text: We are committed to maintaining robust governance and oversight of these risks and to implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in us incurring significant costs related to, for example, rebuilding our internal systems, writing down inventory value, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. Based on media reports and other surveys, we believe there is a general increase in cyberattack volume, frequency, and sophistication. We have experienced the same in our own business. We seek to detect and investigate unauthorized attempts and attacks against our network and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools; however, we remain potentially vulnerable to known or unknown threats. In some instances, we, our suppliers, and our customers can be unaware of a threat or incident or its magnitude and effects.


text: Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See "Risk Factors" for more information on our cybersecurity risks.

companyName: VISHAY INTERTECHNOLOGY INC

ticker: VSH

secItem: Item 1C

stage1Category: None/Other

stage1Method: unanimous


text: We aim to incorporate industry best practices throughout our cybersecurity program. Identifying and assessing cybersecurity risk is integrated into our overall risk management program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards and is tested annually by independent third-party consultants. We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect us, and have processes to assess those issues for potential cybersecurity impact or risk.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on at least an annual basis from senior management, including leaders from our Information Technology, Internal Audit, and Legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Training and awareness: We provide recurring information security training (which includes cybersecurity training) to our associates and certain third parties based on access, risk, roles, policies, standards and behaviors.

companyName: Walmart Inc.

ticker: WMT

stage1Category: Risk Management Process


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our Information Technology, Internal Audit, and Legal teams. Such individuals have an average of over 20 years of prior work experience in various roles involving information technology, security, auditing, legal, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.

stage1Category: Management Role

stage1Method: majority


text: Walmart seeks to build and maintain the trust of customers, associates, shareholders and other stakeholders with respect to our use of technology and data. Our digital trust commitments, in line with our Company's values of service, excellence, integrity and respect for the individual, provide a foundation for our approach to cybersecurity.


text: The Board of Directors, committees of the Board of Directors and management coordinate risk oversight and management responsibilities, and cybersecurity represents an important component of our overall approach to enterprise risk management. In general, we seek to address cybersecurity risks through a cross-functional approach focused on protecting business operations and preserving the confidentiality, integrity and availability of information by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Board of Directors' oversight of risks from cybersecurity threats Our Board of Directors, which has primary responsibility for overseeing risk management, has delegated risk management oversight responsibility for information systems, information security, data privacy and cybersecurity to the Audit Committee. Several of our Board members, including certain members of our Audit Committee, have backgrounds or professional experience in risk management, digital platforms, information technology or cybersecurity.

stage1Category: Board Governance


text: The Audit Committee receives periodic updates from our Chief Information Security Officer ("CISO"), Chief Technology Officer ("CTO") and other members of management on risks related to information systems, information security, data privacy and cybersecurity. Specific topics may include updates to our company's approach to cybersecurity risk management; recent developments; key initiatives; the threat landscape; trends; and the results of certain assessments and testing. The Board of Directors receives regular reports from the Audit Committee chair on these and other risk-related matters as deemed necessary. Our CISO or other members of management provide information to the Audit Committee pursuant to risk-based escalation protocols for cybersecurity incidents that exceed established reporting thresholds.


text: Management's role in assessing and managing material risks from cybersecurity threats Our CISO leads Walmart's Information Security organization and has responsibility for overseeing our Company's cybersecurity program. To operationalize our program, we deploy multidisciplinary teams, including cybersecurity personnel and professionals, to address cybersecurity threats and respond to cybersecurity incidents, including for those non-wholly owned subsidiaries whose systems have not been fully integrated into Walmart's networks. Through ongoing engagement with these teams and certain third-party service providers, our CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and reports cybersecurity incidents that reach established thresholds to senior management and the Audit Committee, which are also analyzed for external reporting requirements.


text: Our CISO has been a Walmart associate for over 30 years, has served in various roles in information technology and information security at Walmart for almost 20 years, and has received industry-recognized information security certifications. Our CTO, to whom the CISO reports, has served as Walmart's CTO since 2019 and prior to that had experience managing technology and other risks at several other large public companies.


text: Risk Management and Strategy Our cybersecurity program is informed by various industry frameworks including the National Institute of Standards and Technology Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (NIST-CSF Version 1.1), which are reflected in our related policies, standards, processes and practices. We may implement changes to our cybersecurity program when deemed necessary based on updates to industry standards among other things. We have multiple layers of security designed to detect and block cybersecurity events, as well as dedicated teams of cybersecurity personnel and professionals, which assist our CISO in helping to assess, identify, monitor, detect and manage cybersecurity risks, threats, vulnerabilities and incidents. We collaborate with public and private entities and industry groups and engage third-party service providers to expand the capabilities and capacity of our cybersecurity program when deemed necessary. Certain key components of our cybersecurity program include the following:


text: Protecting our technology and information systems: When we implement significant changes to our technologies or information systems, we conduct risk-based security and privacy impact assessments and deploy technical safeguards that are designed to reasonably protect our technology and information systems from cybersecurity threats. We actively monitor and proactively research potential cybersecurity threats to our technologies and information systems. We use what we learn to evolve our security controls over time to mitigate risks posed by such threats.


text: We are not aware of any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect the Company, our business strategy, results of operations or financial condition.

companyName: ITC Holdings Corp.

stage1Category: Strategy Integration


text: Assessments and testing: We engage in periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats. These efforts include tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to assist with our assessments and testing. Where appropriate we adjust our cybersecurity policies, standards, processes and practices accordingly based on internal and external assessment and testing results.


text: Certain of Walmart's systems and those of our third-party service providers have experienced cybersecurity incidents and threats. Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. Additional information about cybersecurity risks we face is discussed in " Item 1A. Risk Factors," which should be read in conjunction with the information above.


text: Management's role in assessing and managing material risks from cybersecurity threats Our CISO leads Walmart's Information Security organization and has responsibility for overseeing our Company's cybersecurity program. To operationalize our program, we deploy multidisciplinary teams, including cybersecurity personnel and professionals, to address cybersecurity threats and respond to cybersecurity incidents, including for those recently acquired and non-wholly owned subsidiaries whose systems have not been fully integrated into Walmart's networks. Through ongoing engagement with these teams and certain third-party service providers, our CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and reports cybersecurity incidents that reach established thresholds to senior management and the Audit Committee, which are also analyzed for external reporting requirements.


text: Our CISO has been a Walmart associate for over 30 years, has served in various roles in information technology and information security at Walmart for more than 20 years, and has received industry-recognized information security certifications. Our CTO, to whom the CISO reports, has served as Walmart's CTO since 2019 and prior to that had experience managing technology and other risks at several other large public companies.


text: Risk Management and Strategy Our cybersecurity program is informed by various industry frameworks including the National Institute of Standards and Technology Cybersecurity Framework (NIST-CSF), which are reflected in our related policies, standards, processes and practices. We may implement changes to our cybersecurity program when deemed appropriate based on updates to laws or industry standards among other things. We have multiple layers of security designed to detect and prevent cybersecurity events, as well as dedicated teams of cybersecurity personnel and professionals, which assist our CISO in helping to assess, identify, monitor, detect and manage cybersecurity risks, threats, vulnerabilities and incidents. We collaborate with public and private entities and industry groups and engage third-party service providers to expand the capabilities and capacity of our cybersecurity program when deemed appropriate. Certain key components of our cybersecurity program include the following:


text: Incident response and recovery planning: We maintain incident response and recovery plans that address our response to cybersecurity incidents, including incidents that we become aware of at third parties that support our operations. These plans guide how we evaluate and assign incident severity levels and reporting thresholds; escalate and engage incident response teams; and manage and mitigate the related risks.


text: Third-party risk management: We maintain a risk-based approach to identifying and managing cybersecurity threats presented to Walmart by third-party systems that support our operations, as well as third-party users of our data and systems, including vendors, service providers and subcontractors.


text: Training and awareness: We provide recurring information security training (which includes cybersecurity training) to our associates and certain third parties based on access, risk, roles, policies, standards and behaviors.


text: Assessments and testing: We engage in periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats. These efforts include tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage assessors, consultants, auditors or other third parties to assist with our assessments and testing. Where appropriate we adjust our cybersecurity policies, standards, processes and practices accordingly based on internal and external assessment and testing results.


text: The Company is a holding company and its business units are decentralized. Together with its business units, the Company maintains a risk-based information security program establishing administrative, technical, and physical safeguards that are designed for the size, scope and type of the Company's businesses.

companyName: Graham Holdings Co

ticker: GHC


text: The information security program is designed to protect the confidentiality, integrity, and availability of the Company's information systems and data, and safeguard information systems and data in accordance with applicable local, state, federal or international laws, regulations, or standards.


text: The Company's information security program is risk-based; the Company and its business units perform business impact assessments and risk assessments on a regular basis to calibrate areas of focus. Cybersecurity risks are evaluated as a part of the broader risk management activities at the Company.


text: The Company and its business units leverage several information security controls frameworks, standards and best practices with the International Organization for Standardizations (ISO) 27001 used as the overarching framework. The ISO 27001 establishes a multi-pronged information security standard for organizations to manage information security risks, build cyber resilience, and improve operations.


text: Third-party service provider risk management is one of many components of the Company's information security program. The Company and its business units use a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties that could adversely impact the Company. This approach may include, but is not limited to, reviewing and assessing providers' cybersecurity maturity, conducting diligence on certain providers' information security programs, and/or imposing contractual obligations on the provider depending on the type and quantity of data involved, the access provided to Company systems, the type of provider and the criticality of outsourced operations.

stage1Category: Third-Party Risk


text: The Company maintains an incident response plan that is distributed to its business units for customization according to their specific operations and internal reporting structures. The Company leverages third-party cybersecurity experts to review the response plan and facilitate incident response exercises for its business units. The Company licenses third-party software that provides incident response simulation capabilities and playbooks and makes that available to its business units and also retains a third-party cybersecurity firm to provide assistance if needed during a cybersecurity incident.


text: The Board of Directors has delegated oversight of risks related to cybersecurity to the Audit Committee which reports on its risk management activities, including risks arising from cybersecurity threats, to the full Board. The Company's Vice President of Information Security and Privacy reports to the Audit Committee on an annual basis. In addition, the Audit Committee receives quarterly updates as part of the disclosure control process and updates, as needed, for significant issues.


text: The annual report to the Audit Committee includes an overview of multiple topics, such as current cybersecurity threats; other cybersecurity risks, including operational, legal/regulatory, and reputational risks; a status summary of company-wide metrics relating to information security controls (e.g., controls addressing vulnerability and patch management, web and mobile application security, administrative access, incident response capability, compliance activities, disaster recovery, sensitive data inventory, and phishing prevention); and planned information security initiatives.


text: At the Company's corporate level, the Information Security and Privacy team monitors the prevention, detection and remediation of cybersecurity incidents and coordinates with the Company's business units to assess information security posture and risk. This coordination includes, for example, performing business impact assessments, conducting risk assessments, and testing and evaluating key aspects of business units' information security programs, the results of which are reported to the Company's senior management and the Audit Committee as appropriate.


text: The Company's Information Security and Privacy team is led by the VP of Information Security and Privacy who reports to the Company's Chief Financial Officer. She joined the Company in 2003 and has more than 30 years of relevant experience. Before joining the Company, she served as the federal government and southeast region leader of Guardent (now part of Verisign), a security and privacy consulting and managed security services company. Prior to Guardent, she worked at PricewaterhouseCoopers LLP in the Technology Risk Services consulting practice. She is a strategic advisor to several organizations in the information security and privacy field and is a Certified Information Systems Security Professional (CISSP), and a Certified Information Privacy Professional (CIPP).


text: Members of the Company's Information Security and Privacy team have an average of more than 20 years of information security and compliance experience, spanning diverse environments and industries, government agencies, and public and private companies. All members of the core team maintain cybersecurity certifications and attend regular training programs relating to information security, privacy and compliance.


text: The Company views information security as a shared responsibility. It requires employees to complete information security and privacy awareness training and sends out regular communications on information security and privacy topics. Developers are trained regularly on secure coding practices and the Company mandates that every business unit perform phishing exercises quarterly. Some employees receive additional in-depth training related to their individual job responsibilities.


text: The Company and its business units leverage several information security controls frameworks, standards and best practices with the International Organization for Standardizations (ISO) 27001 used as the overarching framework. ISO 27001 establishes a multi-pronged information security standard for organizations to manage information security risks, build cyber resilience, and improve operations.


text: The cybersecurity team, managed by the SVP of IT Enterprise Strategy and Execution, (i) receives oversight and executive support through engagement with our ERC, which is responsible for the holistic evaluation, management, and supervision of our aggregate risk profile and (ii) collaborates with our ERM function on business alignment and cybersecurity insurance procurement.

companyName: SELECTIVE INSURANCE GROUP INC

ticker: SIGI


text: The Company and its business units engage third parties to assess various aspects of the information security program, provide threat intelligence, perform external audits, perform penetration testing, and provide other services as needed.


text: The Company and its business units have not been materially affected by risks from cybersecurity threats. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect the Company, see Item 1A Risk Factors. Governance.


text: The Board of Directors has delegated oversight of risks related to cybersecurity to the Audit Committee which reports on its risk management activities, including risks arising from cybersecurity threats, to the full Board of Directors. The Company's Vice President of Information Security and Privacy reports to the Audit Committee on an annual basis. In addition, the Audit Committee receives quarterly updates as part of the disclosure control process and other updates, as needed, for significant issues.


text: Cybersecurity Risk Management and Strategy Management is responsible for cybersecurity risk management, which is part of our enterprise risk management and business continuity processes. We regularly evaluate our cybersecurity risk profile as well as the status and activities of our cybersecurity program, which aligns to the industry-recognized Center for Internet Security or CIS framework. We employ a defense-in-depth strategy which involves multiple layers of security controls to help prevent and detect possible risks and employ measures to protect our systems from business disruption. Our cybersecurity program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, as well as plans and strategies to address threats and incidents. We also engage with third-party service providers, who possess expertise in information technology and cybersecurity, to aid in the design, implementation, and management of our cybersecurity infrastructure and protocols.

companyName: WD 40 CO

ticker: WDFC


text: As part of our continuing education, employees are required to participate in cybersecurity awareness training at the commencement of their employment and annually thereafter. We reinforce this training with monthly internal phishing tests and cybersecurity newsletters to educate our employees on the latest cybersecurity threats and the most effective preventative measures.


text: Cybersecurity Governance Management is responsible for implementing our cybersecurity program. Our Chief Financial Officer works with our Vice President of Global Information & Technology ("IT") and regional IT members to lead our enterprise-wide information security program and manage our Cybersecurity Incident Response Plan. With over 30 years of experience in technology and information systems leadership our Vice President, Global Information & Technology oversees a global network of cybersecurity experts with an average of 25 years of experience. These teams work closely with internal stakeholders to develop, implement, and maintain a comprehensive security strategy that protects our enterprise and supports our business objectives. They also coordinate incident response efforts and proactively address emerging security threats. The recommendations of the management team are considered when updating our information security policies, procedures, and standards.


text: The Audit Committee oversees our cybersecurity risk and mitigation strategies. This committee is regularly briefed by management on the status and effectiveness of our cybersecurity initiatives, including policies and actions taken to monitor, identify, evaluate, mitigate, and report significant risks. The Audit Committee has specific training in overseeing cybersecurity risks, including a member who has earned Carnegie Mellon's CERT (Certificate in Cyber-Risk Oversight) and another with a certificate earned over cybersecurity risk. In addition, the Audit Committee receives periodic briefings from external experts in the area and regularly reports its oversight activities to the full board.


text: As of the date of this Annual Report, we have not identified any cybersecurity threats that have had, or are likely to have, a material impact on our operations, including our business strategy, financial results, or financial condition. For more information on the risks associated with cybersecurity, refer to the "Risk Factors" section contained in Item 1A of this Form 10-K.


text: Cybersecurity Governance Management is responsible for implementing our cybersecurity program. Our Chief Financial Officer works with our Vice President of Global Information & Technology ("IT") and regional IT members to lead our enterprise-wide information security program and manage our Cybersecurity Incident Response Plan. With over 30 years of experience in technology and information systems leadership our Vice President, Global IT oversees a highly experienced professional team within its global network. These teams work closely with internal stakeholders to develop, implement, and maintain a comprehensive security strategy that protects our enterprise and supports our business objectives. They also coordinate incident response efforts and proactively address emerging security threats. The recommendations of the management team are consulted when updating our information security policies, procedures, and standards.


text: Management's Role Managing Risk The Company's cybersecurity risk management is part of the Company's Information Security Office, led by the Chief Information Officer. In order to manage the risks associated with cybersecurity threats, the Company has implemented an Information Security Incident Response Plan.

companyName: WEIS MARKETS INC

ticker: WMK


text: The Company engages with a range of third-party experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing its risk management systems. These relationships enable Management to leverage specialized knowledge and insights with respect to the Company's cybersecurity strategies and processes.


text: The Company's Information Security Incident Response Plan includes detailed processes and controls related to cybersecurity awareness training for employees, phishing simulations, backup and recovery, response planning, vulnerability management and endpoint protection as well as ongoing cybersecurity requirements for third-party service providers. The framework is regularly reviewed, assessed, and updated. This framework is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Board Risk Oversight. Our Board of Directors (the "Board") oversees our policies, procedures, and processes related to risk management, including assessing, identifying, and managing risks from cybersecurity threats. This oversight is performed primarily through the Audit Committee. The Board has delegated to the Audit Committee responsibility for reviewing, with management, the guidelines and policies with respect to: (a) risk assessment and risk management, (b) our major risk exposures, and (c) the steps management has taken to monitor and control such exposures.

companyName: EMCOR Group, Inc.

ticker: EME


text: The Audit Committee receives periodic reports relating to risk assessment and risk management, including cybersecurity threats, from our senior management, including our Chief Executive Officer, Chief Financial Officer, General Counsel, Chief Information Security Officer, the head of our Internal Audit Department, and our Vice President of Risk Management. A cybersecurity update is provided to the Audit Committee at least quarterly. Members of our Audit Committee, and certain of our executive officers, including our Chief Executive Officer, General Counsel, and Chief Information Security Officer, are participants in IANS, an industry leading cybersecurity education platform. Our Chief Information Security Officer has more than 40 years of experience in security practice, processes, and standards, and holds various cybersecurity certifications.


text: Governance, Risk Management, and Strategy. As part of our overall risk management process, we have established a cybersecurity program and dedicated teams to manage and assess material risks from cybersecurity threats, direct the policies and procedures in place to protect our information systems, and respond to cybersecurity incidents if they occur. These teams and committees, which additionally monitor the prevention, detection, and remediation of cybersecurity incidents, include the following: • Our Cybersecurity Executive Council, which is comprised of executive leadership, including our Chief Executive Officer, General Counsel, Chief Information Security Officer, and senior leaders from our segments and key operating companies. The Cybersecurity Executive Council is responsible for reviewing policies and procedures related to cybersecurity and our cybersecurity program. Such policies and procedures, as well as our cybersecurity program generally, are discussed with the Board. • Our Cybersecurity Compliance Committee, which is made up of key cybersecurity and information technology personnel at the segment and operating company levels, receives regular updates and training with respect to cybersecurity in order to advise and assist management, including the Cybersecurity Executive Council, in implementing information systems security and incident response at our operating companies.


text: Our cybersecurity program is managed by our Chief Information Security Officer, who has more than 40 years of experience in information security, both in private industry and as an active-duty member of the United States Air Force. Such experience includes developing security practices, processes, and standards, leading security teams, managing incident response and implementing technologies to enhance security and compliance.


text: We have also implemented cybersecurity training. For example, key information technology and security personnel meet biweekly for training, updates on new cybersecurity threats, and implementation of new policies and all employees are required to undergo annual cybersecurity training, including email and password safety and phishing detection.


text: We engage third party cybersecurity firms to support our in-house cybersecurity initiatives and provide additional expertise with respect to our cybersecurity programs. Such firms are overseen by our General Counsel and Chief Information Security Officer and provide the following services: • On an annual basis, conduct penetration testing to evaluate the susceptibility of our information systems to cybersecurity threats and the effectiveness of our cybersecurity program; • On a biennial basis, conduct a comprehensive "tabletop" exercise to evaluate our incident response policies and procedures and provide relevant experience for our employees tasked with executing such response; and • On a biennial basis, conduct a cybersecurity assessment based on the National Institute of Standards and Technology's Cybersecurity Framework.


text: We have also established a process to evaluate third-party vendors and suppliers for cybersecurity risk and compliance with our security standards. As applicable, on an annual basis we review System and Organization Controls (SOC) 1 reports for all significant third-party vendors. In addition to the efforts discussed above, we have developed and maintain an Incident Response Plan to establish a process for addressing cybersecurity incidents. The Incident Response Plan includes incident response teams in place at the corporate and operating company levels to respond to a potential cybersecurity incident, processes for internal and external reporting, and other procedures to facilitate response and coordination.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. Each member of our organization, from facility operators to board members, has a responsibility to safeguard our cybersecurity. Our Chief Information Security Officer (CISO) is responsible for our cybersecurity strategy and execution, while the Board and the Audit Committee are responsible for oversight of our cybersecurity risk.

companyName: WILLIAMS COMPANIES, INC.

ticker: WMB


text: As of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Like other companies, we are the target of cyberattacks. In 2020, for example, we publicly announced that we were the target of a systems intrusion in which a third party infected certain of the Company's systems with malware. Although we were able to resolve that matter without material impact, we cannot provide assurance that we will not be materially affected in the future by cybersecurity risks or any future material incidents. For more information, see Item 1A. Risk Factors, including the risk factor titled "We are increasingly dependent on sophisticated information technology systems; our business and results of operations are subject to adverse impacts due to disruption, failure and cybersecurity breaches of these systems."

stage1Category: Incident Disclosure


text: The Audit Committee receives periodic reports relating to risk assessment and risk management, including cybersecurity threats, from our senior management, including our Chief Executive Officer, Chief Financial Officer, General Counsel, Chief Information Security Officer, the head of our Internal Audit Department, and our Vice President of Risk Management. A cybersecurity update is provided to the Audit Committee at least quarterly. Members of our Audit Committee, and certain of our executive officers, including our Chief Executive Officer, General Counsel, and Chief Information Security Officer, are participants in IANS, an industry leading cybersecurity education platform.


text: We engage third-party cybersecurity firms to support our in-house cybersecurity initiatives and provide additional expertise with respect to our cybersecurity programs. Such firms are overseen by our General Counsel and Chief Information Security Officer and provide the following services: • On an annual basis, conduct penetration testing to evaluate the susceptibility of our information systems to cybersecurity threats and the effectiveness of our cybersecurity program; • On a biennial basis, conduct a comprehensive "tabletop" exercise to evaluate our incident response policies and procedures and provide relevant experience for our employees tasked with executing such response; and • On a biennial basis, conduct a cybersecurity assessment based on the National Institute of Standards and Technology's Cybersecurity Framework.


text: The Cybersecurity Executive Advisory Board (Executive Advisory Board) is led by the CISO, with the Chief Information Officer (CIO), Chief Financial Officer, Chief Human Resources Officer, the General Counsel, and the Chief Operations Officer as standing members. The Executive Advisory Board's purpose is to ensure enterprise alignment with the Cybersecurity Program and provide executive oversight of the Cybersecurity Program.


text: As of the date of this report, we have not experienced a cybersecurity incident that resulted in, or is reasonably likely to result in, a material effect on our business strategy, results of operations, or financial condition. Like other companies, we are the target of cyberattacks. In 2020, for example, we publicly announced that we were the target of a systems intrusion in which a third party infected certain of the Company's systems with malware. Although we were able to resolve that matter without material impact, we cannot provide assurance that we will not be materially affected in the future by cybersecurity risks or any future material incidents. For more information, see Item 1A. Risk Factors, including the risk factor titled "We are increasingly dependent on sophisticated information technology systems; our business and results of operations are subject to adverse impacts due to the disruption, failure, or breaches of these systems."


text: Risk Management and Strategy The Company has implemented the Committee of Sponsoring Organizations ("COSO") Enterprise Risk Management ("ERM") Framework, which outlines the process by which an organization can view any risk by way of governance and culture, integration into strategy, risk assessments, reviewing capabilities and practices, and monitoring and reporting. This process would apply to the cybersecurity risk as it would any of the other enterprise risks. We follow the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") with layered security controls to help identify, protect against, detect, respond to, and recover from cyber-attacks. To safeguard our information assets, we have put various procedures and technologies in place. For example, our Cybersecurity Incident Response Plan clearly defines roles and responsibilities for the investigation of and response to information security incidents to minimize disruption of critical computing services and operations and prevent the loss or theft of sensitive or mission-critical information. Our plan covers various cyber incidents like ransomware attacks, cyber-intrusions, data loss, denial of service, insider threats, malware attacks, and others. In a material cybersecurity incident, our D&T team, inclusive of our Chief Information Officer and VP of Cybersecurity and Infrastructure Support, address the threat via established escalation procedures, roles, responsibilities, and communication. Any cybersecurity incident that is declared as a crisis would follow our global Incident and Crisis Response and Management Procedure, which includes escalation to the West Leadership Team and Board of Directors, as deemed necessary pending the materiality of the incident. We have not encountered cybersecurity challenges that have materially impacted our operations or financial condition. In addition, we retain an external cybersecurity consultant to assist with a cybersecurity event as needed and maintain appropriate cybersecurity liability insurance.

companyName: WEST PHARMACEUTICAL SERVICES INC

ticker: WST


text: The Company also educates and shares best practices globally with its employees to raise awareness of cybersecurity threats. As part of our onboarding process, we train all new employees on cybersecurity and conduct an annual retraining of all employees on cybersecurity standards. Training also includes how to recognize, report and properly respond to phishing and social engineering schemes. Multiple phishing simulation exercises are conducted throughout the year to increase cybersecurity awareness. Our cybersecurity defenses also utilize technologies such as next generation firewalls, Zero Trust architecture, intrusion detection and prevention measures, anti-malware software, advance threat protection, multifactor authentication, network segmentation and encryption to ensure the security of West intellectual properties, customer and vendor data. In addition, we have a dedicated 24-by-7 Security Operations Center to facilitate the monitoring of the Company's cybersecurity landscape and associated applications.


text: Our approach to cybersecurity begins with our responsibility for strong governance and controls. Security begins at the top of our organization, where Company leadership consistently communicates the requirements for vigilance and compliance throughout the organization, and then leads by example. Our diligence and assessment extends beyond West, as the Company performs a cybersecurity assessment when third-party vendors and service providers are onboarded. Throughout the year, we monitor the effectiveness of our third-party vendors' and service providers' control environment, assessing any impact to our Company. The cybersecurity program is led by our Chief Information Officer and VP of Cybersecurity and Infrastructure Support, who provide quarterly updates to the Audit Committee of our Board of Directors, annual updates to the Board of Directors, and regular reports to the West Leadership Team about the program, including information about cyber risk management governance and the status of ongoing efforts to strengthen cybersecurity effectiveness. Additionally, our ERM function monitors cybersecurity risk and provides regular updates to the Audit Committee of our Board of Directors, annual updates to the Board of Directors, and regular reporting to the West Leadership Team on risk mitigation and response efforts. Security controls and processes are developed and maintained to protect sensitive and confidential information while ensuring availability and integrity.


text: Risk Management and Strategy The Company has implemented the Committee of Sponsoring Organizations ("COSO") Enterprise Risk Management ("ERM") Framework, which outlines the process by which an organization can view any risk by way of governance and culture, integration into strategy, risk assessments, reviewing capabilities and practices, and monitoring and reporting. This process would apply to the cybersecurity risk as it would any of the other enterprise risks. We follow the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") with layered security controls to help identify, protect against, detect, respond to, and recover from cyber-attacks. To safeguard our information assets, we have put various procedures and technologies in place. For example, our Cybersecurity Incident Response Plan clearly defines roles and responsibilities for the investigation of and response to information security incidents to minimize disruption of critical computing services and operations and prevent the loss or theft of sensitive or mission-critical information. Our plan covers various cyber incidents like ransomware attacks, cyber-intrusions, data loss, denial of service, insider threats, malware attacks, and others. In a material cybersecurity incident, our D&T team, inclusive of our Chief Information Officer and our VP of Cybersecurity and Infrastructure Support, address the threat via established escalation procedures, roles, responsibilities, and communication. Any cybersecurity incident that is declared as a crisis would follow our global Incident and Crisis Response and Management Procedure, which includes escalation to the West Leadership Team and Board of Directors, as deemed necessary pending the materiality of the incident. We have not encountered cybersecurity challenges that have materially impacted our operations or financial condition. In addition, we retain an external cybersecurity consultancy company to assist when a cybersecurity event arises, as needed and, in addition we maintain appropriate cybersecurity liability insurance.


text: Management is committed to continually enhancing its cybersecurity processes and practices to address the dynamic nature of the threats it faces and to ensure the security and integrity of its systems and data.


text: Our approach to cybersecurity begins with our responsibility for strong governance and controls. Security begins at the top of our organization, where Company leadership consistently communicates the requirements for vigilance and compliance throughout the organization, and then leads by example. Our diligence and assessment extend beyond West, as the Company performs a cybersecurity assessment when third-party vendors and service providers are onboarded. Throughout the year, we monitor the effectiveness of our third-party vendors' and service providers' control environment, assessing any impact to our Company. The cybersecurity program is led by our Chief Information Officer and our VP of Cybersecurity and Infrastructure Support, who provide periodic updates to the Audit Committee of our Board of Directors, annual updates to the Board of Directors, and regular reports to the West Leadership Team about the program, including information about cyber risk management governance and the status of ongoing efforts to strengthen cybersecurity effectiveness. Additionally, our ERM program enables a portfolio view of the risks inherent in our business, including cybersecurity. The ERM function monitors and reports on these top risks with periodic updates to the Audit Committee and our Board of Directors, annual updates to the Board of Directors, and regular reporting to the West Leadership Team on risk mitigation and response efforts. Security controls and processes are developed and maintained to protect sensitive and confidential information while ensuring availability and integrity.


text: Risk Management and Strategy At Western Digital, our management team is charged with managing risk and bringing to our Board of Directors' attention all material risk exposures to our company. Our enterprise risk management ("ERM") process is designed to facilitate the identification, assessment, management, reporting and monitoring of material risks our company may face over the short-term and long-term and assure regular communication with our Board of Directors and its committees regarding these risks. Through our ERM process, we have determined that the compromise, damage or interruption of our technology infrastructure, information systems or products by cybersecurity incidents is a key risk to our company that may have a material negative impact on our business. To help mitigate the potential impact of cybersecurity incidents on our business and protect against cybersecurity threats, we have established organizational structures, procedural measures and response plans that define roles and responsibilities related to cybersecurity risk management.

companyName: WESTERN DIGITAL CORP

ticker: WDC


text: Western Digital's Information Security organization addresses cybersecurity risks with a broad spectrum of technologies, controls, and processes that focus on mitigating these risks. Our cybersecurity strategy is designed to be dynamic and adaptive to combat the rapidly-evolving cybersecurity threat landscape and is influenced by commonly leveraged frameworks such as the NIST-CSF (National Institute of Standard and Technologies – CyberSecurity Framework). Our program includes, but is not limited to, advanced systems and network security protocols, electronic communications protections, vulnerability management programs, least-privilege access controls, third-party risk management procedures, workforce education and training exercises, and compliance programs.


text: Our dedicated 24x7 Security Operations Center incorporates specialized systems and processes for handling security incidents into its regular work and operates a robust, modern security infrastructure with appropriate security sensors and event monitoring capabilities. Upon detection of a cybersecurity incident, the Security Operations Center determines the severity of the incident in accordance with a pre-established incident severity matrix, initiates the appropriate notification and escalation protocols and begins triage. Predefined severity tiers serve as a guide to match our response to each incident's determined severity or risk level.


text: Additionally, we have established a Cyber Incident Response Plan that follows the structure of the Incident Handling Guide published by the U.S. National Institute of Standards and Technology (SP 800-61r2) and that serves as an operational guide for handling cybersecurity incidents at Western Digital. Our Cyber Incident Response Plan provides procedural and strategic guidance that is designed to be flexible enough to apply to a variety of different incidents, but also specific enough to provide guidelines for incident prevention, detection, analysis, escalation and notification, and containment, eradication and recovery.


text: As part of our ongoing information security program, Western Digital utilizes periodic independent third-party experts to conduct assessments of our program's effectiveness. These experts are also leveraged to design and orchestrate tabletop exercises where multiple business functions and leadership levels must navigate complex incident scenarios to help determine our level of preparedness for various cybersecurity incidents.


text: The cybersecurity team is led by the Vice President of Information Security and the Senior Vice President of IT. Our team is comprised of highly skilled analysts, all of whom hold professional certifications and have undergone extensive training to assist in safeguarding our sensitive customer data.

companyName: WORLD ACCEPTANCE CORP

ticker: WRLD


text: As part of our business operations, Western Digital engages with a number of third parties, including but not limited to, online software service providers, vendors, consultants, and partners. Each of these third-parties must be cleared through a formal cybersecurity risk assessment process before being allowed to integrate with Western Digital's information systems, access confidential data, or provide electronic services to members of our workforce. Additionally, further scrutiny is applied during the post-assessment onboarding process in order to fine-tune access rights to limit privileges to those necessary to enable the related service, resulting in a least-privilege level of access.


text: Western Digital has in the past experienced cybersecurity incidents of varying degrees involving our technology infrastructure and information systems, including incidents in which unauthorized parties have obtained access to our information systems and networks. While these incidents have at times resulted in some disruptions to our business operations, as of the date of this Annual Report on Form 10-K, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incident, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected or protected against all such cybersecurity incidents or threats or that we will not experience such an incident in the future. Further details about the cybersecurity risks we face are described under "The compromise, damage or interruption of our technology infrastructure, information systems or products by cybersecurity incidents, data security breaches, other security problems, design defects, information system failures or other events could have a material negative impact on our business" in Part I, Item 1A, Risk Factors, of this Annual Report on Form 10-K.


text: Western Digital has implemented a governance framework related to cybersecurity that includes operational risk-mitigation practices and Board-level cybersecurity risk oversight.


text: Our management team is charged with managing cybersecurity risk and identifying material cybersecurity risk exposures to our company and carries out this function primarily through our Information Security organization, which is led by our Chief Information Security Officer who has a master's degree in computer science, over a decade of information security leadership, and thirty years of combined IT leadership experience. Additionally, our Cyber Incident Response Plan discussed above calls for the establishment of a management Impact Assessment Committee, which consists of key leadership representatives from the organization and is convened on an ad hoc basis to assess the detailed business impact of a cybersecurity incident. The Impact Assessment Committee is led by our Chief Information Security Officer and includes key representatives from the Company's functional groups, including human resources, ethics and compliance, labor, privacy, internal audit, finance, communications, legal, risk and accounting. The Impact Assessment Committee receives updates and communications from the Security Operations Center on a fixed cadence determined by incident severity and follows our pre-established escalation framework to communicate with and include executive leadership, outside counsel and the Board of Directors, as appropriate. The Impact Assessment Committee works with the Company's internal and external legal counsel to determine and facilitate appropriate communications with the Board of Directors.


text: Our Board of Directors is responsible for overseeing the cybersecurity risk management process and exercises this risk oversight through both our full Board of Directors and its Audit Committee. Our Board of Directors has delegated to the Audit Committee the responsibility to oversee risks related to cybersecurity threats, and our Audit Committee Charter requires the Audit Committee to review and discuss with management the Company's policies with respect to risk assessment and enterprise risk management and to review the risk exposure of the Company related to the Committee's areas of responsibility, including with respect to cybersecurity. In carrying out this role, the Audit Committee meets with our Chief Information Security Officer regularly and receives at least quarterly reports on cybersecurity matters.


text: Additionally, at least annually, our Chief Audit Executive, who manages the day-to-day activities of our ERM program, reports to our Board of Directors on enterprise risk assessment under our ERM program, providing updates on key risks, status of mitigation efforts and residual risk trends, including an analysis of cybersecurity risks. Also at least annually, our Chief Information Security Officer reports to the full Board of Directors on cybersecurity matters related to or impacting our company and our business.


text: Risk Management and Strategy At Western Digital, our management team is charged with managing risk and bringing to our Board of Directors' attention all material risk exposures to our company. Our enterprise risk management ("ERM") process is designed to facilitate the identification, assessment, management, reporting and monitoring of material risks our company may face over the short-term and long-term and promote regular communication with our Board of Directors and its committees regarding these risks. Through our ERM process, we have determined that the compromise, damage and interruption of our technology infrastructure, information systems or products by cybersecurity incidents are key risks to our company that may have a material negative impact on our business. To help mitigate the potential impact of cybersecurity incidents on our business and protect against cybersecurity threats, we have established organizational structures, procedural measures and response plans that define roles and responsibilities related to cybersecurity risk management.


text: We strive to integrate cybersecurity into our corporate governance, engaging with expert third parties, managing third-party risks, and ensuring that both management and the Board of Directors are actively involved in overseeing and mitigating these risks.


text: Our Information Security organization addresses cybersecurity risks with a broad spectrum of technologies, controls, and processes that focus on mitigating these risks. Our cybersecurity strategy is designed to be dynamic and adaptive to combat the rapidly-evolving cybersecurity threat landscape and is influenced by commonly leveraged frameworks such as the NIST-CSF (National Institute of Standard and Technologies – CyberSecurity Framework). Our program includes, but is not limited to, advanced systems and network security protocols, electronic communications protections, vulnerability management programs, least-privilege access controls, third-party risk management procedures, workforce education and training exercises, and compliance programs.


text: Additionally, we have established a Cyber Incident Response Plan that follows the structure of the Incident Handling Guide published by the U.S. National Institute of Standards and Technology (SP 800-61r2) and that serves as an operational guide for handling cybersecurity incidents. Our Cyber Incident Response Plan provides procedural and strategic guidance that is designed to be flexible enough to apply to a variety of different incidents, but also specific enough to provide guidelines for incident prevention, detection, analysis, escalation and notification, and containment, eradication and recovery.


text: As part of our ongoing information security program, we utilize periodic independent third-party experts to conduct assessments of our program's effectiveness. These experts are also leveraged to design and orchestrate tabletop exercises where multiple business functions and leadership levels must navigate complex incident scenarios to help determine our level of preparedness for various cybersecurity incidents.


text: As part of our business operations, we engage with a number of third parties, including but not limited to, online software service providers, vendors, consultants, and partners. Each of these third parties must be cleared through a formal cybersecurity risk assessment process before being allowed to integrate with our information systems, access confidential data, or provide electronic services to members of our workforce. Additionally, further scrutiny is applied during the post-assessment onboarding process in order to fine-tune access rights to limit privileges to those necessary to enable the related service, resulting in a least-privilege level of access.


text: We have in the past experienced cybersecurity incidents of varying degrees involving our technology infrastructure and information systems, including incidents in which unauthorized parties have obtained access to our information systems and networks. While these incidents have at times resulted in some disruptions to our business operations, as of the date of this Annual Report on Form 10-K, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incident, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected or protected against all such cybersecurity incidents or threats or that we will not experience such an incident in the future. Further details about the cybersecurity risks we face are described under "The compromise, damage or interruption of our technology infrastructure, information systems or products by cybersecurity incidents, data security breaches, other security problems, design defects, information system failures or other events could have a material negative impact on our business" in Part I, Item 1A, Risk Factors, of this Annual Report on Form 10-K. We have implemented a governance framework related to cybersecurity that includes operational risk-mitigation practices and Board-level cybersecurity risk oversight.


text: Our management team is charged with managing cybersecurity risk and identifying material cybersecurity risk exposures to our company and carries out this function primarily through our Information Security organization, which is led by our Chief Information Security Officer who has a master's degree in computer science, over a decade of information security leadership, and thirty years of combined IT leadership experience. Additionally, our Cyber Incident Response Plan discussed above calls for the establishment of a management Impact Assessment Committee, which consists of key leadership representatives from the organization and is convened on an ad hoc basis to assess the detailed business impact of a cybersecurity incident. The Impact Assessment Committee is led by our Chief Information Security Officer and includes key representatives from the Company's functional groups, including human resources, ethics and compliance, labor, privacy, internal audit, finance, communications, legal, risk and accounting. The Impact Assessment Committee receives updates and communications from the Security Operations Center on a fixed cadence determined by incident severity and follows our pre-established escalation framework provided by our Security Incident Response Plan to communicate with and include executive leadership, outside counsel and our Board of Directors, as appropriate. The Impact Assessment Committee works with our internal and external legal counsel to determine and facilitate appropriate communications with our Board of Directors.


text: Risk Management and Strategy The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard its information systems and protect the confidentiality, integrity, and availability of its data.

companyName: YORK WATER CO

ticker: YORW


text: Our Board of Directors is responsible for overseeing the cybersecurity risk management process and exercises this risk oversight through both our full Board of Directors and its Audit Committee. Our Board of Directors has delegated to our Audit Committee the responsibility to oversee risks related to cybersecurity threats, and our Audit Committee Charter requires our Audit Committee to review and discuss with management the Company's policies with respect to risk assessment and enterprise risk management and to review the risk exposure of the Company related to the Committee's areas of responsibility, including with respect to cybersecurity. In carrying out this role, our Audit Committee meets with our Chief Information Security Officer regularly and receives at least quarterly reports on cybersecurity matters.


text: Additionally, at least annually, our chief audit executive, who manages the day-to-day activities of our ERM program, reports to our Board of Directors on enterprise risk assessment under our ERM program, providing updates on key risks, status of mitigation efforts and residual risk trends, including an analysis of cybersecurity risks. Also at least annually, our Chief Information Security Officer reports to our full Board of Directors on cybersecurity matters related to or impacting our company and our business.


text: Information Security Risk Management and Strategy Our Board of Directors ("Board") is responsible for overseeing risk management at Whirlpool, which is the responsibility of our Executive Vice President and Chief Financial Officer. Our risk management process is designed to identify, prioritize, and monitor risks that could affect our ability to execute our corporate strategy and fulfill our business objectives and to appropriately mitigate such risks.

companyName: WHIRLPOOL CORP /DE/

ticker: WHR


text: As part of our risk management processes, we perform risk assessments in which we map and prioritize information security risks identified through the processes described above, including risks associated with our use of third-party service providers, based on probability, immediacy and potential magnitude. These assessments inform our risk mitigation strategies, which are reviewed regularly with the Board and management, and we view information security risks as one of the key risk categories we face. For example, our information technology and infrastructure has experienced and may in the future be vulnerable to cyberattacks (including ransomware attacks) or security incidents, and third parties have in the past and may in the future be able to access proprietary business information, and personal data that we collect, store and process. For more information regarding the information security-related risks we face, see the information in "Item 1A: Risk Factors" under the caption "We have been and may be subject to information technology system failures, network disruptions, cybersecurity attacks and breaches in data security, which may materially adversely affect our operations, financial condition and operating results".


text: Our risk mitigation process assesses, prioritizes, and monitors information security risks and vulnerabilities and helps ensure risk mitigation efforts are embedded across our business. Among other things, our internal experts regularly conduct audits and tests of our information systems and our cybersecurity program is periodically assisted by established, independent third party consultants, who provide assistance through tabletop and other preparedness exercises. We also review information security threat information published by government entities and other organizations in which we participate and actively engage with suppliers, industry associations, key thought leaders and law enforcement communities as part of our continuous efforts to evaluate and enhance the effectiveness of our cybersecurity program. In 2022, we launched and required all salaried employees to complete a mandatory Global Cybersecurity and Privacy training, covering information security, end-user security policies, remote working, phishing and email security and digital threats. This training was enhanced with additional topics in 2023 around social media, social engineering, and breach response, among others. Additionally, we maintain regular publications on cyber awareness on our Company portal and conduct ongoing simulated phishing exercises. We use the findings from these and other processes to improve our information security practices, procedures and technologies. In 2023, we implemented additional management governance through the creation of a Global Cybersecurity and Data Privacy Steering Committee, which meets periodically to help ensure information security risks and vulnerabilities are being appropriately managed and mitigated. In addition, we maintain insurance to protect against potential losses arising from an information security incident.


text: While we have not yet experienced any material impacts from a cyber attack, any one or more future cyber attacks could materially adversely impact the Company, including a loss of trust among our customers and consumers, departures of key employees, general diminishment of our global reputation and financial losses from remediation actions, loss of business or potential litigation or regulatory liability. Further, evolving market dynamics are increasingly driving heightened cybersecurity protections and mandating cybersecurity standards for our products, and we may incur additional costs to address these increased risks and to comply with such demands. In addition to the risk management processes identified above, Whirlpool also maintains active knowledge security and data privacy programs. Leveraging policies and governance, ongoing training and awareness as well as strong controls and systems-based approaches, these programs help ensure that Whirlpool confidential information is protected and that the company complies with applicable data privacy and data protection laws in all countries where we do business.


text: Information Security Governance and Oversight Our risk management process and information security risk mitigation framework enables our Board and management to establish a mutual understanding of the effectiveness of our information security risk management practices and capabilities, including the division of responsibilities for reviewing our information security risk exposure and risk tolerance, tracking emerging information risks and ensuring proper escalation of certain key risks for periodic review by the Board and its committees.


text: Managing Material Risks & Integrated Overall Risk Management The Company embraces risk management across the company, to include cybersecurity risk. This comprehensive approach ensures that cybersecurity considerations are an integral part of its decision-making processes at every level. The Company's risk management team works closely with its IT department to continuously evaluate and address cybersecurity risks in alignment with its business objectives and operational needs.


text: As part of its broader risk oversight activities, the Board oversees risks from information security threats, both directly and through the Audit Committee of the Board (the "Audit Committee"). As reflected in its charter, the Audit Committee assists the Board in its oversight of risk by periodically reviewing policies and guidelines with respect to risk assessment and risk management, including management reports on our processes to manage and report risks. As another element of its risk oversight activities, the Audit Committee receives reports quarterly from our Global Chief Information Officer ("CIO") and Global Chief Information Security Officer ("CISO") on the execution and effectiveness of our cybersecurity and privacy program, cybersecurity incidents, cyber resilience metrics and the global threat landscape. The Audit Committee also oversees our internal control over financial reporting, including with respect to financial reporting-related information systems.


text: Our CISO, who manages our cybersecurity program, reports to our CIO regularly on how certain information security risks are being managed and progress towards agreed mitigation goals, as well as any potential material risks from cybersecurity threats. The CIO and CISO discuss these matters with our Audit Committee who reports to the Board on the substance of its reviews and discussions. In addition to these discussions, each year our CIO and CISO present to our Board on cybersecurity related trends and program updates. Our CIO and CISO are also responsible for prioritizing risk mitigation activities and developing a culture of risk-aware practices with strong support from management. Both our CIO and CISO have extensive background and expertise in information security, having served in senior leadership positions in the information and information security spaces, respectively, for many years prior to joining Whirlpool.


text: The day-to-day monitoring, identification, and assessment of information security risks and incident response functions are managed centrally by our core cyber incident response team (the "CIRT"), which operationalizes our Cyber Incident Response Plan (the "Plan"). The Plan includes processes to triage, assess severity of, escalate, contain, investigate and remediate information security incidents, including those associated with our third-party service providers, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Under the Plan, the CIRT may escalate matters as necessary to our CISO and CIO, Chief Legal Officer, and other senior leadership, depending on the severity classification of the incident. In addition to the ordinary-course Board and Audit Committee reporting and oversight described above, we also maintain disclosure controls and procedures designed for prompt reporting to the Board and timely public disclosure, as appropriate, of material events covered by our risk management framework, including information security risks.


text: Information Security Risk Management and Strategy Our Board is responsible for monitoring the Company's key risks and overseeing the risk management structure and programs implemented by management. At meetings throughout the year, the Board receives updates from business unit and functional leaders regarding significant risks and challenges within their areas of responsibility and associated mitigation plans and strategies. The Chief Financial and Administrative Officer is responsible for the Company's enterprise risk management (ERM) system, which helps ensure enterprise risks are being effectively managed. Our ERM processes systematically identify, assess, mitigate and monitor enterprise risks, whether strategic, financial, non-financial, operational, compliance or reporting.


text: As part of our risk management processes, we perform risk assessments in which we map and prioritize information security risks identified through the processes described above, including risks associated with our use of third-party service providers, based on probability, immediacy and potential magnitude. These assessments inform our risk mitigation strategies, which are reviewed regularly with the Board and management, and we view information security risks as one of the key risk categories we face. For example, our information technology and infrastructure has experienced and may in the future be vulnerable to cyberattacks (including ransomware attacks) or security incidents, and third parties have in the past and may in the future be able to access proprietary business information, and personal data that we collect, store and process. For more information regarding the information security-related risks we face, see the information in "Item 1A: Risk Factors" under the caption "We have been and may be subject to information technology system failures, cloud failures, network disruptions, cybersecurity attacks and breaches in data security, which may materially adversely affect our operations, financial condition and operating results".


text: Our risk mitigation process assesses, prioritizes, and monitors information security risks and vulnerabilities and focuses on embedment of risk mitigation efforts across our business. Among other things, our internal experts regularly conduct audits and tests of our information systems and our cybersecurity program is periodically assisted by established, independent third party consultants, who provide assistance through tabletop and other preparedness exercises. We also review information security threat information published by government entities and other organizations in which we participate and actively engage with suppliers, industry associations, key thought leaders and law enforcement communities as part of our continuous efforts to evaluate and enhance the effectiveness of our cybersecurity program. In 2022, we launched and required all salaried employees to complete a mandatory Global Cybersecurity and Privacy training, covering information security, end-user security policies, breach response, remote working, phishing and email security and digital threats. The training content is reassessed and refreshed each year to reflect evolving risks. Additionally, we maintain regular publications on cyber awareness on our Company portal and conduct ongoing simulated phishing exercises. We use the findings from these and other processes to improve our information security practices, procedures and technologies. In 2023, we implemented additional management governance through the creation of a Global Cybersecurity and Data Privacy Steering Committee, which meets periodically to review information security risks and vulnerabilities are being appropriately managed and mitigated. In addition, we maintain insurance to protect against potential losses arising from an information security incident.


text: The CIO and CISO have primary responsibility over the Company's cybersecurity risk management program. Quarterly updates are provided to the Company's IT Council, comprised of executive, business unit and IT leaders from across the organization, regarding IT initiatives and risk management processes.

companyName: FEDERAL SIGNAL CORP /DE/

ticker: FSS


text: While we have not yet experienced any material impacts from a cyber attack, any one or more future cyber attacks could materially adversely impact the Company, including a loss of trust among our customers and consumers, departures of key employees, general diminishment of our global reputation and financial losses from remediation actions, loss of business or potential litigation or regulatory liability. Further, evolving market dynamics are increasingly driving heightened cybersecurity protections and mandating cybersecurity standards for our products, and we may incur additional costs to address these increased risks and to comply with such demands. In addition to the risk management processes identified above, Whirlpool also maintains active knowledge security and data privacy programs. Leveraging policies and governance, ongoing training and awareness as well as strong controls and systems-based approaches, these programs focus on protecting Whirlpool confidential information and compliance with applicable data privacy and data protection laws in all countries where we do business.


text: The day-to-day monitoring, identification, and assessment of information security risks and incident response functions are managed centrally by our core cyber incident response team (the "CIRT"), which operationalizes our Cyber Incident Response Plan (the "Plan"). The Plan includes processes to triage, assess severity of, escalate, contain, investigate and remediate information security incidents, including those associated with our third-party service providers, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Under the Plan, the CIRT may escalate matters as necessary to our CISO and CIO, General Counsel, and other senior leadership, depending on the severity classification of the incident. In addition to the ordinary-course Board and Audit Committee reporting and oversight described above, we also maintain disclosure controls and procedures designed for prompt reporting to the Board and timely public disclosure, as appropriate, of material events covered by our risk management framework, including information security risks.


text: Risk Management and Strategy Wiley is committed to maintaining robust cybersecurity practices to safeguard our operations, data, and stakeholders' interests. We monitor our cybersecurity landscape and adapt our strategies and governance practices to mitigate risks in this rapidly evolving area.

companyName: JOHN WILEY & SONS, INC.

ticker: WLY


text: Wiley adopted the National Institute of Standards and Technology Cybersecurity Framework (NIST-CSF), as a guide for its cybersecurity program to establish, and maintain a continuous improvement process for identifying, assessing, and managing cyber risks and cyber-related threats. The framework's key domains of identify, protect, detect, respond, recover and governance encompass specific controls to be established and maintained by an organization. Wiley's controls are monitored and tested on a continuous basis by an external third-party to assess the effectiveness of our cyber program.


text: We maintain a cybersecurity risk management program that is designed to identify, assess, manage, and mitigate cybersecurity risks and provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers. To secure our technology environment, our organization leverages the latest software and security capabilities with a defense-in-depth and layered strategy. We deploy endpoint detection and response, network anomaly detection, and multi-factor authentication across most of our environment. We engage with various third-party consultants as well as utilize various threat intelligence services to assist in our oversight and to identify risks. We require employees with access to our information systems, including all corporate employees and consultants, to undertake annual data protection and cybersecurity training and ongoing phishing simulation exercises.


text: Our Board is responsible for the overall oversight of our enterprise risk management. The Board receives regular updates on the key risks to the organization on a quarterly basis. The Board has delegated oversight of cybersecurity risks to the Audit Committee. The Audit Committee receives quarterly cybersecurity updates from the Company's Chief Information Security Officer (CISO), which includes updates on the Company's cybersecurity policies and strategies, cyber risks and threats, the status of projects designed to continuously improve the Company's information security systems, assessments of the Company's security program, employee training and awareness programs, emerging threat landscape and engagement with external cybersecurity experts and advisors, as needed.


text: The Company also holds an annual cybersecurity educational session and updates both the Audit Committee and the Digital Product and Technology Committee, which oversees the Company's digital product and services and technology strategies, initiatives and investments. The annual session is dedicated to the Enterprise Security Compliance and Data Protection program, which features perspectives on the status of Wiley's Cybersecurity Program, including related policies, procedures and practices and emerging trends in the cybersecurity space from the Company's CISO complemented by an outside expert.


text: Management's Role Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Risk mitigation strategies and key performance indicators are defined, and tracked, as part of the quarterly internal reporting. The Enterprise Security, Compliance and Data Protection team consists of subject matter experts in the field on Information Security, Risk Management Compliance and Data Protection. Our Security, Compliance and Data Protection teams monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures, and regularly report to our CISO. Our CISO is part of the senior management team and regularly updates the Audit Committee on the company's cybersecurity program, including cybersecurity risks, incidents, and mitigation strategies.


text: The Security, Compliance and Data Protection team is led by the CISO who has 25 years in business risk management and cybersecurity and reports to the Chief Information Officer (CIO) who has over 25 years in information technology and security roles. The Security, Compliance and Data Protection team has established processes and procedures that guide and enable continuous monitoring, detection, prevention, mitigation, and remediation of cybersecurity incidents. These processes are carried out using various security platforms tools, capabilities and strategies including tests of our information security program, tabletop exercises, penetration and vulnerability testing, disaster recovery (DR) simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. Incident Response and Management teams utilize procedures that identify escalation paths when security events are identified. Incident priorities dictate escalation of events and how they are reported up from an Incident Commander up to the executive leadership team within Wiley as well as to the Board.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. The threat landscape is constantly changing and will continue to as new technologies, such as AI, evolve.


text: Wiley adopted the National Institute of Standards and Technology Cybersecurity Framework (NIST-CSF) as a guide for its cybersecurity program to establish and maintain a continuous improvement process for identifying, assessing, and managing cyber risks and cyber-related threats. Informed by the NIST-CSF, we maintain a cybersecurity risk management program that is designed to identify, assess, manage, and mitigate cybersecurity risks and provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers. To secure our technology environment, our organization leverages the latest software and security capabilities with a defense-in-depth and layered strategy. We deploy endpoint detection and response, network anomaly detection, and multi-factor authentication across most of our environment. We engage with various third-party consultants as well as utilize various threat intelligence services to assist in our oversight and to identify risks. We require employees with access to our information systems, including all corporate employees and consultants, to undertake annual data protection and cybersecurity training and ongoing phishing simulation exercises. In addition, Wiley's controls are also monitored and tested on a continuous basis by an external third-party to assess the effectiveness of our cyber program.


text: Based on the information we have as of the date of this Annual Report on Form 10-K, we do not believe that any cybersecurity incident experienced by the Company has materially affected or is reasonably likely to materially affect Wiley, including our business strategy, results of operations, or financial condition. For additional information about cybersecurity risks, see Item 1A. "Risk Factors. "


text: Our management team's experience includes extensive experience working in the information technology field and securing corporate information technology systems, including engaging with third party security vendors to perform cyber risk assessments and penetration testing.

companyName: HilleVax, Inc.


text: Our Board is responsible for the overall oversight of our enterprise risk management. The Board receives regular updates on the key risks to the organization on a quarterly basis. The Board has delegated oversight of cybersecurity risks to the Audit Committee. The Audit Committee receives quarterly and yearly cybersecurity updates from the Company's Chief Information & Security Officer ( CISO), which includes updates on the Company's cybersecurity policies and strategies, cyber risks and threats, the status of projects designed to continuously improve the Company's information security systems, assessments of the Company's security program, employee training and awareness programs, emerging threat landscape, and engagement with external cybersecurity experts and advisors, as needed.


text: Management's Role Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures, and maintaining cybersecurity programs. Risk mitigation strategies and key performance indicators are defined, and tracked, as part of the quarterly internal reporting. The information security team consists of subject matter experts in the fields of security operations, governance risk and compliance (GRC), application security, fraud, identity and access management, and security architecture. Our security operation center (SOC) monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures and regularly reports to our CISO. Our CISO is part of the senior management team and regularly updates the Audit Committee on the company's cybersecurity program, including cybersecurity risks, incidents, and mitigation strategies.


text: The information security team is led by the CISO who has 29 years of experience in business risk management and cybersecurity. The information security team has established processes and procedures that guide and enable continuous monitoring, detection, prevention, mitigation, and remediation of cybersecurity incidents. These processes are carried out using various security platforms tools, capabilities, and strategies including tests of our information security program, tabletop exercises, penetration and vulnerability testing, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. Incident response teams within the SOC utilize procedures that identify escalation paths when security events are identified. Incident priorities dictate escalation of events and how they are reported from an incident commander up to the executive leadership team within Wiley as well as to the Board.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident. The threat landscape is constantly changing and will continue to as new technologies, such as AI, evolve.


text: We recognize the increasing volume and sophistication of cyber threats and take our responsibility to protect the information and systems under our purview seriously. Our cybersecurity processes aim to provide a comprehensive approach to assess, identify, and manage material risks arising from these cybersecurity threats.


text: Comprehensive Cybersecurity Program: We have implemented a comprehensive cybersecurity risk management program (Cybersecurity Program) that is aligned with the National Institute for Standards and Technology Cybersecurity Framework. Our Cybersecurity Program provides a risk-based approach to cybersecurity, and security controls are tailored so that cost-effective controls can be applied commensurate with the risk and sensitivity of specific information systems, control systems, and enterprise data. Our Cybersecurity Program incorporates best practices and industry standards from multiple sources and is designed to comply with applicable regulations. The Cybersecurity Program includes, but is not limited to, the following elements: risk assessment, policies and procedures, training and awareness, auditing, compliance monitoring and testing, and incident response.


text: Integration with Overall Risk Management: Our cybersecurity processes have been integrated into our overall risk management system and processes. We consider cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process. Our cybersecurity risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.


text: Engagement of Third Parties: We often engage with specialized third-party assessors, consultants, auditors, and other experts to review, validate, and enhance our cybersecurity practices. Their independent assessments provide an external perspective on our cybersecurity posture, allowing us to leverage best practices from the industry and ensure our defenses remain robust. All third parties engaged for such processes are subjected to rigorous scrutiny to ensure they meet our security standards.


text: Oversight of Third-party Service Providers: We acknowledge the potential risks associated with our use of third-party service providers. Therefore, we have established processes to oversee and identify material cybersecurity risks that may be associated with third-party service providers with whom we engage. This includes conducting thorough, risk-based due diligence before onboarding, performing security assessments, and confirming adherence to our cybersecurity requirements. We also maintain active communication channels with these providers to stay informed about any potential security incidents or concerns.


text: Our Board of Directors oversees cybersecurity-related policy and strategy. As part of this oversight, our CISO provides a cybersecurity dashboard that is reviewed by the Board at every regularly scheduled Board meeting, which includes key performance indicators for cybersecurity process maturity, operational performance, and enterprise performance toward Transportation Security Administration (TSA) compliance. Additionally, our CIO and/or CISO presents to the Board bi-annually regarding our cybersecurity risks and strategies, including as part of our annual long-term strategy session. The Audit Committee, comprised of independent directors, reviews the implementation and effectiveness of cybersecurity risk management protocols and reviews the effectiveness of cybersecurity as part of the Company's accounting and internal control policies. As part of this oversight, our CIO presents to the Audit Committee bi-annually, as well as periodically in conjunction with any internal audits related to cybersecurity. Additionally, we have protocols by which cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, are reported to the Board, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our CIO has been in his role at Williams for over 10 years and has over 30 years of combined Information Technology experience with a broad scope of responsibility. He has provided senior leadership support of the cybersecurity and risk management programs since 2013. Our CIO holds a bachelor's degree in management information systems (MIS) from the University of Oklahoma and a Master of Business Administration in MIS from the University of Dallas.


text: Our CISO has been at Williams for over 25 years. During that time, he has held a variety of IT positions at multiple levels in the organization ranging from network engineering to application development, project management as well as several IT Manager and Director roles. He has had oversight of our cybersecurity and risk management programs since 2017. Active in government and private sector partnerships, he is currently serving as the outgoing Chair of the Oil & Natural Gas Subsector Coordinating Council and recently acted as the Chair of the Interstate Natural Gas Association of America security committee. Our CISO holds degrees in Business Administration and MIS from the University of Oklahoma and is certified in Leadership from Harvard Business School's executive education. In 2018, he obtained his Chief Information Security Officer certification from Carnegie Mellon University.


text: Management for Williams, Transco, and NWP recognizes the increasing volume and sophistication of cyber threats and takes its responsibility to protect the information and systems under its purview seriously. Management's cybersecurity processes aim to provide a comprehensive approach to assess, identify, and manage material risks arising from these cybersecurity threats.


text: Comprehensive Cybersecurity Program: Management has implemented a comprehensive cybersecurity risk management program (Cybersecurity Program) that is aligned with the National Institute for Standards and Technology Cybersecurity Framework. The Cybersecurity Program provides a risk-based approach to cybersecurity, and security controls are tailored so that cost-effective controls can be applied commensurate with the risk and sensitivity of specific information systems, control systems, and enterprise data. The Cybersecurity Program incorporates best practices and industry standards from multiple sources and is designed to comply with applicable regulations. The Cybersecurity Program includes, but is not limited to, the following elements: risk assessment, policies and procedures, contract management, training and awareness, auditing, compliance monitoring and testing, table-top exercises, and incident response.


text: Integration with Overall Risk Management: Management's cybersecurity processes have been integrated into overall risk management system and processes. Management considers cybersecurity threat risks alongside other Company risks as part of its overall risk assessment process. Cybersecurity risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.