text: We have policies, procedures, and processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats as well as secure our networks and systems. Such processes include procedural and technical safeguards, response plans, regular vulnerability and penetration tests on our systems and product applications, incident simulations, and routine review of our policies and procedures to identify risks and improve our practices. Our security incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to assess the severity of, escalate, contain, investigate, and remediate incidents as well as to comply with applicable legal obligations. We maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, and other related breaches.


text: We engage certain external parties to enhance our cybersecurity processes and strategies. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, we evaluate the security and risk posture according to the perceived level of risk and in accordance with industry standard best practices.

companyName: Replimune Group, Inc.

ticker: REPL

secItem: Item 1C


text: Our audit committee of the Board of Directors provides direct oversight over cybersecurity risk and provides applicable updates to the Board of Directors regarding such oversight. Members of management responsible for data privacy, technology, and information security risks join our audit committee meetings from time to time to discuss these risks, risk management activities, incident response plans, best practices, the effectiveness of our security measures, and other related matters.

stage1Category: Board Governance

stage1Method: unanimous


text: Our Chief Information Officer, who reports to our Chief Financial Officer, leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Specific cybersecurity related responsibilities include overseeing our processes and strategies for the detection, mitigation, and remediation of cybersecurity incidents. Our Chief Information Officer has extensive experience assessing and managing cybersecurity and risk programs having served in relevant positions of increasing responsibility for over 25 years at several private and public companies.

stage1Category: Management Role


text: In an effort to deter and detect cyber threats, we provide all employees with routine response and prevention training, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use, and mobile security, and educates employees on the importance of reporting all incidents promptly. We also use technology-based tools to mitigate cybersecurity threats and risks and to bolster our employee-based cybersecurity programs.

stage1Category: Risk Management Process


text: Despite our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Part I, Item 1A, Risk Factors, in this Annual Report for a discussion of cybersecurity risks.


text: We have policies, procedures, and processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall risk management program. Such policies, procedures, and processes are designed to help protect our information assets and operations from internal and external cyber threats as well as secure our networks and systems. Such processes include procedural and technical safeguards, response plans, regular vulnerability and penetration tests on our systems and product applications, incident simulations, and routine review of our policies and procedures to identify risks and improve our practices. Our security incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to assess the severity of, escalate, contain, investigate, and remediate incidents as well as to comply with applicable legal obligations. We maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, and other related breaches.


text: As part of the above processes, we regularly engage with consultants, auditors and other third parties, including annually having an independent third-party review our cybersecurity program to help identify areas for continued focus, improvement and compliance.

companyName: Inhibrx, Inc.


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could materially affect us. See Part I, Item 1A, Risk Factors, in this Annual Report for a discussion of cybersecurity risks.

stage1Category: Strategy Integration


text: Risk Management and Strategy IT plays a crucial role in all of our operations. To remain competitive, our hardware, software and related services must properly and efficiently interact with our suppliers' and customers' products, services and technology, record and process our financial transactions accurately, and obtain accurate and timely data and information to enable our analysis of trends and plans and the execution of our strategies. Accordingly, KLX maintains a cybersecurity risk program led by our internal IT department and strategic vendors designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. These processes are integrated into the Company's overall enterprise risk assessment. Our cybersecurity risk program references industry-standard frameworks and incorporates policies and practices designed to protect the privacy and security of our sensitive information.

companyName: KLX Energy Services Holdings, Inc.

ticker: KLXE


text: We perform technical assessments with feedback incorporated into our systems and procedures through continual upgrades intended to further improve our cybersecurity posture.


text: We continue to evaluate internal systems, processes, and controls to identify potential cybersecurity vulnerabilities and mitigate potential loss from cyber-attacks. We have implemented a monitoring and detection system to help identify cybersecurity incidents. All incidents are escalated to our cybersecurity committee, which includes Vice President of IT, Chief Financial Officer, Chief Compliance Officer/General Counsel and other senior management. We also require our employees to receive annual cybersecurity awareness training. We perform cybersecurity tabletop exercises and implement post-incident "lessons learned" to enhance our response. We provide our system users with access consistent with the principle of least privilege, which requires that such users be given no more access than necessary to complete their job functions. We have also implemented a multi-factor authentication process for employees accessing company information.


text: We engage third-party service providers in connection with our cybersecurity risk program, including assessors, consultants, and auditors. We recognize that third-party service providers introduce cybersecurity risks. In an effort to mitigate these risks, we include security and privacy addendums to our contracts where applicable.

stage1Category: Third-Party Risk


text: Impacts from Cybersecurity Threats As of the date of this report, the Company and our service providers have been subject to certain cybersecurity incidents (including phishing attempts). We are not aware of any prior cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT systems could have significant consequences to the business. See "Risk Factors" in Item 1A of Part I for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: SolarWinds Corp


text: Our Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to our audit committee oversight of cybersecurity and other information security risks. Our audit committee oversees management's activities related to our cybersecurity risk program. Our cybersecurity committee, which includes Vice President of IT, Chief Financial Officer, Chief Compliance Officer/General Counsel and other senior management, reports to the audit committee on a quarterly basis regarding information security and cybersecurity matters, including cybersecurity risks, or as needed.


text: Our Vice President of IT leads our IT department, which is responsible for assessing, identifying, and managing risks from cybersecurity threats. Our Vice President of IT reports to the Company's Chief Financial Officer, including with respect to emerging cybersecurity incidents. To facilitate effective oversight, our Vice President of IT holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks. Our VP of IT has over thirty years of IT background in a variety of industries, with experience developing security frameworks, training on cyber security best practices, and emergency response and remediation.


text: Our Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to our audit committee oversight of cybersecurity and other information security risks. Our audit committee oversees management's activities related to our cybersecurity risk program. Our cybersecurity committee, which includes Vice President of IT, Chief Financial Officer, Chief Compliance Officer/General Counsel and other senior management, reports to the audit committee on a quarterly basis regarding information security and cybersecurity matters, including cybersecurity risks, or as needed, and the audit committee reports to the Board.


text: Our IT department is made up of experienced professionals with an extensive background in information security, risk management and incident response. Our Vice President of IT leads our IT department, which is responsible for assessing, identifying, and managing risks from cybersecurity threats. Our Vice President of IT reports to the Company's Chief Financial Officer, including with respect to emerging cybersecurity incidents. To facilitate effective oversight, our Vice President of IT holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks.


text: Our Vice President of IT has over thirty years of IT background in a variety of industries, with experience developing security frameworks, training on cyber security best practices, and emergency response and remediation.

stage1Method: majority


text: Our business relies on information technology (IT) systems to process, transmit and store electronic information, including customer, employee and company data. The secure processing, maintenance and transmission of this information, including information housed both within an internal IT system or with a third-party and cloud-based environments, is critical to our operations. Each of the systems utilized in our business operations is subject to continually evolving cybersecurity risks and threats that present a risk to the continuity of our business operations, potential financial losses and damage to our reputation, including a loss of public trust. For more information on potential risks related to cybersecurity threats and incidents, please see "Item 1A. Risk Factors – Breaches of our information technology systems or improper disclosure of confidential company or personal data, or a failure to comply with privacy laws, regulations and our contractual obligations concerning data privacy or the security of certain information, could have a material adverse effect on our reputation and operations."

companyName: Elanco Animal Health Inc

ticker: ELAN

stage1Category: None/Other


text: Risk Management, Strategy and Governance Given the importance of the integrity and security of the information and data utilized in our day-to-day operations, our processes for assessing, identifying and managing material risks from cybersecurity threats is incorporated into our overall enterprise risk management framework. We evaluate cybersecurity risks on an ongoing basis, and both our executive management and Board of Directors have an overall responsibility for assessing and managing risks from cybersecurity threats. We have established an information security team which is structured into three areas, each with its own teams and leaders who report directly to our Chief Information Security Officer (CISO): 1) Governance, Risk and Compliance; 2) Architecture; and 3) Operations (Detect and Respond). Our information security team is responsible for the design and execution of our cybersecurity risk management and helps executive management and our Board of Directors stay informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity risks and incidents through various means, including but not limited to, briefings with internal security team members, threat intelligence obtained from public and private sources and alerts and reports produced by security tools deployed within our IT environment. Our current CISO has over 16 years of experience in various roles involving information technology governance and compliance, including cybersecurity, engineering and enterprise architecture, while our Chief Information Officer (CIO) has over 25 years of IT and cybersecurity experience. Our information security team includes professionals with relevant industry, educational and cybersecurity experience.


text: Governance, Risk and Compliance: Our approach to cybersecurity governance, risk and compliance is based on overarching guidelines, standards and best practices developed by the U.S. National Institute of Standards and Technology (NIST), a department of the U.S. Department of Commerce. Our information security governance oversees the process of coordinating the cybersecurity team(s) responsible for the mitigating of business risks posed by IT-related resources. Our governance framework of authority and accountability ensures prioritized initiatives have the required structure, sponsorship and funding to appropriately address the foreseen risks. Risk management includes an assessment of the risks posed to us by an IT solution, including cloud hosted and/or other third-party environments and systems. Our processes also address cybersecurity risks associated with our use of third-party service providers, including those in our supply chain or who have access to our client or employee data on our systems. In addition, cybersecurity considerations affect the selection and oversight of third-party service providers. We perform diligence on third parties, particularly those that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.


text: Our risk management process assesses both the probable frequency and probable magnitude of future loss based on a variety of potential risks and cyber events. The information security team also periodically engages third-party vendors to assist with our cyber threat detection and response actions, as well as to ensure our processes related to information security and defense against cybersecurity threats are appropriately designed and implemented to best prevent, detect and/or respond to a cyber threat or event.


text: Architecture: Our information security architecture is focused on designing IT-related solutions that are foundationally secure. Our information security architecture assumes that internal and external threats always exist, and that all networks are inherently hostile. Accordingly, all connections accessing business assets must first be authenticated and authorized. Where viable, IT services are individually secured and monitored at the source, following the principle of least privilege.


text: Operations (Detect and Respond): In the event of a cybersecurity incident, the Elanco Information Security Incident Response Plan (ISIRP) defines the roles, responsibilities, procedures and reporting processes required to respond effectively to cybersecurity incidents. Responses to information security incidents are led by two teams: 1) the Security Operations Center (SOC) team, which conducts the initial technical triage and analysis, and 2) a cross-functional team of leaders from the IT, Legal, Human Resources and Finance functions (the Cyber Lead team), which is engaged by the CISO on an as needed basis, based on incident severity. The Cyber Lead team is tasked with determining the severity of a cybersecurity incident and bringing together the proper resources to lead the corporate-wide response to such incidents, including engaging the Company's Disclosure Committee, in the event an incident may rise to a level deemed material to us. In the event an incident is escalated by the Cyber Lead team, the Disclosure Committee, led by our Chief Financial Officer and General Counsel, would evaluate all estimable quantitative and qualitative factors, to determine if a Current Report on Form 8-K would be required under Item 1.05, "Material Cybersecurity Incidents".


text: Management's Responsibilities Management is responsible for executing the Cybersecurity Risk Management, Strategy and Governance policies outlined above. This is done, in part, by both establishing systems, processes and controls to minimize the risk of a high severity cybersecurity incident as much as possible, as well as ensuring there is a formal process designed to identify, investigate and appropriately respond to potential cybersecurity incidents. As noted, we have established our ISIRP as a response tool in the event of a cybersecurity incident. The ISIRP documents the actionable steps the SOC team, information security leadership and cross-functional stakeholders and partners take when a cybersecurity incident is identified. The ISIRP covers the preparation, detection and analysis, containment, eradication, recovery and post-incident activities required to effectively respond to an incident.


text: Once a cybersecurity incident has been identified, the SOC team performs an initial investigation to determine if the incident is deemed high or low severity, based upon the business and operational impacts. Any incident deemed high severity would result in notification by the CISO to the Cyber Lead team to determine the appropriate actions to be taken. This determination would be made by the Cyber Lead team based on both qualitative and quantitative factors regarding the extent and magnitude of the incident. If the incident is then escalated to the Disclosure Committee and determined to be material, a disclosure via a Current Report on Form 8-K would be made within four business days of the incident being identified as such. Through December 31, 2023, there have been no cybersecurity incidents deemed to have had a material impact on our results of operations or financial condition. Our Board of Directors would also be notified of any high severity incidents that are determined to be material, concurrently with the notification to the Disclosure Committee, and would be kept apprised of actions taken in response to such incidents.


text: Our information security team is also responsible for cybersecurity awareness and education across the company, including our Board of Directors. Awareness empowers users, including our employees and contractors, to be mindful of cybersecurity in day-to-day situations. Our cybersecurity education practices help ensure specific users have the appropriate security skills and competencies to help prevent and/or detect and respond to a cyber threat. Formal training is delivered and measured throughout our organization on a routine, ongoing basis, and dedicated training is delivered to all new employees and contractors through our onboarding process. Targeted and company-wide communications, as well as simulated phishing campaigns and tabletop exercises are also routinely executed to promote ongoing awareness, preparation and education about cyber threats.


text: Board of Directors' Responsibilities Our Board of Directors actively oversees our cybersecurity management processes, including appropriate risk mitigation strategies, systems, processes and controls. Our CISO meets with the Audit Committee of the Board of Directors and separately with the full Board of Directors at least twice annually to discuss the status of policies and procedures related to information security. Discussions with the Audit Committee and the full Board of Directors focus on any notable incidents and incident responses, updates on known or perceived cyber threats and the information security team's recent actions taken in response to such incidents and threats. In addition, our Board of Directors and the Audit Committee also receive updates from the CISO and/or our CIO on an ad-hoc or as-requested basis. Any incidents or changes to our process of identifying and responding to potential cybersecurity incidents would be included within these materials. According to our ISIRP, our Board of Directors would also be notified of any high severity incidents deemed material, simultaneously with the notification to the Disclosure Committee, and would be kept apprised of actions taken in response to such incidents.


text: Our business relies on IT systems to process, transmit and store electronic information, including customer, employee and company data. The secure processing, maintenance and transmission of this information, including information housed both within an internal IT system or with a third-party and cloud-based environments, is critical to our operations. Each of the systems utilized in our business operations is subject to continually evolving cybersecurity risks and threats that present a risk to the continuity of our business operations, potential financial losses and damage to our reputation, including a loss of public trust.


text: Risk Management, Strategy and Governance Given the importance of the integrity and security of the information and data utilized in our day-to-day operations, our processes for assessing, identifying and managing material risks from cybersecurity threats is incorporated into our overall enterprise risk management framework. We evaluate cybersecurity risks on an ongoing basis, and both our executive management and Board of Directors have an overall responsibility for assessing and managing risks from cybersecurity threats. We have established an information security team which is structured into three areas, that all report directly to our Chief Information Security Officer (CISO): 1) Governance, Risk and Compliance; 2) Architecture; and 3) Operations (Detect and Respond). Our information security team is responsible for the design and execution of our cybersecurity risk management and helps executive management and our Board of Directors stay informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity risks and incidents through various means, including but not limited to, briefings with internal security team members, threat intelligence obtained from public and private sources and alerts and reports produced by security tools deployed within our IT environment. Our current CISO, who reports directly to our Chief Information Officer (CIO), has over 17 years of experience in various roles involving information technology governance and compliance, including cybersecurity, engineering and enterprise architecture, while our CIO has over 25 years of IT and cybersecurity experience. Our information security team includes professionals with relevant industry, educational and cybersecurity experience.


text: Operations (Detect and Respond): In the event of a cybersecurity incident, the Elanco Information Security Incident Response Plan (ISIRP) defines the roles, responsibilities, procedures and reporting processes required to respond effectively to cybersecurity incidents. Responses to information security incidents are led by two teams: 1) the Security Operations Center (SOC) team, which conducts the initial technical triage and analysis, and 2) a cross-functional team of leaders from the IT, Legal, Human Resources and Finance functions (the Cyber Lead team), which is engaged by the CISO on an as needed basis, based on incident severity. The Cyber Lead team is tasked with confirming the severity of a cybersecurity incident and bringing together the proper resources to lead the corporate-wide response to such incidents, including engaging the Company's Disclosure Committee, in the event an incident may rise to a level deemed material to us. In the event an incident is escalated by the Cyber Lead team, the Disclosure Committee, led by our Chief Financial Officer and General Counsel, would evaluate all estimable quantitative and qualitative factors, to determine if a Current Report on Form 8-K would be required under Item 1.05, "Material Cybersecurity Incidents."


text: For the year ended December 31, 2024, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For more information on potential risks related to cybersecurity threats and incidents, please see "Item 1A. Risk Factors – Breaches of our IT systems or improper disclosure of confidential company or personal data, or a failure to comply with privacy laws, regulations and our contractual obligations concerning data privacy or the security of certain information, could have a material adverse effect on our reputation and operations."


text: Once a cybersecurity incident has been identified, the SOC team performs an initial investigation to determine if the incident is deemed high or low severity, based upon the business and operational impacts. Any incident deemed high severity would result in notification by the CISO to the Cyber Lead team to determine the appropriate actions to be taken. This determination would be made by the Cyber Lead team based on both qualitative and quantitative factors regarding the extent and magnitude of the incident. If the incident is then escalated to the Disclosure Committee and determined to be material, a disclosure via a Current Report on Form 8-K would be made within four business days of the incident being identified as such. Our Board of Directors would also be notified of any high severity incidents that are determined to be material, concurrently with the notification to the Disclosure Committee, and would be kept apprised of actions taken in response to such incidents.


text: The Audit Committee of the Board oversees XPEL's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The Director of Enterprise Systems briefs the Audit Committee on the effectiveness of the Company's cyber risk management program, typically on a quarterly basis.

companyName: XPEL, Inc.

ticker: XPEL


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management program that is designed to identify, assess and manage material risks from cybersecurity threats and to protect the security, confidentiality, integrity, and availability of our critical systems and information. Our information security program is developed using industry standards and best practices as a guide, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The program includes penetration tests and periodic vulnerability scans, and evaluations by external service providers. The results of these evaluations are shared with senior management and the audit committee of the board of directors, where appropriate.

companyName: Rallybio Corp

ticker: RLYB


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management processes and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management processes to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, product candidates and our broader enterprise IT environment. • A team principally responsible for managing: (a) our cybersecurity risk assessment processes, (b) our security controls, and (c) our response to cybersecurity incidents. • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls as part of our operational security model. • Threat intelligence that informs our third party IT service provider and us about new vulnerabilities and risks that require timely intervention or remediation. • Cybersecurity awareness training of our employees, incident response personnel, and senior management. • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: resulted in a material effect on our business strategy, results of operations, or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents.


text: The audit committee of our board of directors has primary responsibility for oversight of our information security program. Our cyber security program is managed by our third party IT service provider together with internal personnel. Our service provider and internal personnel work together to assess the environment, potential threats and responses.


text: Governance and Oversight We should have a formal risk management program that addresses cybersecurity and data privacy risks. This program should include regular reporting to our senior management and Board of Directors, who provide oversight and direction. We have not established an enterprise risk management framework to assess and prioritize these risks.

companyName: AVAI BIO, INC.

ticker: AVAI


text: Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, product candidates and our broader enterprise information technology ("IT") environment. • A team principally responsible for managing: (a) our cybersecurity risk assessment processes, (b) our security controls, and (c) our response to cybersecurity incidents. • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls as part of our operational security model. • Threat intelligence that informs our third party IT service provider and us about new vulnerabilities and risks that require timely intervention or remediation. • Cybersecurity awareness training of our employees, incident response personnel, and senior management. • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: Managing Material Risks & Integrated Overall Risk Management Arcosa has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cyber risk awareness. Arcosa's Chief Information Security Officer ("CIO") and Director of Information Security work closely with the IT department to continuously evaluate and address cybersecurity risks in alignment with business objectives, operational needs, and industry-accepted standards, such as the CIS Critical Security Controls and National Institute of Standards and Technology ("NIST") frameworks.

companyName: Arcosa, Inc.

ticker: ACA


text: The Company has processes and procedures in place to monitor the prevention, detection, mitigation, and remediation of cybersecurity risks. These include but are not limited to: • Maintaining a defined and practiced incident response plan; • Maintaining cyber insurance coverage; • Employing appropriate incident prevention and detection software, such as antivirus, anti-malware, firewall, endpoint detection, and identity and access management; • Maintaining a defined disaster recovery policy and employing backup/disaster recovery software, where appropriate; • Educating, training, and testing employees on information security practices and identification of potential cybersecurity risks and threats; • Ensuring familiarity and compliance with cybersecurity frameworks where appropriate; and • Reviewing and evaluating new developments in the cyber threat landscape.


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity risk, the Company engages with a range of external experts, including cybersecurity consultants, in evaluating, monitoring, and testing Arcosa's cyber management systems and related cyber risks. The Company's collaboration with these third parties includes audits, threat and vulnerability assessments, incident response plan testing, company-wide monitoring of cybersecurity risks, and consultation on security enhancements.


text: Managing Third Party Risk Arcosa recognizes the risks associated with the use of vendors, service providers, and other third parties that provide information system services, process information on its behalf, or have access to its information systems, and Arcosa has processes in place to oversee and manage these risks. In addition to the minimum security and control standards, these processes include other quality control measures, such as utilizing a third-party security scoring system to evaluate the security posture of current and potential parties. Arcosa also maintains ongoing monitoring to support continuous compliance with its cybersecurity standards.


text: Risks from Cybersecurity Incidents Arcosa has not been subject to cybersecurity incidents that have materially affected, or are reasonably likely to materially affect the Company, its operations, or financial standing.


text: Risk Management Personnel Arcosa's cybersecurity risk management program is overseen by management at multiple levels. The CIO and Director of Information Security play key roles in assessing, monitoring, and managing the Company's cybersecurity risks with support of dedicated information technology and security personnel. Both the CIO and Director of Information Security have been in their respective roles at Arcosa for 5 years. The CIO has over 40 years of leadership positions in the high tech and IT industries. He is experienced in detailed product and solution development as well as business process operations providing an understanding of how cybersecurity considerations intersect the business. The Director of Information Security and Compliance at Arcosa has more than 20 years of experience architecting, designing, and deploying security solutions based on industrial frameworks.


text: Monitor Cybersecurity Incidents The CIO and Director of Information Security are continually informed and updated about the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. They implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Company is equipped with a defined and practiced incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Board of Director Oversight The Audit Committee of the Company's Board of Directors is responsible for overseeing the Company's cyber risk. The CIO and other experts, as necessary provide the Audit Committee quarterly updates that encompass a broad range of topics, including but not limited to: • Current cybersecurity threat landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from unique cybersecurity events, including those of other companies; • Compliance status and efforts with regulatory requirements and industry standards; and • Benchmarked data on the performance of certain aspects of our cybersecurity program relative to our peers.


text: In addition, the CIO provides updates to the full Board upon request or to update the Board of unique developments, such as regulatory updates or unique vulnerability developments. Our Board is composed of members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Managing Material Risks & Integrated Overall Risk Management Arcosa has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cyber risk awareness. Arcosa's Chief Information Security Officer ("CISO") and Senior Director of Information Security work closely with the IT department to continuously evaluate and address cybersecurity risks in alignment with business objectives, operational needs, and industry-accepted standards, such as the CIS Critical Security Controls and National Institute of Standards and Technology ("NIST") frameworks.


text: Risk Management Personnel Arcosa's cybersecurity risk management program is overseen by management at multiple levels. The CISO and Senior Director of Information Security play key roles in assessing, monitoring, and managing the Company's cybersecurity risks with support of dedicated information technology and security personnel. Both the CISO and Senior Director of Information Security have been in their respective roles at Arcosa for over 6 years. The CISO has over 40 years of leadership positions in the high tech and IT industries. He is experienced in detailed product and solution development as well as business process operations providing an understanding of how cybersecurity considerations intersect the business. The Senior Director of Information Security and Compliance at Arcosa has more than 20 years of experience architecting, designing, and deploying security solutions based on industrial frameworks.


text: Monitor Cybersecurity Incidents The CISO and Senior Director of Information Security are continually informed and updated about the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. They implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Company is equipped with a defined and practiced incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: We use, among other frameworks, the NIST Cybersecurity Framework and CIS Critical Security Controls as guides to help us identify, assess, and manage cybersecurity risks relevant to our business. Although we refer to such frameworks in developing our cybersecurity risk management approaches, our use of them as guides is not intended to suggest that we meet any particular technical standards, specifications, or requirements set forth therein.


text: Board of Director Oversight The Board's Audit Committee is responsible for overseeing the Company's cyber risk. The CISO and other experts, as necessary provide the Audit Committee quarterly updates that encompass a broad range of topics, including but not limited to: • Current and emerging cybersecurity threat landscape; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from unique cybersecurity events, including those of other companies; • Compliance status and efforts with regulatory requirements and industry standards; and • Benchmarked data on the performance of certain aspects of our cybersecurity program relative to our peers.


text: In addition, the CISO provides updates to the full Board upon request and updates the Board on unique developments, such as regulatory updates or unique vulnerability developments. Our Board is composed of members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Cybersecurity Risk Management We maintain a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical information technology systems and information.

companyName: Utz Brands, Inc.

ticker: UTZ


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, incident reporting channels and governance processes as those used in our enterprise risk management. We designed and continue to assess our cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), which we use as a guide to help us identify, prioritize and manage the cybersecurity risks that could materially affect our business, financial condition or results of operations.


text: Our cybersecurity risk management program includes a Security Incident Response Plan ("SIRP"). Our SIRP provides the Company with the capability of planning, identifying, containing, and tracking cybersecurity incidents experienced by us or our third party service providers. Our SIRP was established to reduce or minimize the impact of cybersecurity incidents on our networks, IT systems, users or business processes. The execution of our SIRP is led by the Chief Information Officer ("CIO") in conjunction with our Security Incident Response Team, comprised of network, system administrators and cybersecurity experts, who, in the event of incident, together perform a damage assessment, deliver impact notifications and implement containment procedures depending upon the incident. In addition, we also engage third parties on an as needed basis to assess our cybersecurity practices and procedures.


text: Our cybersecurity risk management program also includes: • a multi-layered approach to cybersecurity in order to protect our assets; • identification of key risk areas through internal reviews and researching trends; • continuous mitigation in the areas of human behavior, data breaches, remote work, third party vendors, removable media and emerging threats; • performance of multiple assessments both internal and external; • quarterly mandatory security training for employees as well as monthly phishing tests; and • multi-factor authentication.


text: For the fiscal year ended December 31, 2023, we did not experience any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Cybersecurity Governance We are committed to protecting our information technology ("IT") assets and data. This commitment includes the protection of IT assets relevant to our operations, employees, customers and suppliers' data, intellectual property and our products, among others.


text: Our Company Board plays a role in overseeing risks associated with cybersecurity threats. The Audit Committee of the Board has been provided specific responsibility for overseeing the Company's risk management of cybersecurity. The Audit Committee has appointed a member of the Audit Committee to receive certified cybersecurity training so he can provide specialized guidance to the Board and Company.


text: Periodically throughout the year, the CIO briefs the Audit Committee and Board on cybersecurity activities and long-term cybersecurity strategies, as well as general cybersecurity trends that could have a material impact on the Company. At any time, the Company Board members may raise concerns regarding the Company's cybersecurity posture and recommend future changes to controls or procedures.


text: Our Audit Committee is also responsible for the oversight of risks from cybersecurity threats. Our CIO, Chief Financial Officer, and Security Incident Response Team provide regular updates to the Audit Committee of the Company Board on cybersecurity risks. Through these updates, the Audit Committee receives information on the status of key cybersecurity activities such as email phishing, event logging and data encryption, among others. Information regarding relevant cybersecurity training is provided as well.


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas.


text: Our CIO leads our management team in assessing and managing our response to cybersecurity threats and incidents. Our CIO has a Bachelor of Technology degree in Computer Science with over 30 years of experience in IT, with over five years managing IT Infrastructure and Security. The primary responsibility of the management team with respect to cybersecurity risk is managing our overall cybersecurity risk management program and supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants, and working with all divisional, manufacturing, and functional teams on cybersecurity issues. The management team's efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents are enhanced by monthly and quarterly briefings from internal security personnel, by receipt of threat intelligence and other information obtained from governmental, public or private sources, including external consultants, periodic assessments against the NIST CSF and through alerts and reports produced by security tools deployed in our IT environment. In the event a cybersecurity incident rise to the level of a corporate crisis, the management team along with the Security Incident Response Team would engage the Company Board.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, incident reporting channels and governance processes, as those used in our enterprise risk management program. We designed and continue to assess our cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), which we use as a guide to help us identify, prioritize and manage the cybersecurity risks that could materially affect our business, financial condition or results of operations.


text: Our cybersecurity risk management program also includes: • a multi-layered approach to cybersecurity designed to protect our assets; • identification of key risk areas through internal reviews and researching trends; • ongoing mitigation in the areas of human behavior, data breaches, remote work, third party vendors, removable media and emerging threats; • performance of multiple assessments both internally and externally; • quarterly mandatory security training for employees as well as monthly phishing tests; and • multi-factor authentication.


text: For the fiscal year ended December 29, 2024, we are not aware of any cybersecurity incidents or risks from cybersecurity incidents that have materially affected or were reasonably likely to materially affect our business strategy, results of operations or financial condition. We cannot guarantee that we may not experience any cybersecurity incidents or risks related to cybersecurity incidents in the future.


text: Our Company Board plays a role in overseeing risks associated with cybersecurity threats. The Audit Committee of the Board has been delegated specific responsibility for overseeing the Company's risk management of cybersecurity. The Audit Committee has appointed a member of the Audit Committee to receive certified cybersecurity training so he can provide specialized guidance to the Board and Company.


text: Our CIO leads our management team in assessing and managing our response to cybersecurity threats and incidents. Our CIO has a Bachelor of Technology degree in Computer Science with over 30 years of experience in IT, with over five years managing IT Infrastructure and Security. The primary responsibility of the management team with respect to cybersecurity risk is managing our overall cybersecurity risk management program and supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants, and working with all divisional, manufacturing, and functional teams on cybersecurity issues. The management team's efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents are enhanced by monthly and quarterly briefings from internal security personnel, by receipt of threat intelligence and other information obtained from governmental, public or private sources, including external consultants, periodic assessments against the NIST CSF and through alerts and reports produced by security tools deployed in our IT environment. In the event a cybersecurity incident meets certain predetermined criteria, the management team along with the Security Incident Response Team would engage the Company Board.


text: We recognize the critical importance of maintaining the trust and confidence of our patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or NIST, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer, General Counsel, and Director of Information Technology.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST and the International Organization for Standardization, as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: a.monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;


text: b.through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;


text: c.employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence;


text: d.provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;


text: e.conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; f.conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data;


text: g.run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; and h.carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Cybersecurity breaches could expose us to material liability, damage our reputation, compromise our confidential information or otherwise adversely affect our business," which disclosures are incorporated by reference herein.


text: In the last two fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. The audit committee of our board of directors is responsible for the oversight of risks from cybersecurity threats.


text: At least annually, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our audit committee generally receives materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Director of Information Technology. Our audit committee also receives prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Financial Officer, General Counsel, and Director of Information Technology. Such individuals have collectively several years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as relevant degrees and certifications. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually.


text: Cybersecurity Strategy and Risk Management The Cigna Group's comprehensive cybersecurity program is supported by policies and procedures designed to protect our systems and operations as well as the sensitive personal information and data of our clients and customers from foreseeable cybersecurity threats. This program is an integral component of our enterprise risk management program.

companyName: Cigna Group

ticker: CI


text: Core to our security model is our defense-in-depth framework, comprising multiple layers of processes and technologies that help prevent, detect, and respond to threats. Our approach to safeguarding against external threats incorporates a suite of preventive technologies, including malicious email blocking, defenses against automated attacks and multifactor authentication. These strategies act to proactively intercept and neutralize cyber threats to help ensure data remains secure within our environment. Event monitoring technologies run continuously, detecting suspected intrusion attempts and alerting our Cybersecurity Incident Response team. The Cigna Group undertakes a number of critical security processes to mitigate and protect against cybersecurity risks, which include but are not limited to: • Identity and Access Management. Employees are provided with the minimum amount of access required to perform their jobs using role-based access control methodology, which defines access to our information systems based on job function. Privileged or elevated access to our systems is subject to supplemental approval requirements, increased authentication processes, and additional logging and monitoring. • Security Awareness and Training. Events and education activities are hosted throughout the year, such as the Cybersecurity Awareness Month, expos, videos, training programs and frequent phishing simulations. The Cigna Group continuously trains workforce members on the importance of preserving the confidentiality and integrity of customer data. All new hires have mandatory information protection and privacy training as part of their onboarding, and all workforce members complete an annual cybersecurity refresh training. • Security Operations and Monitoring. Our operational monitoring processes provide valuable insight into the effectiveness of our security program. A centralized system collects security logs and performs event correlation that creates an alert if a trigger occurs. We review any deviations from our established targets and implement corrective actions. • Change Management. Changes to hardware, software, network components, and/or processes introduced into any production environments are managed by a formal change control process. These requests include the submission of required documentation as well as the business justification for the change. • Disaster Recovery / Business Continuity. These processes are designed to maintain service to our customers, providers and members through a wide range of adverse circumstances. Methods of recovery include rerouting business functions, relocating to an alternative site, independent "hot sites", mobile recovery and work at home. • Intelligence Feeds. These are used to monitor the security industry for the latest global security threats, exposures and patches to help keep company servers current with the latest security service packs, patches and hot fixes. • Physical Security. Our physical security system is utilized in an effort to properly identify appropriate individuals, authorize entry and define the working areas to which they have access. Additional controls at our data centers includes a combination of guard service, access keys and magnetic card systems.


text: • Third-Party Vendor Security Reviews. Suppliers that have access to, host, or pass sensitive data are subject to a rigorous vendor security review which includes questionnaires, security controls and maturity assessments, inspection of evidence of compliance and remediation or acceptance of items identified during a Risk Assessment. • Vulnerability Management / Patching. Any discovered vulnerability is rated by severity and assigned a timeline for remediation. Patching activities are centrally managed with a focus on the identification, remediation, and analysis and closure of vulnerabilities throughout the vulnerability management lifecycle. • Cybersecurity Incident Reporting. Our incident reporting protocol assists prompt and efficient response to cybersecurity threats. This includes links on our internal site listing globally accessible contact numbers for immediate incident reporting, a user-friendly phishing reporting tool in Outlook, and group email boxes that are monitored 24/7 for incident submissions.


text: Internal and external experts regularly evaluate our information security program, with results reported to senior management and our Board of Directors. We actively collaborate with vendors, industry experts, and intelligence and law enforcement communities to continually assess and enhance the effectiveness of our information security policies and procedures.

companyName: RESIDEO TECHNOLOGIES, INC.

ticker: REZI


text: Incident Response We maintain an incident response plan that includes policies and procedures for notifying affected third parties and complying with applicable laws.


text: We routinely manage cybersecurity risks through a defined framework that includes activities aimed at the identification, assessment, treatment and monitoring of risks. Cybersecurity risk assessment results are used by senior management to make informed decisions about where to allocate resources to reduce cybersecurity risks and improve overall security posture. We examine our entire program annually with third-parties and measure the program against generally accepted industry standards and frameworks, such as an internationally recognized security control framework established by the NIST and used by companies to assess and improve their ability to prevent, detect and respond to cyberattacks. Our cybersecurity policies and standards are reviewed annually and are mainly guided by the NIST 800-53 Cybersecurity Framework. In addition to the NIST framework, we leverage the International Organization for Standardization ("ISO") 27001 and 27002 standards. NIST and ISO standards are internationally accepted and provide best practice recommendations for initiating, implementing, and maintaining information security management systems. Cigna's Information Protection policies and standards are informed by NIST 800-53b, moderate level security control baseline requirements. This includes a myriad of NIST controls/control enhancements which are mapped to Cigna Information Protection policies, standards and control library.


text: To enhance our preparedness and practice our collective cybersecurity response capabilities, we conduct tabletop exercises developed in partnership with external security experts. These events are designed to exercise and engage some of the most critical areas of cybersecurity incident response and preparedness through an interactive/evolving, simulated scenario. This exercise provides an opportunity for us to test our response procedures, escalation and communication protocols, roles and responsibilities, legal/privacy considerations and key decision-making processes, in a safe and controlled environment. The participants in these exercises include leaders, stakeholders, subject matter experts and certain executives. In addition to these internal measures, the effectiveness of components of our overall cybersecurity program is frequently evaluated by external third parties, exclusive to our independent registered public accounting firm and scope of internal control over financial reporting. This includes work performed over various levels of controls assessments for specific business lines and core processes. These include Health Information Trust Alliance ("HITRUST") for health care data security, Payment Card Industry Data Security Standard (PCI DSS) for payment security, and System Organization Controls (SOC) 2 for information security and related controls. We also perform an annual maturity assessment and benchmark our security controls to identify opportunities to strengthen our cybersecurity program.


text: As part of our Global Threat Management Program, a dedicated Incident Handling Team, comprising both technical and management personnel, determines the severity of a validated cybersecurity event across the enterprise and is responsible for the development and ongoing maintenance of our comprehensive Global Incident Response Plan ("GIRP"). The GIRP is reviewed quarterly at a minimum but may be updated as needed based on lessons learned, changes in key teams or processes, or other circumstances as warranted. Within the GIRP, incident handling procedures dictate actions during each phase, which include communications, actions to be performed, methods of operation and contingencies for unanticipated outcomes. Using industry best practices and continuous improvement principles, we validate strategies, document business recovery plans, and test these procedures enterprise-wide annually. Upon the discovery of an incident, a broad cross-functional Computer Security Incident Response Team is assembled, which may include but is not limited to experts from key business, technology, legal, privacy and finance sectors, to collaboratively assess the impact and materiality in order to execute a comprehensive and informed response. After an incident is contained, a thorough review is performed to determine if any existing detective or preventative controls were bypassed, or if there was a delay in detection or response. This review, which includes members from our internal audit team, drives the implementation of corrective actions to enhance and strengthen the effectiveness of our prevention, detection, and incident response controls, as applicable.


text: Cigna Information Protection ("CIP") maintains a risk register that is used to manage cybersecurity risks associated with its business activities, technology assets, and its interaction with business, Information Technology ("IT"), and security parties; internal and external. Cybersecurity risks are also periodically reviewed by Enterprise Risk Management ("ERM") to ensure appropriate oversight of cybersecurity risk management activities.


text: Suppliers that have access to, host, or transmit The Cigna Group data are contractually required to comply with our Security Policies and Standards. Additionally, suppliers may be subject to periodic security audits or risk assessments, which include security questionnaires, security capabilities and maturity assessments, controls evidence reviews, application vulnerability assessments, public internet presence monitoring, and alignment reviews with service-specific industry standards (e.g., NIST, ISO, HIPAA, and Payment Card Industry standards). Follow-up activities are performed as needed to discuss observations, track issues and ensure remediation plans are completed to maintain compliance. Contracts with suppliers also include critical security requirements including right to audit, technology requirements, key performance metrics and service levels, and hiring practices including background checks for those who have access to The Cigna Group's network.


text: We follow a structured framework linked to specific security standards and the procedural practices that the security team employs in supporting associated activities. Our information security team works closely with our managed security service provider to triage identified anomalies and alerts that are raised as risks and work across the company to validate the risk and act as deemed appropriate. The global security operations center ("SOC") within the CISO's organization is responsible for incident management including identification, assessment of initial threat, notification of key stakeholders, containment, remediation, and recovery. We have a cross-functional team prepared to respond in a timely manner to the incident and assess our obligations when incidents occur.


text: As of the date of this report, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. That said, as discussed more fully under Part 1, Item 1A. "Risk Factors – Strategic and Operational Risks – As a large global health company, we and our vendors are subject to cyberattacks or other privacy or data security incidents. If we are unable to prevent or contain the effects of any such attacks, or fail to ensure vendors do the same, we may suffer exposure to substantial liability, reputational harm, loss of revenue or other damages," the sophistication of cybersecurity threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may become insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all attacks of these types, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Cybersecurity Governance The Cigna Group's Board has ultimate oversight over the Company's privacy and cybersecurity programs and strategy and is responsible for ensuring that the Company has risk management policies and processes in place to meet and mitigate evolving risks and threats. Certain members of the Board have cybersecurity expertise, including certifications. The Board executes this oversight directly and through both the Audit Committee, for cybersecurity purposes, and the Compliance Committee, for privacy purposes. In these capacities, these committees are regularly briefed by the Global Chief Information Security Officer ("GCISO") and Chief Privacy Officer on cybersecurity and privacy matters. These briefings are designed to provide visibility about the identification, assessment, and management of critical risks, audit findings, and management's risk mitigation strategies. Additionally, these briefings include information about current trends in the environment, incident preparedness, artificial intelligence and various components of the Company's cybersecurity and privacy programs. Annually, the full Board reviews the Company's cybersecurity program, including the threat landscape and related controls and periodically conducts cybersecurity tabletop exercises.


text: The Cigna Group's dedicated cybersecurity team is led by our GCISO. Our current GCISO joined Cigna in October 2023 and works closely with senior management to develop and innovate the cybersecurity strategy and risk management. Prior to joining the team at The Cigna Group, our GCISO held senior information security roles at other global organizations where this individual defined information security strategies, built global information security programs, implemented cybersecurity capabilities that protect consumers, wholesale partners and brand, and oversaw the security of a global payment network, a corporate network and digital assets.


text: Cybersecurity Strategy and Risk Management Our comprehensive cybersecurity program is supported by policies and procedures designed to protect our systems and operations as well as the sensitive personal information and data of our clients and customers from foreseeable cybersecurity threats. This program is an integral component of our enterprise risk management program.


text: Core to our security model is our defense-in-depth framework, comprising multiple layers of processes and technologies that help prevent, detect and respond to threats. Our approach to safeguarding against external threats incorporates a suite of preventive technologies, including malicious email blocking, defenses against automated attacks and multifactor authentication. Event monitoring technologies run continuously, detecting suspected intrusion attempts and alerting our Cybersecurity Incident Response Team. We undertake a number of critical security processes to mitigate and protect against cybersecurity risks, which include but are not limited to (i) identity and access management; (ii) security awareness and training; (iii) security operations and monitoring; (iv) change management; (v) disaster recovery/business continuity; (vi) intelligence feeds; (vii) physical security; (viii) third-party vendor security reviews; (ix) vulnerability management/patching; and (x) cybersecurity incident reporting.


text: We routinely manage cybersecurity risks through a defined framework that includes activities aimed at the identification, assessment, treatment and monitoring of risks. Cybersecurity risk assessment results are used by senior management to make informed decisions about where to allocate resources to reduce cybersecurity risks and improve overall security posture. We examine our entire program annually with third parties and measure the program against generally accepted industry standards and frameworks, such as an internationally recognized security control framework established by the NIST and used by companies to assess and improve their ability to prevent, detect and respond to cyberattacks. Our cybersecurity policies and standards are reviewed annually and are mainly guided by the NIST 800-53 Cybersecurity Framework. In addition to the NIST framework, we leverage the International Organization for Standardization 27001 and 27002 standards. Our information protection policies and standards are informed by NIST 800-53b, moderate-level security control baseline requirements.


text: Our Chief Information Security Officer ("CISO") oversees our information security program, leading a team responsible for enterprise-wide cybersecurity strategy, policy, process, standards, and architecture. Our CISO holds an MBA in technology management and has over twenty-five years of technology leadership experience, along with other certifications in efficiency and project management. Beyond the CISO, the security team in charge of incident management has a strong bench of experienced information security practitioners holding diverse degrees in science, technology, computer science and mathematics. Members of the operations team have certifications such as the Certified Information Systems Security Professional ("CISSP"), Certified Information Security Manager ("CISM"), Offensive Security Certified Professional ("OSCP"), Certified Ethical Hacker and many more. They all come from backgrounds that complement professions in security and all of them have at least several years of industry experience.


text: To enhance our preparedness and practice our collective cybersecurity response capabilities, we conduct tabletop exercises with leaders, stakeholders, subject matter experts and certain executives that are developed in partnership with external security experts. These events are designed to exercise and engage some of the most critical areas of cybersecurity incident response and preparedness through an interactive/evolving, simulated scenario. In addition to these internal measures, the effectiveness of components of our overall cybersecurity program is frequently evaluated by external third parties, which includes work performed over various levels of control assessments for specific business lines and core processes. These include Health Information Trust Alliance for health care data security, PCI DSS for payment security and System Organization Controls 2 for information security and related controls for specific business lines and core processes. We also perform an annual maturity assessment and benchmark our security controls to identify opportunities to strengthen our cybersecurity program.


text: As part of our Global Threat Management Program, a dedicated Incident Handling Team, comprising both technical and management personnel, determines the severity of a validated cybersecurity event across the enterprise and is responsible for the development and ongoing maintenance of our comprehensive Global Incident Response Plan ("GIRP"). The GIRP is reviewed quarterly at a minimum but may be updated as needed based on lessons learned, changes in key teams or processes or other circumstances as warranted, and the procedures therein are tested annually. The GIRP's incident handling procedures dictate our actions during each phase of an incident, including the assembly of a broad, cross-functional Computer Security Incident Response Team, the formulation of a response, and post-incident reviews and corrective actions.


text: Our information protection department maintains a risk register that is used to manage cybersecurity risks associated with its business activities, technology assets and its interaction with business, information technology and security parties, internal and external. Cybersecurity risks are also periodically reviewed by Enterprise Risk Management to ensure appropriate oversight of cybersecurity risk management activities.


text: Suppliers that have access to, host or transmit our data are contractually required to comply with our Security Policies and Standards. Additionally, suppliers may be subject to periodic security audits or risk assessments, which include security questionnaires, security capabilities and maturity assessments, controls evidence reviews, application vulnerability assessments, public internet presence monitoring, and alignment reviews with service-specific industry standards. Follow-up activities are performed as needed. Contracts with suppliers also include critical security requirements, such as right to audit, technology requirements and hiring practices, including background checks for those who have access to our network. To further ensure supplier resilience and continuity, we regularly evaluate and assess our critical supplier relationships and business continuity plans, enabling us to quickly adapt and maintain operations in the event of prolonged disruption.


text: As of the date of this report, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. That said, as discussed more fully under Part I, Item 1A "Risk Factors – Strategic and Operational Risks – As a large global health company, we and our vendors are subject to cyberattacks or other privacy or data security incidents. If we are unable to prevent or contain the effects of any such attacks, or fail to ensure vendors do the same, we may suffer exposure to substantial liability, reputational harm, loss of revenue or other damages," the sophistication of cybersecurity threats continues to increase, and the preventive actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may become insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all attacks of these types, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Cybersecurity Governance Our Board has ultimate oversight over our privacy and cybersecurity programs and strategy and is responsible for ensuring that we have risk management policies and processes in place to meet and mitigate evolving risks and threats. Certain members of the Board have cybersecurity certifications. The Board executes this oversight directly and through both the Audit Committee, for cybersecurity purposes, and the Compliance Committee, for privacy purposes. In these capacities, these committees are regularly briefed by the Global Chief Information Security Officer ("GCISO") and Chief Privacy Officer on cybersecurity and privacy matters. These briefings are designed to provide visibility about the identification, assessment and management of critical risks, audit findings, and management's risk mitigation strategies. Additionally, these briefings include information about current trends in the environment, incident preparedness, artificial intelligence and various components of our cybersecurity and privacy programs. On an annual basis, the Board reviews our cybersecurity program, including the threat landscape and related controls, and periodically conducts cybersecurity tabletop exercises.


text: Our dedicated cybersecurity team is led by our GCISO. Our current GCISO joined the Company in October 2023 and works closely with senior management to develop and innovate the cybersecurity strategy and risk management. Prior to joining the team, our GCISO held senior information security roles at other global organizations where this individual defined information security strategies, built global information security programs, implemented cybersecurity capabilities that protect consumers, wholesale partners and brands, and oversaw the security of a global payment network, a corporate network and digital assets.


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a team comprised of IT security, IT infrastructure, and IT compliance personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan, incident response policy and Security Operations Center (SOC) to respond to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors to assess for cyber risks and to assist the business in making risk-informed technology product and services decisions. We perform due diligence, including risk assessments, as appropriate, on third parties who maintain material data or information to help us evaluate and verify third party information security capabilities.


text: There can be no assurance that our cybersecurity risk management program, including our controls, procedures and processes, will be fully complied with or that our program will be fully effective in protecting the confidentiality, integrity and availability of our information systems and our solutions. See Part I, Item 1A. "Risk Factors – Risks Related to Our Technology, Cybersecurity and the Cyber Incident" of this Annual Report on Form 10-K.


text: Other than with respect to the Cyber Incident, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I, Item 1A. "Risk Factors – Risks Related to Our Technology, Cybersecurity and the Cyber Incident" of this Annual Report on Form 10-K.


text: Cybersecurity Governance Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Board's Technology and Cybersecurity Committee (the "Technology and Cybersecurity Committee"). The Technology and Cybersecurity Committee oversees management's design, implementation and enforcement of our information technology systems and cybersecurity risk management program. Our Technology and Cybersecurity Committee meets and reports to the full Board at least quarterly.


text: Our Chief Information Security Officer, or CISO, regularly reports to the Technology and Cybersecurity Committee on an at least quarterly basis and leads the Company's overall cybersecurity function. The Technology and Cybersecurity Committee receives regular reports from our CISO on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents. Technology and Cybersecurity Committee members also receive regular presentations on cybersecurity topics from our CISO, supported by our internal security staff, as part of the Board's continuing education on topics that impact public companies.


text: Our CISO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in our IT environment.


text: While our Board and Technology and Cybersecurity Committee oversee cybersecurity risk, our senior leadership is responsible for identifying, assessing and managing our material risks from cybersecurity threats. Our IT organization, which is led by our Chief Information Officer, is accountable for our overall cybersecurity risk management program. Reporting to our Chief Information Officer is the individual who provides day-to-day oversight of our cybersecurity program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers, our Chief Information Security Officer ("CISO"). Our CISO has an undergraduate degree in computer science and 30 years of experience in the IT, engineering and cybersecurity space. He has been with the Company since 2017, and previously served in management roles overseeing cybersecurity and security architecture at both publicly traded and private companies in the technology and software development industries. Our CISO is a recognized leader in the cybersecurity industry and often speaks at notable events throughout the world. The team that runs our cybersecurity risk management program comprises IT security, IT infrastructure and IT compliance personnel, who have prior work experience in various roles involving information technology (such as security, auditing, compliance, systems or programming) and/or relevant education or certifications.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.


text: We use, among other frameworks, the NIST Cybersecurity Framework and CIS Critical Security Controls as guides to help us identify, assess, and manage cybersecurity risks relevant to our business. Although we refer to such frameworks in developing our cybersecurity risk management approaches, our use of them as guides is not intended to suggest that we meet any particular technical standards, specifications, or requirements set forth therein.


text: There can be no assurance that our cybersecurity risk management program, including our controls, procedures and processes, will be fully complied with or that our program will be fully effective in protecting the confidentiality, integrity and availability of our information systems and our solutions. See Part I, Item 1A. "Risk Factors – Risks Related to Our Technology and Cybersecurity" of this Annual Report on Form 10-K.


text: Other than with respect to the Cyber Incident, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I, Item 1A. "Risk Factors – Risks Related to Our Technology and Cybersecurity" of this Annual Report on Form 10-K.


text: While our Board and Technology and Cybersecurity Committee oversee cybersecurity risk, our senior leadership is responsible for identifying, assessing and managing our material risks from cybersecurity threats. Our IT organization, which is led by our Chief Information Officer, is accountable for our overall cybersecurity risk management program. Reporting to our Chief Information Officer is the individual who provides day-to-day oversight of our cybersecurity program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers, our CISO. Our CISO has an undergraduate degree in computer science and 30 years of experience in the IT, engineering and cybersecurity space. He has been with the Company since 2017, and previously served in management roles overseeing cybersecurity and security architecture at both publicly traded and private companies in the technology and software development industries. Our CISO is a recognized leader in the cybersecurity industry and often speaks at notable events throughout the world. The team that runs our cybersecurity risk management program comprises IT security, IT infrastructure and IT compliance personnel, who have prior work experience in various roles involving information technology (such as security, auditing, compliance, systems or programming) and/or relevant education or certifications.


text: We have implemented an Enterprise Risk Management ("ERM") program, managed by members of senior management, to identify, assess and monitor key risks that are aligned with our strategic and business objectives. Our policies and processes are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards. We apply NIST best practices in how we implement security and privacy controls. We use NIST to define our practice in conducting risk assessments as well as to define our approach in managing internet of things ("IOT") device security. We have identified various cybersecurity risks that could adversely affect our business, results of operations and financial condition, including violation of privacy laws; intellectual property theft; fraud; business interruption or ransomware; harm to customers or employees; and other legal and reputational risks.


text: We use technical safeguards to protect our systems from cybersecurity threats, including firewalls and access controls. As part of our risk management practice, and given the rapidly changing regulatory landscape, we focus on making relevant privacy and cybersecurity training available to all employees, this includes mandatory training for all users on privacy and security best practices, as well as awareness training tied to our phishing campaigns. Topics included in our yearly training include best practices in password hygiene, phishing awareness, data privacy and other focus areas. We periodically test our policies and practices to guard against cybersecurity threats and engage in audits, threat modeling, vulnerability testing and table top exercises.


text: We have an established practice to oversee and manage third-party service providers in order to protect our interests related to cybersecurity threats. The Contract and Procurement Security Services ("CPSS") process has several key requirements of third-party vendors who manage or control our electronic information resources to ensure they protect our interests in cybersecurity, including: adherence to cybersecurity best practices, such as the NIST Cybersecurity Framework; completion of a security assessment questionnaire prior to any contract execution; and through application of our GRC (Governance, Risk, and Compliance) Tool, which triggers automatic annual security reviews of vendors. The security compliance team within the CISO's organization actively reviews and assesses the third party's responses and takes appropriate actions based on the responses.


text: We continue to evaluate and enhance our systems, controls, and processes where possible, including in response to actual or perceived threats specific to us or experienced by other companies.


text: The Board and the committees of the Board oversee our risk profile and exposures relating to matters within the scope of their authority. Among other matters, the Audit Committee is charged with oversight of Resideo's risks relating to enterprise-wide cybersecurity, including review of the state of the Company's cybersecurity policies and programs and steps management has taken to monitor and control such exposures. Cybersecurity review with the CISO is a regular standing calendar item of the Audit Committee in connection with its overall ERM program oversight. In addition, our Information and Technology Committee coordinates with Audit Committee on the oversight of our product technology and software cybersecurity program. The Audit Committee and Information and Technology Committee, together with the CISO, provide the full Board with visibility into the risks that impact us and the plans to mitigate them. The CISO's reports to the committees and the Board include insights on operations, business cyber risks, emerging threats and key strategic initiatives driving improved security capabilities, and special topics around what the Company is doing to strengthen Resideo's security posture.