Company did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or that are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition other than the risks described in Item 1A. "Risk Factors".


text: The cybersecurity capabilities of third-party vendors providing services to NEE or FPL or accessing NEE's or FPL's systems or data are evaluated as part of the new vendor establishment process. NEE, including FPL, retains the right to audit vendors for cybersecurity of products and services. Where applicable in NEE's or FPL's contracts with third-party vendors accessing its systems or data, standard data security terms and conditions are utilized and minimum amounts of insurance coverage based on the risk of exposure are required.

companyName: FLORIDA POWER & LIGHT CO


text: Management Oversight. While the Board of Directors and its Audit and Technology Committees oversee management's processes related to cybersecurity risks, management is responsible for identifying, monitoring and mitigating the material cybersecurity risks that face the Company. The Company's CRO is directly responsible for the overall cybersecurity risk management program which is a part of the Company's ERM Program. The CRO and the DIS oversee the information security department's implementation and maintenance of the cybersecurity risk management program, including oversight of Vendors and regular reporting to the Board of Directors and its Audit and Technology Committees on the effectiveness of the cybersecurity risk management program. The DIS updates the CRO as appropriate, including as new developments or information related to cyber incidents arise.


text: The Company's CRO has over 27 years of experience in cybersecurity and information technology. The CRO joined the Company in 2011 and became CRO in July 2023. Prior to becoming CRO, he served as SVP and Director of Information Security & ERM for six years and prior to that served five years as Vice President and Senior Information Security Officer of the Company. Prior to joining the Company, the CRO had a ten year career in information technology and began his career serving with the U.S. Air Force, specializing in information technology, cybersecurity, risk mitigation, and encrypted communications.


text: Risk Management and Strategy Cybersecurity risk management is included in NEE's, including FPL's, overall risk management program. NEE, including FPL, operates a cybersecurity program which, among other objectives, seeks to identify potential unauthorized occurrences on or conducted through the electronic information resources owned or used by NEE or FPL (information systems) that may result in adverse effects on the confidentiality, integrity or availability of its information systems or any information residing on those systems (cybersecurity threats) as well as on its operations. The cybersecurity program includes controls to reduce the risk and potential impact of a cybersecurity incident and to align its processes, controls and implemented technologies with industry standard frameworks and regulations. In addition, outside experts assess NEE's, including FPL's, cybersecurity program capabilities, technology environment and security controls to regularly evaluate effectiveness.


text: NEE, including FPL, operates a cybersecurity operations center and has cyber threat intelligence capability to identify, monitor, detect and respond to cybersecurity threats which is led by a cybersecurity incident response team. NEE, including FPL, uses these resources to identify cybersecurity threats and monitor for anomalies that may result in cybersecurity incidents on their systems, and monitors for impacts to external vendors or suppliers. Assessment of an incident includes, but is not limited to, analysis of the urgency and operational or business impact of an incident and the status and effectiveness of incident defenses. NEE, including FPL, invests in personnel and technologies with the objective of limiting the frequency and impact of cybersecurity incidents. Following documented cybersecurity incident response procedures, the cybersecurity incident response team escalates information about cybersecurity incidents as appropriate to oversight committees charged with managing specific aspects of cybersecurity risk, including, among others, the Cybersecurity and Resiliency Committee, the Cybersecurity Governance Executive Committee and NEE's Board of Directors.


text: NEE, including FPL, conducts an annual internal cybersecurity drill with the participation from time to time of local, state and federal agencies to test its capability of dealing with a simulated cyber-attack. NEE, including FPL, also participates in industry forums and trade groups, as well as in NERC activities to learn and apply these learnings to its cybersecurity policies and procedures.


text: NEE, including FPL, uses third parties to periodically assess the extent to which its cybersecurity risk management protocols align with the DOE's Cybersecurity Capability Maturity Model standard. Certain functions within NEE, including FPL, are required to comply with certain regulatory standards that are designed to protect against cybersecurity incidents, including the NERC Critical Infrastructure Protection standards, as well as the NRC cybersecurity protection standards. Further, NEE, including FPL, has a cybersecurity training program and a mock phishing program to educate and train employees on potential cybersecurity risks and on privacy and data protection. Given geopolitical events, NEE, including FPL, continues to take steps to protect against cybersecurity threats to its critical infrastructure, including communications with its employees to ensure heightened awareness of increased cybersecurity threats worldwide.


text: The cybersecurity capabilities of third-party vendors providing system solutions to NEE or FPL or accessing NEE's or FPL's systems or data is evaluated as part of the new vendor establishment process. NEE, including FPL, retains the right to audit vendors for cybersecurity of products and services. Where applicable in NEE's or FPL's contracts with third-party vendors accessing its systems or data, standard data security terms and conditions are utilized and minimum amounts of insurance coverage based on the risk of exposure are required.


text: NEE, including FPL, operates U.S. critical infrastructure. There have been cyberattacks and other physical attacks within the energy industry on energy infrastructure such as substations, gas pipelines and related assets in the past and there may be such attacks in the future. Although there have been no cybersecurity incidents or threats with a material impact on NEE's nor FPL's business strategy, results of operations, or financial condition, NEE's or FPL's information technology systems could fail or be breached, and such systems could be inoperable, causing NEE and FPL to be unable to fulfill critical business operations. The disclosures herein should be reviewed with the risk factors included in Part I, Item 1A.


text: The chief information officer, the vice president, IT infrastructure and cybersecurity and the chief information security officer are responsible for assessing and managing material risks from cybersecurity threats and have careers that represent more than 75 years of combined experience related to the management and protection of technologies. These individuals participate in or receive updates from not only the cybersecurity incident response team but also cybersecurity oversight committees, such as the Cybersecurity and Resiliency Committee comprised of various members of management, including the chief executive officers of FPL and NEER, the chief financial officer and the chief legal officer and the Cybersecurity Governance Executive Committee comprised of various members of management, including vice president of internal audit and executive director of emergency preparedness. These committees are charged with governing cybersecurity, cyber risks and resilience activities as well as the cyber and physical security policies and programs for NEE and its subsidiaries.


text: NEE's Board of Directors is responsible for the oversight of risks from cybersecurity threats and receives cybersecurity reports from NEE's chief information officer and its vice president, IT infrastructure and cybersecurity. The cybersecurity reports to the Board of Directors include various information, such as updates on the cybersecurity threat landscape, risk assessments, mitigation plans, including cyber defenses, notable incidents and a summary of the annual cyber drill results. Significant active cybersecurity incidents and threats are communicated to the Board of Directors as they occur.


text: NEE, including FPL, operates a cybersecurity operations center and has cyber threat intelligence capability to identify, monitor, detect and respond to cybersecurity threats which is led by a cybersecurity incident response team. NEE, including FPL, uses these resources, and leverages third-party resources, to identify cybersecurity threats and monitor for anomalies that may result in cybersecurity incidents on its systems, and monitors for impacts to its vendors or suppliers. Assessment of incidents includes, but is not limited to, analysis of the urgency and operational or business impact of an incident and the status and effectiveness of incident defenses. NEE, including FPL, invests in personnel and technologies with the objective of limiting the frequency and impact of cybersecurity incidents. Following documented cybersecurity incident response procedures, the cybersecurity incident response team escalates information about cybersecurity incidents depending on circumstances to oversight committees and personnel charged with managing specific aspects of cybersecurity risk, including, among others, the Cybersecurity and Resiliency Committee, the Cybersecurity Governance Executive Committee and NEE's Board of Directors.


text: NEE, including FPL, conducts periodic desktop exercises and an annual cybersecurity drill with the participation from time to time of local, state and U.S. federal agencies to test its capability of dealing with a simulated cyberattack. NEE, including FPL, also participates in industry forums and various trade groups, as well as in NERC activities, to learn and apply these incident preparedness learnings to its cybersecurity policies and procedures.


text: NEE, including FPL, uses third parties to periodically assess the extent to which its cybersecurity risk management protocols align with the U.S. Department of Energy's Cybersecurity Capability Maturity Model standard. Certain functions within NEE, including FPL, are required to comply with certain regulatory standards that are designed to protect against cybersecurity incidents, including the NERC Critical Infrastructure Protection standards, as well as the NRC cybersecurity protection standards. Further, NEE, including FPL, has a cybersecurity training program and a mock phishing program to educate and train employees on potential cybersecurity risks and on privacy and data protection. Given geopolitical events, NEE, including FPL, continues to take steps to defend against cybersecurity threats to its critical infrastructure, including communications with personnel to ensure heightened awareness of increased cybersecurity threats worldwide.


text: Both the Risk and Audit Committees of our Board have oversight of the management of our cybersecurity risk. The Audit Committee is responsible for overseeing the CSP under its risk oversight responsibilities as it relates to financial controls. The Risk Committee is responsible for oversight of the management of cybersecurity risk consistent with the Framework.

companyName: CITIZENS FINANCIAL GROUP INC/RI

ticker: CFG


text: NEE, including FPL, operates U.S. critical infrastructure. There have been cyberattacks and other physical attacks within the energy industry on energy infrastructure such as substations, gas pipelines and related assets and there may be such attacks in the future. In addition, the advancement of artificial intelligence has given rise to new security risks. Although there have been no cybersecurity incidents or threats with a material impact on NEE's nor FPL's business strategy, results of operations, or financial condition, NEE's or FPL's information technology systems could fail or be breached, and such systems could be inoperable, causing NEE and FPL to be unable to fulfill critical business operations. The disclosures herein should be reviewed with the risk factors included in Item 1A.


text: The vice president and chief information officer, the vice president cybersecurity and the executive director cybersecurity are responsible for assessing and managing material risks from cybersecurity threats. They have careers that represent more than 50 years of combined experience related to the management and protection of technologies. These individuals participate in or receive updates from not only the cybersecurity incident response team but also cybersecurity oversight committees, such as the Cybersecurity and Resiliency Committee comprised of various members of management, including the executive vice president and chief risk officer, presidents and chief executive officers of FPL and NEER, the executive vice president, finance and chief financial officer and the executive vice president, chief legal, environmental & federal regulatory affairs officer, and the Cybersecurity Governance Executive Committee comprised of various members of management, including the vice president, internal audit and the executive director, emergency preparedness. These committees are charged with governing cybersecurity, cyber risks and resilience activities as well as the cyber and physical security policies and programs for NEE and its subsidiaries.


text: NEE's Board of Directors is responsible for the oversight of risks from cybersecurity threats and receives cybersecurity reports from NEE's vice president and chief information officer and its vice president cybersecurity. The cybersecurity reports to the Board of Directors include various information, such as updates on the cybersecurity threat landscape, risk assessments, mitigation plans, including cyber defenses, notable incidents and a summary of the annual cyber drill results. Significant active cybersecurity incidents and threats are communicated to the Board of Directors as they occur.


text: Risk Management and Strategy The Company's Cybersecurity Program ("CSP") drives an end-to-end, continuous process that protects our customers, colleagues, assets, premises, systems, and information (electronic and non-electronic), and is designed to ensure compliance with current and emerging federal and state laws and regulations. The CSP is designed to ensure the effective implementation of the Corporate Security and Resilience Operating Model across all business lines of the Company and is under the supervision of the Chief Security Officer ("CSO").


text: Non-Financial Risk Management coordinates the development, maintenance, and day-to-day oversight of the Company's Enterprise Risk Management Governance Framework ("the Framework"), which defines an integrated enterprise-wide approach to risk management. This centrally managed program is designed to ensure that all business lines play a role in the successful implementation of the CSP. The CSP aligns with the Framework, enabling the CSO to provide risk oversight to and drive accountability from the business lines.


text: The CSP is designed to assess and mitigate threats and risks to the Company. New and emerging threats are assessed through an intelligence lifecycle, which includes threat modeling. In addition, risk assessment processes drive risk identification and measurement related to security. Once risks are identified and measured, the Framework is leveraged to track and mitigate them. Control testing is utilized to demonstrate that risks are managed effectively, identify gaps in expected control operation, and develop appropriate remediation plans, in order to manage risk to the Company within tolerable limits.


text: As part of the Company's Third Party Risk Management Program and in support of the CSP, reviews for cybersecurity, business continuity, fraud, and other policy-related topics are performed for the onboarding of new vendors and ongoing monitoring of existing vendors. Ratings assigned to a vendor determine review frequency and scope. Results are reported to key stakeholders and identified issues are tracked and monitored.


text: The Company regularly reviews the nature of its business activities and modifies the CSP as appropriate. Many of the elements of the CSP are cyber defense related and are in place to reduce our risk to a wide range of potential cyber threats that may target our assets and information daily. The effectiveness of the CSP is assessed and measured periodically by various lines of defense within the Company and is conducted primarily through risk assessments, assurance testing, and an independent audit. External organizations are also routinely engaged to assess our CSP and test our perimeter defenses. The effectiveness of the CSP is reported periodically to the appropriate governance committees.


text: The Company does not believe that it has experienced any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company and its business strategy, results of operations and/or financial condition.

companyName: CEDAR REALTY TRUST, INC.

ticker: CDR-PC


text: Under the guidance of our CSO, we maintain a comprehensive CSP designed to protect our employees, customers, assets, premises, systems, and information against unauthorized access, misuse, alteration, or destruction that could result in substantial harm or inconvenience to our customers, and loss or reputational damage. The CSP incorporates all of our security policies and covers the core elements of access control, infrastructure security, cybersecurity event and incident management, data protection, third-party vendor cyber risk oversight, payment security, and training and awareness. Independent assessment and benchmarking of the CSP are regularly completed, and the CSP is reviewed and assessed by federal regulators. While we look to numerous frameworks to ensure the CSP is maintained in line with regulatory expectations and industry best practices, the National Institute of Standards and Technology cybersecurity framework is the primary standard against which we benchmark ourselves.


text: Both the Risk and Audit Committees have oversight of the management of our cybersecurity risk. The Audit Committee is responsible for overseeing the CSP under its risk oversight responsibilities as it relates to financial controls. The Risk Committee is responsible for oversight of the management of cybersecurity risk consistent with the Framework.


text: The CSP is presented by the CSO to the Risk Committee annually for approval in conjunction with an annual cybersecurity briefing. This briefing provides an overall assessment of the effectiveness of the CSP and an outlook for the upcoming year. In addition to the annual cybersecurity briefing, the CSO provides updates on cybersecurity to the Risk Committee at each of its meetings. The Audit Committee and Board also receive regular cybersecurity updates as part of the reporting provided by the Technology/Cyber Oversight Committee, a management committee chaired by the CEO which provides executive oversight, guidance and transparency to key transformative initiatives designed to enhance our technology stability, cyber defenses and risk management capabilities. Further, to ensure the Board maintains the appropriate knowledge for providing effective oversight, it is provided with relevant cybersecurity training on an annual basis, with any additional training provided as requested.


text: Operational Risk Management coordinates the development, maintenance, and day-to-day oversight of the Company's Enterprise Risk Management Governance Framework ("the Framework"), which defines an integrated enterprise-wide approach to risk management. This centrally managed program is designed to ensure that all business lines play a role in the successful implementation of the CSP. The CSP aligns with the Framework, enabling the CSO to provide risk oversight to and drive accountability from the business lines.


text: Under the guidance of our CSO, we maintain a comprehensive CSP designed to protect our employees, customers, assets, premises, systems, and information against unauthorized access, misuse, alteration, or destruction that could result in substantial harm or inconvenience to our customers, and loss or reputational damage. The CSP incorporates all of our security policies and covers the core elements of access control, infrastructure security, cybersecurity event and incident management, data protection, third-party vendor cyber risk oversight, and training and awareness. Independent assessment and benchmarking of the CSP are regularly completed, and the CSP is reviewed and assessed by federal regulators. While we look to numerous frameworks to ensure the CSP is maintained in line with regulatory expectations and industry best practices, the National Institute of Standards and Technology cybersecurity framework is the primary standard against which we benchmark ourselves.


text: Cybersecurity Risk Management and Strategy The Company depends on the proper functioning, availability and security of its information systems, including financial, data processing, communications and operating systems. Several information systems are software applications provided by third parties. Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, like other companies in our industry, we could, from time to time, experience threats and security incidents related to our and our third-party vendors' information systems, including attempts to gain unauthorized access to our confidential data, and other electronic security breaches. Such cybersecurity attacks can range from individual attempts to gain unauthorized access to our information technology systems to more sophisticated security threats. While we employ a number of measures to prevent, detect and mitigate these threats, there is no guarantee such efforts will be successful in preventing a cybersecurity attack. A cybersecurity attack could compromise the confidential information of our employees, tenants and vendors. A successful cybersecurity attack could disrupt and otherwise adversely affect our business operations.


text: Assessment, identification and management of cybersecurity related risks are integrated into our overall risk management process. Cybersecurity related risks are included in the risk universe we evaluate to assess top risks to the Company at least annually. To the extent our processes identify a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risk strategy and governance and of other information technology risks to the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Senior management, including the Company's CEO, CFO, and General Counsel, is responsible for assessing and managing cybersecurity risk, and provides briefings regarding the assessment and management of such risk to the Audit Committee, which then reports, as necessary, to the Board of Directors. Although members of our senior management do not have direct cybersecurity expertise obtained through certifications, their experience managing the Company, which includes consulting and coordinating as necessary with a third party information technology expert referred to below, enables them to effectively assess and manage material risks from cybersecurity threats.


text: The Company retained an information technology expert third party company to assist in managing relevant risks. In particular, the Company outsources its information technology function and monitoring to a third party provider whereby it benefits from a professionally managed network monitoring, management, maintenance, detection and response system and a 24/7 security operations center with both onsite and remote support services. Any cybersecurity incident would be reported to the Company promptly by our third party consultant and material and potentially material incidents would be assessed by management and the Audit Committee for remediation and future prevention and detection.


text: The Company, at least annually, updates its policies or procedures that could help mitigate cybersecurity risks. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. The Company has incorporated cybersecurity coverage in its insurance policies; however, there is no assurance that the insurance the Company maintains will cover all cybersecurity breaches or that policy limits will be sufficient to cover all related losses.


text: Cybersecurity Governance The Board of Directors of our parent company, WHLR, has primary oversight over cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risk strategy and governance and of other information technology risks to the Audit Committee of WHLR's Board of Directors (the "Audit Committee"). The Audit Committee reports to the full Board of Directors of WHLR regarding its activities, including those related to cybersecurity. Senior management, including the Company's CEO, CFO, and General Counsel, is responsible for assessing and managing cybersecurity risk, and provides briefings regarding the assessment and management of such risk to the Audit Committee, which then reports, as necessary, to WHLR's Board of Directors. Although members of our senior management do not have direct cybersecurity expertise obtained through certifications, their experience managing the Company, which includes consulting and coordinating as necessary with a third party information technology expert referred to below, enables them to effectively assess and manage material risks from cybersecurity threats.


text: Through WHLR, the Company retained an information technology expert third party company to assist in managing relevant risks. In particular, the Company outsources its information technology function and monitoring to a third party provider whereby it benefits from a professionally managed network monitoring, management, maintenance, detection and response system and a 24/7 security operations center with both onsite and remote support services. Any cybersecurity incident would be reported to the Company promptly by our third party consultant and material and potentially material incidents would be assessed by management and the Audit Committee for remediation and future prevention and detection.


text: The Corporation regards information as one of its most valuable assets. As a result, safeguards have been implemented to protect corporate informational assets and associated technology resources have been established to maintain the integrity, availability, and privacy of confidential information of those assets. The Corporation has established an Information and Cyber Security Program ("Program") that includes standards and procedures to ensure that all information belonging to or held by the Corporation will be appropriately evaluated, classified, and protected against likely forms of unauthorized or inappropriate access, use, disclosure, modification, destruction, and denial.

companyName: CHEMUNG FINANCIAL CORP

ticker: CHMG


text: Enterprise Risk Management embeds risk management into the oversight of cybersecurity as an integral part of the business with comprehensive internal control and assurance processes linked to key risks which are then reported to the Board of Directors ("Board"). Risk oversight, including cybersecurity is a key risk which has been delegated to the Enterprise Risk Committee of the Board ("ERC"). Cybersecurity is integrated into the Corporation's Enterprise Risk Management Policy, Enterprise Risk Management Committee Charter, Escalation Policy, Risk Appetite Statement, Information Technology Steering Meetings, and Division Risk Meetings. Employees are trained on their first day of employment with regards to cybersecurity and additional training is rolled out for all employees throughout the year.