text: Our cybersecurity risk assessment, identification, and management process consists of a dedicated Governance Risk and Compliance ("GRC") team, within our Information Security organization, that implements a repeatable, ISO/IEC 27001-compliant methodology to asses and track cybersecurity risk. This team, reporting to and working with the Chief Information Security Officer ("CISO"), identifies, tracks, and updates cybersecurity risks that threaten the Company directly and through third parties. The GRC team collaborates closely with risk owners throughout the Company, vendors, and suppliers, working with them in an effort to ensure their risks are identified, documented, and mitigated in a timely fashion. In addition to our active ISO/IEC 27001 certification, the Company also assesses itself against the National Institute of Standards and Technology Special Publication 800-171 as required by the Defense Federal Acquisition Regulation Supplement. In accordance with our ISMS, we also actively monitor known threats that could affect our products and services and work with our suppliers to provide us with real-time reports of threats or vulnerabilities that may affect our enterprise-wide systems. Our program also includes a cyber incident response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incident, as well as a business continuity plan that is designed to provide a clear framework for how the Company can continue in the event of any significant disruption in an effort to ensure that we can offer the same level of security, support, and excellence to all our customers. In the normal course, our Security and GRC teams engage assessors, consultants, and other third parties to assist in various cyber-related matters. For example, to maintain our ISO certification, the Company utilizes an external third party to conduct yearly audits of its ISMS. Our Information Security organization also leverages third-party advisors, as appropriate, for various tasks, such as conducting annual third-party penetration testing.


text: We conduct an enterprise risk assessment that includes an assessment of cybersecurity risk in context with other enterprise-level risks. Furthermore, our CISO and our General Counsel regularly discuss cybersecurity risk mitigation. We carry errors and omissions insurance that provides some protection against the potential losses arising from a cybersecurity incident. For additional information regarding potential cybersecurity risks, see relevant business and operational risks under Item 1A, "Risk Factors," of this Annual Report on Form 10-K.

companyName: TELOS CORP

ticker: TLS

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: In the last three years, we have not experienced a material information security breach incident or any penalties or settlements related to the same, and the expenses we have incurred from information security breach incidents were immaterial.


text: Management's role and expertise in assessing and managing material cybersecurity risks Our Information Security team, led by our CISO, is responsible for assessing and managing material cybersecurity risks. Certifications held by the Information Security team include CompTIA A+, Network+, Security+, CyberSecurity Analyst+ ("CYSA+"), Pentest+, Advanced Security Practitioner ("CASP"), EC-Council Certified Ethical Hacker ("CEH"), Certified Security Analyst ("ECSA"), Computer Hacking Forensic Investigator ("CHFI"), Associate Chief Information Security Officer ("ACCISO"), CMMC-AB Registered Practitioner ("RP"), ISC2 Certified Information Systems Security Professional ("CISSP"), Systems Security Certified Practitioner ("SSCP"), ISACA Certified Information Security Manager ("CISM"), PCAP – Certified Associate Python Programmer, & eLearnSecurity Junior Penetration Tester ("eJPT"). Our CISO's background includes over 18 years of experience in IT and Information Security. His formal education includes a Master's degree in Cybersecurity and Information Assurance and a Bachelor's degree in Computer Forensics. Certifications held by the CISO include CompTIA A+, Network+, & Security+, Microsoft Technology Associate ("MTA"), CMMC-AB RP, ISO 27001 Certified Lead Implementer Professional, EC-Council CEH & CHFI, ISACA Certified Data Privacy Solutions Engineer ("CDPSE") & Certified Information Security Manager ("CISM"), ISC2 CISSP, and Offensive Security Certified Professional ("OSCP"). Our CISO reports to our Chief Information Technology Officer ("CITO"), who in turn reports to our Chief Executive Officer ("CEO"). Each of our CITO and our CEO have extensive experience in cybersecurity matters.

stage1Category: Management Role

stage1Method: majority


text: Board of Director's oversight of cybersecurity risks The Board of Directors has oversight responsibility with respect to risk management and reviews matters with management as part of management's regular Board reporting. The Board of Directors has delegated responsibility for information security and cybersecurity risk oversight to the Audit Committee. In accordance with its charter, the Audit Committee discharges these responsibilities through various processes, including the option to use third-party advisers as and when it deems appropriate, and discusses with management the Company's major policies with respect to risk assessment and risk management. The Audit Committee regularly reports the results of these discussions to the Board of Directors. As noted above, the CISO reports to the Audit Committee at each regular Audit Committee meeting on the status of cybersecurity risk assessment, identification and management, as well as reporting information security incidents as they occur, if material, and providing periodic briefings about our information security program, our internal response preparedness, and assessments led by outside advisors. The Chair of the Audit Committee, in turn, reports on these topics to the Board of Directors as and when deemed necessary and/or material. Overall, our Board contains two directors with work experience related to cybersecurity issues or oversight.

stage1Category: Board Governance


text: At NIKE, cybersecurity risk management is an important part of our overall risk management efforts. We have cybersecurity processes, technologies and controls in place to aid in our efforts to assess, identify and manage material risks associated with cybersecurity threats. We assess cybersecurity risk at both the board and management levels.

companyName: NIKE, Inc.

ticker: NKE


text: Management's Role in Managing Risk At the management level, primary responsibility for assessing and managing material risks from cybersecurity threats rests with our Vice President, Corporate Information Security, Risk & Compliance ("VP, CIS"). Our VP, CIS has over two decades of experience in information technology and cybersecurity. The VP, CIS reports to our Chief Information Officer ("CIO") who has significant experience leading technology teams at large public companies and our CIO reports to our Chief Technology Officer.


text: Our approach to managing cybersecurity risk is informed by the industry-standard National Institute for Standards and Technology Cybersecurity Framework. The VP, CIS has primary responsibility for implementing and overseeing our enterprise-wide cybersecurity strategy, policy, architecture and processes. We use various tools and methodologies to identify and manage cybersecurity risk, including risk assessments and a vulnerability management program that includes periodic penetration testing. We have a third-party cyber risk management program that conducts assessments on third parties who integrate with our data, network, systems and applications. These tools and methodologies inform our remediation activities, which are tracked and reported to senior management.


text: In addition, our internal audit function periodically conducts independent testing of the overall operations of our cybersecurity program and supporting control frameworks, and reports the results to the Audit & Finance Committee. We also engage third parties to assess our cybersecurity program maturity and to perform audits of portions of our cybersecurity control environment based on risk or where necessary to ensure regulatory compliance.


text: Our cybersecurity team meets frequently to monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. In the event of a cybersecurity incident, we have an incident response plan that governs our immediate response including detection, escalation, assessment, management and remediation. As part of incident response, the cybersecurity team will also coordinate with external advisors and other key stakeholders as needed. The cybersecurity team routinely tests this plan across the organization to validate the procedures for appropriately escalating potentially material cybersecurity risks and incidents. Also, we provide an annual, mandatory cybersecurity training program for employees that is intended to help them understand cybersecurity risks and comply with our cybersecurity policies.


text: Our Board of Directors has ultimate oversight of cybersecurity risk as part of its risk management oversight responsibilities, including with respect to cybersecurity risk priorities, resource allocation and oversight structures. The Board of Directors receives an update on our cybersecurity program on an annual basis, or more frequently as determined to be necessary or advisable. The Board of Directors has delegated risk management oversight responsibility for information security and data protection to the Audit & Finance Committee, which regularly reviews our cybersecurity program and related matters with management and reports to the Board of Directors. Topics discussed at the board level include our approach to cybersecurity risk management, key initiatives, the threat landscape and recent developments and trends. The Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats and is actively engaged in our cybersecurity risk management strategy.


text: Risks from Cybersecurity Threats Even though, to date, cybersecurity risks have not materially affected our business or our results of operations, we face numerous and evolving cybersecurity threats. There can be no assurance that we, or the third parties with which we interact, will not face a cybersecurity incident in the future that will materially affect us. For more information about the cybersecurity risks we face, see the risk factor entitled "We rely significantly on information technology to operate our business, including our supply chain and retail operations, and any failure, inadequacy or interruption of that technology could harm our ability to effectively operate our business" in Item 1A. Risk Factors.

stage1Category: None/Other


text: We have not experienced any material cybersecurity incidents or identified any material cybersecurity threats that have affected or are reasonably likely to materially affect us, our business strategy, results of operations or financial condition.

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC


text: Our Board of Directors has ultimate oversight of cybersecurity risk as part of its risk management oversight responsibilities, including with respect to cybersecurity risk priorities, resource allocation and oversight structures. The Board of Directors receives an update on our cybersecurity program on a quarterly basis, or more frequently as determined to be necessary or advisable. The Board of Directors has delegated risk management oversight responsibility for information security and data protection to the Audit & Finance Committee, which regularly reviews our cybersecurity program and related matters with management and reports to the Board of Directors. Topics discussed at the board level include our approach to cybersecurity risk management, key initiatives, the threat landscape and recent developments and trends. The Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats and is actively engaged in our cybersecurity risk management strategy.


text: The Company's management, led by its Head of Corporate Information Security, has overall responsibility for identifying, assessing and managing any material risks from cybersecurity threats. The Company's Head of Corporate Information Security leads a dedicated Information Security team of highly skilled individuals with experience across industries that, among other things, develops and distributes information security policies, standards and procedures; engages in employee cybersecurity training; implements security controls; assesses security risk and compliance posture; monitors and responds to security events; and executes security testing and assessments. The Company's Head of Corporate Information Security has extensive knowledge and skills gained from over 25 years of experience in the cybersecurity industry, including serving in leadership positions at other large technology companies and leading the Company's Information Security team since 2016.

companyName: Apple Inc.

ticker: AAPL


text: The Company's Information Security team coordinates with teams across the Company to prevent, respond to and manage security incidents, and engages third parties, as appropriate, to assess, test or otherwise assist with aspects of its security processes and incident response. A dedicated Supplier Trust team manages information security risks the Company is exposed to through its supplier relationships. The Company has processes to log, track, address, and escalate for further assessment and report, as appropriate, cybersecurity incidents across the Company and its suppliers to senior management and the Audit and Finance Committee (the "Audit Committee") of the Board. The Company's enterprise risk management program is designed to identify, assess, and monitor the Company's business risks, including financial, operational, compliance and reputational risks, and reflects management's assessment of cybersecurity risks.


text: The Audit Committee assists the Board in the oversight and monitoring of cybersecurity matters. The Audit Committee regularly reviews and discusses the Company's cybersecurity risks with management, including the Company's Head of Corporate Information Security, its General Counsel and the Heads of Compliance and Business Conduct, Business Assurance, and Internal Audit, and receives updates, as necessary, regarding cybersecurity incidents. The Chair of the Audit Committee regularly reports the substance of such reviews and discussions to the Board, as necessary, and recommends to the Board such actions as the Audit Committee deems appropriate.


text: For a discussion of the Company's cybersecurity-related risks, see Item 1A of this Form 10-K under the heading "Risk Factors."


text: In addition, we have implemented a third-party risk management program to assess our vendors' ability to adequately protect information, which includes requiring agreements with our vendors that address cybersecurity. We periodically review and assess certain third parties' adherence to these agreements and review for information security (including cybersecurity) incidents experienced by our third-party vendors.

companyName: GLOBE LIFE INC.

ticker: GL

stage1Category: Third-Party Risk


text: The Company's Information Security team coordinates with teams across the Company to prevent, respond to and manage security incidents, and engages third parties, as appropriate, to assess, test or otherwise assist with aspects of its security processes and incident response. A dedicated Supplier Trust team manages information security risks the Company is exposed to through its supplier relationships. The Company has processes to log, track, address, and escalate for further assessment and report, as appropriate, cybersecurity incidents across the Company and its suppliers to senior management and the Audit and Finance Committee ("Audit Committee") of the Board. The Company's enterprise risk management program is designed to identify, asse ss, and monitor the Company's business risks, including financial, operational, compliance and reputational risks, and reflects management's assessment of cybersecurity risks.


text: Risk Management and Strategy We have implemented a comprehensive Enterprise Risk Management ("ERM") process to identify, assess and manage risks related to our overall organization, including material risks from cybersecurity threats. Our ERM process takes a holistic view of our specific risks and our strategy to anticipate and manage possible risks. Our Executive Vice President, General Counsel and Chief Risk Officer ("CRO") oversees our ERM program and execution of our risk strategy, including as it relates to cyber risk. The Chief Information Security Officer ("CISO"), who reports to the CRO, leads our cyber risk management and strategy and the Information Security Department.


text: Our cyber risk management and information security strategy includes elements to identify threats, assess risks, implement protective controls, detect attempts from threat actors to compromise the confidentiality, integrity, and availability of information and information systems, respond to those events and ultimately recover from incidents. We use a threat-based approach to identify and assess cyber risks. This approach includes membership in threat intelligence organizations such as the FS-ISAC (Financial Services Information Sharing and Analysis Center) to identify standard and emerging cyber-threats to financial services organizations and specifically to insurance companies. We also monitor for threats through vendor alerts, manufacturer bulletins, and government advisories.


text: Identified threats are analyzed using a recognized risk assessment model to consistently assess the likelihood and impact of these threats. We then map these threats to a well-established industry model called MITRE ATT&CK to identify areas of vulnerability. This analysis produces a likelihood score that is used in conjunction with an impact analysis to calculate the preliminary level of risk. The impact analysis includes factors such as disruption to business operations, employee and customer data, legal issues, reputational harm, and regulatory compliance. Based on the preliminary level of risk, we also analyze compensating controls and other factors to arrive at a residual risk level. If appropriate, additional mitigations may be planned based on this risk level.


text: We manage identified cyber risks by designing and implementing information security policies and controls addressing a wide range of current cyber threats. These policies and associated standards are designed to comply with current applicable legal and regulatory requirements and align with recognized frameworks for cybersecurity risk management. We review and update these policies and controls regularly in order to confirm ongoing alignment with the constantly changing threat landscape and evolving compliance requirements.


text: We assess the effectiveness of our policies and controls internally as well as through the engagement of third parties to conduct regular reviews, penetration tests, and vulnerability scans of information systems and applications. Results from these assessments help inform updates to risk assessments, changes to security controls and processes, and updates to policies and standards as appropriate. We employ a variety of measures to detect, prevent, and reduce the frequency and severity of cybersecurity incidents, which may include, but are not limited to, the use of encryption, intrusion prevention, endpoint security, password protection, multi-factor authentication, internal phishing testing and security awareness training, and vulnerability scanning and penetration testing.


text: Due to the type and volume of information that we collect and store to provide insurance coverage to prospective and current policyholders, we are an attractive target for cyber threat actors seeking financial gain. Our failure to maintain the safety of our policyholder's information could have a material adverse effect on our reputation, financial condition and results of operations. To date, we have not experienced a cybersecurity incident that resulted in a material adverse effect on our business strategy, results of operations, or financial condition; however, there can be no guarantee that we will not experience such an incident in the future. Although we maintain cybersecurity insurance, the costs and expenses related to cybersecurity incidents may not be fully insured. We describe whether and how risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition under Item 1A. Risk Factors, General Risk Factors, "The failure to maintain effective and efficient information systems at the Company could adversely affect our financial condition and results of operations."

stage1Category: Strategy Integration


text: Our Board of Directors considers information security to be an enterprise-wide risk management issue and oversees material cybersecurity risks through the Audit Committee. The Audit Committee is designated with the responsibility to monitor and periodically report to the full Board regarding management's risk management and information security processes. The ERM Committee and the Operational Risk Committee ("ORC") are the senior management-level entities designated with the responsibility to oversee the execution of our risk strategy, including as it relates to cyber risk. These Committees are composed of an enterprise-wide representative group of the Company's Executive and Senior Vice Presidents, as well as other essential directors and personnel. The ERM Committee is chaired by our CRO, and the ORC is chaired by our Chief Security Officer ("CSO"). The Chief Information Officer ("CIO") and CISO serve on both Committees. Our CRO has over a decade of experience managing risks at the Company, including risks from cybersecurity threats. Our current CIO has over 15 years of experience managing risks, including risks from cybersecurity threats. Our current CSO has a Certified Information Systems Security Professional certification, a Certified Information Systems Auditor certification, a Certified in Risk and Information Systems Control certification, and over 20 years of experience in cybersecurity. The CISO serves on both Committees and leads cyber governance and strategy, as well as cyber risk and incident management. The current CISO holds a master's degree in cybersecurity, has a Certified Information Systems Security Professional certification, and has over a decade of experience in cybersecurity.


text: The CISO assesses cyber risk and provides recommendations for management decision(s) by the ORC on a routine basis. The CISO briefs the Audit Committee on a quarterly basis. These updates include compliance with applicable regulations as well as current or planned changes to the regulations, an overview of the current cyber threats, risk management activities, and discussions of cyber incident investigations that warrant the attention of the Board. The CISO also provides an annual update to the entire Board of Directors on changes in cybersecurity, top threats facing the Company, key risks and mitigation efforts, and any potential material cybersecurity incidents. The Chair of the Audit Committee also provides a quarterly report to the Board on any information security topics presented to the Audit Committee by management.


text: Incident Management The Company maintains and tests a cybersecurity incident response plan that outlines steps for the containment, investigation of, response to and recovery from cyber events. The plan also includes information pertaining to roles and responsibilities, escalation, third party support, documentation, reporting, and law enforcement engagement. Escalation is designed to raise awareness of events that may require disclosure to help ensure assessments are performed without unreasonable delay. In alignment with our plan, we maintain playbooks that outline processes for responding to certain incidents commonly observed in the insurance industry. In addition, we have implemented a formal crisis management process, which outlines an incident response communication plan with executive leadership as well as criteria for communication with the chair of the Audit Committee and the Lead Director of the Board.


text: Risk Management and Strategy We have implemented a comprehensive Enterprise Risk Management ("ERM") process to identify, assess and manage risks related to our overall organization, including material risks from cybersecurity threats. Our ERM process takes a holistic view of our specific risks and our strategy to anticipate and manage possible risks. Our Executive Vice President, General Counsel and Chief Risk Officer ("CRO") oversees our ERM program and execution of our risk strategy, including as it relates to cyber risk. The Chief Information Security Officer ("CISO"), who reports to the General Counsel and CRO, leads our cyber risk management and strategy and the Information Security Department.


text: Security Policies and Requirements SilverBow maintains written policies designed to formalize our risk management program and other security requirements including cybersecurity and incident management. Such policies are applicable to all employees, contractors with access to the Company's systems and our Information Technology department.

companyName: SILVERBOW RESOURCES, INC.


text: We assess the effectiveness of our corporate policies and controls internally, as well as through the engagement of external advisors to conduct regular reviews, penetration tests, and vulnerability scans of Company information systems and applications. Results from these assessments help inform updates to risk assessments, changes to security controls and processes, and updates to policies and standards as appropriate. We employ a variety of internal measures to detect, prevent, and reduce the frequency and severity of cybersecurity incidents on the Company's infrastructure, which may include, but are not limited to, the use of encryption, intrusion prevention, endpoint security, password protection, multi-factor authentication, internal phishing testing, security awareness training, and vulnerability scanning and penetration testing.


text: In addition, cybersecurity is incorporated into our third-party risk management program. We assess the ability of our vendors as appropriate to adequately protect information, which includes requiring agreements that address cybersecurity. We periodically review and assess vendors' adherence to these agreements and review for information security (including cybersecurity) incidents experienced by our third-party vendors. With respect to our independent sales agents, we require each agent to execute an agent agreement containing terms governing the ownership, use and confidentiality of policyholder and proprietary information. We also engage with agency offices to support their use of measures and safeguards to protect information.


text: Due to the type and volume of information that we collect and store to support our business, including to provide insurance coverage to prospective, current and former policyholders, we are an attractive target for cyber threat actors seeking financial gain. Our failure to maintain the safety of our policyholder's information could have a material adverse effect on our reputation, financial condition and results of operations. To date, we have not experienced a cybersecurity incident that resulted in a material adverse effect on our business strategy, results of operations, or financial condition; however, we anticipate that our systems and data will continue to face attacks or other cybersecurity risks and there can be no guarantee that we will not experience such an incident in the future. Although we maintain cybersecurity insurance, the costs and expenses related to cybersecurity incidents may not be fully insured. We describe whether and how risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition under Item 1A. Risk Factors, General Risk Factors, "The failure to maintain effective and efficient information systems at the Company could adversely affect our financial condition and results of operations."


text: Our CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. In the event of a cybersecurity incident, our CISO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: AUTONATION, INC.

ticker: AN


text: The CISO assesses cyber risk and provides recommendations for management decision(s) by the ORC on a routine basis. The CISO briefs the Audit Committee on a quarterly basis. These updates include compliance measures designed to meet applicable regulations as well as current or planned changes to the regulations, an overview of the current cyber threats, risk management activities, and discussions of cyber incident investigations that warrant the attention of the Board. The CISO also provides an annual update to the entire Board of Directors on topics such as changes in cybersecurity, top threats facing the Company, key risks and mitigation efforts, and any potential material cybersecurity incidents. The Chair of the Audit Committee also provides a quarterly report to the Board on any information security topics presented to the Audit Committee by management.


text: Incident Management The Company maintains and tests a cybersecurity incident response plan that outlines steps for the containment, investigation of, response to and recovery from cyber events. The plan also includes information pertaining to roles and responsibilities, escalation, third-party support, documentation, reporting, and law enforcement engagement. Escalation is designed to raise awareness of events that may require disclosure to help ensure assessments are performed without unreasonable delay. In alignment with our plan, we maintain playbooks that outline processes for responding to certain incidents commonly observed in the insurance industry. In addition, we have implemented a formal crisis management process, which outlines an incident response communication plan with executive leadership as well as criteria for communication with the chair of the Audit Committee and the Lead Director of the Board.


text: Risk Management and Strategy We have developed and continue to enhance our cybersecurity governance program to help protect the security of our computer systems, software, networks, and other technology assets against material risks from cybersecurity threats, including unauthorized attempts to access confidential information or to disrupt or degrade our business operations. Our cybersecurity governance program is strategically integrated into our broader risk management framework and aims to (1) proactively manage cyber and information security risks at AutoNation, (2) implement the internal controls required by cybersecurity regulatory requirements as well as AutoNation's information security control objective documents and information security standards, and (3) improve the efficiency, maturity, and effectiveness of technology functions and processes.


text: We regularly evaluate new and emerging risks and ever-changing legal and compliance requirements and examine the effectiveness and maturity of our cyber defenses through various means, including internal audits, targeted testing, incident response exercises, maturity assessments, and industry benchmarking. We also dedicate significant resources that are designed to secure our systems and to protect confidential information, such as firewalls, endpoint protection, and behavior analysis tools, among others, and engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. In addition, we annually perform a risk assessment of our third-party service providers.


text: To date, risks from cybersecurity threats have not materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our efforts to ensure the integrity of our computer systems, software, networks, and other technology assets, we may not be able to anticipate, detect, or recognize threats to our systems and assets, or to implement effective preventive measures against all cyber threats, especially because the techniques used are increasingly sophisticated, change frequently, are complex, and are often not recognized until launched. See the risk factor "A failure of our information systems or any security breach or unauthorized disclosure of confidential information could have a material adverse effect on our business" in Part I, Item 1A of this Form 10-K.


text: Our Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats and oversees risks associated with cybersecurity threats. The Board's Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this area. The Audit Committee is composed of independent directors with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Our Chief Information Security Officer ("CISO") plays a pivotal role in informing the Audit Committee on cybersecurity risks. He provides comprehensive briefings to the Audit Committee on a quarterly basis or as needed. These briefings encompass a broad range of topics, including emerging threats, the status of ongoing cybersecurity initiatives, and incident reports and learnings from any cybersecurity events. The Audit Committee actively participates and offers guidance in strategic decisions related to cybersecurity. This involvement helps ensure that cybersecurity considerations are integrated into our broader strategic objectives.


text: Our CISO is responsible for assessing, monitoring, and managing our cybersecurity risks. With over 25 years of experience in the field of cybersecurity, including extensive experience as an enterprise CISO, his in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our cybersecurity governance programs, tests our compliance with applicable standards, remediates known risks, and leads our employee cybersecurity training program.


text: (iv) cybersecurity operations designed to prepare, identify, contain, eradicate, and recover from cyber-related incidents; and (v) identity and access management defining global practices for access, authentication, and authorization to technology systems.

companyName: EXPEDITORS INTERNATIONAL OF WASHINGTON INC

ticker: EXPD


text: Our CISO regularly informs our Chief Executive Officer and Chief Financial Officer of all aspects related to cybersecurity risks and incidents. This helps ensure that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to our Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: To date, risks from cybersecurity threats have not materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our efforts to ensure the integrity of our computer systems, software, networks, and other technology assets, we may not be able to anticipate, detect, or recognize threats to our systems and assets, or to implement effective preventive measures against all cyber threats, especially because the techniques used are increasingly sophisticated, change frequently, are complex, and are often not recognized until launched. See the risk factor "We depend on information technology for our business and are subject to risks related to cybersecurity threats and incidents, including those affecting our third-party suppliers and other service providers. A failure of our information systems or any cybersecurity breaches or unauthorized disclosure of confidential information could have a material adverse effect on our business, disrupt our business, and adversely impact our reputation and results of operations." in Part I, Item 1A of this Form 10-K.


text: Our Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats and oversees risks associated with cybersecurity threats. The Board's Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this area. The Audit Committee is composed of independent directors with diverse expertise, including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Our Chief Information Security Officer ("CISO") plays a pivotal role in informing the Audit Committee on cybersecurity risks. He provides comprehensive briefings to the Audit Committee on a quarterly basis or more frequently as needed. These briefings encompass a broad range of topics, including emerging threats, the status of ongoing cybersecurity initiatives, and incident reports and learnings from any cybersecurity events. The Audit Committee actively participates and offers guidance in strategic decisions related to cybersecurity. This involvement helps ensure that cybersecurity considerations are integrated into our broader strategic objectives.


text: Our CISO is responsible for assessing, monitoring, and managing our cybersecurity risks. With nearly three decades of experience in the field of cybersecurity, including extensive experience as an enterprise CISO, his in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our cybersecurity governance programs, tests our compliance with applicable standards, remediates known risks, and leads our employee cybersecurity training program.


text: To assess and manage risks from cybersecurity threats, we maintain a cybersecurity risk management program (the "Cybersecurity Program") that employs the Critical Security Controls framework developed by the Center for Internet Security as the foundation. Our Information Security team, composed of members of the Company's Corporate Information Technology ("IT") Department and Software Product Operations team, is tasked with monitoring and assessing, and the day-to-day management of, cybersecurity and operational risks related to information security and system disruption. The Cybersecurity Program includes, among other elements: • ongoing identification and assessment of cybersecurity threats based on periodic internal and external assessments and monitoring; • technical and organizational measures designed to protect against, detect, and respond to cybersecurity threats, including documented processes, procedures and technical controls aligned with our information security management system; • an incident management and response program that continuously monitors the Company's information systems for vulnerabilities, threats, and incidents; manages and takes action to contain incidents that occur; remediates vulnerabilities; and communicates the details of threats and incidents to management, as deemed necessary or appropriate; and • organization-wide cybersecurity training and compliance exercises, including formal educational material and compliance testing that is administered to all employees on an annual basis, as well as ad hoc testing and awareness exercises.

companyName: ITERIS, INC.


text: The Company also engages external experts to assist in its assessment, identification, and management of risks from cybersecurity threats. These experts include cybersecurity consultants that we engage as part of our continuing efforts to evaluate and improve the effectiveness of our Cybersecurity Program, and other cybersecurity service providers that help secure our systems and networks. The Company also uses specialized third-party software tools to identify, monitor and mitigate risks from cybersecurity risks.


text: Our Cybersecurity Program also addresses cybersecurity risks associated with our use of third-party service providers, in particular those identified as critical to the functioning of our business. To that end, we take cybersecurity considerations into account in the selection of our third-party service providers. We perform cybersecurity diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity risks identified through such diligence, and we require those third parties to implement appropriate cybersecurity controls with respect to the services they provide to us.


text: As of the date of this Annual Report, the Company has not identified any risks from cybersecurity threats, including as the result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, but there can be no assurance that any such risk will not materially affect the Company in the future. For further information about the cybersecurity risks we face, and potential impacts, see Part I, Item 1A, "Risk Factors."


text: The Board of Directors is responsible for overseeing our enterprise risk management program. The Audit Committee, which consists solely of independent directors, has been designated by our Board to oversee cybersecurity risks and our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee receives quarterly updates, or more frequently as needed, on cybersecurity and information technology matters and related risk exposures from our Chief Financial Officer ("CFO").


text: The CFO works in conjunction with the Chief Technology Officer ("CTO") to oversee the Information Security Team and the operation of the Cybersecurity Program. Our Information Security team in conjunction with the CTO have an average of 15 years of professional IT and software development management experience, including in the areas of incident response, vulnerability management, network security administration and other governance, risk and compliance areas.


text: Our executive management, the Audit Committee, and the Board of Directors are notified of any significant cybersecurity incidents through an escalation process that is established in our incident response plan. Pursuant to that plan, upon detection incidents are first reported to and assessed by the Information Security Team. Depending on the nature and severity of an incident, and considering the actual or potential impact, significance, and scope, the plan calls for the Information Security team to notify the executive team, who may in turn notify the Audit Committee and Board of Directors, regarding the detection, mitigation, and remediation of cybersecurity incidents.


text: Cybersecurity risk management is an important part of our overall risk management efforts. Our industry is prone to cybersecurity threats and attacks, and we regularly experience cybersecurity incidents of varying degrees. At any given time, we face known and unknown cybersecurity risks and threats that are not fully-mitigated, and we discover vulnerabilities in our Cybersecurity Program. We continuously work to enhance our Cybersecurity Program and risk management efforts. As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition.

companyName: SEI INVESTMENTS CO

ticker: SEIC


text: The Utilities have disaster recovery and incident response plans in place to protect their businesses from information technology service interruptions. The disaster recovery plans are established to help prevent the loss of customer data, service interruptions and disruptions to operations or damage to important facilities. In addition, the Utilities also maintain cyber liability insurance that covers certain damages caused by cyber incidents.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: We use a risk management framework based on applicable laws and regulations, and informed by industry standards and industry-recognized practices, for managing cybersecurity risks within our products and services, infrastructure, and corporate resources. This risk management framework is implemented through our Cybersecurity Program. Our Cybersecurity Program is designed to provide a framework for assessing the potential threats to the security and integrity of our systems, networks, databases, applications, electronic information and intellectual property and developing appropriate defenses based on these assessments. We routinely invest to develop and implement numerous cybersecurity programs and processes, including risk management and assessment programs, security and event monitoring capabilities, detailed incident response plans, and other advanced detection, prevention and protection capabilities, including practices and tools to monitor and mitigate insider threats. We regularly assess cybersecurity risks to identify and enumerate threats to us and vulnerabilities these threats can exploit to adversely impact our business operations. In some instances, we engage third parties to conduct or assist us with conducting cybersecurity risk assessments. We have developed and implemented a security infrastructure designed to ensure infrastructure and data confidentiality, integrity, and availability.


text: Key components of our Cybersecurity Program include, but are not limited to, the following: • Information Security Governance: We designed what we believe are appropriate measures, policies and procedures to ensure that information and information systems are properly protected given the nature of our businesses and the size and complexity of our organization, including our reliance on third parties; • Organization: The Information Security team, led by the Chief Information Security Officer (CISO), is responsible for implementing and managing the Cybersecurity Program with executive oversight from the Chief Executive Officer and Chief Financial Officer, as well as oversight from our Board of Directors. Our CISO has extensive cybersecurity knowledge and skills gained from over 26 years of work experience on the information security team at SEI. In addition to the CISO's cybersecurity experience, he has certifications in risk and information systems control along with information systems auditing; • Cybersecurity Controls: We have implemented what we believe are appropriate preventative measures to protect SEI's infrastructure, systems, and data. These measures include network architecture segmentation, system and platform hardening, in-transit and at-rest encryption, dynamic security awareness training, regular vulnerability scanning and penetration testing, firewalls, web proxy filtering, and multifactor authentication, all of which we constantly evaluate and upgrade as we believe is needed based on our risk assessments; • Managed Detection and Response: Our security operations center's uninterrupted monitoring processes utilize tools such as network and host-based intrusion detection systems, endpoint detection and response technology, distributed denial of service detection and mitigation service, and centralized security and information event management (SIEM). These efforts are further supplemented by signals operations and threat hunting that provide the incident responders the ability to write custom detections to complement commercial technology controls and execute triage/analysis, threat intelligence, and response; • Independent Audits: We are subject to industry regulatory examinations. Our internal audit function provides independent assessment and assurance on the overall operations of our Cybersecurity and Privacy Programs and the supporting control frameworks. We also engage various reputable third parties to perform independent auditing and testing as well as network and web application penetration testing; • Risk Management Oversight: Enterprise Risk Management, through the Enterprise Risk Committee, provides independent monitoring and reporting of cybersecurity risks commensurate with our Technology Risk Program. In addition, we leverage our Third Party Risk Management, Insider Threats, Business Continuity & Disaster Recovery and Information Governance programs to supplement our Cybersecurity Program; and • Privacy Oversight: In addition to our Enterprise Risk Management functions, our Legal and Compliance team maintains a privacy risk management program to assess, manage and report privacy risks related to how we are collecting, using, sharing, and storing user data. Our Privacy team works with our Third Party Risk and Information Security teams to manage privacy-related issues.


text: As part of the governance and oversight of the Cybersecurity Program, regular reporting is performed for the Legal and Regulatory Oversight Committee of our Board of Directors along with SEI's various subsidiaries' boards of directors. The reports include cybersecurity metrics/statistics, details of relevant events, results of testing, and overview of current threats. Should any material incidents arise, those will be timely and appropriately communicated to the relevant subsidiary's board of directors.


text: Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "We are exposed to data and cyber security risks," which should be read in conjunction with the information above.


text: Key components of our Cybersecurity Program include, but are not limited to, the following: • Information Security Governance: We designed what we believe are appropriate measures, policies and procedures to ensure that information and information systems are properly protected given the nature of our businesses and the size and complexity of our organization, including our reliance on third parties; • Organization: The Information Security team, led by the Chief Information Security Officer (CISO), is responsible for implementing and managing the Cybersecurity Program with executive oversight from the Chief Executive Officer and Chief Financial Officer, as well as oversight from our Board of Directors. Our CISO has extensive cybersecurity knowledge and skills gained from over 26 years of work experience on the information security team at SEI. In addition to the CISO's cybersecurity experience, he has certifications in risk and information systems control along with information systems auditing; • Cybersecurity Controls: We have implemented what we believe are appropriate preventative measures to protect SEI's infrastructure, systems, and data. These measures include network architecture segmentation, system and platform hardening, in-transit and at-rest encryption, dynamic security awareness training, regular vulnerability scanning and penetration testing, firewalls, web proxy filtering, and multifactor authentication, all of which we constantly evaluate and upgrade as we believe is needed based on our risk assessments; • Managed Detection and Response: Our security operations center's uninterrupted monitoring processes utilize tools such as network and host-based intrusion detection systems, endpoint detection and response technology, distributed denial of service detection and mitigation service, and centralized security and information event management (SIEM). These efforts are further supplemented by signals operations and threat hunting that provide the incident responders the ability to write custom detections to complement commercial technology controls and execute triage/analysis, threat intelligence, and response; • Independent Audits: We are subject to industry regulatory examinations. Our internal audit function provides independent assessment and assurance on the overall operations of our Cybersecurity and Privacy Programs and the supporting control frameworks. We also engage various reputable third parties to perform independent auditing and testing as well as network and web application penetration testing; • Risk Management Oversight: Enterprise Risk Management, through the Enterprise Risk Committee, provides independent monitoring and reporting of cybersecurity risks commensurate with our Technology Risk Program. In addition, we leverage our Third Party Risk Management, Insider Threats, Business Continuity and Disaster Recovery programs to supplement our Cybersecurity Program; and • Privacy Oversight: In addition to our Enterprise Risk Management functions, our Legal and Compliance team maintains a privacy risk management program to assess, manage and report privacy risks related to how we are collecting, using, sharing, and storing user data. Our Privacy team works with our Third Party Risk and Information Security teams to manage privacy-related issues.


text: Risk Management and Strategy Our Board is regularly involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects, stores and uses. Our principal objective for managing cybersecurity risk is to effectively identify and prevent or mitigate the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information.

companyName: Ameris Bancorp

ticker: ABCB


text: The underlying controls of our information security program are based on regulatory guidance, recognized best practices and industry standards, including the National Institute of Standards and Technology Cybersecurity Framework. In addition, we leverage certain industry and government associations, third-party benchmarking, audits and threat intelligence feeds to facilitate and promote program effectiveness. Our Corporate Information Security Officer and our Chief Information Officer, to whom the Corporate Information Security Officer reports, as well as key members of their teams, regularly collaborate with peer banks, industry groups and others to consider cybersecurity and incident response issues, trends and best practices. The information security program is periodically reviewed by these individuals and their teams with the goal of addressing evolving threats and conditions. Our enterprise information security team consists of information security professionals with varying degrees of education and experience who are generally subject to professional education and certification requirements.


text: As one of the critical elements of our overall ERM approach, our cybersecurity program includes a focus on the following key areas: • Governance. As discussed further below, the Board's oversight of cybersecurity risk management is supported by the Enterprise Risk Committee of the Board (the "ERC"), which regularly interacts with the Company's ERM function, Corporate Information Security Officer, Business Continuity Director and other key members of management. The activities of the ERC include a quarterly review of our cybersecurity risk profile, and the ERC provides a report of its activities at each meeting of the full Board. • Technical Safeguards. We deploy technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Third-Party Risk Management. We have designed and maintain a comprehensive, risk-based program in accordance with applicable regulatory standards for identifying and overseeing cybersecurity risks, among others, presented by third parties with whom we engage for the conduct of our business, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. We provide regular, mandatory training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. • Incident Response Plan. In addition, we maintain a comprehensive incident response plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification to appropriate management committees and, as appropriate, the ERC. The incident response plan is overseen by our Business Continuity Director, who reports directly to our Chief Information Officer, and coordinated across multiple parts of the Company, with key members of management included in the implementation and execution of the plan. The incident response plan is updated as appropriate and evaluated at least annually.


text: We also engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability and penetration testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the ERC, who reports such results to the Board as appropriate, and we tailor our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The threat posed by cyberattacks and other cybersecurity incidents is significant, notwithstanding our prevention and mitigation systems and processes. To date, we have not experienced cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect the Company, including our business strategy, results of operations or financial condition. For additional discussion of risks from cybersecurity threats, see "Cyberattacks or other security breaches could have a material adverse effect on our business." in Item 1A., "Risk Factors."


text: The Board, in coordination with the ERC, oversees our ERM process, including specifically the management of risks arising from cybersecurity threats. The Board and the ERC each receive periodic presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment and information security considerations that may arise with respect to our peers, key vendors and other relevant third parties. If a cybersecurity incident meeting established reporting thresholds should occur, the Board and the ERC would also receive timely information regarding such incident, plus appropriate updates until the situation has been sufficiently resolved.


text: Our Corporate Information Security Officer, who holds relevant degrees and certifications and has more than 15 years of information technology and information security experience specific to the financial services industry, is charged with managing our enterprise information security function and administering our information security program. This area's roles and responsibilities include cybersecurity risk assessment, vulnerability assessment, defensive operations, threat intelligence and identity access governance, as well as coordination with our Business Continuity Director for additional risk assessment, incident response and business resilience. These responsibilities are addressed by a first line of defense function, with our second line of defense function, including the Corporate Information Security Officer, providing oversight, guidance, monitoring and management of the first line's activities. Through ongoing engagement among these personnel, our Corporate Information Security Officer and other key members of management routinely monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents, and report such threats and incidents to the ERC when appropriate.


text: Despite the Utilities security measures, all of their systems are vulnerable to disability, failures or unauthorized access caused by natural disasters, cybersecurity incidents, security breaches, user error, unintentional defects created by system changes, military or terrorist actions, power or communication failures or similar events.


text: The underlying controls of our information security program are based on regulatory guidance, recognized best practices and industry standards, including the National Institute of Standards and Technology Cybersecurity Framework. In addition, we leverage certain industry and government associations, third-party benchmarking, audits and threat intelligence feeds to facilitate and promote program effectiveness. Our Corporate Information Security Officer and our Chief Information Officer, to whom the Corporate Information Security Officer reports, as well as key members of their teams, regularly collaborate with peer banks, industry groups and others to consider cybersecurity trends and best practices. The information security program is periodically reviewed by these individuals and their teams with the goal of addressing evolving threats and conditions. Our enterprise information security team consists of information security professionals with varying degrees of education and experience who are generally subject to professional education and certification requirements. In addition, our team leverages managed security service providers to supplement the Company's internal skillsets and capabilities.


text: As one of the critical elements of our overall ERM approach, our cybersecurity program includes a focus on the following key areas: • Governance. As discussed further below, the Board's oversight of cybersecurity risk management is supported by the Enterprise Risk Committee of the Board (the "ERC"), which regularly interacts with the Company's ERM function, Corporate Information Security Officer, Business Continuity Director and other key members of management. The activities of the ERC include a quarterly review of our cybersecurity risk profile, and the ERC provides a report of its activities at each meeting of the full Board. • Technical Safeguards. We deploy technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including authentication and access, firewalls, intrusion prevention and detection systems, anti-malware functionality and data protection controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Third-Party Risk Management. We have designed and maintain a comprehensive, risk-based program in accordance with applicable regulatory standards for identifying and overseeing cybersecurity risks, among others, presented by third parties with whom we engage for the conduct of our business, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. We provide regular, mandatory training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. • Incident Response Plan. In addition, we maintain a comprehensive incident response plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification to appropriate management committees and, as appropriate, the ERC. The incident response plan is overseen by our Business Continuity Director, who reports directly to our Chief Information Officer, and coordinated across multiple parts of the Company, with key members of management included in the implementation and execution of the plan. The incident response plan is updated as appropriate and evaluated at least annually.


text: The threat posed by cyberattacks and other cybersecurity incidents is significant, notwithstanding our prevention and mitigation systems and processes. To date, we have not experienced cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect the Company, including our business strategy, results of operations or financial condition. For additional discussion of risks from cybersecurity threats, see "Cyberattacks or other security breaches could have a material adverse effect on our business. " in Item 1A., "Risk Factors."


text: In addition, the Company has annual third-party, internal and external facing cybersecurity and information technology audits performed, and more frequently, as appropriate. SilverBow relies on continuous security monitoring and conducts penetration testing and vulnerability scanning assessments as part of its cybersecurity program. All employees are trained on cybersecurity as part of their onboarding, and the Company offers additional cybersecurity training to its employees through internal and external resources.


text: Our Corporate Information Security Officer ("CISO"), who has relevant degrees and more than 17 years of information technology and information security experience, including five years in the financial services industry, manages our enterprise information security function and administers our information security program. The roles and responsibilities of the CISO's department include delivering and operating security capabilities and controls to detect, identify, protect against and recover from cyberattacks, as well as coordination with our Business Continuity Director for additional risk assessment, incident response and business resilience. These responsibilities are addressed by a first line of defense function, with our second line of defense function, including the Corporate Information Security Officer, providing oversight, guidance, monitoring and management of the first line's activities. Through ongoing engagement among these personnel, our Corporate Information Security Officer and other key members of management routinely monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents, and report such threats and incidents to the ERC when appropriate.


text: We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems. These include a variety of mechanisms, controls, technologies, methods, systems, written policies, physical safeguards, along with the use of third-party consultants and experts, that are reasonably designed to protect our information, and that of our stakeholders, against cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems.


text: Board of Directors Our Board, in coordination with the Audit Committee, oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. Our Board has delegated the primary responsibility to oversee cybersecurity risk management matters to the Audit Committee. The Audit Committee reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks on at least an annual basis, and more frequently, as appropriate. As part of such reviews, the Audit Committee receives reports and presentations from members of our team responsible for overseeing the company's cybersecurity risk management, including our Information Technology, Legal and Financial Reporting management teams, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Audit Committee and such members of our management team also report to the Board at least annually on data protection and cybersecurity matters. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported promptly to the Audit Committee, as well as ongoing updates regarding any such incident until it has been addressed.


text: The Company has implemented a risk-based, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. At the management level, our Cybersecurity Risk Management Committee, composed of senior personnel representing functional and business areas, including Information Technology, Financial Reporting and Legal, has broad oversight of the Company's risk management processes. The Cybersecurity Risk Management Committee meets periodically to discuss the risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks and report on ongoing training and cybersecurity matters. The committee works closely with the Information Technology and Legal departments to oversee compliance with legal, regulatory and contractual security requirements. The Cybersecurity Risk Management Committee members annually attend the Board's Audit Committee meeting, and more frequent meetings if appropriate, to report on any material developments.


text: At the management level, our Information Technology Supervisor, who has extensive cybersecurity and information technology knowledge and skills gained from over 30 years of work experience at the Company and elsewhere, heads the Information Technology team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business and reports directly to the Executive Vice President, Chief Financial Officer and General Counsel. The Company's Information Technology Supervisor receives reports on cybersecurity threats on an ongoing basis and, in conjunction with management and the Cybersecurity Risk Management Committee, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks, lead stakeholder training and engage external cybersecurity resources. Our Information Technology Supervisor works closely with Legal to oversee compliance with legal, regulatory and contractual security requirements. Reporting to our Information Technology Supervisor are a number of experienced information technology personnel. In addition to our internal cybersecurity capabilities, we also regularly engage consultants and other third parties to assist with assessing, identifying, and managing cybersecurity risks along with training. The Information Technology Supervisor also annually attends the Board's Audit Committee meeting, and more frequent meetings if appropriate, to report on any material developments.


text: Risk Management and Strategy Cybersecurity risk management is overseen as a critical component of SilverBow's overall enterprise risk management. Our cybersecurity strategy is intended to mitigate the cybersecurity threats identified in the risk management process, and ensure that we have appropriate administrative, technical, and physical safeguards to protect our systems and data and respond effectively to cybersecurity threats. Our cybersecurity leverages people, processes, and technology to identify and respond to cybersecurity threats in a timely manner.


text: With respect to incident response, we have a cybersecurity incident response plan that applies in the event of a cybersecurity threat or incident that provides for responding to security incidents. The cybersecurity incident response plan sets out an approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The cybersecurity incident response plan is inclusive of the phases of the National Institute of Standards and Technology framework and focus: preparation; detection; and analysis; containment, eradication and recovery; and post-incident remediation. It applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services require access to secure Company information, and to all devices and network services that are owned or managed by the Company.


text: Material Cybersecurity Risks, Threats & Incidents Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. Additionally, we also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continued improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, stakeholder effects, revenue loss, legal actions, statutory penalties, among other consequences. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Report under the heading "Risks Related to the Business," which should be read in conjunction with the foregoing information.


text: We operate in an industry that requires the continuous use and operation of information and telecommunications systems. In addition, we use information technology systems to collect and retain sensitive information, including confidential and proprietary information about our businesses, and personal information about our customers, shareowners and employees.

companyName: WISCONSIN POWER & LIGHT CO


text: Cybersecurity risks are identified through the enterprise risk management (ERM) program as key risks we face. These risks could include use of malicious code, employee theft or misuse, advanced persistent threats, vulnerabilities, fraud attempts, and phishing attacks that could cause, among others, an information technology system failure, or breach or loss of sensitive information. The potential impact of cybersecurity risks on our business operations, results of operations or financial condition is discussed in the " Risks Related to Business Operations " section of Item 1A " Risk Factors." We have not had any material cybersecurity breaches or incidents and have not incurred any material expenses, penalties or settlement costs related to any cybersecurity breaches or incidents. However, measures that we take to avoid, detect, mitigate or recover from cybersecurity breaches or incidents may be insufficient or become ineffective, and there are no assurances that cybersecurity breaches or incidents will not impact our business operations and strategy, results of operations and financial condition.


text: We maintain a cybersecurity program that includes development and implementation of policies, procedures and tools designed to help ensure availability of critical information technology and telecommunication systems and safeguard sensitive information. The cybersecurity program is assessed against industry standards, including the Center for Internet Security critical security controls. This assessment is conducted by a third party periodically and internally at least annually. We are also required to comply with cybersecurity standards under the North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection and by the Department of Homeland Security Transportation Security Administration. We also periodically collaborate with law enforcement experts, external assessors, consultants, industry peers and other third parties in connection with understanding market and threat conditions used to identify, assess and mitigate cybersecurity risks.


text: The cybersecurity program includes: • a dedicated cybersecurity team; • information technology and telecommunication systems implemented with segmentation and multiple levels of access controls; • a security operations center that continuously monitors information technology and telecommunications systems; • an incident response team composed of individuals from the information technology, operations, accounting, finance, legal, and communications departments, as needed, which is activated to respond to cybersecurity incidents; • periodic drills and exercises to address risks and prepare for extraordinary scenarios, including industry collaboration on incident preparation, such as GridEx drills hosted by NERC, participation in a full activation drill at least annually, and several tabletop drills during the year; • periodic drills with the full executive team, including the Chief Executive Officer (CEO), Chief Financial Officer (CFO), Chief Accounting Officer (CAO), Chief Information Officer (CIO) and General Counsel; • periodic information security awareness training and phishing simulations for employees and contractors who access our networks; • periodic security assessments of evolving risks and threats that lead to strengthening of cybersecurity measures; • implementation of automation solutions to strengthen detection and response capabilities; and • maintenance of cyber liability insurance.


text: Trustee Oversight Senior personnel from our IT department managed our cybersecurity program on a day-to-day basis. For EQC, o ur Board of Trustees oversaw our IT department's management of our cybersecurity program through its Audit Committee. For EQC LT, our Trustees oversaw our IT department's management of our cybersecurity program.

companyName: EQC Liquidating Trust


text: We also address cybersecurity risks associated with third-party service providers, including those in our supply chain or who have access to our customer and employee data or our information technology systems. Third-party risks are included in the ERM program and the cybersecurity program. Diligence is performed on third parties that have access to information technology systems, data or facilities that house such systems or data. High-risk vendors are identified and continually monitored for cybersecurity threat risks. Additionally, third parties that have access to information technology systems, data or facilities that house such systems or data, agree by contract to manage their cybersecurity risks, provide notification in the event of a cybersecurity incident, and be subject to cybersecurity audits.


text: Our cybersecurity program is overseen by our Senior Vice President and CIO, who has nearly two decades of experience in information technology, having previously held CIO roles with other organizations, as well as experience in the utility sector. The CIO oversees a team dedicated to the support of cybersecurity tools and the overall cybersecurity program. The CIO reports to the Executive Vice President and CFO. The CIO provides periodic briefs regarding prevention, detection, mitigation and remediation of cybersecurity incidents, as well as risks, threats and the threat landscape to the Board and executive management, including the CEO, CFO and CAO. These briefs are used to help continuously improve our cybersecurity program and to inform risk assessments as part of the ERM program.


text: The full Board of Directors is responsible for oversight of our key cybersecurity risks. The Board retains direct oversight of cybersecurity matters to best utilize the experiences and expertise of all Board members. Management, including the CIO, provides reports approximately quarterly to the Board regarding risks, threats, the threat landscape, assessments of and improvements to the cybersecurity program and internal response preparedness.


text: Cybersecurity risks are identified as key risks through the enterprise risk management (ERM) program. These risks could include use of malicious code, employee theft or misuse, advanced persistent threats, vulnerabilities, fraud attempts, and phishing attacks that could cause, among others, an operations or information technology system failure, or breach or loss of sensitive information. The potential impact of cybersecurity risks on our business operations, results of operations or financial condition is discussed in the " Risks Related to Business Operations " section of Item 1A " Risk Factors." We have not had any material cybersecurity breaches or incidents and have not incurred any material expenses, penalties or settlement costs related to any cybersecurity breaches or incidents. However, measures that we take to avoid, detect, mitigate or recover from cybersecurity breaches or incidents may be insufficient or become ineffective, and there are no assurances that cybersecurity breaches or incidents will not impact our business operations and strategy, results of operations and financial condition.


text: We maintain a cybersecurity program that includes development and implementation of policies, procedures and tools designed to help ensure availability of critical operations, information technology and telecommunication systems and safeguard sensitive information. The cybersecurity program is assessed against industry standards, including certain Center for Internet Security critical security controls. This assessment is conducted by a third party periodically and internally at least annually. We are also required to comply with cybersecurity standards under the North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection and by the Department of Homeland Security Transportation Security Administration. We also periodically collaborate with federal and state law enforcement experts, external assessors, consultants, industry peers and other third parties in connection with understanding market and threat conditions used to identify, assess and mitigate cybersecurity risks.


text: The cybersecurity program includes: • a dedicated cybersecurity team; • operations, information technology and telecommunication systems implemented with segmentation and multiple levels of access controls; • a security operations center that continuously monitors information technology and telecommunications systems; • an incident response team composed of individuals from the information technology, operations, accounting, finance, legal, and communications departments, as needed, which is activated to respond to cybersecurity incidents; • periodic drills and exercises to address risks and prepare for extraordinary scenarios, including industry collaboration on incident preparation, such as GridEx drills hosted by NERC, participation in a full activation drill at least annually, and several tabletop drills during the year; • periodic drills with the full executive team, including the Chief Executive Officer (CEO), Chief Financial Officer (CFO), Chief Accounting Officer (CAO), Chief Information Officer (CIO) and General Counsel; • periodic information security awareness training and phishing simulations for employees and contractors who access our networks; • periodic security assessments of evolving risks and threats that lead to strengthening of cybersecurity measures; • implementation of automation solutions to strengthen detection and response capabilities; and • maintenance of cyber liability insurance.


text: ASB relies on its information technology systems and networks in connection with many of its business activities. Some of these networks and systems are managed by third-party service providers and are not under the Bank's direct control. The Bank has implemented processes to manage the cybersecurity risks associated with its use of third-party service providers.


text: Our cybersecurity program is overseen by our Senior Vice President and CIO, who has nearly four decades of experience in information technology, including two decades as a CIO, having previously held CIO roles with other organizations, as well as experience in the utility sector. The CIO oversees a team dedicated to the support of cybersecurity tools and the overall cybersecurity program. The CIO reports to the Executive Vice President and CFO. The CIO provides periodic briefs regarding prevention, detection, mitigation and remediation of cybersecurity incidents, as well as risks, threats and the threat landscape to the Board and executive management, including the CEO, CFO and CAO. These briefs are used to help continuously improve our cybersecurity program and to inform risk assessments as part of the ERM program.


text: The full Board of Directors is responsible for oversight of our key cybersecurity risks. The Board retains direct oversight of cybersecurity matters to best utilize the experiences and expertise of all Board members. Management, including the CIO, provides reports approximately quarterly to the Board regarding risks, threats, the threat landscape, assessments of and improvements to the cybersecurity program, and internal response preparedness.


text: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure The Company's cybersecurity program is designed to protect its digital assets and information, and to allow for the secure storage and transmission of proprietary or confidential information regarding our customers, employees, job applicants, and other parties, including financial information, intellectual property, and personal identification information. The Company's cybersecurity program is formed on a risk-based approach in accordance with industry best practices, and is calibrated with recommendations from third party risk management consultants, auditors, cybersecurity professionals, and cybersecurity insurers. Portions of our business are certified under the Cyber Essentials program. Additionally, the Company has performed an ISO 27001 gap analysis and goals have been set forth to comply with ISO 27001 company-wide.

companyName: FOSTER L B CO

ticker: FSTR


text: Our cybersecurity program includes: • a comprehensive cyber education program with ongoing employee cybersecurity awareness and training activities, which include frequent phishing simulation, testing, and ongoing education; • access management and access controls with periodic reviews; • protection of certain data through encryption at rest and in transit; • endpoint and network monitoring and protection software; • sensitive data transmission detection tools; • the engagement of a managed detection and response service which monitors the Company's environment at all times for threats, and in the event of an incident, provides proactive services; • a vulnerability management program that includes identifying and managing the cybersecurity risk associated with third-party service providers, including third-party software, hardware, and network infrastructure; • a dedicated internal cybersecurity team and a cyber incident response plan that provides controls and procedures to support appropriate identification, containment, response, investigation, reporting or and recovery from cybersecurity incidents; • periodic testing of our cybersecurity posture, including by independent third-party consultants; and • integrating cybersecurity requirements and other provision into various contracts.


text: The Company has continued to invest in cybersecurity to evolve and improve its program and regularly assesses and measures itself against industry practices to identify opportunities to enhance training and awareness among our people and improve processes and technology used to identify, prevent, detect, respond, and recover from cybersecurity incidents. When such improvements are identified and validated as appropriate in the Company's business context, they are incorporated in the roadmap for implementation.


text: To date, although the Company has been subject to cyber-attacks, the risks and impacts from cybersecurity threats have not materially affected the Company. We have significantly increased our cybersecurity investments over the last several years and have implemented cybersecurity safeguards designed to detect and prevent cybersecurity events that may have a material adverse effect on the Company. Notwithstanding our increased cybersecurity investments and preparedness activities, sophisticated and targeted computer crime perpetrated by threat actors internal or external to the Company poses a risk to the security of our systems, facilities, and networks and to the confidentiality, availability, and integrity of our data, including but not limited to intellectual property and confidential and personal data. This could result in a violation of applicable privacy and other laws, legal and financial exposure, negative impacts on our customers' willingness to transact business with us, and a loss of confidence in our security measures, which could have an adverse effect on our results of operations and our reputation. Refer to the risk factor titled "We are subject to cybersecurity risks and may incur increasing costs in an effort to minimize those risks" in Item 1A of this Form 10-K for further detail regarding cybersecurity risks that could affect the Company's operations. We maintain insurance covering certain costs that we may incur in connection with cybersecurity incidents, which we believe is commensurate with the size and the nature of our operations. However, the Company may incur expenses and losses related to a cyber incident that are not covered by insurance or are in excess of our insurance coverage.


text: The Company's Board of Directors (the "Board") has overall responsibility for the oversight of risk management at L.B. Foster Company, which includes cybersecurity risks. The Audit Committee of the Board (the "Audit Committee"), is responsible for oversight of the Company's Enterprise Risk Management ("ERM") program which provides oversight and governance of all of the Company's operational and financial risks, specifically including risks from cybersecurity threats to the Company. As described below, the Audit Committee receives regular reports and periodic briefings from senior management on cybersecurity matters, including key risks to the Company, recent developments, and risk mitigation activities.


text: The Company has a Cyber Incident Response Team ("CIRT") of trained information technology professionals who are responsible for assessing, identifying, and managing our material risks from cybersecurity threats on an ongoing basis, all of whom have extensive background, experience, and education in information technology and computer science and are subject to training on industry-leading security platforms and tools as well as continuing education to maximize capabilities with the tools and technology of the Company. This team is overseen by the Vice President of Information Technology, who facilitates the regular cybersecurity updates to the Audit Committee. The Company also has a Cyber Security Materiality Assessment Committee ("CMAC") comprised of the Chief Financial Officer, General Counsel, and information technology and security representatives, which is responsible for assessment of material cybersecurity incidents and communicating such incidents to the Chief Executive Officer, Audit Committee, and the Board.


text: The CIRT maintains an internal execution and communication plan that is designed to measure the impact, assess initial materiality, record the incident, invoke the incident response plan, and communicate the occurrence of certain cybersecurity events or incidents to appropriate members of senior management (including the CMAC) within established procedural time frames. This communication hierarchy includes protocols for informing the Chief Executive Officer, Audit Committee, and the full Board of certain cybersecurity events or incidents and for determining the materiality thereof.


text: Our cybersecurity program includes: • a comprehensive cyber education program with ongoing employee cybersecurity awareness and training activities, which include frequent phishing simulation, testing, and ongoing education; • access management and access controls with periodic reviews; • protection of certain data through encryption at rest and in transit; • endpoint and network monitoring and protection software; • sensitive data transmission detection tools; • the engagement of a managed detection and response service which monitors the Company's environment at all times for threats, and in the event of an incident, provides proactive services; • a vulnerability management program that includes identifying and managing the cybersecurity risk associated with third-party service providers, including third-party software, hardware, and network infrastructure; • a dedicated internal cybersecurity team and a cyber incident response plan that provides controls and procedures to support appropriate identification, containment, response, investigation, reporting, and recovery from cybersecurity incidents; • simulated cyber security emergency response readiness scenario training with key IT personnel and executive leadership; • periodic testing of our cybersecurity posture, including by independent third-party consultants; and • integrating cybersecurity requirements and other provision into various contracts.


text: The Board of Directors has delegated primary responsibility for the oversight of cybersecurity and information technology risks, and the Company's preparedness for these risks, to the Audit Committee. The Audit Committee serves and functions as the Board of Directors primary oversight body to monitor the Company's cybersecurity and related information technology risks. The Audit Committee receives periodic updates from the VP of Tech on the Company's policies, processes, procedures, and any significant development related to the identification, mitigation and remediation of cybersecurity risks. The Audit Committee ensures that the VP of Tech provides to the Board of Directors annual updates on our cybersecurity and information technology risk. These annual updates include topics related to our cybersecurity programs and mitigation strategies, trends in cybersecurity, and other cybersecurity-related developments.

companyName: AIR T INC

ticker: AIRT


text: Vendor Security. We have a vendor risk management program that works to classify service provider or business partner risk based on several factors, including but not limited to data type accessed and/or retained. Using a risk-based approach, we perform diligence and security risk assessments for certain vendors and service providers and include appropriate obligations in our contractual arrangements.

companyName: HOME DEPOT, INC.

ticker: HD


text: Cybersecurity Risk Management and Strategy To effectively prevent, detect, and respond to cybersecurity threats, the Company employs a multi-faceted cybersecurity risk management program supervised by our Vice President of Technology (VP of Tech), who reports directly to our CEO. The VP of Tech is responsible for leading our enterprise cybersecurity strategy. This responsibility includes establishing processes designed to prevent and monitor potential cybersecurity risks, assessing potential cybersecurity incidents, implementing mitigation measures, and maintaining the cybersecurity program itself. We do this so that we can continuously enhance our cybersecurity capabilities and strengthen our defensive posture.