text: We also have processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. To that end, we maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In addition, we perform diligence on our vendors and prospective vendors regarding their cybersecurity posture. We conduct and maintain a regular enterprise risk management program that is overseen by the audit committee of our board of directors, and efforts to address cybersecurity risks are an important component of our overall approach to enterprise risk management.


text: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, endpoint detection and response, logging, monitoring and alerting, anti-malware functionality, advanced email security, network security monitoring and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. All access to our platform is encrypted using industry-standard transport layer security technology. When customers enter sensitive information on our site, such as tax identification numbers, we encrypt the transmission of that information using secure socket layer technology. We also use the HSTS (HTTP strict transport security) to ensure visitors connect to the website over HTTPS which adds an additional layer of protection for our customers. For servers that store personally identifiable information, the data is encrypted. Moreover, our customers may elect to further secure their account credentials through two-factor authentication that requires them to authenticate with information provided by a second device. In order to make secure payments through our platform, we are Payment Card Industry Data Security Standard certified, which means we have demonstrated compliance with the Payment Card Industry security standards required for businesses that complete credit card or debit card transactions.

companyName: UPWORK, INC

ticker: UPWK

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: majority


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business strategy, operating results, and/or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see our risk factor disclosures in Part I, Item 1A of this Annual Report on Form 10-K titled "If we or our third-party partners experience a security breach, other hacking or phishing attack, ransomware or other malware attack, or other privacy or security incident, our work marketplace may be perceived as not being secure, our reputation may be harmed, demand for our work marketplace may be reduced, our operations may be disrupted, we may incur significant legal costs, fines, or liabilities, and our business could be adversely affected."

stage1Category: Strategy Integration

stage1Method: unanimous


text: Cybersecurity Governance While everyone at Upwork plays a part in managing cybersecurity and data privacy risks, oversight responsibility is shared by our board of directors, audit committee, and management.

stage1Category: Board Governance


text: We plan to incorporate a risk management team to collaborate closely with the IT department, consistently assessing and mitigating cybersecurity risks in alignment with our business goals and operational requirements.

companyName: ASIAFIN HOLDINGS CORP.

ticker: ASFH


text: Our board of directors, as a whole, has responsibility for risk oversight, although the committees of our board of directors oversee and review risk areas that are particularly relevant to their respective functions. Among its focus areas, our audit committee reviews matters relating to cybersecurity and data privacy and regularly reports to our board of directors regarding such matters. One member of our audit committee earned the NACD's CERT Certificate in Cybersecurity Oversight in 2023. Our audit committee receives quarterly cybersecurity-related updates from our Chief Information Security Officer, which we refer to as our CISO, including in the form of written reports and presentations. Our CISO and audit committee also provide cybersecurity-related updates to the full board of directors three times per year, including regarding recent developments, evolving standards, metrics about cyber threat response preparedness, program maturity milestones, material cybersecurity risks and risk mitigation status, and the current and emerging threat landscape. We also have implemented controls and procedures that provide for the communication of material cybersecurity incidents to our Chief Executive Officer, Chief Financial Officer, and Chief Legal Officer, as well as to our audit committee and/or to our full board of directors on a timely basis.


text: Our CISO is primarily responsible for our cybersecurity risk management program and partners with our legal team on data privacy matters at the management level. Our CISO has over 25 years of experience in various technology leadership positions across multiple industries including finance, healthcare and technology. He has held leadership positions specifically in the information security space since 2011 at four publicly traded companies. The CISO's leadership team members are all seasoned information security professionals who have worked at some of the largest well-known brand names and are experts in their fields. Our CISO monitors, and participates in, our various cybersecurity policies and procedures, and our cybersecurity team regularly updates our CISO on the current status of the cybersecurity environment, and cybersecurity incidents and actual or potential risks. Our CISO and his team provide regular updates to the management team and escalate events that require leadership's attention.

stage1Category: Management Role


text: Cybersecurity Risk Management and Strategy Our cybersecurity and data privacy risk management processes are integrated in our overall risk management program, and we have developed processes for assessing, identifying, and managing material risks from cybersecurity threats. We have adopted physical, technological, and administrative controls on data security and have a defined procedure for incident detection, containment, response, and remediation. Our information security team is primarily responsible for managing our cybersecurity processes and partners with our legal team on data privacy risk management processes. We conduct regular test exercises to ensure all relevant teams are aware of their responsibilities during a cybersecurity event or incident, and we use these exercises to promote a culture of continuous improvement. We also have implemented controls and procedures that provide for the prompt escalation of cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Our platform is designed to help ensure the security of our data and systems, protect our customers' personal information, and meet the rigorous privacy and security requirements of our Enterprise clients. To that end, we have obtained and maintain the following security and privacy certifications: ISO 27001 and 27018, SOC 2 Type 2 certification, SOC 3 certification, PCI-DSS Level 1 certification, U.S. Department of Commerce Data Privacy Framework certifications, and TRUSTe Enterprise Privacy & Data Governance Practices certification from TrustArc.


text: Our information security controls operate at multiple levels and are designed to detect, prevent, and mitigate cybersecurity threats that could impact the privacy and security of our data and our customers' data. To operate at scale, we have automated several risk mitigation strategies. We have implemented comprehensive trust and safety processes to help prevent and detect suspicious and fraudulent behavior on our platform. Over the years of developing our work marketplace, we have developed and refined specific pattern-matching algorithms to detect unusual behavior on our work marketplace, and we continue to improve such algorithms in the evolving threat landscape. We also regularly update our information security policies, standards and processes as needed to better reflect and account for updates in our cybersecurity posture, cybersecurity risks, and our risk mitigation strategies. We provide regular, mandatory training for our personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage third parties, including vendors and other external service providers, to support our cybersecurity and data privacy processes such as risk assessments, program enhancements, and value-added user verification services. These third parties provide security services, including regular reviews of our security environment to provide an independent, industry-recognized risk rating and internal audits of our technology and security controls. We have also developed a program and engaged with a bug bounty service for ongoing identification of exploitable vulnerabilities in the environment. Separately, our information security team also conducts regular scans of the environment to identify known vulnerabilities for remediation.


text: We also have processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. To that end, we maintain a risk-based approach to identify and oversee cybersecurity risks presented by third parties, including vendors and service providers, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In addition, we perform diligence on our vendors and prospective vendors regarding their cybersecurity posture. We conduct and maintain a regular enterprise risk management program that is overseen by the audit committee of our board of directors, and efforts to address cybersecurity risks are an important component of our overall approach to enterprise risk management.


text: To date, cybersecurity threats, including any previous cybersecurity incidents, have not materially affected our business strategy, operating results, and/or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see our risk factor disclosures in Part I, Item 1A of this Annual Report on Form 10-K titled "If we or our third-party partners experience a security breach, other hacking or phishing attack, ransomware or other malware attack, or other privacy or security incident, our work marketplace may be perceived as not being secure, our reputation may be harmed, demand for our work marketplace may be reduced, our operations may be disrupted, we may incur significant legal costs, fines, or liabilities, and our business could be adversely affected."


text: Our board of directors, as a whole, has responsibility for risk oversight, although the committees of our board of directors oversee and review risk areas that are particularly relevant to their respective functions. Among its focus areas, our audit committee reviews matters relating to cybersecurity and data privacy and regularly reports to our board of directors regarding such matters. One member of our audit committee earned the NACD's CERT Certificate in Cybersecurity Oversight in 2023. Our audit committee receives quarterly cybersecurity-related updates from our Chief Information Security Officer, who we refer to as our CISO, including in the form of written reports and presentations. Our CISO and audit committee also provide cybersecurity-related updates to the full board of directors three times per year, including regarding recent developments, evolving standards, metrics about cyber threat response preparedness, program maturity milestones, material cybersecurity risks and risk mitigation status, and the current and emerging threat landscape. We also have implemented controls and procedures that provide for the communication of material cybersecurity incidents to our Chief Executive Officer, Chief Financial Officer, and Chief Legal Officer, as well as to our audit committee and/or to our full board of directors on a timely basis.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Tesla, Inc.

ticker: TSLA


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, operate a bug bounty program to encourage proactive vulnerability reporting, conduct employee training, monitor emerging laws and regulations related to data protection and information security (including our consumer products) and implement appropriate changes.


text: Our technology and management teams meet regularly with key internal and external stakeholders to review cybersecurity concerns and areas for continued focus and improvement.

companyName: Sanara MedTech Inc.

ticker: SMTI


text: We have implemented incident response and breach management processes which have four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) detection and analysis of a security incident, 3) containment, eradication and recovery, and 4) post-incident analysis. Such incident responses are overseen by leaders from our Information Security, Product Security, Compliance and Legal teams regarding matters of cybersecurity.


text: Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.


text: We also conduct tabletop exercises to simulate responses to cybersecurity incidents. Our team of cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation and remediation strategies.


text: As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. As of 2023, our Information Security Management System has been certified to conform to the requirements of ISO/IEC 27001:2013.


text: Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers and potential fourth-party risks when handling and/or processing our employee, business or customer data. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Our information technology systems or data, or those of our service providers or customers or users could be subject to cyber-attacks or other security incidents, which could result in data breaches, intellectual property theft, claims, litigation, regulatory investigations, significant liability, reputational damage and other adverse consequences" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

stage1Category: None/Other


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from senior management, including leaders from our Information Security, Product Security, Compliance and Legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our Information Security, Product Security, Compliance and Legal teams. Such individuals have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: Risk Management and Strategy The secure processing, maintenance and transmission of sensitive data, including confidential and other proprietary information about our business and our employees, customers, suppliers and business partners, is important to our operations and business strategy. As a result, cybersecurity and data protection are key components of our long-term strategy.

companyName: ON SEMICONDUCTOR CORP

ticker: ON


text: We use various processes to inform our assessment, identification and management of risk from cybersecurity threats. Key areas of our cybersecurity risk management processes and strategy currently include: • Cross-Functional Collaboration and Coordination. Our Enterprise Cybersecurity Services ("ECS") team, led by our Chief Information Security Officer ("CISO"), has first line responsibility for our cybersecurity risk management processes. However, the ECS team works in partnership with other internal teams to coordinate efforts, priorities and oversight. These include: our Cybersecurity Executive Council (the "Council"), which is composed of key leaders from stakeholder groups throughout the Company, including the CISO and certain members of senior management;


text: our Enterprise Risk Management ("ERM") team, which is responsible for evaluating and assessing overall enterprise risk, including cybersecurity risk, and advising senior management and the Board regarding our overall risk profile and priorities as they evolve;


text: our Internal Audit Department ("IAD"), which monitors certain IT systems controls that are integrated into our larger Sarbanes-Oxley control environment; and our Cyber Incident Response Team ("CIRT"), a cross-functional team of subject matter experts from across the Company and certain third-party support providers that we have on retainer.


text: • Ongoing Evaluation and Assessment of Systems and Processes. We update our information security management system from time to time as appropriate and we employ standards and frameworks as we deem necessary to assist us in monitoring compliance with regulatory, industry and evolving data privacy requirements. In addition to periodic in-depth evaluations of our systems and processes, we monitor our IT systems and processes on an ongoing basis with the goal of identifying and remediating real and potential threats as they arise. We adjust our systems, procedures and policies regularly as we deem necessary in response to identified threats and risks. • Security Awareness Program to Train and Test Personnel. We sponsor a multi-faceted security awareness program that includes regular, mandatory trainings for our personnel on data protection and malware detection, policy and process awareness, periodic phishing simulations and other kinds of preparedness testing. • Cyber Incident Response Plan. We maintain a cross-functional cyber incident response plan with defined roles, responsibilities and reporting protocols. This plan, which we evaluate and test on a regular basis, focuses on responding to and recovering from any significant breach as well as mitigating any impact to our business. Generally, when a breach or suspected breach is identified, the ECS team would escalate the issue to the Council for initial analysis and guidance. In the event of a significant breach, the CIRT, overseen by the Council, would typically be tasked with preparing an initial response. The Council (in consultation with, among others, the CIRT) would be responsible for determining whether a particular incident (alone or in combination with other factors) triggers any reporting or notification responsibilities. • Regular Evaluation of Initiatives, Results and Priorities. The ECS team, in consultation with the Council and other members of senior management, updates its strategy at least annually to account for changes in our business strategy, legal and regulatory developments across our geographic footprint, the results of our recent ECS initiatives, and further developments in the cybersecurity threat landscape. In addition, we periodically engage a third-party provider to conduct an external assessment of our security program. The results of this assessment, which are reported to the Audit Committee (and the Board, as appropriate), assist us in determining whether any further changes to our existing policies and practices are warranted.


text: We expect that our cybersecurity risk management processes and strategy will continue to evolve as the cybersecurity threat landscape evolves.


text: As indicated above, we engage third-party providers to assist us with our cybersecurity risk management and strategy. Some of these providers provide us with ongoing assistance (such as threat monitoring, mitigation strategies, updates on emerging trends and developments and policy guidance) while we engage others to provide targeted assistance (such as security and forensic expertise) as needed. Prior to exchanging any sensitive data or integrating with any key third-party provider, we assess their security fitness against our risk posture and request changes as we deem necessary.

stage1Category: Third-Party Risk


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected the Company, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the heading, "Trends, Risks and Uncertainties Related to Technology and Data Privacy" in this Form 10-K.


text: Consistent with our overall risk management governance structure, management is responsible for the day-to-day management of cybersecurity risk while our Board and its Audit Committee play an active, ongoing oversight role.


text: Board Oversight. Our Board has delegated to its Audit Committee specific, first-line responsibility for overseeing major cybersecurity risk exposures in addition to our broader ERM program. Specifically, under its charter, the Audit Committee is responsible for overseeing our cybersecurity posture, risk assessment, strategy and mitigation and for making recommendations to address and resolve any breaches or issues related to the protection or privacy of our data. Management (including our Chief Information Officer ("CIO") and our CISO) reports at least quarterly to the Audit Committee on information security and data privacy and protection. These presentations address a wide range of topics, including trends in cyber threats and the status of initiatives intended to bolster our security systems and the cyber readiness of our personnel. The Audit Committee chair reports to the full Board on these risk discussions as appropriate. At least annually, the Board meets with members of our ERM team to review and discuss our ERM program, including areas of material risk and how these risks, which may include cybersecurity risk, are being managed and reported to the Board and its committees.


text: Management's Role. Our ECS team is composed of several support teams that address and respond to cyber risk, including cyber risks related to security architecture and engineering, identity and access management and security operations. Formerly known as our Information Security and Risk ("ISR") team, the ECS team oversees compliance with our cybersecurity framework within the organization and facilitates cybersecurity risk management activities throughout the organization. The ECS team also assists with the review and approval of policies, completes benchmarking against applicable standards, maintains a cyber risk registrar and oversees the security awareness program.


text: Our ECS team is led by our CISO. Our CISO reports to our CIO who, in turn, reports to our Executive Vice President and Chief Financial Officer. Our CISO has 24 years of experience in leading global security functions and strategies. Collectively, the other members of our ECS team have decades of relevant education and experience and maintain a wide range of industry certifications. We invest in regular, ongoing cybersecurity training for our ECS team.


text: Our BISO, CRO/CISO, and Head of Internal Audit have nearly seven decades of combined work experience, including six decades in banking and financial services risk management and information security roles, and all maintain several industry licenses and certifications through continuing professional education.

companyName: Capital Bancorp Inc

ticker: CBNK


text: As noted previously, our CISO is a member of the Council, which meets at least quarterly to provide operational direction to the ECS team considering the evolving risk landscape. The ECS team and the Council, through ongoing communication, monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The CISO, in consultation with the Council and other members of senior management, reports such threats and incidents to the Audit Committee, as appropriate. These reports may be included in, or in addition to, his regular quarterly reports to the Audit Committee.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, sensitive financial information and personal identifiable information ("Information Systems and Data").

companyName: VARONIS SYSTEMS INC

ticker: VRNS


text: The Chief Information Security Officer ("CISO") and the information security team that reports to the CISO help identify, assess and manage our cybersecurity and privacy threats and risks, including through the use of our external and internal risk assessments. The CISO and the information security team identify and assess risks from cybersecurity threats by monitoring and evaluating our networks, data and our risk profile using various methods including, among other things, manual tools, automated tools, analyzing reports of threats and actors, conducting scans of the computer networks, internal and/or external audits (including compliance audits with respect to ISO (27001, 27017, 27018, and 27701) for our corporate and cloud based software solutions and SOC 2, PCI DSS and HIPAA with respect to our cloud based software solutions), conducting assessments for potential internal and external threats, third-party-conducted risk assessments, conducting vulnerability assessments, third-party-conducted red/blue team testing and tabletop incident response exercises and subscribing to reports and services providing cybersecurity threat intelligence.


text: Depending on the environment, we implement and maintain various technical, physical and administrative processes, measures, standards and policies designed to manage and mitigate risks from cybersecurity threats to our Information Systems and Data, including, among other things, incident detection and response plan and procedures, a vulnerability management policy, disaster recovery/business continuity plans, risk assessments, cryptography, network security controls, secured remote access, access controls, change management, physical security, asset management, secured software development lifecycle, logging and monitoring, third-party risk management programs, security awareness trainings, third-party- and company penetration testing, cybersecurity insurance and dedicated cybersecurity staff. We use our own software to help further mitigate the risk of a material cybersecurity incident. In addition, our Varonis Data Security Platform is deployed internally as part of our insider threat, data security posture, security operations and compliance management programs.


text: Our assessment and management of material risks from cybersecurity and privacy threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk register. In addition, the information security team works with management to prioritize our risks that are more likely to have a material impact on our business and our CISO evaluates material risks from cybersecurity threats against our overall business objectives and reports to the technology committee of the board of directors (the "technology committee") and the board of directors. In addition, the audit committee of the board of directors (the "audit committee") oversees our overall enterprise risk management program and receives semi-annual updates on cybersecurity and privacy threat-related risks as part of such program.


text: We use third-party service providers to assist us from time to time to identify, assess and manage material risks from cybersecurity threats, including, among other things. cybersecurity consultants, cybersecurity software providers, penetration testing firms and other professional services firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as SaaS providers and cloud hosting companies. We have a vendor management program designed to manage cybersecurity and privacy risks associated with our use of these providers. The program includes risk assessments for vendors security questionnaires, review of the vendor's written security program, review of security assessments and reports, audits, and vulnerability scans related to the vendor and imposition of information contractual obligations on the vendor. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity and privacy on the provider.


text: For a description of the risks from cybersecurity threats that may have a material affect on us, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Security breaches, cyberattacks or other cyber-risks of our IT and production systems could expose us to significant liability and cause our business and reputation to suffer and harm our competitive position."


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: P3 Health Partners Inc.

ticker: PIII


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The technology committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The technology committee meets quarterly with members of management, including our CISO, Chief Information Officer ("CIO"), Chief Technology Officer or Senior Vice President of Engineering, as applicable, to discuss cybersecurity developments, significant cybersecurity threats and risks and the processes we have implemented to address them. The audit committee also receives presentations related to cybersecurity threats, risk and mitigation on a semi-annual basis unless more frequent discussions are necessary. The board of directors also receives a presentation from our CISO or CIO on our cybersecurity measures and risks at least annually.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our CISO. Guy Shamilov, our CISO for the last seven years, has been a chief information security officer for eight years and is certified by Certified Information Systems Security Professional (CISSP), among other technical certifications he holds with respect to cybersecurity. He has worked over the last twenty years in the security industry, and prior to working with us, he was CISO of Tata Consultancy Services, Deputy Chief Information Security Officer of Traiana, Information Security Manager of Logic Industries, Senior Information Security Specialist of Migdal Group and Information Security and System Administrator at Matrix. Our CISO oversees the implementation and compliance of our information security standards and mitigation of information security related risks.


text: Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel. Our CISO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Security Management, the Chief Executive Officer, the Chief Financial Officer, the General Counsel, the CIO and other senior members of the Company. Such individuals work with our incident response team to help us assess, mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response plan includes reporting to the technology committee of the board of directors for certain cybersecurity incidents.


text: Our information security program is managed by a dedicated Chief Information Security Officer ("CISO"), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes, including assessing and managing our material risks from cybersecurity threats. The CISO is a Certified Information Systems Security Professional ("CISSP"), and has over 20 years of experience holding various roles in information technology and cybersecurity. The Audit Committee of our Board of Directors is charged with oversight of cybersecurity matters, including oversight of risks from cybersecurity threats.

companyName: Reynolds Consumer Products Inc.

ticker: REYN


text: The CISO provides quarterly reports to the Audit Committee, as well as more frequent reports to our Chief Executive Officer and other members of our senior management. These reports include updates on our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of our information security program, and the emerging threat landscape. Our cybersecurity program is regularly evaluated by internal and external experts, with the results of those reviews reported to senior management and the Audit Committee. We also actively engage with key vendors, industry participants and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: Risk Management and Strategy We have a comprehensive cybersecurity and information security framework that includes risk assessment and mitigation through a threat intelligence-driven approach, application controls and enhanced security with ransomware defense. The framework leverages International Organization for Standardization 27001/27002 standards for general information technology controls, the National Institute of Standards and Technology Cyber Security Framework for measuring overall readiness to respond to cyber threats, and Sarbanes-Oxley Act for assessment in internal controls. Our cybersecurity processes are integrated into our overall risk management system, and include a comprehensive cyber crisis management program that would apply if a cybersecurity related incident were to occur.


text: We perform simulations, tabletop exercises and response readiness tests on an annual basis. In addition, we engage external consultants to perform penetration testing at least annually. Our cyber crisis management program includes a documented plan that provides guidance to address the overall coordination of our response to a cyber crisis and plan for resources, actions and decisions we may need to be prepared for; a cyber crisis communication plan for timely and accurate dissemination of evolving information to stakeholders during the crisis, including the timeline, approval process and monitoring of messaging; and business continuity plans that document the application of specific strategies and measures to enable core business activities to continue during a cyber event. The ongoing development and maturity of our cyber crisis management program is reported to senior management quarterly. Tabletop testing of the various plans occur annually with quarterly preparedness exercises.


text: With respect to third-party service providers, we perform information security assessments and due diligence reviews prior to entering into a contractual agreement. We also perform periodic due diligence reviews for existing third-party service providers based on the risks identified in the initial review, or if events and circumstances necessitate a review.


text: Refer to "A cyber-attack or failure of one or more key information technology systems, operational technology systems, networks, processes, associated sites or service providers could have a material adverse impact on our business and reputation" in Item 1A. "Risk Factors" for information regarding material risks from cybersecurity threats that affect us.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: Vanda Pharmaceuticals Inc.

ticker: VNDA


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process, appropriate personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity and potential mitigations.


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. As part of this process, and our processes to provide for the availability of critical data and systems, maintain regulatory compliance, identify and manage our risks from cybersecurity threats and to protect against, detect and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities, among others: • comparing our processes to benchmark standards, such as those set by the National Institute of Standards and Technology (NIST); • closely monitor emerging data protection laws and implement changes to our processes designed to comply; • conduct annual customer data handling and use requirements training for employees; • conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • through policy, practice and contract (as applicable) require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • conduct regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K; • leverage the NIST incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: As part of the above processes, we may engage with assessors, consultants, auditors, and other third-parties, including by having a third-party review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain, our CROs or those who have access to our customer and employee data or our systems. Third-party risks are included within our broader overall risk assessment process, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third-parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the risk factors entitled "We are increasingly dependent on information technology systems, infrastructure and data. Cybersecurity breaches could expose us to liability, damage our reputation, compromise our confidential information or otherwise adversely affect our business," and "Our internal computer systems, or those of our collaborators, CROs or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of development programs for our product candidates," in Part I, Item 1A of this Annual Report on Form 10-K, each of which is incorporated herein by reference.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management.


text: Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like risk management, business continuity planning, brand management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by a team of senior level management, including our President, Chief Executive Officer and Chairman of the Board, Senior Vice President, Chief Financial Officer and Treasurer, Senior Vice President, General Counsel and Secretary, and VP of Information Technology. Such individuals collectively have significant prior work experience in various roles involving managing information security, developing cybersecurity strategy and implementing effective information and cybersecurity programs.


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: As discussed above, these members of management report to the Audit Committee about cybersecurity threat risks, among other cybersecurity related matters.


text: Risk Management and Strategy Hubbell recognizes the importance of maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Cybersecurity related risks are included in the risk universe that our enterprise risk management program evaluates to assess top risks to the enterprise on an annual basis. To the extent the enterprise risk management process identifies a heightened cybersecurity-related risk, risk owners are assigned to develop mitigation plans, which are then tracked to completion. Cybersecurity related risks are also considered as part of our business continuity and resiliency planning. Business continuity plans establish risk management processes and procedures to mitigate interruptions to business activities, including from cybersecurity incidents.

companyName: HUBBELL INC

ticker: HUBB


text: Given the complexity and evolving nature of the cybersecurity threat landscape, Hubbell has a dedicated team of internal and external cybersecurity professionals led by Hubbell's Chief Information Security Officer ("CISO") that regularly monitor alerts and meet to discuss threat levels, trends, and remediation. We engage a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our cybersecurity program. The engagement of third parties includes regular audits, threat assessments, and information system penetration tests. We also actively engage with key vendors, industry participants, legal counsel, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity policies and procedures. Hubbell further recognizes risks associated with the use of third-party service providers and has processes to identify material risks related to third parties. We conduct security assessments of third-party providers prior to their engagement and perform ongoing monitoring to ensure compliance with our cybersecurity standards. Our monitoring includes periodic assessments by the CISO and a team of cybersecurity professionals. Our cybersecurity risk management program is aligned to the National Institute of Standards and Technology Cyber Security Framework (NIST CSF).


text: We have not encountered any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect our business strategy, results of operations or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item IA. Risk Factors for potential risks related to our information technology systems that we are subject to and that may materially adversely affect our business ("We are subject to risks surrounding our information technology systems failures, network disruptions, breaches in data security and compliance with data privacy laws or regulations.").


text: Hubbell's Board of Directors (the "Board") recognizes the critical nature of managing risks associated with cybersecurity threats. The Audit Committee of the Board has been delegated oversight of risks associated with cybersecurity threats and has developed mechanisms to ensure effective oversight in managing such cybersecurity risks. The Audit Committee is composed of Board members with diverse expertise, including cybersecurity and technology, financial, and risk management experience.


text: The Board, in coordination with the Audit Committee, oversees the Company's enterprise risk management process, including the management of material risks arising from cybersecurity threats. The Audit Committee regularly receives updates from management and third-party cybersecurity experts about major cybersecurity risks, their potential impact on our business operations, and management's processes to identify, monitor, and mitigate such risks, including, as relevant, the results of assessments or audits of our processes. The Audit Committee periodically provides updates on these matters to the Board of Directors.

companyName: HEALTHPEAK PROPERTIES, INC.

ticker: DOC


text: Hubbell's cybersecurity program is managed by a dedicated CISO who has over a decade of information technology and program management experience. The CISO is responsible for leading our enterprise-wide cybersecurity program and assessing, monitoring, and managing our cybersecurity risks. These responsibilities include overseeing cybersecurity governance programs, testing our compliance with standards, remediating known risks, completing cybersecurity risk management activities related to acquisition due diligence and integration, and leading our employee cybersecurity training program. The CISO stays current with the latest developments in cybersecurity and the evolving threat landscape to inform cybersecurity prevention, detection, mitigation, and remediation efforts. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes processes to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a detailed incident response plan which outlines the steps to be followed from incident detection to mitigation, notifications, and recovery. Notifications include functional areas (including legal), senior management and the Board, as applicable. We have adopted and enforce various enterprise-wide policies relating to cybersecurity, to ensure the ongoing protection of our systems including, policies to identify, classify, and protect company data, manage vulnerabilities, and perform user access reviews. We further conduct drills of our incident response plan to prepare incident response teams and provide cybersecurity training and phishing simulations throughout the year via our enterprise learning management systems.


text: The CISO provides regular (but not less than quarterly) updates to the Audit Committee. These updates include a broad range of topics, including the current cybersecurity and emerging threat landscape, the status of ongoing cybersecurity initiatives and strategies, incident reports, and the results of internal and external assessments of our information systems. The CISO, in his capacity, regularly informs our Chairman, President and Chief Executive Officer; EVP, Chief Financial Officer; and SVP, General Counsel and Secretary on aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management, including the Company's Disclosure Committee, are made aware of Hubbell's cybersecurity posture and potential cybersecurity risks. Furthermore, any material cybersecurity matters, and strategic cybersecurity risk management matters are promptly escalated to the Audit Committee of the Board.


text: Cybersecurity Risk Management and Strategy We have implemented several cybersecurity processes and controls to aid in our efforts to assess, identify, and manage material risks from cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. We have engaged a third-party cybersecurity firm who serves as our dedicated information technology (IT) and cybersecurity team and helps us oversee, implement and manage these processes and controls.

companyName: CareTrust REIT, Inc.

ticker: CTRE


text: To identify and assess material risks from cybersecurity threats, we consider cybersecurity threat risks individually and alongside other company risks as part of our overall risk assessment process. Management determines and prioritizes appropriate risk responses for each identified enterprise risk. In doing so, management coordinates with relevant subject matter specialists as appropriate for each relevant risk area, including our third-party IT and cybersecurity team with respect to information technology and security risks.


text: Management is accountable for our day to day risk management activities. With the assistance of our third-party IT and cybersecurity team, we employ a range of tools and services, including a governance, risk and compliance platform to inform our managements' risk identification and assessment relating to our technology program. With this platform, we map our cybersecurity and risk management program to the Center for Internet Security ("CIS") framework.


text: Processes and controls we have implemented with the assistance of our third-party IT and cybersecurity team to assess, identify, manage and protect against material risks from cybersecurity threats include the following: • perform 24/7 security monitoring through an automated detection software managed by our third party cybersecurity firm; • conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • conduct regular phishing email training for all employees with access to corporate email and other systems to enhance awareness and responsiveness to such possible threats; • leverage the CIS Controls incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident.


text: At least annually, our third-party IT and cybersecurity firm conducts a cybersecurity risk assessment. We periodically review reporting on these risks and our cybersecurity threats, the status of our security infrastructure, our risk management activities and the status of, and our responses to, any cybersecurity incidents.


text: We use a range of defenses to help protect against cybersecurity threats and to work to secure our assets, reduce detection time and improve recoverability, such as the ongoing monitoring of our systems, including with the assistance of third party vendors, conducting routine exercises with employees and senior management, including our executive officers, to promote awareness and improve internal processes, and engaging with proxy advisors and external cybersecurity rating agencies that assess our cyber risk to improve our internal evaluations and vulnerability management processes. In addition, to help promote privacy and security awareness throughout the company, all employees with a valid Baxter email address receive annual training and access to virtual events and updated materials. Further, our Third-Party Risk Management Program includes assessment and monitoring of security standards and control procedures for external suppliers and vendors, with enhanced engagement or internal controls depending on the results of the assessment.

companyName: BAXTER INTERNATIONAL INC

ticker: BAX


text: Through our incident response policy, we have designated an incident response team composed of representatives of management and other employees as well as representatives from our outsourced cybersecurity firm that has responsibility for overseeing cybersecurity incidents. Led by management, our third-party IT and cybersecurity team is responsible for the day-to-day investigation of and response to potential information security-related incidents. Pursuant to our incident response policy, incidents meeting specified severity levels are required to be escalated to the incident response team for review and response. The goal of the policy is to prevent, detect and react to information security incidents, determine their scope and risk, respond appropriately to the incident, communicate the results and risk to relevant stakeholders, and reduce the likelihood of the incident from reoccurring. Pursuant to our incident response policy, if we are notified of a cybersecurity incident impacting a third-party service provider that affects our information systems or data, we will respond on the same basis as any other incident. We are implementing a business use case review process and vendor risk assessment for all third-party service providers that will access or implicate our materially significant technology or data. If we deem the cybersecurity risk of a particular service provider too great, such service provider will not be approved or access will be terminated.


text: Based on information known to us, we also do not believe any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We can give no assurance that we have detected or protected against all cybersecurity threats or incidents. Please refer to "Cybersecurity incidents or other damage to the information systems and technology of us or our tenants could harm our business" and "If we or our tenants fail to adhere to applicable privacy and data security laws, this could have a material adverse effect on us or on our tenants' ability to meet their obligations to us" included "Item 1A, Risk Factors" of this Annual Report on Form 10-K for additional information about material risks related to cybersecurity threats.


text: Cybersecurity Governance As described above, we have engaged a third-party IT and cybersecurity firm to whom we have outsourced primary responsibility to oversee, implement and manage our processes and controls to assess, identify, and manage material risks from cybersecurity threats. Members of this dedicated third-party IT and cybersecurity team include a virtual chief information security officer (vCISO) who is responsible for the overall development and implementation of our cybersecurity strategy and responses as well as individuals having the position of cybersecurity analyst, cybersecurity engineer, and director of information security. Our management, including our Chief Executive Officer, oversees the work of our third-party IT and cybersecurity team and regularly communicates with members of the team. Through the policies and controls described above, including our incident response policy, representatives of the third-party IT and cybersecurity team as well as members of our management, including our Chief Executive Officer, are informed about cybersecurity threats and incidents affecting our information systems and direct our efforts to prevent, detect, mitigate and remediate cybersecurity threats and incidents. The representatives of our third-party IT and cybersecurity team who lead our cybersecurity risk management and risk assessment process have collectively over 30 years of prior work experience in various roles managing information systems, developing cybersecurity strategy, implementing information security and cybersecurity programs, identifying and assessing cybersecurity risks and establishing incident response plans. The members of the cybersecurity team hold degrees in computer engineering and cybersecurity as well as advanced cybersecurity certifications, including a Certified Information Systems Security Professional (CISSP) certification, a Certified Information Systems Auditor (CISA) credential and a Certified Information Security Manager (CISM) certification. Other members of our third-party cybersecurity team have also obtained various professional certifications and advanced training in the areas of information security and cybersecurity.


text: Our audit committee is responsible for overseeing our overall risk assessment and risk management program as well as our policies and practices related to our information technology systems, information security and cybersecurity risks. The audit committee reviews at least annually our enterprise risks and related risk management program. In addition, on a quarterly basis, the audit committee receives a report from management on our cybersecurity threat risk management and strategic processes covering topics such as cybersecurity incidents and any remedial actions, if needed, data security posture, the results of third-party risk assessments as well as our cybersecurity risk management processes and strategies. Outside of quarterly presentations, the chair of the audit committee would be notified following any cybersecurity incident meeting specified severity levels, and the audit committee would also be expected to review management's materiality assessment regarding any cybersecurity incident requiring disclosure to the Securities and Exchange Commission. Through their participation in meetings of the audit committee, other members of the Board are also kept apprised of material risks from cybersecurity threats and our related risk management activities.


text: We assess, identify and manage risks from cybersecurity threats through our Global Cybersecurity and Compliance Program (Cybersecurity Program), which is part of our larger enterprise risk management framework. The Cybersecurity Program is currently overseen by the Audit Committee and Quality, Compliance and Technology Committee (QCT Committee) of the Board of Directors and is managed by a dedicated Chief Information Security Officer (CISO), whose organization has oversight of cybersecurity strategy, policy, standards, architecture and processes for the security of our enterprise network, information assets and medical device technologies. Our current CISO has over 20 years of experience in cybersecurity and has held numerous positions in the cybersecurity sector, including serving as Global Cyber Risk Officer at another Fortune 500 medical products and equipment company and CISO at another healthcare company. The CISO's organization monitors and manages, and works to identify and assess, cybersecurity risk through various technologies, resources, processes and policies that are regularly updated to align with the changing threat landscape, our evolving business needs as well as global regulatory requirements. In addition, from time to time, we also utilize external auditors and assessors to help evaluate our Cybersecurity Program, including our control measures, and to assist in conducting risk and maturity assessments. We also actively engage with industry experts, regulatory agencies, advocacy groups, intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our Cybersecurity Program.


text: Management Responsibilities Our cybersecurity program is managed by our Information Security Officer (ISO). Our ISO has over five years of cybersecurity experience working in publicly traded companies, with expertise leading risk remediation efforts in vulnerability management, network security, security awareness, threat monitoring, data security and cloud security.

companyName: LOUISIANA-PACIFIC CORP

ticker: LPX


text: The Cybersecurity Program maintains a cybersecurity governance and oversight framework that seeks to drive accountability for all levels of employees, including senior management and executive officers. Cybersecurity matters are generally managed by a combination of working groups led by senior management that report to the cybersecurity steering committee or cybersecurity executive oversight committee, as appropriate, on matters such as, among other things, enterprise level cybersecurity initiatives and directives, threat intelligence and product cybersecurity risks and remediations. Our cross functional cybersecurity steering committee, which is led by the CISO, is composed of members of senior management, including the Chief Information Officer, and reviews matters such as product security escalations, critical remediations and disclosure recommendations. The output from the steering committee meetings is discussed at meetings of Baxter's cybersecurity executive oversight committee, which is led by the CISO and includes the Chief Executive Officer, Chief Financial Officer, General Counsel, Chief Compliance & Trust Officer and our business segment presidents. The cybersecurity executive oversight committee meets quarterly, oversees enterprise and cybersecurity risk management and reports to the Audit Committee and QCT Committee of the Board. The Audit Committee currently oversees our information technology functions generally, including non-product-related cybersecurity matters, and the QCT Committee oversees product or service-based information technology matters, including with respect to product cybersecurity matters. The Audit Committee is also responsible for the oversight of any cybersecurity incident, including ones related to our products and services. Both committees receive updates from management on cybersecurity-related topics within their purview throughout the year. Additionally, the full Board generally receives periodic updates on information technology and cybersecurity matters from management and external advisors.


text: The CISO maintains and annually updates a Cybersecurity Incident Response Plan which is a guide for our Cyber Security Incident Response Team to respond effectively and efficiently to cybersecurity incidents in a coordinated manner in the interest of minimizing the risk of harm to our patients, customers, operations, partners, employees and third parties, consistent with our legal obligations. Cybersecurity risks and threats, including as a result of any previous cybersecurity incidents, have not materially impacted and are not reasonably expected to materially impact us or our operations to date. However, we recognize the ever-evolving cyber risk landscape and cannot provide any assurances that we will not be subject to a material cybersecurity incident in the future. See Item 1A. Risk Factors "Breaches and breakdowns affecting our information technology systems or protected information, including from cyber security breaches and data leakage, could have a material adverse effect on our business, results of operations, financial condition, cash flows, reputation and competitive position" for a discussion of cybersecurity-related risks.


text: Cybersecurity Risk Management and Strategy In our business operations, we use information technology, enterprise applications, communications tools, cloud network solutions, and related systems to manage our operations, including to manage our building systems, tenant and vendor relationships, accounting and recordkeeping, and communications, among other aspects of our business.


text: We have developed and implemented a cybersecurity risk management program intended to protect our properties, confidential and proprietary data, and information technology and systems, from cybersecurity threats, including unauthorized access or attack. We leverage the National Institute of Standards and Technology ("NIST") Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to the business. This does not imply that we meet any particular technical standards, specifications, or requirements.


text: Our processes for assessing, identifying, and managing risks from cybersecurity threats, including operational risks, financial reporting risks, reputational risks, personal data theft, fraud, and other potential risks, are integrated into our overall enterprise risk management process, and share common methodologies, reporting channels, and governance processes that apply across the enterprise risk management process to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes the following: • a multidisciplinary team comprised of personnel from information technology ("IT"), internal audit, accounting, and legal, as well as third-party cybersecurity experts principally responsible for directing (i) our cybersecurity risk assessment processes, (ii) our security processes, and (iii) our response to cybersecurity incidents; • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • internal and third-party security tools to monitor our systems, identify cybersecurity risks, and test our IT environment; • the use of third-party cybersecurity experts, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • a cybersecurity incident response plan and business continuity plan; • cybersecurity training for employees and key business partners with access to our systems; • a third-party cybersecurity risk management process for service providers and vendors who access our systems; • requiring employees, as well as third parties who have access to our systems, to treat confidential and private information and data with care, including performing controls relating to such data; and • cybersecurity risk insurance. We also seek to engage reputable service providers that maintain cybersecurity programs or controls.


text: We have not identified risks from known cybersecurity threats within the prior fiscal year, including as a result of any prior cybersecurity incident, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Please refer to "Item 1A, Risk Factors" in this report for additional information about certain ongoing risks related to our information technology that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Cybersecurity is an important part of our overall risk management processes and an area of focus for our Board of Directors and management.


text: CFO is responsible for the day-to-day oversight of cybersecurity risks, and who utilizes the Coalition management platform for such risk management. Our CFO keeps the Board apprised of ongoing cybersecurity risk mitigation and any breaches if presented.

companyName: MIRA PHARMACEUTICALS, INC.

ticker: MIRA


text: Our enterprise risk team consists of cross-functional professionals who collaborate with subject matter specialists, as necessary, including an independent third-party expert we have retained to functionally serve as a virtual chief information security officer ("CISO"), to identify and assess material risks from cybersecurity threats, their severity, and potential mitigation steps. The CISO is primarily responsible for leading our cybersecurity risk assessment and management processes. This expert has experience having served as the chief information security officer for an international commercial real estate services company and currently serves as chief executive officer of a cybersecurity firm focused on commercial real estate. He is supported by an internal cross-functional management team of IT and internal audit personnel who regularly review and assess cybersecurity initiatives, including our incident response plan, as well as cybersecurity compliance, training and risk management efforts.


text: Risk Management and Strategy We manage risks from cybersecurity threats through our overall enterprise risk management process, which is overseen by our Board. Management has created a global information security program, which encompasses a dedicated global information security team and policies, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats. Marriott's policies, procedures, and processes follow recognized frameworks established by the National Institute of Standards and Technology ("NIST") and the International Organization for Standardization, as well as other relevant standards. Our program is designed to maintain the confidentiality, integrity, security, and availability of the data that is created, collected, stored, and used to operate our business.

companyName: MARRIOTT INTERNATIONAL INC /MD/

ticker: MAR


text: We assess, identify, and manage risks from cybersecurity threats through various mechanisms, which from time to time may include tabletop exercises, business unit assessments, control gap analyses, threat modeling, impact analyses, internal audits, external audits, vulnerability scans, penetration tests, and engagement of third parties to conduct analyses of our information security program. We obtain cybersecurity threat intelligence from recognized forums, third parties, and other sources as part of our risk assessment process. We also maintain a risk-based approach for assessing, identifying, and managing risks from cybersecurity threats associated with third party service providers, owners, franchisees, and other companies with whom we do business.


text: With respect to incident response, we maintain a Global Information Security & Privacy Incident Response Plan ("IRP"), which applies globally to information security incidents involving properties owned, leased, or managed by Marriott, as well as our above-property business locations. Franchisees are responsible for information security at franchised properties and the systems and business processes related to information security that are under their direction and control. Franchisees are required to comply with brand standards relating to information security, which include an obligation to report information security incidents to us.


text: Our IRP sets out a coordinated, multi-functional approach for investigating, containing, and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process follows the NIST framework and focuses on four phases: (i) preparation; (ii) detection and analysis; (iii) containment, eradication, and recovery; and (iv) post-incident remediation.


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our overall business strategy, results of operations, or financial condition over the long term. See the discussion about the Starwood Data Security Incident under the "Litigation, Claims, and Government Investigations" caption in Note 7 of our financial statements, the discussion of the same in Part II, Item 7, "Management's Discussion and Analysis of Financial Condition and Results of Operations," and the discussion of cybersecurity risk in Part I, Item 1A, "Risk Factors."


text: Our Board has established a Technology and Information Security Oversight Committee ("TISOC") to assist the Board in providing oversight of matters pertaining to technology, information security, and privacy, including risks from cybersecurity threats; management's efforts to monitor and mitigate those risks; and significant cybersecurity incidents. The TISOC meets at least four times a year and typically receives quarterly reports from our Chief Information Security Officer ("CISO") and other members of management. Risks from cybersecurity threats are also discussed with the full Board as part of regular legal updates and management presentations, the Board's oversight of enterprise risk management, and periodic education sessions. The Board's Audit Committee also receives reports regarding information security and technology-related audits conducted by our internal audit department.


text: To establish, implement, and evaluate our risk management policies and practices with respect to cybersecurity threats, and to facilitate the communication of such matters to the Board and to the TISOC, we have established a number of management committees, several of which include senior leaders and direct reports of the Company's President and CEO, that serve as our policymaking and management-level governing bodies with respect to our information security and data privacy programs; oversee the implementation of our information security and data privacy risk management strategy; and identify, consider, and escalate information security and data privacy issues that may arise in our business.


text: Our global information security team led by our CISO works in coordination with these management committees and other cross-functional teams and is principally responsible for overseeing our information security strategy, working collaboratively with business leaders across the organization to assess, identify, and manage risks from cybersecurity threats, and to address cybersecurity incidents when they arise. Our global information security program is operated on a 24/7 basis to address risks from cybersecurity threats and to respond to cybersecurity incidents globally.


text: Our CISO and other members of senior management responsible for our information security program have extensive experience assessing and managing risks from cybersecurity threats, including decades of experience in information technology and information security positions; serving in information technology leadership positions at other large public companies; and having other significant experience in the areas of risk management, information technology, and information security. Our CISO has more than 26 years of experience in information technology and/or information security, including more than 12 years in such positions in the hospitality industry.


text: Risk Management and Strategy We manage cybersecurity risk through three core teams: cybersecurity engineering, data privacy, and a security operation center. These teams are responsible for overseeing data safety during new system and infrastructure deployments, maintaining appropriate cybersecurity controls, and monitoring, documenting and investigating any anomalies affecting employees, suppliers, and customers. Our IT security controls are designed to align with the NIST (National Institute of Standards and Technology) standard and are tested on an ongoing basis. These controls and procedures include cybersecurity risks associated with third-party service providers. For instance, we conduct risk and compliance assessments of third-party service providers that request access to our information assets. To support our internal risk management structure, we use third-party specialists to monitor for emerging threats, conduct vulnerability scans and analysis including simulated hacker attacks, and audit our cybersecurity framework. We also maintain an information security risk insurance policy in the event of a security breach. Our internal audit function provides independent assessment and assurance on the overall operations of our cybersecurity programs and the supporting control frameworks.

companyName: LENNOX INTERNATIONAL INC

ticker: LII


text: Leadership receives training on how to respond to ransomware events and participates in breach simulations at least once a year. Additionally, employees throughout the organization support LII's risk management efforts by participating in mandatory cybersecurity training at least once a year, ongoing awareness campaigns, and quarterly simulated phishing attempts.


text: LII has not experienced any material cybersecurity incidents within the last three years. However, as described in Item 1A, "Risk Factors," any breach of data security could result in a disruption of our services or improper disclosure of personal data or confidential information, which could harm our reputation, require us to expend resources to remedy such a security breach or defend against further attacks or subject us to liability under laws that protect personal data, resulting in increased operating costs or loss of revenue.


text: Our Chief Technology Officer is responsible for overseeing cybersecurity and reports to the Board of Directors twice a year on our cybersecurity tactical responses and strategic roadmap. The entire Board of Directors reviews significant cybersecurity risks and works with the Audit Committee to address these issues.


text: At the management level, our Data Protection & Cybersecurity Steering Committee ("DPCSC") meets on a quarterly basis. The DPCSC includes representatives from communications, ethics and compliance, human resources, information technology, corporate audit, legal, risk, privacy, and sourcing. This committee is responsible for overseeing LII's data protection and cybersecurity policies and procedures. These cybersecurity policies and procedures include an IT security and privacy incident response plan to notify the appropriate parties in a timely manner, including our Chief Technology Officer, our Disclosure Committee, and our Board of Directors.


text: Our Chief Technology Officer has served in the role since 2008, and has more than 15 years of experience in developing and executing large enterprise data privacy and cyber security roadmaps at publicly-traded companies. He holds undergraduate and graduate degrees in engineering. Our Vice President, Information Technology, has served in the role since 2003, and has more than 35 years of cybersecurity experience. He holds an undergraduate degree in computer science.


text: We use people, process, and technology controls to manage and mitigate cybersecurity risk. The Risk and Compliance Committee, in consultation with and regular reporting to our full Board of Directors (the "Board"), has been delegated oversight for enterprise technology and its associated risks including cybersecurity. As a financial services and technology company, we face a range of cybersecurity risks that are inherent in our industry. Cybersecurity risk has been integrated into the Company's overall Enterprise Risk Management framework as well as our Internal Audit plan.

companyName: Triumph Financial, Inc.

ticker: TFIN


text: Safeguarding the security and integrity of our systems, networks and data is an important element of our business activities. We continually invest in the development and implementation of various cybersecurity programs and processes that are designed to assess, identify and manage material risks from cybersecurity threats and to address the constantly evolving cybersecurity landscape.

companyName: Optimum Communications, Inc.

ticker: OPTU


text: The Company's Chief Information Security Officer ("CISO") is primarily responsible for developing, monitoring, and implementing our Information Security Program (the "ISP"). Our CISO has over twenty-five years of experience managing information security programs across banking and technology companies. Our CISO reports monthly on cybersecurity matters to the Board and The Risk and Compliance Committee in addition to full quarterly reports and an annual report. Our ISP team is organized around six key functions: (1) security operations and incident response, (2) security engineering and architecture, (3) threat and vulnerability management, (4) Information Technology/Information Security – governance, risk and controls, (5) security awareness and training, and (6) identity and access management. These functions are integrated into each of our business lines through coordination with a dedicated security business partner.


text: Our ISP operates as an enterprise-wide function that monitors external and internal threats to assess cybersecurity risk and drives risk-based remediation across all departments. The Company's ISP is aligned to the Federal Financial Institutions Examination Council standards and is built on recognized best practices and standards for cybersecurity and information technology. We identify vulnerabilities and remediate based on risk and priority. Our ISP team conducts annual security awareness training, regular phishing exercises, sponsors Company-wide security awareness programs, and provides regular updates across the Company to keep employees engaged and informed on ways to mitigate cybersecurity risk.


text: The ISP also has a documented Information Security Incident Response Plan (the "ISIRP) to manage any high severity security incidents that may arise. The ISIRP establishes a framework for our information security team to escalate, contain, investigate, and remediate a potential cybersecurity event. The ISIRP is reviewed no less than annually and is integrated into the Company's overall Crisis Management Plan, which is reviewed, led, and tested regularly by senior management.


text: We engage third-party services to conduct penetration testing as well as other regular evaluations of our security protocols and processes. Additionally, we assess and monitor the cybersecurity controls of third party service providers and partners. Ongoing and regular monitoring of our third parties is also managed through our ISP team's protocols in partnership with the vendor management, enterprise risk management, and internal audit departments.


text: Notwithstanding the focus we place on cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. As of the date of this Form 10-K, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion, please see Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Risk Management and Strategy LP places utmost priority on ensuring consistent and uninterrupted operational capability, as well as securing confidential business assets. We have systems and processes in place to assess, identify and manage cybersecurity incidents, and those systems and processes are integrated into our overall enterprise risk management system. We invest heavily in technology and third-party support to identify, mitigate, and quickly respond to cybersecurity incidents, and we have maintained a strong focus in consistently reviewing fundamental cybersecurity practices and ensuring we are reviewing emerging threats.


text: To respond to the threat of security breaches and cyberattacks, we maintain a cybersecurity program designed to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, LP. This program includes mechanisms to monitor and detect unusual network activity, cybersecurity incident response and containment tools, and a response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incident. We also have a cybersecurity training and compliance program in place for the Company whereby our connected employees receive training and are tested routinely through simulated phishing attempts.


text: We rely heavily on third-party suppliers and vendors, and a cybersecurity incident at one of our suppliers or vendors could have a material adverse impact on our business operations. We evaluate third-party cybersecurity risk controls through various assessment activities carried out by LP employees and by third-party service providers acting on our behalf. We engage an independent third party to conduct a biennial Security Program Assessment under the National Institute of Standards and Technology Cybersecurity framework. For incident alerts and response, we outsource around-the-clock coverage to a third-party managed service provider who provides timely alerting and notification of potential cybersecurity issues. In 2023, we also engaged a specialized third-party assessor to perform an operational technology security assessment for a subset of our manufacturing facilities. We continually work with third-party experts to advise on new threats and cybersecurity strategy best practices for specific capabilities.


text: No risks from cybersecurity threats have materially affected, nor has LP identified any specific risks from known cybersecurity threats that are reasonably likely to materially affect, LP, including our business strategy, results of operations or financial condition. Please see "Risk Factors – Business and Operational Risk Factors – Cybersecurity risks related to the technology used in our operations and other business processes, as well as security breaches of Company, customer, consumer, employee, or vendor information could adversely affect our business" in Item 1A of this annual report on Form 10-K for additional discussion of cybersecurity risks applicable to LP.


text: To more effectively share information and gain consensus regarding cybersecurity initiatives and prevention policies, the Company has in place a Cyber Council consisting of various members of LP senior leadership and the Chief Information Officer. The Cyber Council is chaired by our ISO. The ISO, along with her team, is responsible for leading an enterprise-wide information security strategy, including policy, standards, architecture, processes, and security technology. The Cyber Council (i) meets semi-annually to review and discuss the Company's cybersecurity risks and threats, incident responses, technology, the status of projects to strengthen the Company's information security systems, assessments of the Company's cybersecurity program and the emerging threat landscape and (ii) reports risks related to any material cybersecurity incidents, as needed, to the Board of Directors and the Finance and Audit Committee (FAC) of the Board of Directors.


text: Board Responsibilities Oversight of risks from cybersecurity threats is shared by the Board of Directors and the FAC. The FAC oversees our cybersecurity program. The ISO provides the FAC with an annual presentation on our cybersecurity program, emerging threats, and the state of LP's cybersecurity maturity. In addition, the ISO provides updates to the FAC no less often than quarterly with respect to materials regarding the cybersecurity program.


text: Risk Management and Strategy The security of the Company's products, data, services and network is a critical priority. To effectively assess, identify and manage material risks associated with cybersecurity threats, the Company has adopted a comprehensive approach with respect to acceptable use, risk management, data privacy, education and awareness, security incident management and reporting, identity and access management, third-party management, security (with respect to physical assets, products, networks and systems), security monitoring and vulnerability identification. The Company has, and continues to, invest in internal and external tools to better detect, patch, monitor, and restore systems. Further, the Company maintains cybersecurity insurance coverage intended to protect against loss of business and other related consequences resulting from cyber incidents.

companyName: WESTINGHOUSE AIR BRAKE TECHNOLOGIES CORP

ticker: WAB


text: The Company also maintains a global incident response plan and regularly conducts exercises to help with our overall preparedness. The Company takes measures to improve and update our cybersecurity program, including independent third party assessments, penetration testing and scanning of our systems for vulnerabilities. The Company pairs with assessors, consultants, auditors, and other third-party service providers and advisers to assist in monitoring cybersecurity risks.


text: The Company remains committed to preserving the integrity of its network, while remaining adaptable to identify new and emerging threats relying on both internal and external research and intelligence gathering. The Company has instituted a Cybersecurity Awareness Month program and the Cybersecurity Champion Network for continuous improvement via trainings and continued awareness on emerging cybersecurity risks.


text: During 2022, the Company detected a cyber-security incident which impacted the Company's network. The Company promptly activated incident response protocols and completed a thorough investigation. The incidents did not have a material impact on our business, operations or financial results.

stage1Category: Incident Disclosure


text: The Company and its Board understands the importance of maintaining a secure environment for our products, data and systems that effectively supports our business objectives and customer needs. Cybersecurity risks are overseen by the Audit Committee of the Board. The Senior Vice-President and Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") provide ongoing and continuing reports to the Audit Committee, which includes information about cyber-risk management, the effectiveness of the Company's cybersecurity framework, and benchmarking the Company against its industry peers. The CISO is responsible for navigating cyber risks, data access governance, security governance and global regulatory compliance related to cybersecurity regulations and industry standards. The Company also has a Chief Product Security Officer ("CPSO") who manages imbedding cybersecurity in the Company's products and services as they are being developed.


text: The Company's CIO, CISO, and cybersecurity team collectively have decades of experience in various roles managing information security, developing cybersecurity strategy, and implementing, planning and operationalizing a comprehensive global IT infrastructure. Our CIO and CISO maintain relevant degrees, certifications, and trainings while also being recognized as experts in their respective fields by industry leaders.


text: The Company also conducts ongoing cyber security reviews which includes updates on the Company's enterprise cybersecurity risk and product cybersecurity risk. Risk is assessed utilizing internal key performance indicators and external evaluations to determine the Company's cybersecurity score in comparison to its peer group. Wabtec's Board of Directors participates in all enterprise annual security awareness training and phishing campaigns. Throughout the year, as appropriate, in addition to regularly scheduled updates, the Audit Committee, CIO, and CISO maintain an ongoing dialogue regarding the Company's cybersecurity risk and posture. The cybersecurity framework is also supported by Wabtec's broader enterprise risk management process to ensure alignment of the Company's cybersecurity efforts with the Company's overall enterprise risk management.