text: Governance. As discussed in more detail under the heading "Governance," the Board maintains an active role concerning cybersecurity risk management including oversight of the Company's employee personnel with extensive experience in the field.

companyName: Axe Compute Inc.

ticker: AGPU


text: While the Board has the primary responsibility for risk oversight, the Audit Committee assists the Board in fulfilling its oversight responsibility with respect to the management of cybersecurity-related risks. Through its Cybersecurity Subcommittee, the Audit Committee periodically reviews and discusses with management, including the Vice President of Information Technology, (i) the Company's information security strategy, priorities and objectives; (ii) the Company's technology and information security risks, including with respect to cybersecurity and data privacy; and (iii) the steps management has taken to manage cybersecurity.

companyName: Air Transport Services Group, Inc.

secItem: Item 1C

stage1Category: Board Governance

stage1Method: unanimous


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or that are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, the nature of potential cybersecurity risks and threats are uncertain, and any future incidents, outages or breaches may materially affect our business strategy, results of operations or financial condition. For additional discussion of potential risks regarding cybersecurity, please see the information contained in Risk Related to Business Interruptions and Cybersecurity Incidents in Part 1A of this Form 10-K.

stage1Category: Strategy Integration


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: EXPAND ENERGY Corp

ticker: EXE


text: We design and assess our cybersecurity risk management program guided by the NIST Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

stage1Category: Risk Management Process


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes, but is not limited to, the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • systems for protecting information technology systems and monitoring for suspicious events, such as threat protection, firewall and anti-virus software; • cybersecurity awareness training of our employees and contractors, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, software, and vendors who access our data and/or systems.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A. Risk Factors "Cyber-attacks targeting systems and infrastructure used by the gas and oil industry and related regulations may adversely impact our operations and, if we or our third-party providers are unable to obtain and maintain adequate protection for our key systems and data, our business may be harmed."


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as a critical part of the enterprise and its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Our Audit Committee receives quarterly updates from management on our cybersecurity risks. In addition, management updates our Audit Committee, as necessary, regarding any material cybersecurity incidents.


text: Our Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Our Board of Directors also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from information security management, internal security staff, our internal audit group and external experts as part of our Board of Director's continuing education on topics that impact public companies.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including, as appropriate, briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, such as external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Our Cybersecurity Manager is responsible for assessing and managing risks from cybersecurity threats, our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Cybersecurity Manager is responsible for reporting material incidents to our Cybersecurity Committee that includes our Chief Financial Officer, General Counsel and Corporate Secretary, and our Chief Information Officer. Our internal cybersecurity team has over 50 years of combined experience in information security and maintains several cybersecurity certificates including but not limited to CISSP, CISM, SRISC, GSEC, and GCFE. Our Cybersecurity team regularly participates with private energy industry and federal security working groups and organizations.

stage1Category: Management Role


stage1Method: majority


text: We design and assess our cybersecurity risk management program guided by the NIST Cybersecurity Framework to help us identify, assess and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program includes, but is not limited to, the following key elements: • risk assessments designed to help identify and address material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • systems for protecting information technology systems and monitoring for suspicious events, such as threat protection, firewall and anti-virus software; • cybersecurity awareness training for all of our employees and contractors; • a cybersecurity incident response plan that includes procedures for responding to, escalating, and reporting cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, software, and vendors who access our data and/or systems.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A. Risk Factors "Cyber-attacks targeting systems and infrastructure used by the gas and oil industry and related regulations may adversely impact our operations and, if we or our third-party providers are unable to obtain and maintain adequate protection for our key systems and data, our business may be harmed."


text: Our Audit Committee receives bi-annual updates from management on our cybersecurity risks. In addition, management updates our Audit Committee, as necessary, regarding any significant cybersecurity incidents.


text: Our Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Our Board of Directors also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from information security management, internal security staff, our internal audit group and external experts as part of our Board of Director's continuing education on topics that impact public companies.


text: Our Cybersecurity Manager leads our cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Cybersecurity Manager is responsible for assessing and managing risks from cybersecurity threats and reporting significant incidents to our Cybersecurity Committee, which includes our Chief Financial Officer, General Counsel and Corporate Secretary, Chief Information Officer, Cybersecurity Manager and Director of Internal Audit. Our Cybersecurity Manager has over 20 years of experience in information security and incident response and our internal cybersecurity team has over 50 years of combined experience in information security and maintains several cybersecurity certificates including but not limited to CISSP, CISM, SRISC, GSEC, and GCFE. Our Cybersecurity team regularly participates with private energy industry and federal security working groups and organizations.


text: Cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are fully integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are subject to oversight by the Company's Board of Directors. The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with the goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; and (iv) maintaining the confidence of our customers, clients and business partners.

companyName: EQUITY LIFESTYLE PROPERTIES INC

ticker: ELS


text: Risk Management and Strategy Consistent with overall ERM policies and practices, the Company's cybersecurity program focuses on the following areas: • Vigilance: The Company maintains a primarily domestic presence, with our cybersecurity threat operations designed with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, software updates and patches, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides periodic mandatory training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated periodically. • Communication and Coordination: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management, internal audit and other key business functions, as well as the members of the Board of Directors and the Audit Committee in an ongoing dialogue regarding cybersecurity threats and incidents.


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board of Directors, and the Company considers adjustments to its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.


text: The Company is not aware of any cybersecurity incidents in the last three years that have materially affected or are reasonably likely to materially affect the business strategy, results of operations, or financial condition of the Company. For more information regarding how cybersecurity threats could materially affect the Company, see "We Face Risks Relating to Cybersecurity Incidents and Privacy Laws." in Item 1A. Risk Factors.


text: The Board of Directors, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board of Directors and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board of Directors and the Audit Committee receive prompt and timely information regarding any cybersecurity incident that meets established reporting guidelines. Decisions regarding the disclosure and reporting of such incidents are made by management in a timely manner. The Board of Directors and Audit Committee receive ongoing updates regarding any such incidents until they have been addressed. The Audit Committee regularly interacts with the Company's ERM function, the Company's Vice President of Information Technology, other members of management and relevant management committees, including the Company's Security Advisory Board and Cybersecurity Incident Response Team. On a quarterly basis each year, the Audit Committee discusses the Company's approach to cybersecurity risk management with the Company's Vice President of Information Technology.


text: The Company's Vice President of Information Technology is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Vice President of Information Technology works in coordination with the other members of the Security Advisory Board, which includes our President and Chief Executive Officer, Executive Vice President and Chief Financial Officer and Executive Vice President and Chief Legal Officer. The Company's Vice President of Information Technology has over 25 years in Information Technology leadership including 15 years overseeing security and compliance operations. The Director of Information Security has over 15 years in various security roles in private and public sectors and has attained the professional certification of Certified Information Systems Security Professional (CISSP).


text: Our Chief Information Officer (CIO) meets at a regular cadence with a member of the board of directors who is the board's cybersecurity designee. The CIO also briefs the audit committee on the effectiveness of Wolfspeed's cyber risk management program quarterly or in accordance with significant events. In addition, the board of directors is advised by our CIO on Wolfspeed's cybersecurity risk exposures and steps taken to monitor and mitigate cybersecurity risks.

companyName: WOLFSPEED, INC.

ticker: WOLF


text: The Company's Vice President of Information Technology and Director of Information Security, in coordination with the Security Advisory Board and Cybersecurity Incident Response Team, work collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through the ongoing communications from these teams, the Vice President of Information Technology and Director of Information Security, in coordination with the Security Advisory Board and Cybersecurity Incident Response Team monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.


text: Risk Management and Strategy Consistent with overall ERM policies and practices, the Company's cybersecurity program focuses on the following areas: • Vigilance: The Company maintains a primarily domestic presence, with our cybersecurity threat operations designed with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, software updates and patches, anti-malware functionality and access controls, all of which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity threats and risks. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides periodic mandatory training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested, evaluated and adjusted periodically. • Communication and Coordination: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management, internal audit and other key business functions, as well as the members of the Board of Directors and the Audit Committee in an ongoing dialogue regarding cybersecurity threats and incidents.


text: Wolfspeed's Senior Director of Information Security leads our InfoSec GRC organization and is responsible for the implementation, operation, and monitoring of our cybersecurity risk management program. Our Senior Director of Information Security reports to the CIO, who reports to the Executive Vice President, Chief Financial Officer. The Senior Director of Information Security has over 16 years of experience in the cybersecurity space and has completed advanced training in the fields of cybersecurity and technology.


text: The Company's Vice President of Information Technology is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Vice President of Information Technology works in coordination with the other members of the Security Advisory Board, which includes our President and Chief Executive Officer, Executive Vice President and Chief Financial Officer and Executive Vice President and Chief Legal Officer. The Company's Vice President of Information Technology has over 26 years in Information Technology leadership including 16 years overseeing security and compliance operations. The Director of Information Security has over 15 years in various security roles in private and public sectors and has attained the professional certification of Certified Information Systems Security Professional (CISSP).


text: Risk Management and Strategy We maintain a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. The program aligns with Wolfspeed's Enterprise Risk Management (ERM) program and addresses information technology and business environments. Our cyber risk management program is designed based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and we aim to incorporate industry best practices throughout.


text: Our Information Security (InfoSec) Governance, Risk and Compliance (GRC) organization leverages multiple methods and overlapping capabilities to protect the confidentiality, integrity and availability of our data, information and intellectual property. Assessments of Wolfspeed's cyber program are conducted by internal audit and third-party information and cyber experts to monitor the effectiveness and maturity level of Wolfspeed's cybersecurity program.


text: Cybersecurity tabletop exercises and event simulations are conducted with management, incorporating external resources and advisors, to test our ability and preparedness to respond to cyber threats and identify any areas of weakness. The program, standard operating procedures and supporting tools for determining thresholds for materiality are incorporated as a key component to the incident response program and related activities.


text: All employees are required to complete cybersecurity training semiannually, with additional on-demand training and phishing campaigns offered throughout the year. InfoSec GRC's approach to cybersecurity is structured to align with Wolfspeed's business goals, objectives and regulatory requirements and covers all company locations, globally.


text: Engagement of Third Parties Given the complex and quickly evolving nature of cybersecurity threats, we engage third-party advisors to assist our team in developing and maintaining effective cybersecurity risk management. Partnering with external entities allows us to leverage specialized knowledge and insights, better ensuring our cybersecurity strategies and processes are well-designed and effective. For example, in 2023 we engaged a global cybersecurity leader to conduct an external assessment of our Information Security program, which included consideration of the cybersecurity framework, organizational structure and collective capabilities.


text: Oversight of Third-party Risk As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits and ongoing risk assessments. Our cybersecurity risk management extends to risks associated with our use of third-party service providers. For example, we conduct security risk assessments of third-party providers that request or require access to our digital and information assets.


text: As of the date of this Annual Report, we have not identified a material cyber incident that would have a material impact on our business, results of operations, or financial condition; however, the occurrence or scope of such events is not always immediately apparent and there can be no assurance that we will not suffer a material cyber incident in the future. Refer to Item 1A "Risk Factors" of this Annual Report for further discussion on cybersecurity risks.


text: The board of directors, as a whole, has oversight responsibility for our strategic and operational risks. The audit committee assists the board of directors with this responsibility by reviewing and discussing our risk program and practices, including cybersecurity risks, with members of senior leadership and management. In turn, the audit committee periodically reports on its review to the full board of directors.


text: Responsible for assessing and managing our cyber risk management program, the InfoSec GRC organization is comprised of multiple teams that address and respond to cyber risk related to identification and access management, data protection, security architecture and engineering, security operations, insider threat, and cyber defense. The InfoSec GRC oversees compliance with our cybersecurity framework, including benchmarking, within the organization and facilitates cybersecurity risk management activities. The InfoSec GRC teams also oversee the review and approval process of policies and the security awareness program. Each team reports directly to the Senior Director of Information Security who is responsible for informing the CIO, information technology leadership and senior leadership teams on the prevention, detection, mitigation, and remediation of the program, including cybersecurity incidents.


text: Risk Management and Strategy We maintain a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. The program aligns with Wolfspeed's Enterprise Risk Management ("ERM") program and addresses information technology and business environments. Our cyber risk management program is designed based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and we aim to incorporate industry best practices throughout.


text: Our Information Security ("InfoSec") Governance, Risk and Compliance ("GRC") organization leverages multiple methods and overlapping capabilities to protect the confidentiality, integrity and availability of our data, information and intellectual property. Assessments of Wolfspeed's cyber program are conducted by internal audit and third-party information and cyber experts to monitor the effectiveness and maturity level of Wolfspeed's cybersecurity program.


text: Engagement of Third Parties Given the complex and quickly evolving nature of cybersecurity threats, we engage third-party advisors to assist our team in developing and maintaining effective cybersecurity risk management. Partnering with external entities allows us to leverage specialized knowledge and insights, better ensuring our cybersecurity strategies and processes are well-designed and effective. For example, in 2025 we engaged a global cybersecurity leader to conduct an external assessment of our Information Security program, which included consideration of the cybersecurity framework, organizational structure and collective capabilities.


text: As of the date of this Annual Report, we have not identified a material cyber incident that would have a material impact on our business, results of operations, or financial condition; however, the occurrence or scope of such events is not always immediately apparent and there can be no assurance that we will not suffer a material cyber incident in the future. Refer to Part 1, Item 1A "Risk Factors" of this Annual Report for further discussion on cybersecurity risks.


text: Our Chief Information Officer (the "CIO") meets at a regular cadence with a member of the board of directors who is the board's cybersecurity designee. The CIO also briefs the audit committee on the effectiveness of Wolfspeed's cyber risk management program quarterly or in accordance with significant events. In addition, the board of directors is advised by our CIO on Wolfspeed's cybersecurity risk exposures and steps taken to monitor and mitigate cybersecurity risks.


text: Wolfspeed's VP, Chief Information Security Officer (the "CISO"), with over 25 years of experience in Fortune 500 companies including in aspects of IT, infrastructure, information security including multiple CISO roles, and certifications across IT and information security, leads our InfoSec GRC organization and is responsible for the implementation, operation, and monitoring of our cybersecurity risk management program. Our CISO reports to the CIO, who reports to the Chief Executive Officer.


text: Responsible for assessing and managing our cyber risk management program, the InfoSec GRC organization is comprised of multiple teams that address and respond to cyber risk related to identification and access management, data protection, security architecture and engineering, security operations, insider threat, and cyber defense. The InfoSec GRC oversees compliance with our cybersecurity framework, including benchmarking within the organization and facilitates cybersecurity risk management activities. The InfoSec GRC teams also oversee the review and approval process of policies and the security awareness program. Each team reports directly to the Senior Director of Information Security who is responsible for informing the CIO, information technology leadership and senior leadership teams on the prevention, detection, mitigation, and remediation of the program, including cybersecurity incidents.


text: Cybersecurity risk management, strategy and governance Risk oversight and management is a key role for the Board and its committees. The Board is responsible for identifying and understanding Enbridge's principal risks and ensuring that appropriate systems are implemented to monitor, manage and mitigate those risks. The committees of the Board have oversight over risks within their respective mandates.

companyName: ENBRIDGE INC

ticker: ENB


text: Oversight of cybersecurity is integrated into the responsibilities of the Board. The Audit, Finance and Risk Committee (the AFRC) provides oversight of cybersecurity matters, particularly as they relate to financial risk and controls, integrity of financial data and public disclosures, and security of the cyber landscape across data and digital. The Safety and Reliability Committee (SRC) has oversight responsibility for security (physical, data and cyber) including as it relates to operational risk and controls, safety, operations integrity and reliability, and asset operations.


text: Management provides regular reports to the Board at every meeting to review our top risks, identify trends and help manage risk. This includes quarterly reports to the AFRC and SRC on cybersecurity matters. In addition, on an annual basis management prepares and provides to the Board and its committees a corporate risk assessment (CRA), which analyzes and prioritizes enterprise-wide risks (including cybersecurity), highlighting top risks and trends. The annual CRA is an integrated enterprise-wide process. We assess and rank risks based on impact and probability, and we strive to ensure that mitigation measures are appropriately designed, prioritized and resourced. The CRA report is reviewed by the Board committees with responsibility for the risk category relevant to their mandate and is provided to the Board, which coordinates Enbridge's overall risk management approach. Complementary to the CRA, management prepares and provides to the SRC an annual top operational risk report that highlights the highest consequence operational risks across Enbridge and includes further detail on the risks and their treatment. This information helps inform the Board about the potential impact of top operational risks and that appropriate treatments are in place to manage those risks.


text: Cybersecurity has been identified as a top risk as attacks against participants in our industry have continued to increase in sophistication and frequency over the years. Cybersecurity risk is described in Item 1A. Risk Factors.

stage1Category: None/Other


text: Enbridge's management is responsible for the implementation of risk management strategies and monitoring performance. The technology and information services (TIS) function is centralized under the Senior Vice President & Chief Information Officer (CIO), who has over two decades of international leadership in the business of technology. We also engage independent third parties to assess our cybersecurity program, track their recommendations and use those to further improve the program. Reporting to the CIO is the Chief Information Security Officer who is in charge of our cybersecurity program and oversees the 24x7x365 Security Operations Center (SOC).


text: We conduct continuous assessments of our cybersecurity standards, perform regular tests of our ability to respond and recover, and monitor for potential threats. To further mitigate threats, we collaborate with governments and regulatory agencies, and take part in external events to learn and share. Our workforce participates in regular security awareness training, including exercises to build capabilities to identify and report suspect phishing emails to our SOC. In the last year, we continued to expand the cybersecurity training and simulated testing we administer to high-risk groups within the organization. A tailored cybersecurity training course has been implemented for team members in operational technology roles, and we have increased the frequency of phishing simulation tests.


text: We have a cybersecurity third party risk management program, which is an evolving, cross-functional program to help assess and mitigate risks from third party vendors and other service providers. Our cybersecurity team also uses several layers of defense and protection technologies, cybersecurity experts, and automated alerting and response mechanisms to reduce risk to Enbridge.


text: Although cybersecurity risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have experienced an increasing number of cybersecurity threats in recent years. For more information about the cybersecurity risks we face, see the risk factor entitled "Cyber attacks and other cybersecurity incidents pose threats to our technology systems and could materially adversely affect our business, operations, reputation or financial results." in Item 1A. Risk Factors.


text: The CIO meets regularly with leaders of our various information technology management teams to review and discuss our cybersecurity and other information technology risks and opportunities. Our global incident response plan sets forth a detailed security incident management and reporting protocol, with escalation timelines and responsibilities.

companyName: DARDEN RESTAURANTS INC

ticker: DRI


text: Cybersecurity risk management, strategy and governance O versight of cybersecurity is integrated into the responsibilities of the Board and its committees. The Board is responsible for identifying and understanding Enbridge's principal risks and ensuring that appropriate systems are implemented to monitor, manage and mitigate those risks. The committees of the Board have oversight over risks within their respective mandates.


text: The Audit, Finance and Risk Committee (AFRC) provides primary oversight of cybersecurity matters, including with respect to financial risk and controls, integrity of financial data and public disclosures, and security of the cyber landscape across data and digital. Management provides quarterly cybersecurity reports to the AFRC and the Board and also reports to the Safety and Reliability Committee, as deemed necessary, on cybersecurity issues related to safety, reliability and operations.


text: Each year, management prepares and provides to the Board and its committees a corporate risk assessment (CRA), which analyzes and prioritizes enterprise-wide risks, highlighting top risks and trends (including cybersecurity). The annual CRA is an integrated enterprise-wide process which engages each part of our business to assess and rank risks based on impact and probability. We strive to ensure that mitigation measures are appropriately designed, prioritized and resourced. The CRA report is reviewed by the Board committees with responsibility for the risk categories relevant to their mandate and is provided to the Board, which coordinates Enbridge's overall risk management approach. Complementary to the CRA, management prepares and provides to the Safety and Reliability Committee an annual top operational risk report that highlights the highest consequence operational risks across Enbridge and includes further detail on the risks and their treatment. This information helps inform the Board about the potential impact of top operational risks and of treatments in place to manage those risks.


text: Cybersecurity has been identified as a top risk, as attacks against participants in our industry have continued to increase in sophistication and frequency over the years. Although we devote significant resources and security measures to prevent unwanted intrusions and to protect our systems and data, we (and our third-party vendors) have experienced, and expect to continue to experience, cyber attacks of varying degrees in the conduct of our business, including, for example, denial of service attacks. Cybersecurity risk is described in Item 1A. Risk Factors.


text: Enbridge's management is responsible for the implementation of risk management strategies and monitoring performance. The technology and information services (TIS) function is centralized under the Senior Vice President & Chief Information Officer (CIO). We also engage independent third parties to assess our cybersecurity program, track their recommendations, and use those to further improve the program. Reporting to the CIO is the Chief Information Security Officer who is in charge of our cybersecurity program and oversees the 24x7x365 Security Operations Center (SOC).


text: We conduct continuous assessments of our cybersecurity standards, perform regular tests of our ability to respond and recover, and monitor for potential threats. To further mitigate threats, we collaborate with governments and regulatory agencies and take part in external events to learn and share. Our workforce participates in regular security awareness training, including exercises to build capabilities to identify and report suspect phishing emails to our SOC. In the last year, we continued to expand the cybersecurity training and simulated testing we administer to high-risk groups within the organization. A tailored cybersecurity training course has been implemented for team members in operational technology roles, and we have increased the frequency of phishing simulation tests.


text: We have a cybersecurity third-party risk management program, which is an evolving, cross-functional program to help assess and mitigate risks from third-party vendors and other service providers. Our cybersecurity team also uses several layers of defense and protection technologies, cybersecurity experts, and automated alerting and response mechanisms to reduce risk to Enbridge.

stage1Category: Third-Party Risk


text: Risk management and strategy As detailed in our risk factors included in Item 1A, Chubb recognizes the significant risks posed by cybersecurity and data protection challenges, which could adversely affect our business, financial condition, and results of operations. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems, and we evaluate changes and enhancements to our technology environment as well as conduct third party assessments to confirm that they meet our information security control requirements. Our cybersecurity program and control environment incorporate appropriate industry standards and best practices, such as the National Institutes of Standards and Technology Cyber Security Framework (NIST CSF), and is designed to comply with numerous U.S. federal and state and international laws, rules and regulations governing the protection of personal and confidential information of our clients and employees. We use various tools and methods to assess, identify and manage cybersecurity risk that are tested regularly, including the following:

companyName: Chubb Ltd

ticker: CB


text: Employee Training We endeavor to provide all employees with data protection training. Employees involved with information protection, privacy and other risk management specialties also engage in specialized role-based training as is practicable. We use a variety of training methods, including computer-based training, role-based training, company intranet awareness campaigns and various simulation exercises.


text: Data Protection Culture Chubb actively promotes a data protection culture. We maintain policies and standards designed to protect personal and corporate information. The policies and standards are developed by a multi-disciplinary team, with participation from information security and IT compliance, privacy, IT legal, compliance and business representatives.


text: Risk Assessments and Operational Audit Our information security policies and protocols undergo regular assessments and audits, and we engage with external parties to review our protections, including benchmarking to industry standards and best practices, such as the NIST CSF. In addition, we benchmark our programs against key regulatory frameworks and conduct technical assessments of our controls, which may include penetration testing and other technical testing. These processes are integrated into our established Enterprise Risk Management (ERM) framework, which is led by Chubb's senior management and overseen by our Board's Risk & Finance Committee. Refer to "Enterprise Risk Management" under Item 1 for further description of our ERM function and Board oversight.


text: Chubb uses risk-based processes to oversee and identify cybersecurity risks associated with the use of third-party service providers and third-party hardware. These processes include contractual controls as well as risk-based diligence processes, periodic assessments, and monitoring. Chubb recognizes the growing risk associated with third-party hardware, software, and services, and we have taken steps we believe are appropriate to manage those risks. We review third-party software and hardware in our environment to understand the components used and what impact they could have on our overall cyber risk environment.


text: To our knowledge, and as of the filing date on this annual report, risks from cybersecurity threats, including potential risks arising from previous cybersecurity incidents, have not materially affected, nor are they reasonably likely to materially affect Chubb's business strategy, results of operations, or financial condition. For more detail regarding cybersecurity threats, see our risk factor titled "A failure in our operational systems or infrastructure or those of third parties, including due to security breaches or cyber-attacks, could disrupt business, damage our reputation, and cause losses" under Item 1A.


text: Board and Management Governance We have cybersecurity and information technology oversight at the Board and management levels. Direct Chubb Board-level oversight is generally within the purview of two of the Board's committees: Audit and Risk & Finance.


text: The Audit Committee is responsible for oversight of our cybersecurity program and related exposures and risks. The Audit Committee periodically reports to the full Board and consults with the Risk & Finance Committee on such matters. The Audit Committee's review and oversight generally encompasses data breach risk and impact, cyber protection and detection controls, privacy matters, third-party risks (including risks from cybersecurity threats associated with any third-party service providers), cyber trends and events, and other topics. The Risk & Finance Committee is responsible for oversight of risk generally and identifying significant risks, which may include risks relating to cybersecurity and privacy, business continuity risk (including the resilience of IT operations and physical infrastructure) and cyber underwriting risk. The oversight responsibilities of the Audit and Risk & Finance Committees with respect to cyber security and information technology risks are each set forth in their respective charters. Members of management, including our Chief Information Security Officer (CISO) and Global Chief Technology Officer (CTO), regularly provide updates to these committees in person and through written reports. The Audit and Risk & Finance Committees also conduct a joint meeting on ERM matters, which includes coverage of strategic risk priorities, as well as Chubb's actions and mitigation efforts in response to such risks.


text: Cybersecurity risk management oversight is led by our CISO and CTO. Prior to joining Chubb in 2015, our CISO was Director of the threat analytics platform for a major cybersecurity incident detection and response company. Prior to that, our CISO was an executive leader within the information security practice and a technical architect with two global accounting firms. Our CTO has extensive experience as a chief technology officer in digital-first environments and was previously the chief technology officer of a large global bank, responsible for the bank's core infrastructure, end-user technology, production support, group architecture, cloud technology, and software license management. Our CTO holds a master's degree in geographical information systems and a bachelor's degree in artificial intelligence and computer science. Chubb management also benefits from the advice provided by a Cyber Advisory Board of external experts. The members of the Cyber Advisory Board have extensive experience and deep expertise on cybersecurity matters, several having served in senior government positions with executive responsibility for identifying and mitigating cyber threats across the globe.


text: Amedisys has established a cybersecurity risk management process that includes internal reporting of significant cybersecurity risk to our Enterprise Risk Management Committee ("ERMC") on a quarterly basis. In addition, our incident response plan includes processes to triage, assess severity, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. These processes are assessed annually during our penetration testing.

companyName: AMEDISYS INC


text: Chubb management continues to prioritize investments in cybersecurity to protect the confidentiality, integrity and availability of our data. In accordance with our cybersecurity risk assessment processes, we have deployed a set of cybersecurity controls to protect Chubb. We also maintain a data security incident response plan, applied at an enterprise level, to facilitate our ability to rapidly detect and address data security incidents with the goals of: (i) minimizing risk to data and systems; (ii) quickly recovering and resuming operations; (iii) where applicable, providing timely notice of an incident to regulators and providing timely notice and remediation services to affected individuals; (iv) minimizing potential brand damage; (v) managing litigation, investigations and disputes that may arise in the aftermath of an incident; and (vi) identifying opportunities to enhance Chubb's data security approach. Consistent with our incident response plan, the CISO informs the Chief Privacy Officer, who is a member of our legal team, and they notify other members of management of significant cybersecurity incidents and provide them with regular updates on the status of such incidents, including mitigation, remediation, and steps to avoid recurrence.


text: Risk management and strategy As detailed in our risk factors included in Item 1A, Chubb recognizes the significant risks posed by cybersecurity and data protection challenges, which could adversely affect our business, financial condition, and results of operations. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems, and we evaluate changes and enhancements to our technology environment as well as conduct third-party assessments to confirm that they meet our information security control requirements. Our cybersecurity program and control environment incorporate appropriate industry standards and best practices, such as the National Institute of Standards and Technology Cyber Security Framework (NIST CSF), and are designed to comply with numerous U.S. federal and state and international laws, rules, and regulations governing the protection of personal and confidential information of our clients and employees. We use various tools and methods to assess, identify, and manage cybersecurity risk that are tested regularly, including the following:


text: Technological Tools Chubb uses information security tools designed to protect information and systems. Our Information Security team regularly monitors these tools to discover and respond promptly to anomalous and suspicious patterns. We also participate in information sharing networks (government and private) and deploy system updates and other technologies.


text: Employee Training We endeavor to provide all employees with data protection training. Employees involved with information protection, privacy, and other risk management specialties also engage in specialized role-based training as is practicable. We use a variety of training methods, including computer-based training, role-based training, company intranet awareness campaigns, and various simulation exercises.


text: Data Protection Culture Chubb actively promotes a data protection culture. We maintain policies and standards designed to protect personal and corporate information. The policies and standards are developed by a multi-disciplinary team, with participation from information security and IT compliance, privacy, IT legal, compliance, and business representatives.


text: The Chief Information Security Officer ("CISO") regularly updates the Audit Committee and Allstate Board on Information Security Program status, cybersecurity risk management, the control environment, emerging threat intelligence and key risk and performance measurements. In addition, the CISO provides updates to senior leadership, the Audit Committee and the Allstate Board, as appropriate.

companyName: ALLSTATE CORP

ticker: ALL


text: The management-level responsibility for assessing and managing cybersecurity risk is led by our CISO and CTO. Prior to joining Chubb in 2015, our CISO was Director of the threat analytics platform for a major cybersecurity incident detection and response company. Prior to that, our CISO was an executive leader within the information security practice and a technical architect with two global accounting firms. Our CTO has extensive experience as a chief technology officer in digital-first environments and was previously the chief technology officer of a large global bank, responsible for the bank's core infrastructure, end-user technology, production support, group architecture, cloud technology, and software license management. Our CTO holds a master's degree in geographical information systems and a bachelor's degree in artificial intelligence and computer science. Chubb management also benefits from the advice provided by a Cyber Advisory Board of external experts. The members of the Cyber Advisory Board have extensive experience and deep expertise on cybersecurity matters, several having served in senior government positions with executive responsibility for identifying and mitigating cyber threats across the globe.


text: Chubb management continues to prioritize investments in cybersecurity to protect the confidentiality, integrity, and availability of our data. In accordance with our cybersecurity risk assessment processes, we have deployed a set of cybersecurity controls to protect Chubb. We also maintain a data security incident response plan, applied at an enterprise level, to facilitate our ability to rapidly detect and address data security incidents with the goals of: (i) minimizing risk to data and systems; (ii) quickly recovering and resuming operations; (iii) where applicable, providing timely notice of an incident to regulators and providing timely notice and remediation services to affected individuals; (iv) minimizing potential brand damage; (v) managing litigation, investigations, and disputes that may arise in the aftermath of an incident; and (vi) identifying opportunities to enhance Chubb's data security approach. Consistent with our incident response plan, the CISO informs the Chief Privacy Officer, who is a member of our legal team, and they notify other members of management of significant cybersecurity incidents and provide them with regular updates on the status of such incidents, including mitigation, remediation, and steps to avoid recurrence.


text: Amedisys recognizes the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational disruption, intellectual property theft, fraud, extortion, harm to employees or patients, violation of privacy or security laws and other litigation and legal risk. Amedisys has implemented various cybersecurity processes, technologies and controls to enhance our efforts to assess, identify and manage such material risks.


text: Amedisys deploys a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments and penetration testing, to inform our leadership team of cybersecurity-based risks. In addition, we schedule tabletop exercises with management and other employees to test our cyber incident response plans. Amedisys has also received HITRUST certification for our internally developed applications which allows us to baseline our program to industry standards and best practices.


text: Our cybersecurity program includes controls designed to identify, protect against, detect, respond to and recover from cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K) and to provide for the availability of critical data and systems to maintain regulatory compliance. These controls include the following activities: • Closely monitoring emerging data protection laws and implementing needed changes to our processes in order to comply. • Conducting annual cybersecurity management and incident training for all employees of the organization. • Requiring employees and third parties who provide services on our behalf to treat customer information and data with care. • Leveraging the HITRUST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident. • Carrying information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Additionally, Amedisys performs periodic internal and third-party assessments to test our cybersecurity controls and regularly evaluates our policies and procedures surrounding our handling and control of personal data and the systems we have in place to help protect us from cybersecurity threats or personal data breaches.


text: Our risk management processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or those who have access to our customer and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. Amedisys performs diligence on third parties that have access to our systems, data or facilities that house such systems or data and monitors cybersecurity threat risks identified through such diligence.


text: We face a number of cybersecurity risks in connection with our business (see Part I, Item 1A. "Risk Factors – Risks Related to our Operations – Our business depends on our information systems. A cyber-attack, security breach or our inability to effectively integrate, manage and keep our information systems secure and operational could disrupt our operations."). Although such risks have not materially impacted our business strategy, results of operations or financial condition to date, we have experienced threats to and breaches of our data and systems, including malware and computer virus attacks.


text: The Audit Committee of the Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. On an annual basis, management provides the Audit Committee with an overview of our cybersecurity threat risk management and strategy covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk mitigation related goals, our incident response plan and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The Audit Committee also receives materials, including a cybersecurity briefing, indicating current and emerging cybersecurity threat risks and describing the Company's ability to mitigate those risks.


text: The members of management who are responsible for assessing and managing cyber risk are the Chief Information Security Officer and the Chief Information Officer of the Company who, combined, have over 30 years of experience in managing cybersecurity. The ERMC has ultimate responsibility for the risk management of cyber risk and is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in addition to the cyber incident response and reporting processes.


text: Amedisys recognizes the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as such term is defined by the SEC in Item 106(a) of Regulation S-K. These risks include, among other things, operational disruption, intellectual property theft, fraud, extortion, harm to employees or patients, violation of privacy or security laws and other litigation and legal risk. Amedisys has implemented various cybersecurity related processes, technologies and controls to enhance our efforts to assess, identify and manage such material risks.


text: Amedisys deploys a range of tools and services, including regular network and endpoint monitoring and vulnerability assessments and penetration testing, to mitigate our cybersecurity-based risks. In addition, we schedule tabletop exercises with management and other employees to evaluate our cyber incident response plans. Amedisys has also received HITRUST certification for our internally developed applications which allows us to baseline our program to industry standards and best practices.


text: Our cybersecurity program includes controls designed to identify, protect against, detect, respond to and recover from cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K) and to provide for the availability of critical data and systems to maintain regulatory compliance. These controls include the following activities: • Closely monitoring emerging data protection laws and implementing needed changes to our processes to maintain compliance; • Conducting annual cybersecurity management and incident training for all employees of the organization; • Requiring employees and third parties who provide services on our behalf to treat customer information and data with care; • Leveraging the HITRUST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • Carrying information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident, although our insurance coverage may be insufficient to cover all losses from a cybersecurity incident or our insurer may deny coverage for a claim.


text: Additionally, Amedisys performs periodic internal and third-party assessments to evaluate our cybersecurity controls and regularly evaluates our policies and procedures surrounding our handling and control of personal data and the systems we have in place to help protect us from cybersecurity threats or personal data breaches.


text: Amedisys has established a cybersecurity risk management process that includes internal reporting of significant cybersecurity risk to our Enterprise Risk Management Committee ("ERMC") on a quarterly basis. In addition, our incident response plan includes processes to triage, assess severity, escalate, contain and investigate and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. These processes are assessed annually for effectiveness during our penetration testing.


text: Jeffrey Wright is senior vice president and CISO for Allstate. He is responsible for the development and execution of the security strategy which protects Allstate's information from external and internal cybersecurity threats. Mr. Wright has more than 20 years of information security leadership experience.


text: Our risk management processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or those who have access to our customer and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. Amedisys performs diligence on third parties that have access to our systems, data or that have facilities that house such systems or data and monitors cybersecurity threat risks identified through such diligence.


text: We face cybersecurity risks in connection with our business (see Part I, Item 1A. "Risk Factors – Risks Related to our Operations – Our business depends on our information systems. A cyber-attack, security breach or our inability to effectively integrate, manage and keep our information systems secure and operational could disrupt our operations."). Although such risks have not materially impacted our business strategy, results of operations or financial condition to date, we have experienced threats to and breaches of our data and systems, including malware and computer virus attacks, and future such events or circumstances could have a material adverse effect on our business and consolidated financial condition, results of operations or cash flows.


text: The Audit Committee of the Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The Audit Committee receives updates from management on a regular basis of our cybersecurity threat risk management and strategy covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk mitigation related goals, our incident response plan and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The Audit Committee also receives materials, including a cybersecurity briefing, indicating current and emerging cybersecurity threat risks and describing the Company's ability to mitigate those risks.


text: The members of management who are responsible for assessing and managing cyber risk are the Acting Chief Information Security Officer and the Acting Chief Information Officer of the Company who, combined, have over 30 years of experience in managing cybersecurity. Our Acting Chief Information Security Officer is responsible for our cybersecurity risk management program and reports directly to the Acting Chief Information Officer. The Acting Chief Information Officer is a member of the ERMC and accountable for informing and updating the ERMC on cybersecurity risk management. The ERMC has ultimate responsibility for the risk management of cyber risk and is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in addition to the Company's cyber incident response and reporting processes.


text: We have implemented and maintain a cybersecurity risk management program, which consists of, among other things, comprehensive processes to identify, assess, manage, and mitigate material cybersecurity threats as part of our broader enterprise risk management program. We utilize an internal team of cybersecurity professionals and, to some extent, data privacy professionals to oversee this program. Where appropriate, we obtain input from external experts on our program, including with respect to prevailing cybersecurity practices and the latest cyber threat trends. Cybersecurity Team.

companyName: USANA HEALTH SCIENCES INC

ticker: USNA


text: Our internal team of cybersecurity and data privacy professionals oversee, among other things, our cybersecurity risk management and mitigation, incident prevention, detection, and remediation. The leadership of these teams is comprised of various professionals with cybersecurity expertise, including our Vice President of Information Security and Disaster Recovery, who reports to our Chief Operating Officer. Our Vice President of Information Security and Disaster Recovery has a bachelor's degree in computer information systems, multiple university certifications in advanced cybersecurity, and over 30 years' experience in cybersecurity and technology roles at various companies. Our executive leadership team, with input from the above teams, is responsible for our overall enterprise risk management system and associated processes, and regularly considers cybersecurity risks in the context of other material risks to the Company. Risk Management Program Components, Training, and Incident Response.


text: As part of our cybersecurity risk management program, our incident response team tracks and logs cybersecurity and data privacy incidents across the Company to identify, assess, mitigate, remediate, and resolve any such incidents. Prior to forming a contractual relationship with a material vendor or third-party service provider that will have access to our information systems or data, we perform due diligence on their cybersecurity and data privacy posture. We conduct annual reviews and tests of our information security program and we periodically review and update our cybersecurity policies. We also periodically utilize qualified third parties to evaluate and assess our cybersecurity risk management program, including through conducting cybersecurity maturity assessments. We utilize cybersecurity user awareness trainings with our employees, cybersecurity insurance, business continuity mechanisms, tabletop exercises, penetration testing, and vulnerability scanning to evaluate the effectiveness of our information security program and improve our security measures and planning. The material results of these assessments are reported to our executive leadership team and the Governance, Risk and Nominating Committee of the Company's Board of Directors (the "Board").


text: At the management level, our Vice President, IT Security leads our enterprise-wide cybersecurity program and is primarily responsible for assessing and managing our material risks from cybersecurity threats. In performing his role, the Vice President, IT Security monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents and is a key stakeholder and participant in the Company's cybersecurity and privacy incident reporting framework described above. Our Vice President, IT Security reports to our CIO who, in turn, reports to our Chief Financial Officer.

companyName: SANMINA CORP

ticker: SANM


text: We have adopted a cybersecurity and data privacy incident response plan that provides a framework for identifying, classifying, documenting, and responding to cybersecurity and data privacy incidents and determining whether reporting of an incident is appropriate or required under regulatory standards. The plan also includes a materiality assessment framework to assist us in determining whether a security incident is "material" under the federal securities laws. A cross-functional working group reviews significant cybersecurity incidents under this framework to assess the incident and, among other things, determine whether further assessment and escalation of the incident within USANA is appropriate. Any incident assessed as being or potentially becoming material is immediately escalated to designated members of our executive leadership team. We consult with outside cybersecurity and data privacy consultants and legal counsel as appropriate, including on cyber incident significance and/or materiality analysis and disclosure matters, and designated members of our management team make the final materiality determinations and disclosure and other compliance decisions. Our management apprises the Governance Risk and Nominating Committee and, where necessary, our independent registered public accounting firm, of cybersecurity matters and relevant developments, as appropriate. Governance.


text: Our Board is actively involved in the assessment, oversight and management of the material risks that could affect the Company. The Board carries out its risk oversight and management responsibilities by monitoring risk directly as a full Board and, where appropriate, through its committees. The Board has delegated to the Governance, Risk and Nominating Committee the ultimate oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Our cybersecurity and data privacy professionals regularly discuss cyber risks and trends and, should they arise, any material incidents with management and the Governance, Risk and Nominating Committee. Material Risks from Cybersecurity Threats.


text: As a global company with operations and customers in 25 markets, we encounter a variety of cybersecurity threats. However, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats. Nevertheless, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see "Item 1A. Risk Factors." of this Annual Report on Form 10-K.


text: We have implemented and maintain a cybersecurity risk management program, which consists of, among other things, comprehensive processes to identify, assess, manage, and mitigate material cybersecurity threats as part of our broader enterprise risk management program. We utilize an internal team of cybersecurity professionals and data privacy professionals to oversee this program. Where appropriate, we obtain input from external experts on our program, including with respect to prevailing cybersecurity practices and the latest cyber threat trends. Cybersecurity Team.


text: Our internal team of cybersecurity and data privacy professionals oversee, among other things, our cybersecurity risk management and mitigation, incident prevention, detection, and remediation. The leadership of these teams is comprised of various professionals with cybersecurity expertise, including our Executive Vice President of Information Security and Disaster Recovery, who reports to our Chief Operating Officer. Our Executive Vice President of Information Security and Disaster Recovery has a bachelor's degree in computer information systems, multiple university certifications in advanced cybersecurity, and over 30 years' experience in cybersecurity and technology roles at various companies. Our executive leadership team, with input from the above teams, is responsible for our overall enterprise risk management system and associated processes, and regularly considers cybersecurity risks in the context of other material risks to the Company. Risk Management Program Components, Training, and Incident Response.


text: Management briefs the Audit Committee on a quarterly basis regarding our information security programs. As part of its oversight responsibilities, the Audit Committee regularly discusses and reviews with management, among other items, Aptar's compliance and cybersecurity programs. We also periodically test our systems for vulnerabilities and regularly engage third parties to conduct evaluations of our security controls whether through penetration testing, independent audit or consulting on best practices to address new challenges. An independent review of our cybersecurity program has been assessed against the National Institute of Standards and Technology (NIST) cybersecurity framework. In addition, we maintain cybersecurity insurance as part of our overall insurance portfolio.

companyName: APTARGROUP, INC.

ticker: ATR


text: Increased global cybersecurity threats and sophisticated, targeted computer crime could pose a risk to our operations. Aptar has strategically integrated cybersecurity risk management into a broader enterprise-wide risk management framework, and consists of administrative, operational, organizational, physical, and technical processes that we believe are appropriate to the scope and nature of our business. We believe this integrated approach allows cybersecurity considerations to be an integral part of our decision-making processes. Our risk management team works closely with our Information Security Department to continuously evaluate and address cybersecurity risks in alignment with our business and operational needs.


text: Our cybersecurity strategy focuses on continued strengthening of our security posture, improvement of security operational efficiencies, and preparedness for evolving business and technology needs including the detection, analysis, and response to known, anticipated or unexpected cybersecurity threats, management of material risks related to cybersecurity threats and resilience against cybersecurity incidents. We regularly assess potential threats and make investments seeking to reduce the risk of these threats against our critical information and assets by implementing a broad set of security measures, including comprehensive monitoring of our networks and systems, rapid detection and response, and threat management capabilities. For example, we scan our systems for vulnerabilities and annually engage external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our cybersecurity systems. The results of such assessments and reviews are reported to our Information Security Department and Audit Committee of the Board of Directors (the "Audit Committee"), and then we consider adjustments to our cybersecurity processes and practices as appropriate based on the information provided by the third-party assessments and reviews.


text: Security and data privacy awareness and training is provided to new employees and annually for current Aptar employees, which is designed to educate employees on recognizing information security and cybersecurity concerns, how they can help protect the organization and how to inform the cybersecurity team of potential incidents. In addition, Aptar implements stringent processes to oversee and manage risks associated with our third-party providers. As set forth in our Sustainable Purchasing Charter, third-party providers are expected to, among other things, protect personal data and implement security and protection measures in relation thereto. We conduct security assessments of third-party providers before engagement and monitor their compliance with our cybersecurity standards on an ongoing basis. The monitoring includes periodic and ongoing assessments by our Information Security Department. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. In addition, we maintain cybersecurity insurance as part of our overall insurance portfolio.


text: Risk Management and Strategy We have implemented a cybersecurity risk management program based on multiple cybersecurity frameworks, primarily the National Institute of Standards and Technology Cybersecurity Framework (800-171), as well as information security standards issued by international bodies. We use this program, which is integrated into our overall enterprise risk management framework, to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our Information Security Department, reports to our Vice President and Chief Information Officer and is headed by our Director of Information Security. This team is comprised of full-time information security professionals, is responsible for the implementation of our cybersecurity strategy, including assessing and managing material risks from cybersecurity threats. Our Vice President and Chief Information Officer is an experienced information technology professional with 34 years of experience in the industry, including oversight of our cybersecurity department and has a degree in Management Information Systems. The Information Security Department ultimately reports to, and regularly informs, our Chief Information Officer and Chief Financial Officer with regard to cybersecurity risks and incidents. Our Chief Financial Officer is responsible for oversight of our response to cybersecurity incidents, as appropriate. In addition, our executive management discusses cybersecurity issues quarterly.


text: Aptar has a detailed incident response plan that provides the process and workflow of communication for escalation of incidents to executive leadership to determine if there is a breach that would warrant further action. We also have a cyber incident materiality committee, which is a cross functional team that includes various departments across the Company including Finance, Public Relations, Accounting/Controller, Legal and the Director of Information Security. Our Information Security Department, in conjunction with the cyber incident materiality committee, review each incident under our materiality framework to assess whether further escalation and reporting is required and if the incidents could constitute a material breach. Periodically, our incident response team participates in a tabletop exercise or cybersecurity preparedness led by a third-party incident response provider.


text: The Audit Committee is responsible for the oversight of risks from cybersecurity threats. The Audit Committee is composed of independent directors with diverse experiences, including relating to risk management, technology, and finance. Management briefs the Audit Committee on a quarterly basis, and on an as needed basis, regarding our information security program and related risks to Aptar. As part of its oversight responsibilities, the Audit Committee regularly discusses and reviews with management, among other items, Aptar's risk management system, including cybersecurity programs. The Audit Committee receives regular updates on any significant developments relating to cybersecurity. Furthermore, significant cybersecurity matters and related strategic risk management decisions are escalated to the Board of Directors.


text: Although we have not experienced any material cybersecurity events to date, cybersecurity threats could materially affect our business strategy, results of operations, or financial condition, as further discussed in the risk factor entitled "Increased global cybersecurity threats and more sophisticated, targeted computer crime could pose a risk to our operations" in Part I, Item 1A of this report.


text: Security and data privacy awareness and training is provided to new employees and annually for current Aptar employees, is designed to educate employees on recognizing information security and cybersecurity concerns, how they can help protect the organization and how to inform the cybersecurity team of potential incidents. In addition, Aptar implements stringent processes to oversee and manage risks associated with our third-party providers. As set forth in our Sustainable Purchasing Charter, third-party providers are expected to, among other things, protect personal data and implement security and protection measures in relation thereto. We conduct security assessments of third-party providers before engagement and monitor their compliance with our cybersecurity standards on an ongoing basis. The monitoring includes periodic and ongoing assessments by our Information Security Department. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. In addition, we maintain cybersecurity insurance as part of our overall insurance portfolio.


text: We acknowledge the increasing importance of cybersecurity in today's digital and interconnected world. Cybersecurity threats pose significant risks to the integrity of our systems and data, potentially impacting our business operations, financial condition and reputation.

companyName: 60 DEGREES PHARMACEUTICALS, INC.

ticker: SXTP


text: Management reports to the Audit Committee on a quarterly basis regarding our information security programs. As part of its oversight responsibilities, the Audit Committee regularly discusses and reviews with management, among other items, Aptar's compliance and cybersecurity programs. We also periodically test our systems for vulnerabilities and regularly engage third parties to conduct evaluations of our security controls whether through penetration testing, independent audit or consulting on best practices to address new challenges. An independent review of our cybersecurity program has been assessed against the National Institute of Standards and Technology (NIST) cybersecurity framework. In addition, we maintain cybersecurity insurance as part of our overall insurance portfolio.


text: Our Information Security Department, reports to our Chief Information Security Officer who reports to the Chief Information Officer. This team is comprised of full-time information security professionals, is responsible for the implementation of our cybersecurity strategy, including assessing and managing material risks from cybersecurity threats. Our Chief Information Officer is an experienced information technology professional with 35 years of experience in the industry, including oversight of our cybersecurity department and has a degree in Management Information Systems. Our Chief Information Security Officer regularly informs our Chief Information Officer and Chief Financial Officer of any cybersecurity risks and incidents. Our Chief Financial Officer is responsible for oversight of our response to cybersecurity incidents, as appropriate. In addition, our executive management discusses cybersecurity issues quarterly.


text: Aptar has a detailed incident response plan that provides the process and workflow of communication for escalation of incidents to executive leadership to determine if there is a breach that would warrant further action. We also have a cyber incident materiality committee, which is a cross functional team that includes various departments across the Company including Finance, Public Relations, Accounting/Controller, Legal and the Chief Information Security Officer. Our Information Security Department, in conjunction with the cyber incident materiality committee, review each incident under our materiality framework to assess whether further escalation and reporting is required and if the incidents could constitute a material breach. Periodically, our incident response team participates in a tabletop exercise or cybersecurity preparedness led by a third-party incident response provider.


text: RISK MANAGEMENT AND STRATEGY We host, collect, process, use, and retain large amounts of sensitive and personal data across an array of our own and third-party information systems. To help protect these systems and data, we have implemented a robust information security program that includes numerous administrative, technical, and physical safeguards. We strive to evolve our cyber defenses to help minimize impacts from cyber threats. In general, we seek to address cybersecurity risks through a cross-functional approach. This approach focuses on protecting business operations and preserving the confidentiality, integrity, and availability of systems and data by preventing and mitigating cybersecurity threats, as well as effectively responding to cybersecurity incidents when they occur.

companyName: INTUIT INC.

ticker: INTU


text: Our information security program includes: • Having designated information security personnel, led by our Chief Information Security and Fraud Prevention Officer (CISO), who has decades of relevant experience and has previously served as Chief Information Officer. The CISO is supported primarily by our Cybersecurity, Compliance, Risk, and Fraud Team (CyberCRAFT), which consists of approximately 490 professionals as of July 31, 2024. In addition to bringing their current expertise to their roles, CyberCRAFT professionals have the ability to participate in our specialized training and development programs to further enhance their cybersecurity skillsets and cross-train on related capabilities. The CISO works closely with the Company's internal legal team to oversee compliance with legal, regulatory and contractual security requirements; • Risk assessments designed to help identify and prioritize significant cybersecurity risks. Our process for identifying and assessing material risks from cybersecurity threats includes incorporation of an internally developed threat catalog and our tracking of trends for areas such as vulnerability management, our leverage of technical standards and guidance, input from our participation and collaboration with law enforcement and government initiatives, and our internal and vendor-supported threat intelligence initiatives. The cybersecurity risk assessment operates alongside our broader overall enterprise-wide risk assessment and management process, and key cybersecurity risks are presented to the Audit and Risk Committee in a manner that helps frame cybersecurity risks as part of a broader risk context;


text: As a smaller reporting company, we currently do not have formalized cybersecurity measures, a dedicated cybersecurity team or specific protocols in place to manage cybersecurity risks.


text: Tables of Contents • Regular testing and assessments of our systems and controls to evaluate the information security program maturity and effectiveness using cybersecurity frameworks (such as ISO 27001, PCI DSS, and SOC 2) and to identify and address potential vulnerabilities—and as appropriate, we adjust our policies, standards, and processes based on testing and assessment results; • A vulnerability management program to determine the in-scope systems, patch systems based on criticality, and disclose potential vulnerabilities; • A cybersecurity incident response plan and scenario-specific playbooks for responding to various types of cybersecurity incidents; • Business continuity and disaster recovery plans to support more effective response and recovery efforts in the event of a significant cybersecurity incident or disruption; • The use of external service providers and consultants to assess or monitor the environment or otherwise assist with aspects of our cybersecurity controls; • Commercially available and customized security technologies and security and business controls to limit access to and use of such sensitive data; • A security awareness and training program for our employees and contractors, with role-based training for certain personnel and positions; and • A third-party risk management framework designed to monitor and address cybersecurity risks from various third parties (including vendors, service providers, and other contractors) that includes diligence regarding the third party's cybersecurity capabilities and additional monitoring of certain third parties based on the results of diligence. In addition, we have established standard contractual terms and conditions regarding cybersecurity applicable to third parties, as well as further downstream parties, that may be tailored to the use case and sensitivity of any data or business processes involved.


text: Additionally, we maintain cybersecurity insurance which may cover some or all of the potential losses from a cybersecurity incident. During the last fiscal year, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected Intuit, including its business strategy, results of operations, or financial condition. However, we continue to face ongoing and increasing cybersecurity risks which may materially affect us in the future. Additional information on the cybersecurity risks is discussed in "Risk Factors" in Item 1A of Part I of this Annual Report, including without limitation the risk that "Security incidents, improper access to or disclosure of our data or customers' data, or other cyberattacks on our systems could harm our reputation, business, and financial condition."


text: Management is responsible for the day-to-day administration of the Intuit's cybersecurity policies, processes, practices, and risk management. The Audit and Risk Committee of our Board of Directors provides primary oversight of cybersecurity risks and the Company's efforts to mitigate those risks.


text: As part of management oversight, our CEO receives monthly updates from the CISO and representatives from CyberCRAFT. These updates provide a recurring overview of cybersecurity trends and status updates (e.g., security events, fraud detection, IT roadmap progress, follow-up from prior assessments, security awareness exercise results), as well as a more focused analysis on select cybersecurity topics for the month. Examples of prior topics include: recent cybersecurity legislation, cybersecurity incidents affecting external entities, and trends in cybersecurity controls and adoption. As part of our incident response processes, incidents are classified based on the incident's characteristics. For certain risk-based classifications of incidents, the CEO and other members of the executive leadership team are also informed and contribute as part of our incident response processes.


text: Our full Board of Directors provides ultimate oversight for the cybersecurity program, in addition to other significant risks of Intuit. The Board of Directors has delegated to the Audit and Risk Committee to provide the primary oversight of cybersecurity risks. On a quarterly basis, the CISO and CyberCRAFT specialists present the Audit and Risk Committee with updates, metrics, and trends, such as the status of prior security events, existing and emerging threat landscapes, the results of audits or assessments, fraud prevention efforts, vulnerability detection and disclosure changes, and the status of projects to strengthen our security systems and improve incident readiness, and how these may affect broader enterprise risk management. Under our incident response processes' risk-based escalation protocols, the CISO, or other management, escalates certain incidents to the chair of the Audit and Risk Committee, who may then involve the broader committee or the full Board of Directors, as appropriate.


text: Our information security program includes: • Having designated information security personnel, led by our Chief Information Security and Fraud Prevention Officer (CISO), who has decades of relevant experience and also serves as Chief Information Officer. The CISO is supported primarily by our Cybersecurity, Compliance, Risk, and Fraud Team (CyberCRAFT), which consists of approximately 500 professionals as of July 31, 2025. In addition to bringing their current expertise to their roles, CyberCRAFT professionals have the ability to participate in our specialized training and development programs to further enhance their cybersecurity skill sets and cross-train on related capabilities. The CISO works closely with the Company's internal legal team to oversee compliance with legal, regulatory and contractual security requirements; • Risk assessments designed to help identify and prioritize significant cybersecurity risks. Our process for identifying and assessing material risks from cybersecurity threats includes incorporation of an internally developed threat catalog and our tracking of trends for areas such as vulnerability management, our leverage of technical standards and guidance, input from our participation and collaboration with law enforcement and government initiatives, and our internal and vendor-supported threat intelligence initiatives. The cybersecurity risk assessment operates alongside our broader overall enterprise-wide risk assessment and management process, and key cybersecurity risks are presented to the Audit and Risk Committee in a manner that helps frame cybersecurity risks as part of a broader risk context; • Regular testing and assessments of our systems and controls to evaluate the information security program maturity and effectiveness using cybersecurity frameworks (such as ISO 27001, PCI DSS, and SOC 2) and to identify and address potential vulnerabilities—and as appropriate, we adjust our policies, standards, and processes based on testing and assessment results; • A vulnerability management program to determine the in-scope systems, patch systems based on criticality, and disclose potential vulnerabilities; • A cybersecurity incident response plan and scenario-specific playbooks for responding to various types of cybersecurity incidents; • Business continuity and disaster recovery plans to support more effective response and recovery efforts in the event of a significant cybersecurity incident or disruption; • The use of external service providers and consultants to assess or monitor the environment or otherwise assist with aspects of our cybersecurity controls; • Commercially available and customized security technologies and security and business controls to limit access to and use of such sensitive data; • A security awareness and training program for our employees and contractors, with role-based training for certain personnel and positions; and • A third-party risk management framework designed to monitor and address cybersecurity risks from various third parties (including vendors, service providers, and other contractors) that includes diligence regarding the third party's cybersecurity capabilities and additional monitoring of certain third parties based on the results of diligence. In addition, we have established standard contractual terms and conditions regarding cybersecurity applicable to third parties, as well as further downstream parties, that may be tailored to the use case and sensitivity of any data or business processes involved.


text: Management is responsible for the day-to-day administration of Intuit's cybersecurity policies, processes, practices, and risk management. The Audit and Risk Committee of our Board of Directors provides primary oversight of cybersecurity risks and the Company's efforts to mitigate those risks.