text: Our internal audit department also reviews our cybersecurity program, processes, policies and controls at least annually. The program also is regularly reviewed in annual external audits and regulatory assessments. Lessons learned from those efforts are used to drive improvements to continually strengthen the cybersecurity program, including controls for data security.


text: The CST works closely with the sourcing and vendor management team when contracting for third-party information technology services. Our information technology architecture review board, which includes cybersecurity leadership, reviews all potential vendors. We have comprehensive cybersecurity assessment processes and procedures in place, including security risk questionnaires, standard documentation requests, and utilization of a third-party risk evaluation tool to provide insight on potential third-party vendors. We utilize private connections (including private VPN) and extensive use of virtual desktops to secure access to our data and systems. Our legal team ensures that specific protections are included in contracts, including confidentiality language, nondisclosure obligations and security provisions.

companyName: CNO Financial Group, Inc.

ticker: CNO

secItem: Item 1C

stage1Category: Third-Party Risk

stage1Method: majority


text: Critical vendors are monitored by our sourcing and vendor management team. Resources contracted through a third-party that will have access to corporate systems must complete CNO's associate training or their company's security awareness training that has been approved by CNO. We also perform periodic risk assessments throughout the term of the engagements, including those third parties located outside the United States that have access to our Company and customer information.


text: To date, no cybersecurity threat, including from a cybersecurity incident, has materially affected our business strategy, results of operations, or financial condition.

stage1Category: Strategy Integration

stage1Method: unanimous


text: We recognize that security is an enterprise concern and requires stakeholders from across the enterprise to understand and manage this risk. Our security management structure reflects a centralized security program that coordinates security functions across the enterprise. The CISO, who oversees the CST, reports directly to our chief information officer and is responsible for the overall strategy and function of the cybersecurity program. We also have a cybersecurity steering committee that takes an active role in setting strategic direction for cybersecurity initiatives and provides oversight and guidance for overall information security risk management. The CISO provides regular reports on our cybersecurity program and potential risks to the Audit and Enterprise Risk Committee ("AERC") of the Board of Directors. The AERC regularly briefs the full Board on these matters. One AERC member holds the CERT Certification in Cybersecurity Oversight from Carnegie Mellon University, and a second has significant work experience related to technology and data security.

stage1Category: Management Role


text: Our CISO is well-qualified in the area of cybersecurity and data protection. These qualifications include: (i) 23 years of experience in cybersecurity, security risk management and IT auditing; (ii) the designation of Certified Information Systems Security Professional ("CISSP"); and (iii) a Bachelor's degree in Computer Information Systems. Our CISO also previously held the Certified Information Systems Auditor ("CISA") and Certified in Risk and Information Systems Controls ("CRISC") certifications.


text: Failure to maintain a reasonable and effective cybersecurity program, or any compromise of the security, confidentiality, integrity, or availability of our information systems and the sensitive, proprietary, and confidential data on such systems could lead to additional costs and liabilities, as well as damage our reputation or deter people from purchasing our products. There can be no assurance that a future breach will not occur or, if any does occur, that it can be promptly detected and sufficiently remediated without materially impacting our business or our operations. While we maintain insurance coverage that, subject to policy terms and conditions, is designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses or all types of claims that may arise in the event of a material cyber risk incident.


text: Risk Management and Strategy The Company's cybersecurity approach comprises a holistic strategy that includes comprehensive security policies and standards, a robust security awareness and education program, and the implementation of advanced and layered defenses, which is integrated into the Company's overall risk management processes. Our cybersecurity program is aligned with generally accepted principles and practices for securing information systems and data. The program is designed to comply with applicable laws and regulations and is based on many industry best practices. For instance, our cybersecurity program, policies and controls align to those of the National Institute of Standards and Technology's Cybersecurity Framework.

stage1Category: Risk Management Process


text: We have established and continue to enhance our procedures for identifying cybersecurity risks and implementing defenses to mitigate these risks. We devote significant resources to maintaining and regularly updating our systems and processes to protect the security of our computer systems, software, networks and other technology assets against unauthorized parties attempting to access confidential information, destroy data, disrupt or degrade service, sabotage systems, or cause other damage. Our cyber incident response plan provides procedures and controls for timely and accurate reporting of any material cybersecurity incident, and each associate is educated, trained and tested on cybersecurity to help be our first line of defense.


text: We have a dedicated Cybersecurity Services team ("CST") devoted to information security which is led by the chief information security officer ("CISO"). In addition, our Security Operations Center provides near-real-time monitoring of network traffic going in and out of the enterprise to identify any abnormalities or indications of malicious behavior. We use managed security services providers to provide monitoring, threat hunting and response services through network and security log monitoring and a hosted security information and event management solution.


text: We conduct regular enterprise-wide internal and external cyber risk assessments. These efforts include audits, internal and external regulatory compliance assessments, and periodic self-assessments. Vulnerability assessments are performed frequently for systems, and internal and external penetration tests are performed annually. We periodically engage vendors to review and benchmark our cybersecurity processes. In addition, members of the CST perform regular security control assurance testing.


text: As of December 31, 2024, no cybersecurity threat, including from a cybersecurity incident, has materially affected our business strategy, results of operations, or financial condition.


text: Material Effects of Cybersecurity Threats While cybersecurity risks have the potential to materially affect the Bank's business, financial condition, and results of operations, the Bank does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Bank, including its business strategy, results of operations or financial condition. Accordingly, no matter how well designed or implemented the Bank's controls are, there is a risk that it may not be able to anticipate all zero-day cyber security exploits and vulnerabilities, and it may not be able to implement effective preventive measures against such exploits / vulnerabilities and potentially associated security breaches in a timely manner.

companyName: BCB BANCORP INC

ticker: BCBP


text: We recognize that security is an enterprise concern and requires stakeholders from across the enterprise to understand and manage this risk. Our security management structure reflects a centralized security program that coordinates security functions across the enterprise. The CISO, who oversees the CST, reports directly to our chief information officer and is responsible for the overall strategy and function of the cybersecurity program. We also have a cybersecurity steering committee that takes an active role in setting strategic direction for cybersecurity initiatives and provides oversight and guidance for overall information security risk management. The CISO provides regular reports on our cybersecurity program and potential risks to the Audit and Enterprise Risk Committee ("AERC") of the Board of Directors. The AERC regularly briefs the full Board on these matters. One AERC member holds the CERT Certification in Cybersecurity Oversight from Carnegie Mellon University, and a second has significant work experience related to technology.


text: Our CISO is well-qualified in the area of cybersecurity and data protection. These qualifications include: (i) 24 years of experience in cybersecurity, security risk management and IT auditing; (ii) the designation of Certified Information Systems Security Professional ("CISSP"); and (iii) a Bachelor's degree in Computer Information Systems. Our CISO also previously held the Certified Information Systems Auditor ("CISA") and Certified in Risk and Information Systems Controls ("CRISC") certifications.


text: Failure to maintain a reasonable and effective cybersecurity program, or any compromise of the security, confidentiality, integrity, or availability of our information systems and the sensitive, proprietary, and confidential data on such systems could lead to additional costs and liabilities, as well as damage our reputation or deter people from purchasing our products. There can be no assurance that a future breach will not occur or, if any does occur, that it can be promptly detected and sufficiently remediated without materially impacting our business or our operations. While we maintain insurance coverage that, subject to policy terms and conditions, is designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses or all types of claims that may arise in the event of a material cyber risk incident. For a discussion regarding risks associated with cybersecurity threats, see Risk Factors – General Business Risk – "Interruption in telecommunication, information technology and other operational systems, or a failure to maintain the security, confidentiality or privacy of sensitive data residing on such systems, could harm our business," and "The use or anticipated use of AI technologies, including generative AI, by us or third parties, may increase the operational risks discussed above, or create new or unanticipated operational risks."

stage1Category: None/Other


text: Risk Assessment and Management As digitization and technological advancements continue to accelerate, the landscape of cybersecurity faces new challenges. Compass Minerals remains vigilant in our efforts to minimize risk by safeguarding systems and protecting private business, partner, and customer information. Protection of our digital assets requires strategically focused cybersecurity processes with persistent execution.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: We maintain a cybersecurity program employing many components and strategies to mitigate and remediate day-to-day cybersecurity threats and exposures. We approach cybersecurity threats through a cross-functional, multilayered approach, with specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to us; (ii) preserving the confidentiality, security, integrity, and availability of the information that we collect and store to use in our business; (iii) protecting our intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required. Our layered approach to cyber security risk mitigation includes the following: • Secure architectural solution design of processes and system configuration. • Assessment and remediation of cybersecurity events with potential impact on business processes. • Proactive monitoring and mitigation of active exploits through managed services. • Evolution of the information security governance program.


text: We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, and/or reputation. We employ continuous monitoring systems and other technologies and security controls to assist us with the identification of cybersecurity risks and threats. These strategies include, among others, the application, adoption or modification of cybersecurity policies and procedures, implementation of administrative, technical, and/or physical controls and employee training, education, and awareness initiatives.


text: Our cybersecurity risk management includes continuous monitoring of networks and systems for potential signs of suspicious activity. We have deployed managed detection and response services for all corporate production systems (servers, desktops, and laptops). This managed service includes 24x7x365 monitoring, threat hunting, remediation, and escalation to help maintain a secure environment. We also provide mechanisms and training for employees to report to the IT Department any unusual or potentially malicious activity they observe for proper identification and analysis.


text: We track key performance indicators and cybersecurity metrics to evaluate the efficacy of our cybersecurity controls and practices. Further, our cybersecurity program is periodically reviewed by senior members of management and adjusted as needed to maintain the program's agility and responsiveness as circumstances and technologies evolve, new cybersecurity threats emerge, and regulations change.


text: Cybersecurity represents a critical component of our overall approach to risk management. Our cybersecurity policies, standards and practices are fully integrated into our enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our Board of Directors (the "Board"). We separately operate an ERM program to identify, evaluate and manage risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program to align cybersecurity efforts with our broader business goals and objectives. We believe that integrating cybersecurity risks into our ERM program fosters a proactive and holistic approach to cybersecurity, which helps safeguard our operations, financial condition, and reputation in an ever-evolving threat landscape. Cybersecurity risks are further considered and evaluated as part of an annual risk assessment performed independently by our internal audit department.


text: Incident Response We maintain an incident response policy and program focused upon detecting, managing, documenting, and reporting incidents affecting our systems and data, including those specific to cybersecurity. In the event of a significant cybersecurity incident, we establish an incident response team ("IRT") that works in conjunction our internal crisis management team, subject matter experts, and business stakeholders to identify, contain, eradicate and, if necessary, recover from a cybersecurity incident. We have built into our incident response program, a review process that gives our disclosure committee real-time access to information to rapidly assess materiality. These efforts may include detecting, identifying, defending against, responding to and, if necessary, recovering from cybersecurity incidents. Incidents that meet certain thresholds are escalated to senior members of management, internal legal advisors, communication specialists and other key stakeholders for additional guidance and action.


text: Through third parties we are also able to rapidly deploy forensic analysis, legal services, notification, and call center service(s). Our incident response and change management policies and procedures were designed based on guidelines from the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF").


text: Use of Third Parties Cybersecurity Service Providers and Third-Party Consultants. Periodically we engage independent cybersecurity consultants, auditors and other third parties to assess and enhance our cybersecurity risk assessment and practices. These third parties conduct independent assessments, penetration testing and vulnerability assessments to identify weaknesses and recommend improvements. When cybersecurity risks are identified, we prioritize mitigation strategies based upon risks' potential impact, likelihood, velocity, and vulnerability, considering both quantitative and qualitative factors. Additionally, we employ several third-party tools and technologies as part of our efforts to enhance cybersecurity functions and monitoring.


text: Oversight of Third-Party Service Providers. We use third-party service providers to support our operations and many of our technology initiatives, including third parties that house financial or sensitive information. Our technology acquisition policy and our internal controls framework require us to obtain and review attestation reports regarding these third-party service providers and their sub-service processors or providers and their internal controls, complementary user entity controls and contractual obligations, including those specific to cybersecurity. We evaluate cybersecurity risks associated with our use of third-party service providers, which may include a review of a service provider's cybersecurity posture or a recommendation of specific mitigation controls. We determine and prioritize service provider risk based on potential threat impact and likelihood and these risk determinations determine the level of due diligence and ongoing compliance monitoring required for each service provider. We have independent validation and assessment capabilities from our cyber insurance provider (Resilience). Each year we select several third-party suppliers for evaluation, analyze resultant reports, and mitigate risks associated with the vendor as needed.


text: Risks from Material Cybersecurity Threats As of the date of this report, we have not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although we have not previously experienced cybersecurity incidents that are individually, or in the aggregate, material, we have experienced cyberattacks in the past, which we believe have thus far been deflected or mitigated by our preventative, detective, and responsive measures. COMPASS MINERALS INTERNATIONAL, INC.


text: Our board level audit committee retains oversight of our cyber security program, which is led by our vice president of information technology services. Our senior leadership regularly provides updates on cybersecurity risks and cyber security initiatives to both the audit committee and the broader board. The Board is responsible for overseeing management's assessments of major risks facing the Company and for reviewing options to mitigate these risks. The Board's oversight of cybersecurity risks occurs at both the Board level and through its Audit Committee.

stage1Category: Board Governance


text: The Board. The Chief Executive Officer, the Chief Financial Officer, other members of senior management and other personnel and advisors, as requested by the Board, report on our financial, operating, and commercial strategies, as well as major related risks, which may include cybersecurity risks, at regularly scheduled meetings of the Board. The Board may request follow-up data and presentations to address any specific concerns or recommendations.


text: The Audit Committee. The Audit Committee reviews with our management team, including our vice president of information technology services, our cybersecurity frameworks, policies, technologies, programs, opportunities, strategies, and risks. These presentations highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks, related remediation and mitigation activities, security user awareness and reporting training program and any other relevant cybersecurity topics. In addition, members of our Legal Department advise the Audit Committee as needed regarding cybersecurity-related legal matters, including disclosure requirements. Management believes that these reports help to provide the Audit Committee with an informed understanding of our cybersecurity program, risks, and strategies. The Audit Committee may request follow-up data and presentations to address any specific concerns or recommendations. In addition to this periodic reporting, significant cybersecurity risks or threats may also be escalated to the Audit Committee as needed based upon our cyber incident reporting process. The Audit Committee reports regularly to the entire Board and reviews with the Board any major issues that arise at the committee level, which may include cybersecurity risks.


text: Management's Role Our IT Department addresses current and emerging cybersecurity matters. This function is led by our vice president of information technology services, who reports to our Chief Strategy Officer. The IT Department's security team, a cross-functional group composed of members with substantial professional and technical information technology experience, oversees the cybersecurity program to help ensure the confidentiality, integrity and availability of the company's systems and mitigate day-to-day threats and exposures. It is responsible for measuring and managing cybersecurity risk, including the prevention, detection, mitigation, and remediation of cybersecurity incidents and for implementing cybersecurity policies, programs, procedures and strategies. The security team reports significant cybersecurity incidents to senior management, internal legal advisors, communication specialists and other key stakeholders as required.


text: We maintain a cybersecurity program employing many components and strategies to mitigate and remediate day-to-day cybersecurity threats and exposures. We approach cybersecurity threats through a cross-functional, multilayered approach, with specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to us; (ii) preserving the confidentiality, security, integrity, and availability of the information that we collect and store to use in our business; (iii) protecting our intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required. Our layered approach to cyber security risk mitigation includes the following: • Secure architectural solution design of processes and system configuration. • Assessment and remediation of cybersecurity events with potential impact on business processes. • Proactive monitoring and mitigation of active exploits through managed services. • Evolution of the information security governance program. COMPASS MINERALS INTERNATIONAL, INC.


text: Our cybersecurity risk management includes continuous monitoring of networks and systems for potential signs of suspicious activity. We have deployed managed detection and response for all corporate production systems (servers, desktops, and laptops). This managed service includes 24x7x365 monitoring, threat hunting, remediation, and escalation to help maintain a secure environment. We also provide mechanisms and training for employees to report to the IT Department any unusual or potentially malicious activity they observe for proper identification and analysis.


text: We track key performance indicators and cybersecurity metrics to evaluate the efficacy of our cybersecurity controls and practices. Furthermore, our cybersecurity program is periodically reviewed by senior management members and adjusted as needed to maintain the program's agility and responsiveness as circumstances and technologies evolve, new cybersecurity threats emerge, and regulations change.


text: Material Effects of Cybersecurity Threats While cybersecurity risks have the potential to materially affect the Bank's business, financial condition, and results of operations, the Bank does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Bank, including its business strategy, results of operations or financial condition. Accordingly, no matter how well designed or implemented the Bank's controls are, there is a risk that it may not be able to anticipate all zero-day cyber security exploits and vulnerabilities, and it may not be able to implement effective preventive measures against such exploits / vulnerabilities and potentially associated security breaches in a timely manner.


text: Incident Response We maintain an incident response policy and program focused upon detecting, managing, documenting, and reporting incidents affecting our systems and data, including those specific to cybersecurity. In the event of a significant cybersecurity incident, we establish an Incident Response Team ("IRT") that works in conjunction with our internal crisis management team, subject matter experts, and business stakeholders to identify, contain, eradicate and, if necessary, recover from the incident. We have built into our incident response program, a review process that gives our disclosure committee real-time access to information to rapidly assess materiality. These efforts may include detecting, identifying, defending against, responding to and, if necessary, recovering from cybersecurity incidents. Incidents that meet certain thresholds are escalated to senior members of management, internal legal advisors, communication specialists and other key stakeholders for additional guidance and action.


text: Use of Third Parties Cybersecurity Service Providers and Third-Party Consultants. Periodically we engage independent cybersecurity consultants, auditors and other third parties to assess and enhance our cybersecurity risk assessment and practices. These third parties conduct independent assessments, penetration testing and vulnerability assessments to identify weaknesses and recommend improvements. When cybersecurity risks are identified, we prioritize mitigation strategies based on the potential impact, likelihood, velocity, and vulnerability of risks, considering both quantitative and qualitative factors. Additionally, we employ several third-party tools and technologies as part of our efforts to enhance cybersecurity functions and monitoring.


text: Oversight of Third-Party Service Providers. We use third-party service providers to support our operations and many of our technological initiatives, including third parties that house financial or sensitive information. Our technology acquisition policy and our internal controls framework require us to obtain and review attestation reports regarding these third-party service providers and their sub-service processors or providers and their internal controls, complementary user entity controls and contractual obligations, including those specific to cybersecurity. We evaluate cybersecurity risks associated with our use of third-party service providers, which may include a review of a service provider's cybersecurity posture or a recommendation of specific mitigation controls. We determine and prioritize service provider risk based on potential threat impact and likelihood and these risk determinations determine the level of due diligence and ongoing compliance monitoring required for each service provider.


text: Risks from Material Cybersecurity Threats As of the date of this Form 10-K, we have not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although we have not previously experienced cybersecurity incidents that are individually, or in the aggregate, material, we have experienced cyberattacks in the past, which we believe have thus far been deflected or mitigated by our preventative, detective, and responsive measures.


text: Our board-level audit committee retains oversight of our cybersecurity program, which is led by our Vice President of Information Technology Services. Our senior leadership regularly provides updates on cybersecurity risks and cybersecurity initiatives to both the audit committee and the broader board. The Board is responsible for overseeing management's assessments of major risks facing the Company and for reviewing options to mitigate these risks. The Board's oversight of cybersecurity risks occurs at both the Board level and through its Audit Committee.


text: The Board. The Chief Executive Officer, the Chief Operating Officer, the Chief Financial Officer, other members of executive management, and other personnel and advisors, as requested by the Board, report on our financial, operating, and commercial strategies, as well as significant related risks, which may include cybersecurity risks, at regularly scheduled meetings of the Board. The Board may request follow-up data and presentations to address any specific concerns or recommendations.


text: Incident Response and Recovery Planning: We have established and maintained comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.

companyName: UNIVERSAL TECHNICAL INSTITUTE INC

ticker: UTI


text: The Audit Committee. The Audit Committee reviews with our management team, including our Vice President of Information Technology Services, our cybersecurity frameworks, policies, technologies, programs, opportunities, strategies, and associated risks. These presentations highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks, related remediation and mitigation activities, security user awareness and reporting training program and any other relevant cybersecurity topics. In addition, members of our Legal Department advise the Audit Committee as needed regarding cybersecurity-related legal matters, including disclosure requirements. Management believes that these reports help to provide the Audit Committee with an informed understanding of our cybersecurity program, risks, and strategies. The Audit Committee may request follow-up data and presentations to address any specific concerns or recommendations. In addition to this periodic reporting, significant cybersecurity risks or threats may also be escalated to the Audit Committee as needed based upon our cyber incident reporting process. The Audit Committee reports regularly to the entire Board and reviews with the Board any major issues that arise at the committee level, which may include cybersecurity risks.


text: Management's Role Our IT Department addresses current and emerging cybersecurity matters. This function is led by our Vice President of Information Technology Services, who reports to our Chief Financial Officer, and brings more than 15 years of leadership experience in enterprise technology, digital transformation, and operational risk management. This position oversees the Company's information technology, cybersecurity, data governance, and enterprise architecture functions and has led multi-year modernization initiatives across infrastructure, core business platforms, and security tooling. The Vice President of Information Technology Services has experience managing cybersecurity frameworks, vulnerability management programs, OT/IT security integration, vendor risk oversight, and incident response preparedness, in addition to a background in leading cross-functional teams, partnering with external security firms, and strengthening organizational controls to reduce cyber, operational, and compliance risks. The Vice President of Information Technology Services holds both a masters degree and a bachelors degree in business administration. Prior to working at Compass Minerals, the Vice President of Information Technology Services held various positions of increasing responsibility within the IT function, including Business Solutions Architect; Manager, Business Solutions; and Director, Business Solutions. The IT Department's security team, led by our Senior Manager, Cybersecurity, comprise of a cross-functional group of members with substantial professional and technical information technology experience, oversees the cybersecurity program to help ensure the confidentiality, integrity and availability of the company's systems and mitigate day-to-day threats and exposures. It is responsible for measuring and managing cybersecurity risk, including the prevention, detection, mitigation, and remediation of cybersecurity incidents and for implementing cybersecurity policies, programs, procedures and strategies. The security team reports significant cybersecurity incidents to senior management, internal legal advisors, communication specialists and other key stakeholders as required. COMPASS MINERALS INTERNATIONAL, INC.


text: Cybersecurity Risk Management and Strategy Cybersecurity risks are continually evolving, becoming increasingly complex and pervasive across all industries. To mitigate these cybersecurity risks and protect nonpublic, personally identifiable customer data, financial transactions and our classified information systems, the Bank has implemented a comprehensive information security program, which is a component of its overarching enterprise risk management program. Key components of the information security program include: • A risk assessment process that identifies and prioritizes material cybersecurity risks; defines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the Board of Directors. • Annual security assessments that proactively identify potential vulnerabilities that are both externally facing and internal within the bank's infrastructure; reports the results for all assessments to executive management and the Board of Directors with tracking and resolution to potential areas of risk. • Vulnerability management program that patches known vulnerabilities across operating systems and software platforms. • Strong controls around user access including creation, changes and termination of access, ongoing user access reviews, multifactor authentication and password policies. • A technology team covering all critical cyber defense functions such as engineering, data protection, identity and access management, insider risk management, security operations, threat emulation and threat intelligence. • A training program that educates employees about cybersecurity risks and how to protect themselves from cyberattacks. • An awareness program that keeps employees informed about cybersecurity threats and how to stay safe online. • An incident response plan that outlines the steps the Bank will take to respond to a cybersecurity incident, which is tested on a periodic basis. • Adoption and implementation of a layered defense / defense in depth model n which security systems are linked or stacked so that the strengths of one security system compensate the weaknesses of the other system. • Additional controls that include but not limited to data encryption; change management; end of life management; asset management; malware and antivirus detection, response and mitigation; physical security; business continuity and disaster recovery management.


text: The Bank engages reputable third-party assessors to conduct various independent audits on a regular basis, including but not limited to maturity assessments and various testing. Following a defense-in-depth strategy, the Bank leverages both in-house resources and third-party service providers to implement and maintain processes and controls to manage the identified risks.


text: The Bank's Third-Party / Vendor Risk Management program is designed to ensure that our vendors meet our cybersecurity requirements. This includes conducting periodic risk assessments of vendors, requiring vendors to implement appropriate cybersecurity controls and monitoring vendor compliance with our cybersecurity requirements.


text: The Bank's information security program and strategy are designed to ensure the Bank's information and information systems are resilient and appropriately protected from a variety of threats, both natural and man-made. Periodic audits and risk assessments are performed to validate control requirements and ensure that the Bank's information is protected at a level commensurate with its sensitivity, value, and criticality. Preventative and detective security controls and policies are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission to ensure the confidentiality, integrity, and availability of Bank information. These controls and policies include, but are not limited to access control, data encryption, data loss prevention, incident response, security monitoring, third party risk management, and vulnerability management.


text: The Bank's information security program and strategy are regularly reviewed and updated to ensure that they are aligned with the Bank's business objectives and are designed to address evolving cybersecurity threats and satisfy regulatory requirements and industry standards.


text: We maintain a well-documented process to oversee cybersecurity risks associated with our third-party service providers. We evaluate our third parties prior to any engagements and review their System and Organization Controls reports to obtain reasonable assurance that their controls meet our security standards.

companyName: Green Plains Inc.

ticker: GPRE


text: Board of Directors Oversight The Bank's Board of Directors is charged with overseeing the establishment and execution of the Bank's security management framework and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Consistent with this responsibility the Board has delegated primary oversight responsibility over the Bank's security management framework, including oversight of cybersecurity risk and cybersecurity risk management, to the Information Technology /Information Security Committee of the Board of Directors. The Information Technology /Information Security Committee receives regular updates on cybersecurity risks and incidents and the cybersecurity program through direct interaction with the Chief Information Technology Officer and provides periodic updates regarding cybersecurity risks and the cybersecurity program to the full Board of Directors. Additionally, awareness and training on cybersecurity topics is provided to the Board on an annual basis.


text: Management's Role The Information Technology department is responsible for implementing and maintaining the Bank's cybersecurity risk management program. The Information Technology department consists of cybersecurity and information risk professionals who assess, identify, and manage cybersecurity risks. Information Security is led by Chief Information Technology Officer, who reports directly to the Chief Operating Officer and dotted lined to the Board of Directors. The Bank's CITO has over 23 years of experience in technology and cybersecurity across the financial services industry. Prior to joining the Bank, the Bank's CITO served as Chief Information Officer and Information Security Officer at First Choice Bank and the Director of Technology and IT Governance at OceanFirst Bank. The Information Technology department is responsible for ensuring the protection of electronic and physical information through the identification and management of risk activities. Information security risk is reported by the Information Technology Department through quarterly management reporting to achieve an appropriate flow of information risk reporting to the Board. The committees and working groups that monitor information security risks include the Cybersecurity Incident Response Team, and the Information Technology / Information Security Committee of the Board of Directors. These committees and working groups establish and oversee policies, programs, and other guidance to provide specific expectations for managing the cybersecurity risk.


text: Our third-party vendor management program has a tiered approach to assess vendors based on risk profile. We review each third-party vendor's architectures, security practices and data flows, and integrate stringent contractual terms encompassing breach notifications and other security requirements. The risk profiles associated with our service level agreements are monitored by senior employees in our information security and technology departments. Our vendor management program also includes an annual reassessment of the risk profile of each vendor and interim vendor reviews are completed if service alterations occur.

companyName: PIPER SANDLER COMPANIES

ticker: PIPR


text: Management's Role We recognize the critical importance of developing, implementing, assessing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Senior Management, in collaboration with the Information Technology and Risk Departments, is responsible for the implementation and oversight of the Bank's Cybersecurity Risk Management Program.


text: Information security risk is systematically reported to our Board of Directors by the Information Technology and Risk Departments through quarterly management reports, ensuring a structured and effective flow of cybersecurity risk information to the Board of Directors. Various committees and working groups are dedicated to monitoring and managing information security risks, including the Cybersecurity Incident Response Team and the Information Technology/Information Security Committee of the Board of Directors. These committees play a pivotal role in establishing and overseeing policies, programs, and guidance that define clear expectations for managing cybersecurity risk.


text: Due to the evolving nature of cybersecurity threats, we actively engage with external experts to enhance our security expertise. These subject matter experts provide independent evaluations and testing of our cybersecurity risk management framework. Our collaboration with these entities includes regular audits, threat assessments, and consultations on security enhancements to reinforce our security posture.


text: As a trusted advisor to our clients and a regulated financial services firm, information and cybersecurity are critical to our operations and reputation. Our management team takes an active role in identifying, assessing, monitoring and managing material risks from information and cybersecurity threats. Management's assessment of information and cybersecurity threats is incorporated into our enterprise risk management processes, which include assessing inherent risks posed by the internal operating environment and external factors, assessing the adequacy and design of controls, testing controls, determining residual risk and comparing it to risk appetite thresholds, and taking steps to further mitigate risks as needed. Our board of directors is actively engaged in the oversight of cybersecurity and information technology risks, with primary oversight responsibility delegated to the audit committee of the board of directors. The audit committee is composed of board members with the appropriate expertise, including risk management, cybersecurity and finance, to oversee these risks as well as management's cybersecurity processes and protocols.


text: Our chief information and operations officer is a member of our leadership team and has been in this role for 15 years. With more than 25 years of experience in information technology in the investment banking industry, he is responsible for overseeing more than 100 employees in our information security and technology departments who possess relevant educational and industry experience. The information security and technology departments are responsible for various functions of our information and cybersecurity program, including implementing and maintaining policies and procedures; developing, implementing and governing various service level agreements; ratifying security standards; reviewing project implementations; performing third-party vendor assessments; and operating programs such as threat intelligence, vulnerability management, security information event management, and information governance.


text: Our information and cybersecurity program utilizes the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and our security controls are mapped to the NIST Cybersecurity Framework to ensure alignment with recognized industry best practices. Annually, we engage a third-party consultant to conduct an assessment of the effectiveness of our information and cybersecurity program against the NIST Cybersecurity Framework. This assessment is reviewed with the audit committee, and opportunities for further maturation are incorporated into our information and cybersecurity roadmap.


text: Additionally, we regularly engage consultants and other third parties to evaluate specific priority areas of our information and cybersecurity program based on our assessment of the current cybersecurity threat landscape. Examples of our engagement with consultants include external penetration testing, application security assessment and cybersecurity incident response tabletop exercises.


text: Senior information security and technology employees, including the chief information and operations officer, meet regularly to discuss potential information and cybersecurity threats that have been identified by our systems, employees or otherwise made known to us by our third-party service providers, vendors and other external users, and to formulate the appropriate response to any identified material information and cybersecurity threats. When high-priority information or cybersecurity risks are identified, certain employees in our information security, privacy, technology, legal and compliance departments meet or communicate to review potential threats in accordance with our internal cybersecurity incident response process.


text: Potential threats, our response to such threats, and our evaluation of any residual risk are communicated quarterly to the audit committee. As necessary, the chief information and operations officer provides interim updates to the audit committee and, as appropriate, the board of directors, concerning high-priority or material information or cybersecurity threats. Our chief information and operations officer also provides a quarterly update to the audit committee regarding our ongoing information and cybersecurity initiatives; the current cybersecurity landscape and emerging threats; and metrics on the effectiveness of certain aspects of our information and cybersecurity program.


text: Employees, including representatives of management, conduct an annual cybersecurity incident response tabletop exercise to review our processes and procedures in the event of a material information or cybersecurity incident, including the process for assessing the materiality of an incident and communication of an incident to the audit committee and, as appropriate, the board of directors. In addition, to promote a company-wide culture of cybersecurity risk management, we conduct regular phishing email simulations for employees to enhance awareness and responsiveness to possible threats and other kinds of preparedness training. We also require all employees to complete an annual cybersecurity and privacy awareness training.


text: We believe that we have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, as well as controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: We are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect our company, including our business strategy, results of operations or financial condition. However, we cannot provide assurance that a future cybersecurity incident would not materially affect our business strategy, results of operations or financial condition. Additional information regarding risks related to cybersecurity is included under "Risk Factors" in Part I, Item 1A of this Form 10-K.


text: Our chief information and operations officer is a member of our leadership team and has been in this role since 2008. With more than 25 years of experience in information technology in the investment banking industry, he is responsible for overseeing more than 100 employees in our information security and technology departments who possess relevant educational and industry experience. The information security and technology departments are responsible for various functions of our information and cybersecurity program, including implementing and maintaining policies and procedures; developing, implementing and governing various service level agreements; ratifying security standards; reviewing project implementations; performing third-party vendor assessments; and operating programs such as threat intelligence, vulnerability management, security information event management, and information governance.


text: Our information and cybersecurity program utilizes the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0, and our security controls are mapped to the NIST Cybersecurity Framework 2.0 to ensure alignment with recognized industry best practices. Annually, we engage a third-party consultant to conduct an assessment of the effectiveness of our information and cybersecurity program against the NIST Cybersecurity Framework 2.0. This assessment is reviewed with the audit committee, and opportunities for further maturation are incorporated into our information and cybersecurity roadmap.


text: Employees, including representatives of management, conduct an annual cybersecurity incident response tabletop exercise to review our processes and procedures in the event of a material information or cybersecurity incident, including the process for assessing the materiality of an incident and communication of an incident to the audit committee and, as appropriate, the board of directors. In 2024, our board of directors also participated in the cybersecurity incident response tabletop exercise. In addition, to promote a company-wide culture of cybersecurity risk management, we conduct regular phishing email simulations for employees to enhance awareness and responsiveness to possible threats and other kinds of preparedness training. We also require all employees to complete an annual cybersecurity and privacy awareness training.


text: Risk management and strategy We have implemented and maintain an information security program designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data including intellectual property, clinical trial participant and patient-related data, and confidential information that is proprietary, strategic or competitive in nature, or collectively, Information Systems and Data.

companyName: Jazz Pharmaceuticals plc

ticker: JAZZ


text: Our cybersecurity threat risk management processes include the following, among others: • Our information security department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example, manual methods and automated tools, conducting scans of the threat environment, conducting threat assessments, performing vulnerability assessments, use of external intelligence feeds, and through third-party-conducted red/blue team testing and tabletop incident response exercises. • Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: information security policies and standards governing access control, network and device security, encryption standards, incident response plans, disaster recovery plans, risk management, vulnerability detection and management and security awareness training requirements as well as security tools such as firewalls, malware protection tools, secure authentication tools, centralized logging and monitoring tools, threat intelligence tools, and data protection tools. • Our overall risk assessment and management processes address cybersecurity threats that may have a material impact on our business. Our information security department maintains a risk register of individual risks from cybersecurity threats. Our Chief Information Security Officer, or CISO, and Chief Information Officer, or CIO, periodically review the area of cybersecurity risk management within our overall enterprise risk management program and work with our executive director of internal audit and enterprise risk management to incorporate the aggregate risks from the cybersecurity threat risk register into the overall enterprise risk management program risk register. In addition, our CISO and CIO report significant increases to our threat profile to the Information Security Governance Committee (described below). • We use third parties, including professional services, incident response and managed security firms (including some that we have on a pre-paid retainer basis), to assist us from time to time to identify, assess, and manage cybersecurity risks, perform threat assessments relating to our Information Systems and Data by reviewing our business and industry vertical threat profiles and applying those to the overall threat landscape, perform penetration tests, conduct cybersecurity readiness exercises, assess program maturity, and to assist in the event of a cyber security incident. • We have third-party vendor management processes designed to help us identify, assess and manage risks from cybersecurity threats to our Information Systems and Data that may arise out of our use of third-party vendors across our business, including, among others, application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. Depending on the nature of the services and the service provider, our vendor management processes may include assessment of the cybersecurity practices of such vendors and contractually imposing obligations on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how those risks may affect us see "Significant disruptions of information technology systems or data security breaches could adversely affect our business" under Part I, Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: To operate our business, we utilize certain third-party service providers to perform a variety of operational functions. We have implemented a third-party risk management program to evaluate the cybersecurity practices of higher risk vendors and vendors that encounter our systems or data. We additionally engage and retain third-party consultants, legal advisors and assessors to keep us appraised of emerging third-party risk, defense and mitigation strategies, and governance best practices.

companyName: QVC INC

ticker: QVCD


text: • Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors, or Audit Committee, helps oversee our cybersecurity risk management processes, including oversight of risks from cybersecurity threats. • The Information Governance Security Committee and the Audit Committee receive various reports from CISO and CIO. The CISO (or its designee) reports to the Audit Committee on cybersecurity risk on at least a quarterly basis. Written reports and presentation materials regarding cybersecurity risk provided to the Audit Committee are made available to the board of directors and they can discuss the materials and cybersecurity risk with the Audit Committee members. The Internal Audit team oversees internal controls implemented by us under our information security program. • Our information security program is implemented and maintained by certain of our management, including the CISO, CIO and other members of our Information Security Governance Committee (Chief Legal Officer, Chief Financial Officer, and Chief Privacy Officer). Our CISO has been at the company for over 7 years, and has served in various cybersecurity roles for over 20 years across multiple companies and industry verticals including banking, consulting, ecommerce, and pharmaceuticals. He is a Certified Information Systems Security Professional and has experience responding to major information security incidents at previous companies prior to joining the company. Our CIO has been at the company and had oversight of our cybersecurity for over 7 years. In addition, our CIO has served in various information technology roles in the U.S. and overseas for over 25 years across multiple companies and industry verticals including consulting, healthcare, and pharmaceuticals. • The Information Security Governance Committee helps assess and manage our cybersecurity risks and monitor the effectiveness of our information security program and risk management. Management, including those serving on our Information Security Governance Committee, is responsible for hiring appropriate cybersecurity personnel, helping to integrate cybersecurity considerations into our overall risk management strategy, providing appropriate resources for cybersecurity risk management, and communicating key priorities to relevant personnel. Our cybersecurity incident response plan includes processes designed to escalate certain cybersecurity incidents that caused a significant impact to us to members of the Information Security Governance Committee, and certain members of executive management depending on the circumstances. In addition, our incident response plan includes reporting to the Audit Committee for certain cybersecurity incidents, including those that have potentially had a material impact to us.


text: Our cybersecurity threat risk management processes include the following, among others: • Our information security department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example, manual methods and automated tools, conducting scans of the threat environment, conducting threat assessments, performing vulnerability assessments, use of external intelligence feeds, and through third-party-conducted red/blue team testing and tabletop incident response exercises. • Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: information security policies and standards governing access control, network and device security, encryption standards, incident response plans, disaster recovery plans, risk management, vulnerability detection and management and security awareness training requirements as well as security tools such as firewalls, malware protection tools, secure authentication tools, centralized logging and monitoring tools, threat intelligence tools, and data protection tools. • Our overall risk assessment and management processes address cybersecurity threats that may have a material impact on our business. Our information security department maintains a risk register of individual risks from cybersecurity threats. Our CISO and CIO periodically review the area of cybersecurity risk management within our overall enterprise risk management program and work with our executive director of internal audit and enterprise risk management to incorporate the aggregate risks from the cybersecurity threat risk register into the overall enterprise risk management program risk register. In addition, our CISO and CIO report significant increases to our threat profile to the Information Security Governance Committee (described below). • We use third parties, including professional services, incident response and managed security firms (including some that we have on a pre-paid retainer basis), to assist us from time to time to identify, assess, and manage cybersecurity risks, perform threat assessments relating to our Information Systems and Data by reviewing our business and industry vertical threat profiles and applying those to the overall threat landscape, perform penetration tests, conduct cybersecurity readiness exercises, assess program maturity, and to assist in the event of a cyber security incident. • We have third-party vendor management processes designed to help us identify, assess and manage risks from cybersecurity threats to our Information Systems and Data that may arise out of our use of third-party vendors across our business, including, among others, application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. Depending on the nature of the services and the service provider, our vendor management processes may include assessment of the cybersecurity practices of such vendors and contractually imposing obligations on the provider.


text: • Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee helps oversee our cybersecurity risk management processes, including oversight of risks from cybersecurity threats. • The Information Governance Security Committee and the Audit Committee receive various reports from CISO and CIO. The CISO (or its designee) reports to the Audit Committee on cybersecurity risk on at least a quarterly basis. Written reports and presentation materials regarding cybersecurity risk provided to the Audit Committee are made available to the board of directors and they can discuss the materials and cybersecurity risk with the Audit Committee members. The Internal Audit team oversees internal controls implemented by us under our information security program. • Our information security program is implemented and maintained by certain of our management, including the CISO, CIO and other members of our Information Security Governance Committee (Chief Legal Officer, Chief Financial Officer, and Chief Privacy Officer). • The Information Security Governance Committee helps assess and manage our cybersecurity risks and monitor the effectiveness of our information security program and risk management. Management, including those serving on our Information Security Governance Committee, is responsible for hiring appropriate cybersecurity personnel, helping to integrate cybersecurity considerations into our overall risk management strategy, providing appropriate resources for cybersecurity risk management, and communicating key priorities to relevant personnel. Our cybersecurity incident response plan includes processes designed to escalate certain cybersecurity incidents that caused a significant impact to us to members of the Information Security Governance Committee, and certain members of executive management depending on the circumstances. In addition, our incident response plan includes reporting to the Audit Committee for certain cybersecurity incidents, including those that have potentially had a material impact to us.


text: Risk Management and Strategy. The Company's information security program consists of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis. These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, sensitive data management, electronic communication, risk/security reporting, incident response planning and business continuation planning. The information technology department ("IT Department"), which includes the cybersecurity department ("IT Security Department"), is responsible for implementing such processes and coordinating with the Human Resources Department to align training and onboarding efforts with such processes. The IT Security Department carries out risk management primarily by outsourcing risks to those companies and agencies that specialize in handling such risks and that have the appropriate resources to do so. Additionally, the IT Department assesses and improves the Company's cybersecurity risk management processes on an annual basis by: (i) engaging its cyber insurance broker, AON, plc, to complete a benchmarking evaluation to compare the Company's cybersecurity posture against peers and (ii) engaging cyber risk readiness and response company, Netdiligence, to conduct vulnerability and penetration testing, which produces a report that specifies any possible risk area and devices. Such report is presented to the IT Department for analysis and for the purpose of developing subsequent action plans to remediate any vulnerabilities. As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial conditions, except as otherwise noted.

companyName: ASHFORD HOSPITALITY TRUST INC

ticker: AHT


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Governance. Management is ultimately responsible for assessing and managing the Company's cybersecurity risk. The information security program is overseen by the Chief Financial Officer, Vice President of IT, and the Information Security Manager. The Information Security Manager provides a weekly report to the Vice President of IT, which contains an overview of the activity in the department, any United States Computer Emergency Readiness Team alerts processed and all findings from the preventative maintenance tools. The Vice President of IT provides such report to the Chief Financial Officer on a quarterly basis. The Audit Committee of the Board is then briefed each quarter on the occurrence of any cybersecurity incidents. The Board will also be provided an overview of the information security program on an annual basis, including updates on the IT team, IT training, implementation of IT controls, cybersecurity testing, the incident response process and the cybersecurity assets of the Company.


text: Risk Management and Strategy. The Company relies on Ashford Inc. and the Company's managers to protect the electronic assets of the Company. Their programs consist of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis. These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, electronic communication, risk/security reporting, incident response planning and business continuity planning. The information technology department of Remington Hospitality ("IT Department"), which includes a cybersecurity department ("IT Security Department"), is responsible for implementing processes and coordinating with the Human Resources Department to align training and onboarding efforts of Ashford Inc. and Remington Hospitality employees handling the Company's electronic assets.


text: Remington Hospitality's IT Security Department carries out risk management primarily by outsourcing risks to those companies and agencies that specialize in handling such risks and that have the appropriate resources to do so. Additionally, Remington Hospitality's IT Department assesses and improves the Company's cybersecurity risk management processes on an annual basis by: (i) engaging consultants to complete a benchmarking evaluation to compare its cybersecurity posture against peers; and (ii) engaging a cybersecurity risk readiness and response company to conduct vulnerability and penetration testing, which produces a report that specifies any possible risk area and devices. Such report is presented to the IT Department for analysis and for the purpose of developing subsequent action plans to remediate any vulnerabilities. As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial conditions, except as otherwise noted.


text: Governance. Management, provided by Ashford Inc., is ultimately responsible for assessing and managing the Company's cybersecurity risk. The information security program is overseen by the Chief Financial Officer of Ashford Inc. and the Chief Technology Officer for Remington Hospitality. A Cyber Incident Response Team comprised of Ashford Inc. and Remington Hospitality employees meets bi-weekly to review incidents that have occurred and/or impacted the Company's electronic assets. The Chief Technology Officer of Remington Hospitality reviews weekly reports that contain an overview of the activity in the department, any United States Computer Emergency Readiness Team alerts processed and all findings from the preventative maintenance tools. The Chief Technology Officer provides such report to the Chief Financial Officer on a quarterly basis. The Audit Committee of the board of directors is then briefed each quarter on the occurrence of any cybersecurity incidents. The board of directors will also be provided an overview of the information security program on an annual basis, including updates on Remington Hospitality's IT team, IT training, implementation, IT controls, cybersecurity testing, the incident response process and the cybersecurity assets of the Company.


text: Risk Management and Strategy We have implemented ongoing processes that are designed to continually identify, assess, manage and mitigate the dynamic and evolving material risks to us from cybersecurity threats. Our cybersecurity threat risks are identified, assessed, managed, and monitored by our Adviser's and Administrator's resource management and compliance departments, on our behalf, and work in conjunction with an independent third-party information technology service provider ("ISP") engaged by our Adviser to manage our information technology strategy. The ISP regularly performs cyber assessments and assists in maintaining our cyber and information security programs. The ISP proposes recommendations to our Adviser's resource management and compliance departments, which then are considered by other officers and employees of our Adviser and Administrator, working on our behalf, before improvements are implemented to our information technology strategy, cybersecurity, and incident response policies, processes and procedures.

companyName: GLADSTONE COMMERCIAL CORP

ticker: GOOD


text: In addition, regular ongoing cybersecurity threat risk assessments are performed throughout the year and reported to our officers and Board of Directors by our Chief Compliance Officer ("CCO") no less than quarterly. Cybersecurity risks are assessed in general as part of the overall enterprise risk management for us, but also specifically between the ISP and our Adviser and Administrator in monitoring and determining not only the risks but also in assessing corresponding processes and procedures to mitigate those risks appropriately. Additionally, third party business applications are also incorporated in these risk assessments.


text: For additional information on our cybersecurity risks, see "Our business is subject to cyber security risks, including cyber security threats and cybersecurity incidents, such as security breaches and identity theft" in Part I, Item 1A of this Annual Report on Form 10-K.


text: As an international service provider, our ISP constantly monitors information technology risk and cybersecurity threats globally. When risks are detected, we, through our Adviser and Administrator, consults with the ISP to assess if the risk is a cybersecurity threat to our information technology systems or data. If a risk to our information systems or data is identified, we then, through our Adviser and Administrator, work in conjunction with the ISP to implement recommended processes, improvements, or safeguards to our systems or processes to address the risks as needed. Relevant examples of such efforts include but are not limited to: • implementation of industry leading Cloud solutions and business applications which possess integrated cybersecurity safeguards; • anti-malware, antivirus and threat detection software; • ransomware containment and isolation software; • enhanced password requirements and multifactor authentication requirements; • endpoint encryption; • intrusion detection and response system conduct file integrity monitoring; • email archiving, firewalls, and quarantine capabilities; • mobile device management of business applications; • frequent systems backups with recovery capabilities; and • regular vulnerability scans and penetration testing.


text: Contractually, we require the ISP to annually provide a third-party report on its systems and on the suitability of the design and operating effectiveness of its controls relevant to information and cyber security. In addition to the ongoing dialogue and technology interaction between our Adviser and Administrator, on our behalf, and our ISP, any significant findings in these reports are shared with us, including our Board of Directors and other officers, to enhance ongoing monitoring and assessment of our information technology and cybersecurity risk management.


text: While our ISP works to create a hardened information technology systems environment, our Adviser and Administrator also regularly trains employees working on our behalf on the evolving threats and educates them on cybersecurity risks. Whether it is communicating information about the latest cybersecurity threats, assessing employees' awareness through mock fraud exercises, social engineering and phishing campaigns, or providing access to a library of educational material about past and newly evolving cybersecurity attacks, our Adviser and Administrator work in concert with the ISP, on our behalf, to keep employees servicing us informed so as to provide an additional protection barrier through end-user knowledge.


text: Notwithstanding our risk management and strategy described above, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See "Risk Factors - Cybersecurity threats and cyber incidents may adversely affect our business by causing a disruption to our operations, or the operations of businesses in which we invest, a compromise or corruption of our confidential information and/or damage to our business relationships, all of which could negatively impact our business, financial condition and operating results." for a discussion of risks related to cybersecurity and cyber incidents.


text: Our Board of Directors is actively engaged in overseeing our cybersecurity and information security program. Our Board of Directors receives regular reports during board meetings from our CCO on our and our Adviser's and Administrator's efforts concerning information security and addressing information technology and cybersecurity risks, no less than quarterly. The reports are distributed to our Board of Directors, and our CCO engages in detailed discussions with the independent board members during the independent members' session. The reports cover all potentially material cybersecurity threats facing us, as well as key risks and mitigation efforts undertaken by us and our Adviser and Administrator. As significant threats or events are identified by management or the ISP between regular reporting periods, our CCO will inform our Board of Directors immediately and keep it informed as to the developments of assessing the risks, mitigating efforts, and potential disclosure. Appropriate members of management and third party providers will be involved as deemed necessary based on the potential impact.


text: Our management personnel most involved with assessing and managing the cybersecurity risks and program with our ISP include our Head of Resources Management, who is also a member of our Board of Directors, and our CCO. Our Head of Resources Management has more than 30 years of overall experience and more than 20 years directly assessing and managing our cyber information technology and human resources systems, and the associated security concerns. Our CCO has more than 30 years of overall experience as a CPA, with more than 15 years managing information technology systems and databases, and 15-plus years supporting our Adviser's and Administrator's resource management department. This includes identifying, assessing, mitigating, and monitoring cyber information security risks. These managers, as well as other management personnel, attend various professional continuing education programs, which include cybersecurity matters. Certain members of our Board of Directors have, or previously held, positions with other companies, including other public companies, that involved managing risks associated with their cyber and information technology systems. Our Board of Directors regularly receives updates from third parties on various business risks, which include cybersecurity matters.


text: We have in place an incident response plan to identify, respond to, and recover from cybersecurity threats and cybersecurity incidents. In the event of a potentially material cybersecurity incident, as determined by the VPoC with support from legal, as needed, the IRT is notified through an established escalation protocol. The Chair of the Audit Committee is also notified and briefed, and meetings of the Audit Committee and/or full Board of Directors would be held as appropriate. We maintain a relationship with a third-party forensic vendor available for incident response and investigation. Additionally, we maintain cybersecurity insurance.

companyName: TransDigm Group INC

ticker: TDG


text: Risk Management and Strategy We have implemented ongoing processes that are designed to continually identify, assess, manage and mitigate the dynamic and evolving material risks to us from cybersecurity threats. Our cybersecurity threat risks are identified, assessed, managed, and monitored by our Adviser's and Administrator's resource management, information technology ("IT"), and compliance departments, on our behalf, and work in conjunction with an independent third-party information technology service provider ("ISP") engaged by our Adviser to manage our information technology strategy. The ISP regularly performs cyber assessments and assists in maintaining our cyber and information security programs. The ISP proposes recommendations to our Adviser's Head of Resource Management, Director of IT, and Chief Compliance Office ("CCO"), which then are considered by other officers and employees of our Adviser and Administrator, working on our behalf, before improvements are implemented to our information technology strategy, cybersecurity, and incident response policies, processes and procedures.


text: In addition, regular ongoing cybersecurity threat risk assessments are performed throughout the year and reported to our officers and Board of Directors by our CCO no less than quarterly. Cybersecurity risks are assessed in general as part of the overall enterprise risk management for us, but also specifically between the ISP and our Adviser and Administrator in monitoring and determining not only the risks but also in assessing corresponding processes and procedures to mitigate those risks appropriately. Additionally, third party business applications are also incorporated in these risk assessments.


text: As an international service provider, our ISP constantly monitors information technology risk and cybersecurity threats globally. When risks are detected, our Head of Resource Management, Director of IT, and CCO consult with the ISP to assess if the risk is a cybersecurity threat to our information technology systems or data. If a risk to our information systems or data is identified, we then, through our Adviser and Administrator, work in conjunction with the ISP to implement recommended processes, improvements, or safeguards to our systems or processes to address the risks as needed. Relevant examples of such efforts include but are not limited to: • implementation of industry leading Cloud solutions and business applications which possess integrated cybersecurity safeguards; • restrict access to known devices only; • anti-malware, antivirus and threat detection software; • ransomware containment and isolation software; • enhanced password requirements and multifactor authentication requirements; • endpoint encryption; • intrusion detection and response system conduct file integrity monitoring; • email archiving, firewalls, and quarantine capabilities; • mobile device management of business applications; • frequent systems backups with recovery capabilities; and • regular vulnerability scans and penetration testing.


text: Contractually, we require the ISP to annually provide a third-party report on its systems and on the suitability of the design and operating effectiveness of its controls relevant to information and cyber security. In addition to the ongoing dialogue and technology interaction between our Director of IT and our ISP, any significant findings in these reports are shared with us, including our Board of Directors and other officers, to enhance ongoing monitoring and assessment of our information technology and cybersecurity risk management.


text: Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Our management personnel most involved with assessing and managing the cybersecurity risks and program with our ISP include our Head of Resources Management, who is also a member of our Board of Directors, Director of IT, and CCO. Our Head of Resources Management has more than 30 years of overall experience and more than 20 years directly assessing and managing our cyber information technology and human resources systems, and the associated security concerns. Our Director of IT has over 20 years of experience in IT, with a focus in the implementation of information security projects to enhance organizations' resilience against emerging threats, and has collaborated closely with security vendors/partners to contain and address cybersecurity incidents. Our CCO has more than 30 years of overall experience as a CPA, with more than 15 years managing information technology systems and databases, and 15-plus years supporting our Adviser's and Administrator's resource management department. This includes identifying, assessing, mitigating, and monitoring cyber information security risks. These managers, as well as other management personnel, attend various professional continuing education programs, which include cybersecurity matters. Certain members of our Board of Directors have, or previously held, positions with other companies, including other public companies, that involved managing risks associated with their cyber and information technology systems. Our Board of Directors regularly receives updates from third parties on various business risks, which include cybersecurity matters.


text: Risk Management and Strategy We are committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, have implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats.


text: Cybersecurity risks are assessed as part of our enterprise risk assessment and risk management program and our cybersecurity risk management program is designed and assessed based on recognized frameworks, including the National Institute of Standards and Technology Cybersecurity Framework.


text: We rely on a multidisciplinary team, including our information security function, legal department, management, and third-party consultants, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, using manual and automated tools such as vulnerability scanning software, monitoring existing and emerging cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and assessments, and conducting threat and vulnerability assessments.


text: To manage and mitigate material risks from cybersecurity threats to our information systems and data, we implement and maintain various technical, physical and organizational measures, processes and policies. These measures include risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our information technology ("IT"), security and other departments, encryption of data, network security controls, access controls, physical security, asset management, system monitoring, vendor risk management program, employee cybersecurity awareness and training, phishing tests, and penetration testing. Cybersecurity awareness training is also made available annually to our board of directors.


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place at QVC. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary.


text: To operate our business, we utilize certain third-party service providers to perform a variety of operational functions. We have implemented a third-party risk management program to evaluate the cybersecurity practices of higher risk vendors and vendors that encounter our systems or data. We additionally engage and retain third-party consultants, legal advisors and assessors to keep us appraised of emerging third-party risk, defense and mitigation strategies, and governance best practices.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: For additional information on our cybersecurity risks, see "Our business is subject to cyber security risks, including cyber security threats and cybersecurity incidents, such as security breaches and identity theft" in Part I, Item 1A of this Annual Report on Form 10-K.


text: The Company's Board of Directors oversees our enterprise risk management ("ERM") program and has delegated the primary responsibility for its oversight, which includes oversight of cybersecurity risk, to the Audit Committee. The Audit Committee is informed of about material risks from cybersecurity threats through regular discussion with management regarding cybersecurity risk mitigation and cybersecurity incident management. Executive management, including our VPoC, regularly presents to the Audit Committee regarding cybersecurity matters, including program updates, key metrics, and developments.


text: Role of the Qurate Retail Board of Directors The Qurate Retail board of directors has overall responsibility for risk oversight and has delegated to its Audit Committee primary enterprise risk oversight responsibility, including privacy and cybersecurity risk exposures, policies and practices, the steps management takes to detect, monitor and mitigate such risks and the potential impact of those exposures on our business, financial results, operations and reputation. The Audit Committee receives quarterly updates on the enterprise risk management program, including cybersecurity risks and the initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates, employee education initiatives, and internal audit observations, if applicable. In addition to the efforts undertaken by the Audit Committee, Qurate Retail's board of directors regularly reviews matters relating to cybersecurity risk and cybersecurity risk management. Any material cybersecurity events are brought to the attention of Qurate Retail's board of directors once the event is deemed material. We additionally use our incident response framework as part of the process we employ to keep our management and board of directors informed and to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Role of Management Through a services agreement between Qurate Retail and Liberty Media Corporation ("LMC"), Qurate Retail has established a cross functional Information Security Steering Committee ("ISSC") with executives from the Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at Qurate Retail and at QVC.


text: At QVC, the VP Information Security is responsible for day-to-day management and oversight of cybersecurity, including assessing, monitoring and mitigating cybersecurity risk. The VP Information Security provides regular reporting to the ISSC and QVC executive management, including quarterly updates on security hot topics, threat intelligence, incidents (if any) and the status of the cybersecurity program to the Chief Executive Officer and the broader executive leadership team. In addition to real time notification to the ISSC of privacy and security incidents, the ISSC and QVC have a bi-monthly meeting to discuss incidents, incident trends, developments in laws and regulations, and other privacy and cybersecurity hot topics, as applicable.


text: The experience of the combined QVC and Qurate Retail management teams includes a diverse background in telecom, retail and other industries, with decades of experience in various aspects of technology and cybersecurity. LMC's Head of Cybersecurity, who sits on the ISSC, has more than 25 years of cybersecurity and IT experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications. QVC's VP Information Security has more than 30 years of IT experience and holds multiple certifications, including Certified Information Security System Professional and Certified Information Security Manager. Together this management team has worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, business applications, customer facing applications and customer payment systems.


text: Role of the QVC Group Board of Directors The QVC Group board of directors has overall responsibility for risk oversight and has delegated to its Audit Committee primary enterprise risk oversight responsibility, including privacy and cybersecurity risk exposures, policies and practices, the steps management takes to detect, monitor and mitigate such risks and the potential impact of those exposures on our business, financial results, operations and reputation. QVC Group's audit committee receives quarterly updates on the enterprise risk management program, including cybersecurity risks and the initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates, employee education initiatives, and internal audit observations, if applicable. In addition to the efforts undertaken by the audit committee, QVC Group's board of directors regularly reviews matters relating to cybersecurity risk and cybersecurity risk management. Any material cybersecurity events are brought to the attention of QVC Group's board of directors once the event is deemed material. We additionally use our incident response framework as part of the process we employ to keep our management and board of directors informed and to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Role of Management Through a services agreement between QVC Group and Liberty Media Corporation ("LMC"), QVC Group has established a cross functional Information Security Steering Committee ("ISSC") with executives from the Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at QVC Group and at QVC.


text: At QVC, the VP of Cybersecurity is responsible for day-to-day management and oversight of cybersecurity, including assessing, monitoring and mitigating cybersecurity risk. The VP of Cybersecurity provides regular reporting to the ISSC and QVC executive management, including quarterly updates on security hot topics, threat intelligence, incidents (if any) and the status of the cybersecurity program to the Chief Executive Officer and the broader executive leadership team. In addition to real time notification to the ISSC of privacy and security incidents, the ISSC and QVC have a bi-monthly meeting to discuss incidents, incident trends, developments in laws and regulations, and other privacy and cybersecurity hot topics, as applicable.


text: The experience of the combined QVC and QVC Group management teams includes a diverse background in telecom, retail and other industries, with decades of experience in various aspects of technology and cybersecurity. LMC's Head of Cybersecurity, who sits on the ISSC, has more than 25 years of cybersecurity and IT experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications. QVC's VP of Cybersecurity has more than 30 years of IT experience and holds multiple certifications, including Certified Information Security System Professional and Certified Information Security Manager. Together this management team has worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, business applications, customer facing applications and customer payment systems.


text: The Company's enterprise-wide cybersecurity program is embedded within and integrated with the enterprise risk management function. The Chief Security Officer is part of our senior leadership team and reports to the Chief Risk Officer. Our Chief Security Officer has over thirty years of cybersecurity, technology, and leadership experience both as a career active-duty military cyber operations officer and in the private sector. The cybersecurity team is organized into three departments: Protective Operations, Posture Management, and Governance, Risk, and Compliance. Each of the three departments identifies, assesses, and manages material cybersecurity threats through specific approaches as further described below.

companyName: NELNET INC

ticker: NNI