text: Our Chief Technology Officer ("CTO") has overall responsibility for our information technology program, which includes the Company's cybersecurity program. Our Chief Information Security Officer ("CISO") is directly responsible for the Company's cybersecurity program, which is designed to protect and preserve the integrity, confidentiality, and continued availability of the information owned by, or in the care of, the Company. Our CTO has over 25 years of information technology experience, including systems development, technology strategy, and vendor management; our CISO has over 30 years of information technology and cybersecurity program management experience. Prior to joining Brighthouse Financial, both our CTO and CISO previously served in roles that involved leading and overseeing information technology and cybersecurity programs at other public companies in the financial services industry. In addition, our CTO serves on a cross-departmental, management-level risk committee that oversees the Company's enterprise risks, including cybersecurity risks. This enterprise-level risk committee is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents.


text: Our cybersecurity team regularly assesses the threat landscape and takes an enterprise-wide view of cybersecurity risks. We monitor issues that are internally discovered or externally reported that may affect our business, and we employ a range of tools and third-party services to effectuate our cybersecurity risk identification and assessments, including regular network and endpoint monitoring, threat and vulnerability assessments, and external penetration testing. In addition, our cybersecurity team conducts regular reviews, conducts tabletop exercises, performs internal testing, and leverages the audits performed by our internal audit team, as well as the services of third-party consultants, to assess and evaluate the effectiveness of our controls (in alignment with the NIST framework) and to improve our security measures and strategy. The cybersecurity team has also engaged a third party to measure our cybersecurity program against the NIST cybersecurity framework. The results of this assessment confirmed the rigor of our cybersecurity risk management practices.

companyName: Brighthouse Financial, Inc.

ticker: BHF

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: Our cybersecurity team has also established Company-wide policies and procedures that cover cybersecurity matters, which are designed to enable us to effectively identify, evaluate, and respond to events that have the potential to impact our business. In the event of a cybersecurity incident, the Company utilizes a well-defined incident response plan that coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations (including relevant securities laws) and mitigate brand and reputational damage. This plan includes immediate actions to mitigate the impact, as well as long-term strategies for the remediation and prevention of future incidents. In accordance with this plan, we have established a cross-departmental Brighthouse Response Team that is responsible for coordinating enterprise-wide responses to cybersecurity incidents, as applicable. This Brighthouse Response Team provides reports regarding cybersecurity incidents to the enterprise-level risk committee referenced above.


text: Further, employees outside of our technology organization have a role in our cybersecurity defenses, and we encourage a corporate culture supportive of security, which we believe improves the effectiveness of our cybersecurity risk management program. Through our Security Awareness Program, we provide our employees with regular cybersecurity training and educational resources to help ensure that they remain vigilant against threats. These include frequent simulations, newsletters, alerts, e-mail reminders, and a mandatory annual cybersecurity awareness training course for all employees. In addition to company policies that we make available to all employees, our awareness training provides clear reporting and escalation processes in the event of suspicious activity.


text: Our board of directors has an advanced understanding of its role and that of management in cyber-risk oversight and is well-positioned to guide management in the development and implementation of an effective cybersecurity risk program. Two members of our audit committee hold cybersecurity certifications: Ms. Sears holds a Cyber Risk and Strategy Certification from Diligent Institute; and Ms. Barbe holds a CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors.

companyName: Invitation Homes Inc.

ticker: INVH

stage1Category: Board Governance


text: Third-Party Risk Management Our processes also address the cybersecurity risks associated with our use of third-party vendors, some of whom have access to our customer and employee data. We conduct security assessments of all third-party vendors that have access to our systems, our data and/or the facilities that house such systems or data. As part of our third-party risk management program, our cybersecurity risk management and third-party risk management teams collaborate to monitor our third-party vendors' compliance with our cybersecurity standards. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

stage1Category: Third-Party Risk


text: Risks from Cybersecurity Threats Our systems and our third-party vendors' systems periodically experience directed attacks intended to lead to (i) interruptions or delays in our operations or (ii) the loss, misuse or theft of personal information and other data, including confidential information or intellectual property. We have not experienced any cybersecurity incidents to date, directly or indirectly, that have materially impacted our business, financial condition, or results of operations. For more information regarding our risks from cybersecurity threats, see "Risk Factors — Operational Risks — Any failure in cyber- or other information security systems, as well as the occurrence of events unanticipated in Brighthouse Financial's or our third-party service providers' disaster recovery systems and business continuity planning could result in a loss or disclosure of confidential information, damage to our reputation and impairment of our ability to conduct business effectively" and "Risk Factors —Operational Risks — Any failure to protect the confidentiality of customer, employee, or other third-party information could adversely affect our reputation and have a material adverse effect on our business, financial condition and results of operations."

stage1Category: Strategy Integration

stage1Method: majority


text: Board of Directors - Oversight and Management Reporting The Audit Committee of the Board of Directors (the "Audit Committee") is primarily responsible for overseeing cybersecurity risks, and the Board of Directors is actively engaged with respect to these risks. The Audit Committee and/or the Board of Directors generally meet with our CTO and CISO on a quarterly basis to review our information technology and cybersecurity risk profile and to discuss our activities to manage the related risks, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, tabletop exercises, and other areas of importance. In addition to these regular meetings, we have an escalation process in place to timely inform the Board of Directors of any significant cybersecurity incidents, including any updates relating thereto, to ensure that the Board of Directors' oversight is proactive and responsive. Our Chief Compliance Officer also regularly reports to the Audit Committee regarding the Company's compliance with applicable regulations relating to cybersecurity.


text: Cybersecurity Risk Management Program and Strategy We understand the importance of maintaining a robust cybersecurity risk management program to assess, identify, and manage the material risks associated with cybersecurity threats.


text: Managing Cybersecurity Risks; Cybersecurity Risk Management Strategy Our cybersecurity risk management program is integrated into the Company's enterprise risk management framework, and our strategy focuses on implementing effective and efficient processes, technologies, and controls to assess, identify, and manage cybersecurity risks. Our cybersecurity risk management program is designed to be aligned with the National Institute of Standards and Technology Cybersecurity Framework ("NIST Framework"), which provides standards, guidelines and best practices on managing cybersecurity risk, as well as the organization, improvement and assessment of the Company's cybersecurity risk management program.


text: Our Chief Technology Officer ("CTO") has overall responsibility for our information technology program, which includes the Company's cybersecurity risk management program. Our Chief Information Security Officer ("CISO") is directly responsible for the Company's cybersecurity risk management program, which is designed to protect and preserve the integrity, confidentiality, and continued availability of the information owned by, or in the care of, the Company. Our CTO has over 25 years of information technology experience, including systems development, technology strategy, and vendor management; our CISO has over 30 years of information technology and cybersecurity risk management program management experience. Prior to joining Brighthouse Financial, both our CTO and CISO previously served in roles that involved leading and overseeing information technology and cybersecurity risk management programs at other public companies in the financial services industry. In addition, our CTO serves on a cross-departmental, management-level risk committee that oversees the Company's enterprise risks, including cybersecurity risks. This enterprise-level risk committee is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents.

stage1Category: Management Role


text: Our cybersecurity team regularly assesses the threat landscape and takes an enterprise-wide view of cybersecurity risks. We monitor issues that are internally discovered or externally reported that may affect our business, and we employ a range of tools and third-party services to effectuate our cybersecurity risk identification and assessments, including regular network and endpoint monitoring, threat and vulnerability assessments, and external penetration testing. In addition, our cybersecurity team conducts regular reviews, conducts tabletop exercises, performs internal testing, and leverages the audits performed by our internal audit team. We also engage the services of third-party consultants to assess and evaluate the effectiveness of our controls (in alignment with the NIST Framework), to improve our security measures and strategy, and to review our cybersecurity risk management program against the NIST Framework. The results of the most recent assessment of our cybersecurity risk management program confirmed the rigor of our cybersecurity risk management practices.


text: Our cybersecurity team has also established company-wide policies and procedures that cover cybersecurity matters, which are designed to enable us to effectively identify, evaluate, and respond to events that have the potential to impact our business. In the event of a cybersecurity incident, the Company utilizes a well-defined incident response plan that is designed to coordinate the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations (including relevant securities laws) and mitigate brand and reputational damage. This plan includes immediate actions to mitigate the impact of the incident, as well as long-term strategies for the remediation and prevention of future incidents. In accordance with this plan, we have established a cross-departmental Brighthouse Response Team that is responsible for coordinating enterprise-wide responses to cybersecurity incidents. This Brighthouse Response Team provides reports regarding cybersecurity incidents to the enterprise-level risk committee referenced above.


text: Further, employees outside of our information technology organization have a role in our cybersecurity defenses, and we encourage a corporate culture supportive of security, which we believe improves the effectiveness of our cybersecurity risk management program. Through our Security Awareness Program, we provide our employees with regular cybersecurity training and educational resources to help ensure that they remain vigilant against threats. These include frequent simulated phishing campaigns, newsletters, alerts, e-mail reminders, and a mandatory annual cybersecurity awareness training course for all employees. In addition to Company policies that we make available to all employees, our cybersecurity awareness training provides clear reporting and escalation processes in the event of suspicious activity.


text: Third-Party Risk Management Our processes also address the cybersecurity risks associated with our use of third-party vendors, some of which have access to our customer and employee data. We conduct security assessments of all third-party vendors that have access to our systems, our data and/or the facilities that house such systems or data. As part of our third-party risk management program, our cybersecurity risk management and third-party risk management teams collaborate to monitor our third-party vendors' compliance with our cybersecurity standards. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Risks from Cybersecurity Threats Our systems and our third-party vendors' systems periodically experience directed attacks intended to lead to (i) interruptions or delays in our operations or (ii) the loss, misuse or theft of personal information and other data, including confidential information or intellectual property. Based on the information available as of the filing date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents, directly or indirectly, that have materially affected or are reasonably likely to materially affect our business, results of operations, or financial condition. For more information regarding our risks from cybersecurity threats, see "Risk Factors — Operational Risks — Any failure in our cybersecurity risk management program, as well as the occurrence of events unanticipated in Brighthouse Financial's or our third-party service providers' disaster recovery systems and business continuity planning, could result in a loss or disclosure of confidential information, damage to our reputation and impairment of our ability to conduct business effectively" and "Risk Factors —Operational Risks — Any failure to protect the confidentiality of customer, employee, or other third-party information could adversely affect our reputation and have a material adverse effect on our business, financial condition and results of operations."


text: Board of Directors - Oversight and Management Reporting The Audit Committee of the Board of Directors (the "Audit Committee") is primarily responsible for overseeing cybersecurity risks, and the Board of Directors is actively engaged with respect to these risks. The Audit Committee and/or the Board of Directors generally meet with our CTO and CISO on a quarterly basis to review our information technology and cybersecurity risk profile and to discuss our activities to manage the related risks, including risk assessments, mitigation strategies, areas of emerging risks, incidents, industry trends, tabletop exercises, and other areas of importance. In addition to these regular meetings, we have an escalation process in place to timely inform the Board of Directors of any significant cybersecurity incidents, including any updates relating thereto, to ensure that the Board of Directors' oversight is proactive and responsive. Our Chief Compliance Officer also regularly reports to the Audit Committee regarding the Company's compliance with applicable regulations relating to cybersecurity.


text: Risk Management and Strategy Our operations are highly dependent upon information systems that support our business processes. In the ordinary course of our business, we collect and store certain confidential information such as personal information of our residents and associates and information about our business partners, contractors, vendors, and suppliers. Cyber intrusions could seriously compromise our networks and the information stored therein could be accessed, publicly disclosed, misused, lost, or stolen. As such, we have established information security processes and policies using principles from industry recognized cybersecurity frameworks focused on: (i) developing organizational understanding to manage cybersecurity risks; (ii) applying safeguards to protect our systems; (iii) detecting the occurrence of a cybersecurity incident; (iv) responding to a cybersecurity incident; and (v) recovering from a cybersecurity incident. Where appropriate, these processes and policies are integrated into our overall risk management systems and processes.


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our information systems and the data residing therein.

companyName: Liberty Energy Inc.

ticker: LBRT


text: Our cybersecurity risk management program includes, among other key features: • regular cybersecurity risk assessments; • detection and reporting of any cybersecurity events; • robust information security training program that includes annual information security training for all associates, as well as additional role-specific information security training; and • cyber incident response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incident to executive leadership and our board of directors.


text: We assess our cybersecurity risk management program at least annually and regularly review our cyber incident response plan and conduct cybersecurity tabletop exercises. Our processes and policies also include the identification of those third-party relationships which have the greatest potential to expose us to cybersecurity threats. We also partner with industry leading third parties for regular security audits. These audits ensure we view cybersecurity with a holistic perspective.


text: In addition, where appropriate, we seek to include in contractual arrangements with certain of our third-party vendors provisions addressing best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit, and test such vendors' cybersecurity programs and practices. We also utilize a number of digital controls to monitor and manage third-party access to internal systems and data.


text: We expect that our cybersecurity risk management processes and strategy will continue to evolve as the cybersecurity threat landscape evolves. As a backstop to our strong information security programs, policies, and procedures, we purchase a cybersecurity risk insurance policy that would defray the costs of an information security breach, if we were to experience one.


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected the Company, our business strategy, our results of operations, or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see Part I. Item 1A. "Risk Factors — Risks Related to Information Technology, Cybersecurity, and Data Protection."


text: Our Vice President, Chief Information Security Officer ("CISO") leads a team of information security professionals who have the first line responsibility for our cybersecurity risk management processes and activities. Our CISO has more than 20 years of experience as an information security leader and reports directly to our Executive Vice President, Chief Information and Digital Officer. Certifications of our cybersecurity professionals include, but are not limited to: Certified Information Systems Security Professionals from the International Information System Security Certification Consortium; Certified Information Security Manager from Information Systems Audit and Control Association; and focused training/certifications from security vendors on the applications utilized in the management of the cybersecurity program. The certifications mentioned above are accompanied by multiple years of direct experience in cybersecurity which provide the framework for the team's continuous learning of new technologies, processes, trends, and concepts, with additional training obtained through relevant cybersecurity focused conferences.


text: We have also adopted a robust cybersecurity risk governance model, including the formation of the Cybersecurity Governance Committee composed of key leaders from stakeholder groups throughout the Company including our CISO, Chief Operating Officer, Chief Legal Officer, and the head of Internal Audit, along with other senior members of management.


text: The Cybersecurity Governance Committee meets quarterly to review the processes and performance indicators related to prevention, detection, mitigation, and remediation of cybersecurity incidents that could adversely impact business operations.


text: We maintain a cross-functional cyber incident response plan with defined roles, responsibilities, and reporting protocols, which focuses on responding to and recovering from any significant breach as well as mitigating any impact to our business. Generally, when a breach or suspected breach is identified, the information security team would escalate the issue to the Cybersecurity Governance Committee for initial analysis and guidance. The Cybersecurity Governance Committee, in consultation with appropriate subject matter experts, would be responsible for determining whether a particular incident alone or in combination with other factors, triggers any reporting and/or further notification responsibilities. The Cybersecurity Governance Committee would designate the primary manager of a cybersecurity incident, identify the parties who should be informed about the incident, and oversee the processes for containment, eradication, recovery, and resolution of the incident. Depending on the severity and impact of a cybersecurity threat, the audit committee and the board of directors would be notified of an incident and kept informed of the mitigation and remediation efforts.


text: Our CISO and other senior members of information technology personnel regularly report to the audit committee and the board of directors on recent trends in cyber risks and review our strategy to defend our business systems and information against cyber-attacks. From time to time, outside advisors may be invited to brief the audit committee on the current cybersecurity threat landscape and other related topics.


text: As part of its overall risk oversight activities, with respect to cybersecurity risk management, the audit committee: • oversees the quality and effectiveness of our policies and procedures with respect to our information technology and network systems; • provides oversight on our policies and procedures in preparation for responding to any material data security incidents; and • oversees management of internal and external risks related to our information technology systems and processes.


text: Information technology and data security, particularly cybersecurity, are areas of focus for our board of directors and its audit committee. We employ a multi-layered security model that leverages risk-based controls with a focus on protecting our residents' and associates' data. We follow a cloud-first approach to enable efficient scaling, robust business continuity, and access to the latest technology innovations.


text: Our cybersecurity risk management program aims to protect and preserve the confidentiality, integrity, and continued availability of our residents' and associates' data and includes controls and procedures for the identification, containment, and remediation of cyber threats.


text: Our cybersecurity risk management program includes, among other key features: • regular cybersecurity risk assessments; • detection and reporting of any cybersecurity events; • independent strategy consultation on enhancement items and processes for cybersecurity tabletop exercises; • robust information security training program that includes annual information security training for all associates, as well as additional role-specific information security training; and • cyber incident response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incident to executive leadership and our board of directors.


text: We assess our cybersecurity risk management program at least annually and regularly review our cyber incident response plan. Our processes and policies also include the identification of those third-party relationships which have the greatest potential to expose us to cybersecurity threats. We also partner with industry leading third parties for regular security audits to ensure we view cybersecurity with a holistic perspective.


text: Our cybersecurity risk management processes are a key element of our Enterprise Risk Management ("ERM") process, which is designed to identify and evaluate the full range of significant risks to our business and operations. As part of our ERM program, our functional and operations departments identify and manage enterprise risks on an annual cycle. The process consists of structured reviews, discussions, and mitigation planning and includes risks identified by our Cybersecurity Governance Committee and information technology and cybersecurity functions as part of the overall review of significant enterprise risks. The top ERM risks are compiled annually and shared with the audit committee of the board of directors as well as the full board of directors. In addition, internal audit incorporates these risks into its continuous risk assessment process. Where appropriate, we seek to include in contractual arrangements with certain of our third-party vendors provisions addressing best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit, and test such vendors' cybersecurity programs and practices. We also utilize a number of digital controls to monitor and manage third-party access to internal systems and data.


text: Like other businesses, we have been, and expect to continue to be, subject to attempts at unauthorized access, mishandling or misuse, computer viruses or malware, cyber-attacks and intrusions, and other events of varying degrees. To date, we have not experienced a material security breach, nor are we aware of any third-party outside service providers that have experienced a cybersecurity breach. As a result, we have not incurred any significant expenses from information security breaches or any penalties or settlements related to the same. As of December 31, 2024, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, our results of operations, or our financial condition. For a discussion of risks from cybersecurity threats that could materially affect us, please see Part I. Item 1A. "Risk Factors — Risks Related to Information Technology, Cybersecurity, and Data Protection."


text: Since August 2020, our Vice President, Chief Information Security Officer (" CISO ") has led a team of information security professionals who have the first line responsibility for our cybersecurity risk management processes and activities. Our CISO has more than 20 years of experience as an information security leader responsible for assessing and managing cybersecurity programs. He reports directly to our Executive Vice President, Chief Information and Digital Officer, who reports to our Chief Executive Officer, has over 25 years of experience managing global information technology operations, including strategy, application, infrastructure, information security, support, and execution.


text: In performing his role, our CISO regularly performs the following: review of enterprise cybersecurity risks, controls, program policy, processes, and training; oversight of policy and program development, implementation, and updates; and information to senior leadership about cybersecurity-related issues and activities affecting the organization. Our CISO is regularly apprised of enterprise cybersecurity events, threats, and activities, including with respect to incidents, protection vulnerabilities, software update needs, and lifecycle status. He possesses a deep understanding of evolving cybersecurity threats, technologies, and industry best practices to identify cybersecurity risks and threats and assess and guide mitigation strategies effectively. Relevant cyber certifications include Certified Information Systems Security Professional and Certified Information Security Manager.


text: Certifications of our cybersecurity professionals include, but are not limited to: Certified Information Systems Security Professionals from the International Information System Security Certification Consortium; Certified Information Security Manager from Information Systems Audit and Control Association; and focused training/certifications from security vendors on the applications utilized in the management of our cybersecurity program. The certifications mentioned above are accompanied by multiple years of direct experience in cybersecurity which provide the framework for the team's continuous learning of new technologies, processes, trends, and concepts, with additional training obtained through relevant cybersecurity focused conferences.


text: We have implemented a robust cybersecurity risk governance model, including the formation of the Cybersecurity Governance Committee chaired by our CISO and composed of key leaders from stakeholder groups throughout our company including our President and Chief Operating Officer, Chief Legal Officer, Chief Compliance Officer, and the head of internal audit, along with other senior members of management. Experience of key members of the committee includes: • Our President and Chief Operating Officer, who joined the Company as Chief Operating Officer in November 2017 and has served in his current role since March 2023, has over 25 years of commercial and strategic leadership experience. He excels at identifying and mitigating operational risks, including cybersecurity threats that could disrupt critical business processes. His contributions to the Cybersecurity Governance Committee include aligning cybersecurity initiatives with broader business strategies and ensuring cybersecurity considerations are integrated into information technology infrastructure and operations. • Our Chief Legal Officer, serving since August 2015, brings extensive experience as the top legal executive across various organizations. At Invitation Homes, he oversees all legal and regulatory affairs, including direct supervision of the risk management department. His expertise includes advising on governance frameworks, supporting board oversight of cybersecurity risk management, and addressing litigation trends and risks associated with cybersecurity breaches. • Our Chief Compliance Officer, who joined the Company in July 2016 and has served in her current role since July 2024, is an experienced public company counsel with over 20 years of combined private practice and in-house experience. She provides expertise in SEC regulations and disclosure requirements, including cybersecurity-related guidance, and ensures compliance with legal standards for disclosing material cybersecurity risks and incidents. In collaboration with internal audit, she helps oversee our ERM program to align cybersecurity initiatives with broader business strategies. She also brings a thorough understanding of breach notification requirements and regulatory responses to cybersecurity incidents. • Our Vice President of Internal Audit, serving since November 2017, brings specialized expertise in identifying internal threats and potential fraud related to cybersecurity through advanced audit techniques. She is skilled in aligning cybersecurity risk assessments with our ERM framework and monitoring the implementation of cybersecurity audit recommendations to ensure their effectiveness over time.


text: Our board of directors has an advanced understanding of its role and that of management in cyber-risk oversight and is well-positioned to guide management in the development and implementation of an effective cybersecurity risk program. Two members of our audit committee hold cybersecurity certifications: Ms. Sears holds a Cyber Risk and Strategy Certification from Diligent Institute; and Ms. Barbe holds a CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: DXC Technology Co

ticker: DXC


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management ("ERM") program, and shares common methodologies, reporting channels and governance processes that apply across the ERM program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments and penetration testing designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers such as forensic analysts, third party security reviewers, and other consultants such as outside counsel, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We could be held liable for damages, our reputation could suffer, and our business may be materially impacted due to service interruptions, from security breaches, cyber-attacks, other cybersecurity events or incidents or disclosure of confidential information or personal data".


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: Cybersecurity Governance Cybersecurity is considered a critical risk area at DXC and is integrated into the Company's overall ERM program, which includes maintaining the ERM framework, evaluating risk appetite, and monitoring evolving risks and the effectiveness of mitigations. Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Nominating/Corporate Governance Committee oversight of cybersecurity and other information security risks. The Nominating/Corporate Governance Committee oversees management's efforts to identify, assess, mitigate, and remediate material information security risks. Similarly, the Audit Committee oversees our disclosure controls and procedures, which include cybersecurity reporting disclosure controls.


text: The Nominating/Corporate Governance Committee receives reports from the Global Chief Information Security Officer ("Global CISO") on the Company's information security program at each regular quarterly Committee meeting. In addition, management updates the Nominating/Corporate Governance Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant. The Nominating/Corporate Governance Committee chair then provides an overview of the information security reports to the full Board at each regular quarterly Board meeting. In fiscal 2024, the full Board also received a briefing from management on our enterprise risk management program.


text: Our management team, including our Global CISO, Chief Operating Officer ("COO"), Chief Information Officer ("CIO"), General Manager of Cloud Infrastructure and ITO, and General Counsel, comprise our Security Steering Committee ("SCC") and are responsible for assessing and managing our material risks from cybersecurity threats. Our Global CISO and our General Manager of Cloud Infrastructure and ITO have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Global CISO has extensive experience assessing and managing cybersecurity-related risks and implementing related policies, procedures, and strategies. Our Global CISO has served in leadership roles related to information security for over 28 years, including serving as a Deputy CISO at another company since 2005, then as its CISO since 2017 and as DXC's Global CISO since May 2019. Similarly, our General Manager of Cloud Infrastructure and ITO is a well-known industry leader with more than 20 years of experience in the technology industry and has been with DXC since 2020.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment. The SCC also analyzes emerging global cyber security risks and uses the expertise of its members to review DXC's current security posture and consider steps to take to mitigate such risks and implement improvements where it deems necessary.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We could be held liable for damages, our reputation could suffer, and our business may be materially impacted due to service interruptions from security breaches, cyber-attacks, other cybersecurity events or incidents or disclosure of confidential information or personal data."


text: The Nominating/Corporate Governance Committee receives reports from the Global Chief Information Security Officer ("Global CISO") on the Company's information security program at each regular quarterly Committee meeting. In addition, management updates the Nominating/Corporate Governance Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant. The Nominating/Corporate Governance Committee chair then provides an overview of the information security reports to the full Board at each regular quarterly Board meeting.


text: Our management team, including our Global CISO, Chief Information Officer, Managing Director of Global Infrastructure Services, and General Counsel, along with other key business and functional leaders, constitute our Security Steering Committee ("SCC") which is responsible for assessing and managing our material risks from cybersecurity threats. Our Global CISO and our Managing Director of Global Infrastructure Services have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Global CISO has extensive experience assessing and managing cybersecurity-related risks and implementing related policies, procedures, and strategies. Our Global CISO has served in leadership roles related to information security for over 23 years, including serving as a CISO at another company since 2015, then as DXC's IT CISO since May 2022 and as DXC's Global CISO since August 2024. Our Global CISO reports to our Managing Director of Global Infrastructure Services who is a well-known industry leader with more than 20 years of experience in the technology industry and has been with DXC since 2020.


text: The Audit Committee oversees the cybersecurity program and receives reports from management regarding the Company's cybersecurity policies and procedures on an annual basis. The Audit Committee also receives reports from management on any cybersecurity incidents that may occur.

companyName: ESTABLISHMENT LABS HOLDINGS INC.

ticker: ESTA


text: As part of our cybersecurity program, our IT management reports to the Company's Chief Operating Officer and Chief Executive Officer and is responsible for assessing and managing cybersecurity risks and developing and implementing our cybersecurity program. Our current Head of Global IT has more than 15 years of experience in technology and process improvements, which includes the execution of digital business strategies within highly regulated industries. Our IT management has obtained relevant experience in various sectors such as technology firms, financial institutions, and consulting firms and have actively engaged in continuous learning and professional development initiatives to stay updated on evolving cybersecurity threats and trends. This includes participating in industry conferences, workshops, training programs, and becoming members of professional cybersecurity organizations.


text: Our cybersecurity program is designed to identify, assess, and mitigate risks from cybersecurity threats, and includes the following elements: • a risk assessment process to identify and assess cybersecurity risks; • a risk mitigation strategy to address cybersecurity risks; • an incident response plan to identify, respond to, mitigate and remediate cybersecurity incidents; • an awareness and training program to educate employees about cybersecurity risks; • a procedure to procure information technology services, including cloud computing and data storage, from third-party providers with sufficient cybersecurity provisions, and to monitor their cybersecurity process on an ongoing basis; and • periodic testing and evaluation by external parties we engage to assess the effectiveness of the cybersecurity intrusion protections and make recommendations to improve the security of our information systems.


text: As a result, we have implemented a multi-layered cybersecurity program that includes measures to protect our information systems, including firewalls, network access controls, intrusion detection systems, phishing campaigns, security awareness training and monitoring, network operation center, security operation center, and data encryption, and to monitor our information systems to detect potential cybersecurity incidents, including through the use of automated detection software. Through these processes and the other processes described above, including our incident response plan, our management is informed about cybersecurity threats and incidents affecting us.


text: Our company has implemented robust processes to assess, identify, and manage material cybersecurity risks effectively. These processes are an integral component of our overall risk management system, ensuring that cybersecurity concerns are comprehensively addressed within our broader risk management framework. Risk assessment, identification, and management processes are seamlessly integrated into our overall risk management system. The processes for assessing, identifying, and managing cybersecurity risks are aligned with our strategic objectives and business goals. We foster cross-functional collaboration and communication to facilitate the integration of cybersecurity risk management into various business functions and processes.


text: We also review our cybersecurity practices, their effectiveness, and the cybersecurity practices of the third-parties we rely on, on an ongoing basis and make changes as necessary to address new risks. However, we cannot guarantee that our efforts will be successful in preventing all cybersecurity incidents.


text: We are not aware of any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We can give no assurance that we have detected or protected against all cybersecurity threats or incidents. We are subject to a variety of cybersecurity risks, which could have a material adverse effect on our business, financial condition, and results of operations. See the "Risks Related to Intellectual Property and Data Security" section of Item 1A. Risk Factors for additional discussion on risks affecting our information systems.


text: As part of our cybersecurity risk management program, we maintain processes related to third-party vendor cybersecurity risk management. As appropriate, we contractually require certain third-parties to certify that they have the ability to implement and maintain appropriate cybersecurity measures, consistent with applicable laws, and to promptly report any suspected cybersecurity incidents that may affect our company or our data.

companyName: Entrada Therapeutics, Inc.

ticker: TRDA


text: As a result, we have implemented a multi-layered cybersecurity program that includes administrative, physical, and technical measures to protect our information systems. Through these processes and the other processes described above, including our incident response plan, our management is informed about cybersecurity threats and incidents affecting us.


text: Risk Management and Strategy As part of our overall risk management process, we have established a cybersecurity risk management program for assessing, identifying, and managing risks from cybersecurity threats. Our cybersecurity risk management program is informed by recognized industry standards and frameworks and incorporates elements of the same, including elements of the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the Federal Information Processing Standards Publication ("FIPS").


text: Our cybersecurity risk management program includes a control framework and operations that utilizes tools and processes designed to prevent, detect, and analyze current and emerging cybersecurity threats, and we maintain plans and strategies to address any cybersecurity threats and incidents. These tools and processes include, but are not limited to, periodic cybersecurity risk assessments and vulnerability analyses, as well as monitoring for critical risks from cybersecurity threats using automated tools. Personnel at all levels and departments are made aware of our cybersecurity policies through participation in cybersecurity risk awareness trainings during onboarding and on an annual basis thereafter.


text: As necessary and appropriate, we engage consultants, or other third parties, in connection with our cybersecurity risk assessment processes. These service providers assist us in designing and implementing cybersecurity procedures, as well as in monitoring and testing the effectiveness of our cybersecurity safeguards. For example, we engage these vendors to conduct annual risk assessments, including internal and external penetration testing, to identify cybersecurity threats, as well as to perform cybersecurity risk assessments in the event of substantial changes to our business practices that may affect our information systems. These cybersecurity risk assessments are designed to include identification of reasonably foreseeable internal and external cybersecurity risks, analysis on the likelihood and potential damage that could result from such risks, and feedback on the sufficiency of our existing procedures, systems, and safeguards to mitigate such cybersecurity risks.


text: We face a number of cybersecurity risks in connection with our business. Although risks from cybersecurity threats have to date not materially affected us, and we do not believe they are reasonably likely to materially affect us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats and security incidents relating to our and our third party vendors' information systems. For more information, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors has delegated this cybersecurity risk management oversight function to our audit committee. Under the purview of our audit committee, our President and Chief Operating Officer, General Counsel, and Chief Financial Officer ("CFO") collectively, the "Risk Management Committee") are primarily responsible for assessing, managing and mitigating our critical risks from cybersecurity threats. Our Head of Information Technology ("IT"), who reports directly to our CFO, has primary responsibility for the day-to-day management of our cybersecurity risk management program. The individual currently operating as our Head of IT possesses approximately 19 years of experience with information technology and cybersecurity risk management programs. Our Head of IT's responsibilities, with support from our internal IT team and external IT consultants, include assessing, monitoring, and managing our cybersecurity risks.


text: Our Head of IT periodically reports to our CFO on matters relating to our overall cybersecurity risk management program and, in the event of a cybersecurity incident, reports directly to our entire Risk Management Committee. The CFO reports on the cybersecurity risk management program to the other members of our Risk Management Committee and, alongside our General Counsel, provides quarterly cybersecurity risk management briefings to the audit committee, including discussion of cybersecurity risks, that include any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and other matters relevant to our overall cybersecurity risk management. Our audit committee provides quarterly updates, as appropriate, on the cybersecurity risk management program, to our full board of directors.


text: Risk Management and Strategy As part of our overall risk management process, we have established a cybersecurity risk management program for assessing, identifying, and managing risks from cybersecurity threats. Our cybersecurity risk management program is informed by recognized industry standards and frameworks and incorporates elements of the same, including elements of the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the Federal Information Processing Standards ("FIPS") Publication.


text: We have an Executive Compliance Committee consisting of executive officers and members from senior management across the regulatory, quality, legal, finance and people operations functions that supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which includes updates from our internal cybersecurity team, as relevant; review of any threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Praxis Precision Medicines, Inc.

ticker: PRAX


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors has delegated this cybersecurity risk management oversight function to our audit committee. Under the purview of our audit committee, our President and Chief Operating Officer, General Counsel, and Chief Financial Officer ("CFO") (collectively, the "Risk and Compliance Committee ") are primarily responsible for assessing, managing and mitigating our critical risks from cybersecurity threats. Our Head of Information Technology ("IT"), who reports directly to our CFO, has primary responsibility for the day-to-day management of our cybersecurity risk management program. The individual currently operating as our Head of IT possesses approximately 20 years of experience with information technology and cybersecurity risk management programs. Our Head of IT's responsibilities, with support from our internal IT team and external IT consultants, include assessing, monitoring, and managing our cybersecurity risks.


text: Our Head of IT periodically reports to our CFO on matters relating to our overall cybersecurity risk management program and, in the event of a cybersecurity incident, reports directly to our entire Risk and Compliance Committee. The CFO reports on the cybersecurity risk management program to the other members of our Risk and Compliance Committee and, alongside our General Counsel, provides quarterly cybersecurity risk management briefings to the audit committee, including discussion of cybersecurity risks, that include any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and other matters relevant to our overall cybersecurity risk management. Our audit committee provides quarterly updates, as appropriate, on the cybersecurity risk management program, to our full board of directors.


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity risk-management program includes a cybersecurity incident response plan.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF, also integrating security best practices typically used to support the Health Insurance Portability and Accountability Act, or HIPAA, and General Data Protection Regulation, or GDPR, implementations. We use the NIST CSF and such security best practices as a guide to help us monitor, identify, assess and manage cybersecurity risks relevant to our business; however, this does not imply that we meet any particular technical standards, specifications or compliance requirements.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise-IT environment; • adoption of various cybersecurity software, including but not limited to cloud-based malware, ransomware and antivirus software, phishing monitoring and artificial intelligence-based anomaly detection; • a security team principally responsible for managing (1) our cybersecurity risk-assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • security audits and a third-party risk assessment process for key service providers, suppliers and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For more information, see the section titled "Risk Factor—Risks Related to Data Privacy and Cybersecurity—Cyberattacks or other failures in our telecommunications or information technology, or IT, systems, or those of our collaborators, contract research organizations, third-party logistics providers, distributors or other contractors or consultants, could result in information theft, data corruption and significant disruption of our business operations."


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other IT risks as well as management's implementation of our cybersecurity risk management program. The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: We have an internal cybersecurity team, led by our Chief Financial Officer, who is responsible for (i) managing our overall cybersecurity risk-management program; (ii) assessing and managing our risks from cybersecurity threats; and (iii) overseeing retained cybersecurity consultants and providers for additional external expertise. This internal team's experience includes over 30 years in cybersecurity implementation, testing and management.


text: Cybersecurity Risk Management and Strategy Our management and board of directors recognize the critical importance of maintaining the trust and confidence of our customers, business partners and employees, including the importance of managing cybersecurity risks as part of our larger risk management program. While all personnel at our company play a part in managing cybersecurity risks, as discussed in more detail under "—Governance" below, our board of directors, through delegation to the audit committee of the board of directors, or the audit committee, and our senior management team are involved in the oversight of our cybersecurity risk management program. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our information security program is aligned to our overall enterprise risk management program and utilizes an overarching framework to address enterprise information security governance, which seeks to protect information assets and systems against attacks and incidents while establishing appropriate security as a priority throughout the product development process. It is a risk-based program that aligns with industry-standard frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework and use of a Cyber Security Incident Response Team, to incorporate security principles applicable to our regulatory and contractual obligations. This program is managed by a dedicated Chief Information Security Officer, or the CISO, who reports to the Chief Executive Officer and oversees a team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes.

companyName: Alteryx, Inc.


text: Our CISO has over fifteen years of experience in information security, serving in roles of increasing responsibility within public and private companies. As part of our information security program, we have an incident response program that coordinates activities across multiple teams in responding to cybersecurity incidents in accordance with a defined Cyber Security Incident Response Policy. Each of these teams are managed by experienced and credentialed professionals with knowledge in their fields and the teams comprise a security operations center to detect, analyze, and escalate cybersecurity events, a cybersecurity incident response team to own containment and recovery activities, and a crisis response team to liaise with business stakeholders, secure priority resources, and validate completion of any post incident activities. These teams inform our CISO of all material events and key developments and coordinate with other teams, such as the Information Technology, Legal and Privacy teams, as appropriate for analysis and compliance with legal and contractual obligations. We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We conduct initial due diligence on the cybersecurity profile of our vendors as they are onboarded and utilize third-party software to provide continuous monitoring and scanning of critical third-party infrastructure and to monitor any known breaches of those third-party systems. We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We also provide regular, mandatory training for our personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats and to communicate our evolving information security policies, standards, processes and practices.


text: We have in the past experienced, and may in the future experience, adverse impacts to our business strategy, operating results, and/or financial condition as a result of cybersecurity incidents. However, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business or our financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have an adverse effect, including on our business operations, operating results, or financial condition. For more information regarding cybersecurity risks that we face and the related potential impacts on our business, see the risk factor titled "Cybersecurity risks and cyber incidents could result in the compromise of confidential data or critical data systems and give rise to potential harm to customers, remediation and other expenses under consumer protection laws or other laws or common law theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business and operations."


text: The audit committee is responsible for reviewing with management our cybersecurity and other information technology risks, controls and processes, including the processes used to prevent or mitigate cybersecurity risks and respond to cybersecurity events. The CISO provides reports at least quarterly to the audit committee as well as to our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the audit committee. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. Our audit committee also receives prompt and timely information regarding cybersecurity threats or incidents that may be material in nature, as well as ongoing updates regarding any such threat or incident until it has been mitigated, resolved, or otherwise addressed. To mitigate the impact of any cybersecurity incidents, we maintain appropriate errors and omissions insurance that provides coverage for such incidents.


text: We are committed to combating the threat of cyber-attacks and to securing our business through our information security programs and developing a deep understanding of cybersecurity risks, vulnerabilities, mitigations, and threats. We have a global cybersecurity process applicable to all subsidiaries and business lines.

companyName: NEWMARK GROUP, INC.

ticker: NMRK


text: Risk Management and Strategy Our global cybersecurity processes form the comprehensive framework we utilize for planning, performing, managing, assessing, and improving our security controls as they relate to cybersecurity, and form part of our overall risk management system. We aim to conduct our cybersecurity program in accordance with current recognized global policies and standards for cybersecurity and information technology. These processes are managed by our cybersecurity team headed by our CISO and supported by our business continuity teams.


text: At Kinetik, we believe that the recognition and reporting of cybersecurity threats by every employee and contractor plays a key role in protecting and securing our network. We have mandatory annual training for our employees and contractors on security awareness annually, using a library of cybersecurity training modules. We deploy quarterly simulated phishing emails to all system users in an effort to gauge their cybersecurity awareness.

companyName: Kinetik Holdings Inc.

ticker: KNTK


text: We conduct periodic internal and external vulnerability audits and assessments and penetration testing and provide periodic cybersecurity training to employees. These measures include regular phishing simulations, annual general cybersecurity awareness training and data protection training. We also participate in industry-specific cybersecurity roundtables and professional groups to ensure we remain abreast of industry-wide cybersecurity developments and best practices and thereby enhance our threat identification processes and responses as necessary. Additionally, when engaging with and utilizing third-party vendors and partners for our business, we conduct various oversight assessments, including due diligence and periodic monitoring to identify potential cybersecurity threats associated with our conducting business with such vendors and partners and to ensure any corresponding risk exposure aligns with our business requirements and risk tolerances.


text: We maintain an incident reporting and escalation process in the event of any observed, detected, or suspected events that we believe may qualify as a cybersecurity incident. Risks are identified based on a four-tier system, and tiers are assigned based on the service impact, user impact, financial impact, and security impact that a threat may pose. Our processes include steps to recover our systems and information through established and tested system recovery plans and business continuity plans, each based on the appropriate response associated with the corresponding tier of the identified threat. Our incident response process includes steps to notify key incident management team members who are responsible for communicating with regulatory and other governmental authorities about cybersecurity events as applicable and as required by law. We determine the materiality of such incidents based upon a number of factors including if the incident had or may have a material impact on our business strategy, results of operations, or financial condition. This process involves a review of the nature of the incident by our cybersecurity team as well as other members of management and employees with specialized technology or financial knowledge, including our CISO, CIO, and CFO, as applicable. In the event of a material breach, we have a process for escalation to appropriate members of our senior management, and, where appropriate, to our Board and Audit Committee. These groups also collaborate in determining the appropriate response to such events and disclosure of any material breach.


text: We engage third parties from time to time that assist us in the identification, assessment, and management of cybersecurity risks. We also engage cybersecurity specialists to complete assessments of our cybersecurity processes, program and practices, including our data protection practices, as well as to conduct targeted attack simulations. The feedback from these assessments and guidance from external specialists informs our overall risk management system and the development and improvement of our processes to mitigate cybersecurity risks throughout the Company.


text: Disaster Recovery Our processes address disaster recovery concerns. We operate most of our technology from dual-primary data centers in the cloud, with one located in the East US region and the other in the West US region. Either site alone is capable of running all of our essential systems. In addition, we maintain technology operations from regions in East Asia, West US and South Central US regions. Replicated instances of this technology are maintained in our East US region. All regions are built and equipped to best-practice standards of physical security with appropriate environmental monitoring and safeguards. Failover for the majority of our systems is automated.


text: Board Governance and Management Our global cybersecurity processes are managed primarily by our CISO, whose experience includes approximately 25 years of service in roles relating to assessing, managing and providing oversight for cybersecurity risks at public and private entities; our CIO, whose experience includes managing the technology professionals and processes at public commercial real estate advisors, and our CFO, whose experience includes risk management and specialized financial knowledge. Pursuant to the Audit Committee charter, the Audit Committee oversees the management of the Company's risk management process, including the identification, prioritization, assessment and management of risks related to cybersecurity. While our Board and Audit Committee members have broad experience in risk management and in some cases technological expertise relating to cybersecurity, our CISO and CIO and management teams handle cybersecurity threat management. The CISO and CIO provide the Board and Audit Committee periodic reports regarding the Company's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of our information security program, and any issues associated with the emerging threat landscape. In addition, the CISO provides periodic reports to our executive officers, members of the boards of certain of our regulated entities internationally and other members of our senior management as appropriate. Material events and updates are reported to the full Board and Audit Committee annually and on an ad hoc basis where warranted based on the level of materiality of any such incidents as determined by the incident reporting and escalation process led by our CISO and CIO. Our processes are regularly evaluated by internal and external experts, with the results of those reviews reported to senior management and, where appropriate, the Board and Audit Committee.


text: Although we believe risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition to date, they may in the future, and we continue to closely monitor risks from cybersecurity threats. For additional information on the impact of cybersecurity matters on us, see "Risks Related to Our Business—Risks Related to Our IT Systems and Cybersecurity" in Part I, Item 1A, Risk Factors of this Annual Report on Form 10-K.


text: We consider cybersecurity protection, including protection of sensitive customer, employee, and partner information, to be a priority in the Company's business, strategy, and management. Carvana's enterprise risk management program, which is designed to identify, evaluate, and respond to our high priority risks and opportunities, integrates assessment, review, identification and management of cybersecurity risks.

companyName: CARVANA CO.

ticker: CVNA


text: The Audit Committee is responsible for ensuring sufficient oversight of our cybersecurity risk exposures and leads the full Board in periodic reviews of the adequacy and effectiveness of our information security program and internal controls, including quarterly and ad hoc updates of cybersecurity risks, initiatives, and key metrics. Senior leaders from our Information Security, Legal and Compliance teams provide the Board and Audit Committee with periodic briefings of our current risks and security strategy, as well as future plans with regard to cybersecurity posture, preparation, prevention, and incident response.


text: Our Chief Information Security Officer ("CISO"), who has extensive cybersecurity knowledge and experience, with over ten years in the field of information security, is primarily responsible for assessing and managing cybersecurity risk. The CISO oversees a team of dedicated information security professionals (the "Information Security Team") who focus on specialty areas such as application security, security compliance, security architecture and engineering, vulnerability management, and security operations, each with relevant experience and industry certifications in their respective areas.


text: The Information Security Team leverages a variety of processes and controls to stay informed of and manage cybersecurity risk. It partners with a variety of business units, including our engineering, legal, compliance, internal audit, technology, and product teams to identify and control emerging risks. We also from time to time engage third parties to assist in investigating and remediating security incidents, monitoring of security vulnerabilities, and performing risk assessments based on industry standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Our Information Governance Committee, whose members include representatives from the Information Security Team and key senior leaders from relevant stakeholder groups, meets quarterly to review and discuss, among other topics, the implementation and management of these cybersecurity processes. The Information Security Team additionally has adopted security control principles based on ISO 27002:2022 and uses various formalized incident management and monitoring standards and incident response plans and playbooks, which define immediate steps in the event of a cybersecurity incident, roles and responsibilities, as well as materiality criteria to allow for efficient and effective incident management. This includes a third-party vendor management procedure, under which we conduct vendor risk assessments and, when appropriate, ongoing threat monitoring. In implementing these policies, the Information Security Team utilizes a layered approach, aided by industry leading technology, to detect, respond, and prevent cybersecurity risks and exposures.


text: As of the date hereof, we have not experienced any material cybersecurity incidents. However, future incidents, whether direct or through our third-party providers, could have a material impact on our business strategy, results of operations, or financial condition. The Company maintains cybersecurity insurance to mitigate the risks of a material cybersecurity incident; however, the costs may exceed our coverage and, therefore, may not be fully insured. See Part I, Item 1A - "Risk Factors" in this Annual Report on Form 10-K for a further discussion of various cybersecurity risks to the Company.


text: We consider cybersecurity protection, including protection of customer, employee, and partner information, to be a priority in the Company's business, strategy, and management. Carvana's enterprise risk management program, which is designed to identify, evaluate, and respond to our high priority risks and opportunities, integrates assessment, review, identification and management of cybersecurity risks.


text: While management is responsible for the day-to-day handling of our risk management program, the Board of Directors, as a whole and through its committees, oversees risk management, including cybersecurity risks. The Board has delegated certain risk management responsibilities with respect to cybersecurity to the Audit Committee, which is responsible for ensuring sufficient oversight of our cybersecurity risk exposures. The Audit Committee leads the full Board in periodic reviews of the adequacy and effectiveness of our information security program and internal controls, including quarterly and ad hoc updates of cybersecurity risks, initiatives, and key metrics. Senior leaders from our Information Security, Legal, Privacy, and Compliance teams provide the Board and Audit Committee with periodic briefings of our current risks and security strategy, as well as future plans with regard to cybersecurity posture, preparation, prevention, and incident response.


text: O ur Chief Information Security Officer ("CISO"), who has extensive cybersecurity knowledge and experience, with over 15 years in the field of information security, including over seven years of experience leading information security departments within financial services and technology organizations as a cybersecurity executive, is primarily responsible for assessing and managing cybersecurity risk. The CISO oversees a team of dedicated information security professionals (the "Information Security Team") who focus on specialty areas such as application security, security compliance, security architecture and engineering, vulnerability management, and security operations, each with relevant experience and industry certifications in their respective areas.


text: In the event that management identifies significant risk exposures with respect to cybersecurity, it will present such exposure to our Audit Committee. Our Cyber Security Incident Response Plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. This would include notifying the appropriate individuals, investigating the incident, evaluating materiality, and responding to the incident. We have in the past and may continue to retain outside legal counsel, where necessary, to guide incident response efforts and perform a confidential and privileged review of the facts and circumstances surrounding suspected or confirmed cybersecurity incidents. If an incident were to occur, the Company may engage other service providers, where needed, to assist with the collection of forensic artifacts and perform additional procedures necessary to resolve and report any material cybersecurity incidents. Although we have cyber insurance and believe that our cybersecurity processes and controls are adequate, cybersecurity risk has increased due to remote access and increased sophistication of cybersecurity adversaries, as well as the increased frequency of malware attacks. As such, technology failures or cybersecurity breaches could still create system disruptions or unauthorized disclosure or alterations of confidential information and disruptions to the systems of our third-party suppliers and providers.

companyName: WARRIOR MET COAL, INC.

ticker: HCC


text: The Information Security Team leverages a variety of processes and controls to stay informed of and manage cybersecurity risk. It partners with a variety of business units, including our engineering, legal, privacy, compliance, internal audit, technology, and product teams to identify and control emerging risks. The Information Security and privacy teams also from time to time engage consultants and other third parties to assist in investigating and remediating security incidents, monitoring of security vulnerabilities, and performing risk assessments based on industry standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Our Information Governance Committee, whose members include representatives from the Information Security Team and key senior leaders from relevant stakeholder groups, meets quarterly to review and discuss, among other topics, the implementation and management of these cybersecurity processes. The Information Security Team additionally has adopted security control principles based on ISO 27002:2022 and partners with counterparts in our legal department to use various formalized incident management and monitoring standards and incident response plans and playbooks, which define immediate steps in the event of a cybersecurity incident, roles and responsibilities, as well as materiality criteria to allow for efficient and effective incident management. This includes a third-party vendor management procedure, under which we conduct vendor risk assessments and, when appropriate, ongoing threat monitoring. In implementing these policies, the Information Security Team utilizes a layered approach, aided by industry leading technology, to detect, respond, and prevent cybersecurity risks and exposures.


text: As of the date hereof, we have not experienced any material cybersecurity incidents. However, future incidents, whether direct or through our third-party providers, could have a material impact on our business strategy, results of operations, or financial condition. We maintain cybersecurity insurance to mitigate the risks of a material cybersecurity incident; however, the costs may exceed our coverage and, therefore, may not be fully insured. See Part I, Item 1A - "Risk Factors" in this Annual Report on Form 10-K for a further discussion of various cybersecurity risks to the Company.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws; other litigation and legal risk; and reputational risks. We have in place and continuously monitor and improve cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks. We continue to make investments in people, processes and technology to enhance our cybersecurity risk assessment, identification and management capabilities and to strengthen our cybersecurity risk response posture. Additionally, as part of the Company's Information Technology controls framework, management has established a suite of preventative and detective controls which enhance and strengthen the Company's cybersecurity program.


text: We rely on information systems and networks as well as various other technologies to conduct and support our business. We have implemented security protocols, controls, and systems with the intent of maintaining the physical and electronic security of our operations and protecting our and our counterparties' confidential information and information related to identifiable individuals against unauthorized access. Some of these systems and networks are managed, hosted, and provided by third parties, and as a result, are also sources of cybersecurity risk. Third party cybersecurity incidents could affect a provider's ability to deliver a product or service to the Company or result in lost or compromised information of the Company or its customers. We have implemented measures intended to secure our information systems and networks and prevent unauthorized access to or loss of sensitive data. Where third parties house financially significant or sensitive data, the Company obtains and reviews attest reports covering cyber-related controls at these third parties, designs and implements complementary user entity controls, maintains open lines of communication for cyber incident notifications, and has contractual safeguards in place in the event a cyber incident occurs.


text: We evaluate cybersecurity risk independently, and we have integrated cybersecurity risk into the Company's overall Enterprise Risk Management ("ERM") process. The IT function is responsible for cybersecurity risk and reports to our Chief Administrative Officer. The Chief Financial Officer and the Director of Treasury and Risk Management are responsible for our ERM process, which is performed annually and updated throughout the year and involves a cross-functional group of management, including our Director of IT who has over 20 years of information technology experience. Pursuant to our ERM process, cybersecurity risk is evaluated based on likelihood, severity, speed of onset and persistence (the duration of time during which the organization could be impacted). The Company also leverages third parties, where needed, in connection with cybersecurity risk management, strategy and incident response.


text: We have been and may be subject to security breaches, which have resulted in and could result in unauthorized access to our facilities or the information that we are trying to protect. When these incidents occur, we have taken appropriate remediation steps and, through investigation, determined that the events or incidents did not have a material effect on our business, results of operations, or financial results. Although we are not aware of any material cybersecurity incidents, because of the past cybersecurity threats and what we have learned in responding to those threats, we have enhanced our cybersecurity protection efforts.


text: The Audit Committee of the Board of Directors oversees the Company's cybersecurity posture and the steps taken by management to monitor, identify, and mitigate cybersecurity risks. The Information Technology team briefs the Audit Committee on the effectiveness of the Company's cyber risk management program, typically on an annual basis.

companyName: Ranger Energy Services, Inc.

ticker: RNGR


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Terrorist attacks and cyber-attacks or other security breaches may negatively affect our business, financial condition and results of operations and cash flows" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

stage1Category: None/Other


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. Though management is responsible for the day-to-day management of risks the Company faces, including cybersecurity risks, the Board, as a whole and through its committees, has the ultimate responsibility for oversight of the Company's risks and risk management strategy. The company performs assessments to evaluate its cybersecurity risk as it relates to the organization and assets.


text: The Board has delegated to certain committee's oversight responsibility for risks that are directly related to each such committee's area of focus. The Audit Committee oversees our major financial risk exposures, including cybersecurity. The Audit Committee receives periodic reports from management regarding cybersecurity and management's assessment of current and future cybersecurity risks. The ERM process, which includes cybersecurity, is performed annually and updates are discussed quarterly, both internally and with the Audit Committee. The Audit Committee communicates the results of the annual process and quarterly updates to the full Board. The Board and committees thereof, including the Audit Committee, regularly receive reports from the Company's management and the Company's outside counsel, as appropriate, regarding the risks faced by, or anticipated to be faced by, the Company, including risks from cybersecurity threats. When such reports relating to cybersecurity are delivered to the Audit Committee, the Audit Committee's review of such reports, and discussions with management, informs the Audit Committee in detail of the material risks facing the Company related to cybersecurity.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws; other litigation and legal risk; and reputational risks. Our enhanced approach is grounded in industry-leading practices, including the National Institute of Standards and Technology Cybersecurity Framework version 2.0, and is designed to actively manage cyber risks while embedding cybersecurity into our Company's workplace culture. We have in place and continuously monitor and improve cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks. We continue to make investments in people, processes and technology to enhance our cybersecurity risk assessment, identification and management capabilities and to strengthen our cybersecurity risk response posture. Additionally, as part of the Company's Information Technology controls framework, management has established a suite of preventative and detective controls which enhance and strengthen the Company's cybersecurity program.


text: Centuri's cybersecurity team performs independent reviews of new vendors whose services may be potentially integrated within the Centuri enterprise. As part of a standardized review process, Centuri's cybersecurity team maintains a Control Assurance Toolkit to review vendor activities, practices, and controls for alignment with Centuri's policies and procedures. Resulting control recommendations are coordinated to ensure appropriate implementation during integration activities.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan, employee training, testing and assessments and a third party risk management process.

companyName: Lemonade, Inc.

ticker: LMND


text: Our program is informed by best practice approaches relevant to the technologies we use, the environments in which our services are designed and deployed, our business needs, and relevant regulatory requirements. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the various standards and frameworks as guides to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common approaches, reporting channels, and governance processes that apply the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Centuri undertakes vulnerability, attack, and penetration testing via a third-party audit. As part of its general control practices, Centuri performs a review of service organizational controls reports for in-scope vendors to ensure adherence to generally accepted cybersecurity practices. Any reported weaknesses and associated responses are captured and evaluated for impact, and subsequently provided to Centuri leadership for review and response.


text: Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Security tools deployed in the IT environment for protection against and monitoring of suspicious events; • Security awareness training of our employees, incident response personnel, and senior management; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A third-party risk management process for service providers, suppliers, and vendors who access our data and/or systems.


text: We have not identified known cybersecurity threats to date that could have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats such as loss or theft of data, disruptive attacks from financially motivated bad actors, and third party supply chain issues that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Risks Relating to Our Business."


text: Cybersecurity Governance Our Board considers cybersecurity risk as a critical part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management.


text: The Audit Committee periodically receives reports on our cybersecurity risks from our Chief Information Security Officer ("CISO") or his designee at least twice annually. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents or incidents with lesser impact potential.


text: The Audit Committee regularly reports its activities, including those related to cybersecurity, to the full Board. The full Board also receives briefings from management on our cyber risk management. As part of the Board's continuing education on topics that impact public companies, Board members receive presentations on cybersecurity topics from our CISO or his designee.


text: The management team delegates responsibility for assessing and managing our cybersecurity risks to the CISO. The CISO has primary responsibility for our overall cybersecurity risk management and supervises both our internal cybersecurity personnel and any external cybersecurity consultants. The CISO has over two decades of security work that includes work for large global enterprises, managing global security teams, and establishing and running security programs for both conventional and high-tech companies, including publicly traded and regulated companies. The CISO reports to an internal security team periodically regarding current security posture, risk, and trending security incidents and threats relevant to the Company. The security team comprises key management personnel, department heads, and business unit leaders.