text: We review all technology third party vendors and service providers for the following: access management controls including physical safeguards, disaster recovery capabilities, data privacy and notification processes, onboarding processes, and incident response procedures. In addition, we perform periodic independent testing of vendor capabilities and review the annual System and Organization Controls ("SOC") Type 1 and/or SOC II Type 2 reports of all of our third-party vendors hosting our data to ensure they conform to those requirements.


text: Our IT department, lead by our Chief Information Officer ("CIO"), maintains and is responsible for our cybersecurity incident response plans. Our cybersecurity incident response plans include processes for evaluating and escalating our response to cybersecurity incidents across our organization, up to and including our senior executive management and Board, and, where required, making public disclosures. Cybersecurity threats and incidents (including potential cybersecurity threats and incidents) are identified through our cybersecurity detection, prevention, and mitigation tools and procedures. These plans are reviewed and updated at least annually and we maintain third-party cybersecur ity insurance. We have not identified any material cybersecurity incidents during the fiscal years covered by this report. For a discussion of how risks from cybersecurity threats affect our business, see Part I, Item 1A - " Risk Factors – Operational Risks – Information technology failures and data security breaches could harm our business" in this Annual Report on Form 10-K.

companyName: Meritage Homes CORP

ticker: MTH

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: Cybersecurity and data privacy risks related to our information technology resources are a key component of our Board's risk oversight. The Audit Committee assists the Board in evaluating our cybersecurity and data privacy risks and overseeing our efforts to mitigate these risks. Our Audit Committee is also responsible for reviewing and analyzing significant financial and operational risks and how management is managing and mitigating such risks through its internal controls and financial risk management processes and is regularly engaged in discussions with management regarding business risks, operational risks, transactional risks, cybersecurity, enterprise-level and financial risks. Our CIO provides a formal update to our Audit Committee at least twice per year, reviewing cybersecurity risks, trends, plans for future actions and measurements against recognized external cybersecurity frameworks and benchmarks and our Vice President of Internal Audit/Compliance conducts an annual ERM survey, which includes cybersecurity risk, and provides the findings to the Board.

stage1Category: Board Governance


text: Our cybersecurity program is led and managed by experienced technology leadership that drives the creation of our cybersecurity and data privacy strategy, policies, and procedures and consists of experts in the execution of the related controls and safeguards. Our CIO has more than 30 years of experience working in information technology including chief information officer roles in the financial services, banking, healthcare, and hospitality sectors. While in those roles, the CIO has led governance, risk, and compliance technology programs and information security programs. Supporting the CIO is a dedicated cybersecurity team that designs and monitors cybersecurity control framework and data privacy procedures, as well as implements cybersecurity control systems and solutions. This cybersecurity team collectively has experience in: cybersecurity, information systems management and security, and related fields of focus.

stage1Category: Management Role


text: Cybersecurity Strategy and Risk Management The Company faces a wide variety of cybersecurity threats ranging from uncoordinated individual attempts to gain unauthorized access to information technology ("IT") systems to sophisticated and targeted measures known as advanced persistent threats directed at the Company, its products, its customers, supply chain and/or its third-party service providers, including cloud providers. These threats and incidents originate from many sources globally.

companyName: Johnson Controls International plc

ticker: JCI

stage1Category: None/Other

stage1Method: majority


text: The Company's cybersecurity policies, standards, and procedures apply to all users, creating awareness of threats and the importance of information security and cybersecurity across the Company's workforce. The policies and standards were created using elements of recognized standards such as ISO 27001 and the NIST Cybersecurity Framework for the overall enterprise and ISA/IEC 62443 for automation and control system products. The Company has implemented cybersecurity policies throughout its operations, including designing and incorporating cybersecurity into the development process for its products and services. The Company's enterprise risk management ("ERM") process considers cybersecurity threat risks alongside other significant risks as part of the Company's overall risk assessment process.


text: The Company leverages multiple channels to promote cybersecurity topics, deliver targeted initial and refresher training for all users, and conduct an annual mandatory global information security training campaign with certification, which is translated into 20 languages, and ongoing awareness campaigns. These elements are designed to maintain a risk aware culture.


text: The Company maintains a 24 x 7 operations center that monitors the Company's IT environment, and coordinates the investigation and remediation of alerts. As cybersecurity events occur, the cybersecurity team focuses on responding to and containing the threat and minimizing impact. In the event of an incident, the cybersecurity team assesses, among other factors, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost and potential for reputational harm, with participation from technical, legal and law enforcement support, as appropriate.


text: The Company engages with third parties to perform security assessments of its technology environment to perform penetration testing and maturity assessment as well as providing services to support threat analysis and incident detection and response.


text: Cybersecurity considerations affect the selection and oversight of the Company's third-party product and service providers. The Company performs due diligence on third parties that have access to its critical systems and data and whose products and services are integrated into the Company's products. Contractual undertakings and oversight are put in place, based on the results of the risk assessment to manage and reduce the cybersecurity risk associated with such third-party providers. Such undertakings may include requirements to comply with administrative, technical and physical safeguards to provide notification of cyber incidents involving the Company's systems or data and agreements to be subject to cybersecurity audits, which the Company conducts as appropriate. The Company requires compliance with appropriate certifications (e.g., SOC 2, ISO 27001, etc.) depending on the offering, region of use, and other factors.

stage1Category: Third-Party Risk


text: During the weekend of September 23, 2023, the Company experienced a cybersecurity incident impacting its internal IT infrastructure and applications. The incident caused disruptions and limitation of access to portions of the Company's business applications supporting aspects of the Company's operations and corporate functions. The impact of the incident included lost and deferred revenues, primarily attributable to order processing and logistics disruptions and delays, and expenses associated with the response to, and remediation of, the incident. Further, the cybersecurity incident caused disruptions to certain of the Company's billing systems, which negatively impacted cash provided from continuing operations primarily during the first quarter of fiscal 2024. The overall impact of the cybersecurity incident did not have a material impact on net income, net of insurance recoveries, or cash flows from operations for the full year fiscal 2024.

stage1Category: Incident Disclosure


text: Cybersecurity Governance The Company's Board of Directors (the "Board") has oversight of the management of the most significant risks facing the Company, including cybersecurity. The Board receives information technology and cybersecurity updates from senior management, including the Chief Information Officer, Chief Information Security Officer ("CISO") and Chief Technology Officer, several times per year. These updates cover the cybersecurity risks facing the Company's enterprise information technology environment, as well as the Company's digital products and services. Regular oversight of cybersecurity matters is further delegated by the Board to the Governance and Sustainability Committee. The Governance and Sustainability Committee provides a deeper level of oversight through quarterly engagements with senior management, including the Chief Information Officer and CISO, to review the Company's cybersecurity program, including the highest risk areas and key mitigation strategies.


text: The Company maintains a Cybersecurity Steering Committee ("CSC") designed to ensure effective governance of risks associated with the Company's use of information and technology assets and demonstrate effective governance of cybersecurity risk. The CSC is chaired by the CISO, and includes the Company's Chief Financial Officer, General Counsel, Chief Information Officer, and other senior representatives from the Company's business segments and functions. The CSC meets quarterly to monitor the current risk landscape and active risk reduction efforts. Through this review and monitoring activity, the CSC oversees effective governance of IT Risk Management in the Enterprise IT Portfolio, drives accountability and transparency of control effectiveness, and facilitates risk remediation and mitigation in a coordinated and comprehensive manner.


text: The CISO is appointed by the Chief Information Officer and is responsible for cybersecurity risk management across the Company. The CISO leads a global enterprise security team responsible for enterprise-wide security strategy, architecture, engineering, and operations. The Cybersecurity Steering Committee has granted authority to the CISO to pause or stop business processes during the execution of cybersecurity incident response duties if they deem it necessary. The CSC maintains approval authority for the Company's Enterprise Information Security Policy. The CISO has over 20 years of technology experience including cybersecurity, infrastructure, architecture, and data and analytics in highly regulated industries including healthcare and aviation and defense. The CISO has an undergraduate degree in Computer Information Systems.


text: The Company's cybersecurity policies, standards, and procedures apply to all users, creating awareness of threats and the importance of information security and cybersecurity across the Company's workforce. These policies and standards are reviewed annually to reflect emerging threats and evolving industry practices, including elements of recognized standards such as ISO 27001 and the NIST Cybersecurity Framework for the overall enterprise and ISA/IEC 62443 for automation and control system products. The Company has implemented cybersecurity policies throughout its operations, including designing and incorporating cybersecurity into the development process for its products and services. The Company's enterprise risk management ("ERM") process considers cybersecurity threat risks alongside other significant risks as part of the Company's overall risk assessment process.


text: The Company maintains a 24 x 7 operations center that monitors the Company's IT environment and coordinates the investigation and remediation of alerts. As cybersecurity events occur, the cybersecurity team focuses on responding to and containing the threat and minimizing impact. In the event of an incident, the cybersecurity team assesses, among other factors, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost and potential for reputational harm, with participation from technical, legal and law enforcement support, as appropriate.


text: The Company's vulnerability management program conducts assessments with specified frequencies for specific asset types to validate system health against known threats. The Company leverages multiple tools, which are routinely updated with new threat signatures, to continually respond to evolving threats identified as part of its threat detection capability. The Company also maintains a cybersecurity insurance policy.


text: The Company engages with third parties to perform security assessments of its technology environment, including penetration testing and maturity assessments, in addition to providing services to support threat analysis and incident detection and response.


text: Cybersecurity considerations affect the selection and oversight of the Company's third-party product and service providers. The Company performs due diligence on third parties that have access to its critical systems and data and whose products and services are integrated into the Company's products. Contractual undertakings and oversight are put in place, based on the results of the risk assessment to manage and reduce the cybersecurity risk associated with such third-party providers. Such undertakings may include requirements to comply with administrative, technical and physical safeguards to provide notification of cyber incidents involving the Company's systems or data and agreements to be subject to cybersecurity audits, which the Company conducts as appropriate. The Company requires compliance with appropriate certifications (e.g., SOC 2, ISO 27001, etc.) or appropriate alternative requirements, depending on the offering, region of use, and other factors.


text: The Company's results of operations, and financial condition were adversely affected by its previously disclosed September 2023 cybersecurity incident due to lost and deferred revenues, remediation expenses and billing and cash collection. However, the overall impact of the cybersecurity incident did not have a material impact on net income, net of insurance recoveries, or cash flows from operations for fiscal year 2024. The Company is regularly subject to cybersecurity threats. See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for more information on risks from cybersecurity threats.

stage1Category: Strategy Integration


text: Cybersecurity Governance The Company's Board of Directors (the "Board") has oversight of the management of the most significant risks facing the Company, including cybersecurity. The Board receives information technology and cybersecurity updates from senior management, including the Chief Digital and Information Officer ("CDIO") and Chief Information Security Officer ("CISO") several times per year. These updates cover the cybersecurity risks facing the Company's enterprise information technology environment, as well as the Company's digital products and services. Regular oversight of cybersecurity matters is further delegated by the Board to the Governance and Sustainability Committee. The Governance and Sustainability Committee provides a deeper level of oversight through quarterly engagements with senior management, including the Chief Digital and Information Officer and CISO, to review the Company's cybersecurity program, including the highest risk areas and key mitigation strategies.


text: The Company maintains a Cybersecurity Steering Committee ("CSC") designed to ensure effective governance of risks associated with the Company's use of information and technology assets and demonstrate effective governance of cybersecurity risk. The CSC is chaired by the CISO, and includes the Company's Chief Financial Officer, General Counsel, CDIO, and other senior representatives from the Company's business segments and functions. The CSC meets quarterly to monitor the current risk landscape and active risk reduction efforts. Through this review and monitoring activity, the CSC oversees effective governance of IT Risk Management in the Enterprise IT Portfolio, drives accountability and transparency of control effectiveness, and facilitates risk remediation and mitigation in a coordinated and comprehensive manner.


text: The CISO has been appointed by the Chief Digital and Information Officer and is responsible for cybersecurity risk management across the Company. The CISO leads a global enterprise security team responsible for enterprise-wide security strategy, architecture, engineering, and operations. The CSC has granted authority to the CISO to pause or stop business processes during the execution of cybersecurity incident response duties if they deem it necessary. The CSC maintains approval authority for the Company's Enterprise Information Security Policy.


text: The CISO has over 20 years of technology experience including cybersecurity, infrastructure, architecture, and data and analytics in highly regulated industries including healthcare and aviation and defense. The CISO has an undergraduate degree in Computer Information Systems.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Callaway Golf Co

ticker: CALY


text: Cybersecurity Risk Assessment, Identification and Management We are committed to protecting our information technology ("IT") infrastructure, including computers, systems, corporate networks and sensitive data, from unauthorized access or attack. We have established global IT policies as well as IT security management control procedures designed to assess, identify, and manage material risks from cybersecurity threats by: Creating information security awareness among our employees and business partners and defining responsibilities among them; Implementing controls to identify IT risks and monitor the use of our systems and information resources; Establishing key policies and processes to adequately and timely respond to security threats;

companyName: POWER INTEGRATIONS INC

ticker: POWI


text: Maintaining disaster recovery and business continuity plans; and Emphasizing compliance with applicable laws, regulations and contractual obligations regarding the management of information security.


text: These policies and controls procedures discussed in more detail below, are an integrated component of our enterprise risk management assessment processes. We routinely review and assess our business groups and systems to identify and prioritize areas of risk, including cybersecurity risk. The results of these assessments and progress against prioritized goals are presented to the board of directors each quarter.


text: We have incurred and may in the future incur significant costs in order to implement, maintain, and/or update security systems we believe are necessary to protect our IT infrastructure. We deploy technical safeguards that are designed to protect our systems from cybersecurity threats, including firewalls, intrusion prevention, and intrusion detection systems. We have established disclosure controls and procedures to address cybersecurity events, which include elements relating to comprehensive analysis of events and communication within the company, as well as addressing potential disclosure obligations arising from security breaches.


text: We have partnered with third parties to support our information security systems and processes, and to help design, build, test, implement and maintain them. Annual risk assessments are conducted by third party consultants to help ensure that risks to our IT infrastructure are minimized or eliminated.


text: We rely on products and services provided by third parties for portions of our IT infrastructure, including business management, operations and finance systems. These providers may also experience breaches and attacks on their products which may impact our systems. Further we may also face additional cybersecurity risk due to error or intentional misconduct by contractors and other third-party service providers related to the use of these systems as part of our IT infrastructure.


text: We have a third-party security policy in place to identify, manage and oversee the potential material risks from threats associated with the use of third-party service providers. We evaluate vendors and consider amongst other factors the criticality of services and sensitivity of information that is within the scope of the services to be provided and manage risk accordingly. Our internal legal department reviews all IT Service Agreements with input from the IT department to ensure that services, terms and conditions in the agreement are suitable. Our IT department performs regular monitoring of vendor services as part of its' on-going review and monitoring of vendors. As part of our policy, we monitor termination of agreements with vendors designed to ensure that access to Company information is appropriately terminated in a timely manner. Unauthorized network intrusions or other significant information security incidents against third-party systems used by the Company internally are handled in the same manner as internal systems. However as described in Part 1. Item 1A. Risk Factors of this Annual Report on Form 10-K under "Risks Related to the Operation and Growth of Our Business", we have limited insight into the data privacy or security of third-party service providers and our response may be limited or more difficult because we may not have direct access to their systems.


text: Although we believe we have adequate resources and sufficient policies, procedures, and oversight in place to identify and manage IT security risks related to our business operations, there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K under "Risks Related to the Operation and Growth of Our Business."


text: Management Oversight Our IT infrastructure and the assessment and management of associated risks are primarily the responsibility of our Chief Information Security Officer ("CISO"). Our CISO's additional responsibilities include hiring appropriate personnel, helping to integrate cybersecurity risks into the Company's overall risk management strategy, and communicating updates regarding IT/Information security key priorities to relevant personnel including management and the board.


text: Our CISO has served in that position since 2018. Our CISO has extensive experience serving in executive and senior IT leadership positions over the past 25 years including serving at Cavium in a succession of information security roles, including Vice President of Business Systems, for eleven years, Vice President of IT Applications at ServiceNow for two years, and overseeing worldwide IT Infrastructure, IT Operations and Information Security at Pinnacle Systems for eight years.


text: We have in place an Incident Response Procedure policy to define our response to unauthorized network intrusions or other significant information security incidents, collectively cybersecurity incidents. The policy defines the standard operational process to determine if an event observed on a system could have caused a breach of the system or a compromise of sensitive data. This policy serves to establish a formal process to report incidents and track response activities. It also defines escalation processes within the Information Security team and to our Cybersecurity Incident Response Team. It is the responsibility of the Cybersecurity Incident Response team to determine if an incident is material. The Cybersecurity Incident Response Team consists of members from functional groups across our organization including executive management, IT, Information Security, legal, finance and operations. We may include other individuals, including third parties, as appropriate depending on the nature of the incident and system(s) involved. This cross-functional group allows us to address the operational impacts of cybersecurity incidents as and when they occur and to guide decisions related to materiality and, if applicable, disclosure. The Cybersecurity Incident Response Team is responsible for extrapolating cybersecurity incident event information into quantitative and qualitative impacts as they relate to our financial condition and operations. In addition, the Company's Incident Response Procedure policy includes reporting to the board of directors for certain cybersecurity incidents.


text: Board Governance Our full board of directors oversees our risk management including but not limited to IT and cybersecurity policies, procedures, and risk assessments. Our management reports to our board of directors on information security matters on a quarterly basis, or more frequently as needed.


text: One of the key functions of our board of directors is informed oversight of our various processes for managing risk. An overall review of risk is inherent in our board of directors ongoing consideration of our long-term strategies, transactions and other matters presented to and discussed by the board of directors. This includes a discussion of the likelihood and potential magnitude of various risks, including cybersecurity risks, and any actions management has taken to limit, monitor or control those risks.


text: At each quarterly board meeting, the full board receives the quarterly cybersecurity board update that is prepared by our CISO. The report provides a comprehensive cybersecurity update for the past quarter, including topics such as details on threat landscape, incident response, security metrics and performance, compliance and regulatory updates, cybersecurity investments and budget, employee security awareness and trainings, vendor risk management updates, business continuity and disaster recovery updates, and an update on cybersecurity strategy, projects and roadmap.


text: Cybersecurity Risk Assessment, Identification and Management We are committed to protecting our information technology ("IT") infrastructure, including computers, systems, corporate networks and sensitive data, from unauthorized access or attack. We have established global IT policies as well as IT security management control procedures designed to assess, identify, and manage material risks from cybersecurity threats, including but not limited to: Creating information security awareness among our employees and business partners and defining responsibilities among them; Implementing controls to identify IT risks and monitor the use of our systems and information resources; Establishing key policies and processes to adequately and timely respond to security threats;


text: Our CISO has served in that position since 2018. Our CISO has extensive experience serving in executive and senior IT leadership positions over the past 25 years including eleven years at Cavium in a succession of information technology roles, including vice president of business systems, two years at ServiceNow as vice president of IT Applications, and eight years overseeing worldwide IT infrastructure, IT operations and information security at Pinnacle Systems.


text: We have in place an Incident Response Procedure policy to define our response to unauthorized network intrusions or other significant information security incidents, collectively cybersecurity incidents. The policy defines the standard operational process to determine if an event observed on a system could have caused a breach of the system or a compromise of sensitive data. This policy serves to establish a formal process to report incidents and track response activities. It also defines escalation processes within the Information Security team and further escalation to our Cybersecurity Incident Response Team. It is the responsibility of the Cybersecurity Incident Response team to determine if an incident is material. The Cybersecurity Incident Response Team consists of members from functional groups across our organization including executive management, IT, the CISO, legal, finance and operations. We may include other individuals, including third parties, as appropriate depending on the nature of the incident and system(s) involved. This cross-functional group allows us to address the operational impacts of cybersecurity incidents as and when they occur and to guide decisions related to materiality and, if applicable, disclosure. The Cybersecurity Incident Response Team is responsible for extrapolating cybersecurity incident event information into quantitative and qualitative impacts as they relate to our financial condition and operations. In addition, the Company's Incident Response Procedure policy includes reporting to the board of directors for certain cybersecurity incidents.


text: At each quarterly board meeting, the full board receives the quarterly cybersecurity board update that is prepared by our CISO. The report provides a comprehensive cybersecurity update for the past quarter, usually including topics such as details on threat landscape, incident response, security metrics and performance, compliance and regulatory updates, cybersecurity investments and budget, employee security awareness and trainings, vendor risk management updates, business continuity and disaster recovery updates, and an update on cybersecurity strategy, projects and roadmap.


text: The Company has training and awareness programs designed to educate its employees about cybersecurity risks and how to protect the Company, its customers and themselves from cyberattacks and to keep its employees informed about cybersecurity threats and how to stay safe online, including secure access practice, phishing schemes, remote work and response to suspicious activities.

companyName: FirstCash Holdings, Inc.

ticker: FCFS


text: Cybersecurity Risk Management and Strategy Voya Financial maintains an information security program that seeks to comply with applicable regulatory requirements. The information security team, led by Voya Financial's Chief Information Security Officer ("CISO"), implements appropriate measures designed to safeguard sensitive information and protect our operations and systems against cyber threats. The information security team carries out continuous monitoring and evaluation of Voya Financial's technology and digital infrastructure with the goal of identifying and assessing threats and proactively mitigating potential risks. The CISO and the information security team provide regular updates to Voya Financial's senior management, as further described under Cybersecurity Governance below.

companyName: VOYA RETIREMENT INSURANCE & ANNUITY Co


text: In addition, as part of its risk management strategy, Voya Financial has an established and integrated cybersecurity incident response plan that focuses on incident detection, management and response. The information security team periodically reviews and updates the plan and tests playbooks within the plan through tabletop exercises.


text: Voya Financial's information security team is responsible for identifying, assessing, and managing cyber risk, with support from Voya Financial's operational risk management team. Information security control tasks are performed under the direction and guidance of Voya Financial's CISO, who is designated under Voya Financial's risk management principles and policies to oversee the evaluation and mitigation of information security risks. Information security management is integrated into Voya Financial's overall risk management framework, which provides for a coordinated approach to addressing cybersecurity risk.


text: As part of Voya Financial's overall information security program, it may engage and retain external assessors and consultants to help improve our security, stay aligned with industry best practices, evaluate external threats and, on an as-needed basis, perform forensic reviews of cybersecurity-related incidents or independent security assessments.


text: With regard to risks posed by third-party vendors and service providers, Voya Financial has a dedicated team that is responsible for evaluating, assessing, and addressing those risks, with the ultimate goal of protecting sensitive information and the security of our operations and systems supported by those vendors and providers using a risk-based approach. This team conducts due diligence on third-party vendors and service providers, including evaluating their information security controls and related measures, to identify potential risks and implement appropriate controls.


text: Technology risks, including cybersecurity threats, undergo a thorough risk management assessment. Voya Financial evaluates risks quantitatively and qualitatively to determine both the probability and potential severity of such risks and whether any such risks could materially affect Voya Financial or its subsidiaries, including VRIAC. We have experienced and may continue to experience cybersecurity incidents and threats that could materially affect our business strategy, results of operations or financial condition. There have been no known cybersecurity incidents that have materially affected us in the past three years. For more information about the cybersecurity related risks that we face, see Interruption or other operational failures in telecommunication, cybersecurity, information technology and other operational systems, including as a result of human and process error or a failure to maintain the security, integrity, confidentiality, or privacy of such systems, could harm our business in Risk Factors in Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance As detailed above, Voya Financial's CISO and the information security team regularly assess and manage cybersecurity risks. Voya Financial's information security leadership team has extensive information technology and information security experience, and the full team comprises over 100 employees with over 150 certifications from leading information security certification organizations. Additional management of cybersecurity risks is conducted by Voya Financial's Technology and Operational Risk Committee ("TORC"), which has been delegated authority by Voya Financial's Management Risk Committee to provide oversight of operational risk, including information and technology risk, as well as related legal, compliance and regulatory risks. Members of the TORC include senior management with relevant expertise in operations, technology, information security, legal, compliance, data privacy and operational risk management. The information security team participates in the TORC meetings to discuss cybersecurity risks and mitigation treatment. The TORC provides guidance and direction in assessing, addressing, mitigating and monitoring cybersecurity risks within Voya Financial.


text: Voya Financial's Board committees include the Technology, Innovation and Operations ("TIO") Committee, which provides support to the Voya Financial Board in its oversight of information technology, including cybersecurity risks. In addition, the TIO Committee supports the Voya Financial Audit Committee in reviewing cybersecurity risks and disclosures thereof, and collaborates with both the Audit Committee and the Risk, Investment and Finance ("RIF") Committee of Voya Financial's Board to oversee material risks. Management, including the CISO, regularly updates the TIO Committee on cybersecurity-related matters.


text: Cybersecurity threats are assessed, identified, and managed within our Enterprise Risk Management Framework. We use a multi-layered approach to effectively manage risk. This approach includes, but is not limited to: (1) employees who are responsible for and manage risk; (2) employees and systems that oversee, monitor, and report risk: and (3) independent assurance, evaluation, and oversight of risk management activities.

companyName: ISABELLA BANK CORP

ticker: ISBA


text: Cybersecurity Governance As detailed above, Voya Financial's CISO and the information security team regularly assess and manage cybersecurity risks. Voya Financial's information security leadership team has extensive information technology and information security experience, and the full team comprises over 100 employees with over 150 certifications from leading information security certification organizations. The CISO, who oversees the organization supporting the day-to-day operations of our information security program, brings over 30 years of professional IT experience in financial services. Before assuming his current role, the CISO served as Voya Financial's Chief Technology Officer, where he was responsible for our infrastructure, cloud, and business resiliency office. Additional management of cybersecurity risks is conducted by Voya Financial's Technology and Operational Risk Committee ("TORC"), which has been delegated authority by Voya Financial's Management Risk Committee to provide oversight of operational risk, including information and technology risk, as well as related legal, compliance and regulatory risks. Members of the TORC include senior management with relevant expertise in operations, technology, information security, legal, compliance, data privacy and operational risk management. The information security team participates in the TORC meetings to discuss cybersecurity risks and mitigation treatment. The TORC provides guidance and direction in assessing, addressing, mitigating and monitoring cybersecurity risks within Voya Financial.


text: Voya Financial's Board committees include the Risk Committee, which provides support to the Voya Financial Board in its oversight of information technology, including cybersecurity risk. The Risk Committee is responsible for overseeing cybersecurity risk and collaborates with the Voya Financial Audit Committee on the disclosures thereof. The Risk Committee receives regular updates from the CISO on cybersecurity-related matters.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a global incident response plan.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a cybersecurity team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers and software, where appropriate, to monitor, assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees; • a global incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers and suppliers.


text: We have not identified risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information. Refer to "Item 1A. Risk Factors", including "Cybersecurity incidents, including cyber-attacks, unauthorized access to, or accidental disclosure of, personal information including payment card information, that we or our vendors collects or stores on our behalf may result in significant expense and negatively impact our reputation and business," for additional discussion about our cybersecurity risks.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives reports from management on our cybersecurity risks, typically at least twice per year. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on our cyber risk management program.


text: Our management team, including the leaders of our Global Information Technology and Information Security and Information Technology Compliance organizations, are responsible for assessing and managing our material risks from cybersecurity threats, including the primary responsibility for our overall cybersecurity risk management program, and supervision of both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team has over 90 years of combined experience in cybersecurity, risk, and compliance, and includes members with multiple cybersecurity and compliance certifications such as Certified Information Systems Security Professional (CISSP) from ISC2, Certified Information Systems Manager (CISM) from ISACA, Certified Information Systems Auditor (CISA) from ISACA, Security+ and Network+ from the Computing Technology Industry Association (CompTIA), Certified Ethical Hacker (C|EH) from EC-Council, and other technology certifications.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants we engage; and alerts and reports produced by security tools deployed in the IT environment.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a cybersecurity team principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents; • the use of external service providers and software, where appropriate, to monitor, assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees; • a global incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers and suppliers.


text: We have not identified risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information. Refer to "Item 1A. Risk Factors", including "Cybersecurity incidents, including cyber-attacks, unauthorized access to, or accidental disclosure of, personal information including payment card information, that we or our vendors collect or store on our behalf may result in significant expense and negatively impact our reputation and business," for additional discussion about our cybersecurity risks.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives reports from management on our cybersecurity risks, typically at least twice per year. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program.


text: Our management team, led by the newly appointed Chief Information Security Officer (CISO) and supported by leaders from our Global Information Technology, Information Security, and Information Technology Compliance organizations, oversees the assessment and management of material risks associated with cybersecurity threats. This includes directing our comprehensive cybersecurity risk management program, supervising internal cybersecurity personnel, and collaborating with external cybersecurity consultants to maintain a robust and adaptive security posture, as well as strengthening our cybersecurity framework and ensuring alignment with evolving regulatory requirements and industry best practices. These efforts underscore our commitment to proactively managing risks and safeguarding critical assets in an increasingly complex threat landscape.


text: Our CISO has over 13 years of experience overseeing cybersecurity strategy, risk management, cyber defense and regulatory compliance, including for a large casino and hospitality company and a large, nationwide health system. Additionally, our CISO holds the Certified Information Security Manager (CISM) credential. Our CISO is supported by a leadership team with over 75 years of combined experience and extensive expertise in cybersecurity, risk management, and compliance. Team members hold numerous globally recognized certifications, including Certified Information Systems Security Professional (CISSP) from ISC2 and Certified Information Systems Auditor (CISA) from ISACA, Security+ and Network+ from CompTIA, and Certified Ethical Hacker (C|EH) from EC-Council, among others.


text: Risk Management and Strategy The Company recognizes the importance of being able to effectively respond to and manage cybersecurity threats and incidents that may compromise the confidentiality, integrity or availability of its information systems, data or network resources.


text: As part of its overall enterprise risk management framework, the Company maintains both an Information Security Program ("ISP") and an Incident Response Plan ("IRP"). The Company's ISP is managed by its Chief Information Officer (the "CIO") whose team (the Security Incident Response Team, or "SIRT") is responsible for leading company-wide cybersecurity strategy, policy, standards, architecture, and processes. The Company's IRP is based on applicable federal and state laws as well as cybersecurity incident response best practices. The purpose of the IRP is to define procedures for reporting and responding to cybersecurity incidents. It creates objectives for actionable procedures that can be measured, evaluated, scaled and revised as necessary for each specific incident. These objectives include maximizing the effectiveness of the Company's operations through an established plan of action and assigning responsibilities to appropriate personnel and/or third-party contractors.


text: The Company has engaged a third-party managed detection and response company to monitor the security of its information systems around-the-clock, including intrusion detection, and to provide instantaneous alerting should a cybersecurity event occur. If a cybersecurity threat or cybersecurity incident is identified through the Company's information systems, the SIRT will communicate the cybersecurity threat or cybersecurity incident and any damages to the CIO and other members of senior management of the Company. The Company will assess the materiality of the cybersecurity threat or cybersecurity incident to determine if any public disclosures are required under the SEC's cybersecurity disclosure rule. If deemed necessary, third-party consultants, legal counsel, and assessors will be engaged to evaluate the materiality assessment.


text: The cybersecurity program of the Company interfaces with other functional areas within the Company, including but not limited to the Company's business segments and information technology, legal, risk, human resources and internal audit departments, as well as external third-party partners, to identify and understand potential cybersecurity threats. The Company regularly assesses and updates its processes, procedures and management techniques in light of ongoing cybersecurity developments.


text: Recognizing the complexity and evolving nature of cybersecurity threats, the Company also engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing its risk management systems. These partnerships enable the Company to leverage specialized knowledge and insights, ensuring its cybersecurity strategies and processes remain at the forefront of industry best practices. The Company's collaboration with these third parties includes regular audits, testing, threat assessments and consultation on security enhancements.


text: To date, risks from cybersecurity threats or incidents have not materially affected the Company. However, the sophistication of and risks from cybersecurity threats and incidents continues to increase, and the preventative actions the Company has taken and continues to take to reduce the risk of cybersecurity threats and incidents and protect its systems and information may not successfully protect against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect the Company's business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.


text: Given the Company's status as a pawn store operator and payment solutions company entrusted with the safeguarding of sensitive customer information, the Board believes that a strong enterprise cybersecurity program is vital to the Company's overall enterprise risk management. The Board is responsible for overseeing and monitoring the material risks facing the Company. The Board has tasked the Audit Committee of the Board with leading the Company's cyber and technology risk mitigation efforts. As part of its oversight responsibilities, the Audit Committee is responsible for discussing with management the Company's major risk exposures, such as cybersecurity, and the steps management has taken to monitor and control those exposures, including the Company's risk assessment and risk management policies. The Audit Committee also monitors the Company's compliance with legal and regulatory requirements and the risks associated therewith. On a regular basis, the Audit Committee reviews with senior management significant areas of risk exposure involving cybersecurity.


text: At the direction of the Audit Committee, the CIO and SIRT monitor internal and external cybersecurity threats and review and revise the Company's cybersecurity defenses on an ongoing basis. The Company's CIO, together with other members of the SIRT, bring a wealth of expertise to their respective roles, including expertise in security technologies; designing and implementing security strategies; security standards such as NIST, ISO, COBIT and ITIL; risk management and incident response. The CIO prepares reports on IT general controls and cybersecurity metrics for the Audit Committee on a regular basis, and the CIO presents those reports to the Audit Committee and addresses any questions and concerns raised by the Audit Committee. At least annually, the Audit Committee meets with the CIO in person to discuss cybersecurity in greater detail. The Audit Committee reports to the Board regarding cybersecurity matters, and the Board addresses cybersecurity issues either directly with management or through the Audit Committee.


text: The Company has training and awareness programs designed to educate its employees about cybersecurity risks and how to protect the Company, its customers and themselves from cyberattacks and to keep its employees informed about cybersecurity threats and how to stay safe online, including secure access practice, phishing schemes, remote work and response to suspicious activities.


text: To date, risks from cybersecurity threats or incidents have not materially affected the Company. However, the sophistication of and risks from cybersecurity threats and incidents continues to increase, and the preventative actions the Company has taken and continues to take to reduce the risk of cybersecurity threats and incidents and protect its systems and information may not successfully protect against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect the Company's business strategy, results of operations, or financial condition, please refer to "Item 1A. Risk Factors."


text: Given the Company's status as a pawn store operator and payment solutions company entrusted with the safeguarding of sensitive customer information, the Board believes that a strong enterprise cybersecurity program is vital to the Company's overall enterprise risk management. The Board is responsible for overseeing and monitoring the material risks facing the Company. The Board has tasked the Audit Committee of the Board with leading the Company's cyber and technology risk mitigation efforts. As part of its oversight responsibilities, the Audit Committee is responsible for discussing with management the Company's major risk exposures, related to cybersecurity and technology, and the steps management has taken to monitor and control those exposures, including the Company's risk assessment and risk management policies. The Audit Committee also monitors the Company's compliance with legal and regulatory requirements and the risks associated therewith. On a regular basis, the Audit Committee reviews with senior management significant areas of risk exposure involving cybersecurity.


text: At the direction of the Audit Committee, the CIO and SIRT monitor internal and external cybersecurity threats and review and revise the Company's cybersecurity defenses on an ongoing basis. The Company's CIO, together with other members of the SIRT, bring a wealth of expertise to their respective roles, including expertise in security technologies; designing and implementing security strategies; security standards such as NIST, ISO, COBIT and ITIL; and risk management and incident response. The CIO prepares reports on IT general controls and cybersecurity metrics for the Audit Committee on a regular basis, and the CIO presents those reports to the Audit Committee and addresses any questions and concerns raised by the Audit Committee. At least annually, the Audit Committee meets with the CIO in person to discuss cybersecurity in greater detail. The Audit Committee reports to the Board regarding cybersecurity matters, and the Board addresses cybersecurity issues either directly with management or through the Audit Committee.


text: Risk Management and Strategy We have implemented and maintain multiple layers of physical, administrative and technical security processes designed to protect our manufacturing facilities from disruptions that may result from cybersecurity incidents, as well as safeguard the confidentiality of our critical systems, and data residing on those systems, including employee data, customer data and intellectual property. Our risk assessment and management of material risks from cybersecurity threats is integrated into our overall enterprise risk management process, as well as our information systems processes. Our strategy includes regular formal risk assessments, dynamic risk and threat analysis, utilization of security tools, regular cybersecurity-related tabletop and phishing exercises designed to simulate cybersecurity incidents, and frequent security awareness and technical security trainings. We conduct periodic internal and third-party assessments to evaluate our cybersecurity posture and test and assess our incident response program, incident roles and responsibilities, material impact evaluation, and decision-making processes in the event of a cybersecurity incident. We use our risk and security assessments to enhance our information security capabilities. We also have an internal employee network of hundreds of security awareness ambassadors from diverse functions throughout our global locations who inform our personnel concerning threat awareness and cybersecurity risk mitigation.

companyName: LEAR CORP

ticker: LEA


text: Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including an incident response policy, plan, procedures and scenario-based playbooks, an incident detection and response program, a vulnerability management program, disaster recovery and business continuity plans, risk assessment processes, security standards, network security controls, access controls, systems monitoring, employee awareness training and cybersecurity insurance. We have obtained Trusted Information Security Assessment Exchange (TISAX) certification labels at multiple global locations.


text: In our risk factors, we describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. See our risk factor disclosures in Part I, Item 1A of this Annual Report.

companyName: SYNOPSYS INC

ticker: SNPS


text: Our internal information security team oversees and works collaboratively with various information security service providers. Our cybersecurity program incorporates external guidance and expertise through the use of third-party service providers to assist in the identification, assessment and management of risks specific to cybersecurity threats, including vendors providing threat intelligence, risk mitigation, dark web monitoring, external scanning and scoring, threat and reputation monitoring, forensics, cyber-insurance, advisory services and legal counsel. We use a managed security service provider to augment our internal information security team and to provide additional monitoring capabilities. We also have a vendor management program addressing cybersecurity risk associated with application providers, hosting services and information technology support services we may retain. This program includes security questionnaires, review of vendor security programs, review of security assessments and assurance reports, vulnerability scans, and direct inquiries and collaboration with our vendors' security personnel. Our vendor management process involves different levels of assessment depending on the services provided by the vendor, the sensitivity of the related information systems and data, and the identity of the provider. It is designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: We have an incident response plan that includes scenario-based playbooks for managing cybersecurity incidents and associated crisis communication procedures designed to facilitate coordination across the Company and with our partners, customers, the public and others.


text: For the year ended December 31, 2023, there have been no risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For a description of risks related to our information technology systems, including cybersecurity threats, see Item 1A, "Risk Factors."


text: In addition, we have product cybersecurity risk assessment and management processes in place within our E-Systems business, where our products are more susceptible to cybersecurity threats, that align our internal policies, standards and development practices with customer requirements and industry standards, including the International Organization for Standardization ("ISO") 21434 control framework specific to road vehicle cybersecurity engineering. We received our ISO 21434 Road Vehicle Cybersecurity Engineering certification in 2023.


text: Our Board of Directors (the "Board") addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee of the Board (the "Audit Committee") is responsible for overseeing our cybersecurity risk management processes, including our assessment and mitigation of material risks from cybersecurity threats. The Audit Committee receives regular reports, summaries or presentations related to cybersecurity threats, risk, mitigation and related processes from the Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"). In addition, on at least an annual basis, the Board receives reports, summaries or presentations related to cybersecurity threats, risk, mitigation and related processes.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our CIO and CISO, who are supported by other members of management, as necessary. Our CIO and CISO are responsible for approving budgets, cybersecurity incident preparedness, approving cybersecurity processes, reviewing security assessments and other security-related reports, and providing the Chief Financial Officer ("CFO") with regular updates on cybersecurity-related matters. Our CIO has served in this role for three years and has more than 28 years of relevant experience, including previous roles as the CIO for two companies and the divisional information technology leader for two companies. Our CISO, who reports to the CIO, has served in this role for two years and has more than 28 years of relevant experience, including a focus on information security and cybersecurity for the last 15 years. Our CISO was previously the CISO for another automotive supplier. In addition, our CISO is very engaged in the cybersecurity community through current and past involvement with organizations such as the chair of General Motors Supplier Automotive Community and a member of Automotive Information Sharing and Analysis Center, Michigan Infragard, Domestic Security Alliance Council and the European Association of Automotive Suppliers cybersecurity workgroup. In addition, we have an information security team comprised of dozens of employees dedicated to cybersecurity with extensive experience and relevant certifications. The CIO and CISO are responsible for hiring appropriate personnel, assisting with the integration of cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, and mitigating and remediating in the event of a cybersecurity incident. Our product cybersecurity risk assessment and management processes are implemented and maintained by E-Systems management, including the Division President; Vice President of Global Strategy, Product Management and Electronics Engineering; and Vice President of Product Integrity and Technology. Our product security team within our E-Systems business consists of a team of employees dedicated to product cybersecurity engineering.


text: Our cybersecurity incident response and vulnerability management programs are designed to escalate certain cybersecurity incidents to various levels of management depending on the circumstances, including our CIO, CISO, General Counsel, Division Presidents, CFO and/or Chief Executive Officer (collectively, "Senior Management") and, in the instance of product cybersecurity, our E-Systems Safety Committee. Senior Management works with our incident response team to help mitigate and remediate certain escalated cybersecurity incidents. In addition, our incident response and vulnerability management programs include reporting certain cybersecurity incidents to the Audit Committee and, in certain circumstances, to the Board.


text: Our security strategy is a layered approach. We utilize multiple layers of defense, both internally and externally, to ensure the integrity of our systems and data. We engage reputable security partners (assessors, consultants, auditors, and other third parties) for real time analysis and protection of our network infrastructure. This includes the use of preventative and detective tools to monitor, block, and alert us to suspicious activity. We utilize industry and regulator recognized assessment tools, such as the FFIEC Cybersecurity Assessment Tool and the Ransomware Self-Assessment Tool, to identify potential cybersecurity threats as well as the impact they could have on the Bank. Dashboards are used to track and monitor cybersecurity activity and trends.


text: Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including an incident response policy and scenario-based playbooks, an incident detection program, a vulnerability management program, disaster recovery and business continuity plans, risk assessment processes, security standards, network security controls, access controls, systems monitoring, employee awareness training and cyber insurance.


text: Our internal information security team oversees and works collaboratively with various information security service providers. Our cybersecurity program and practices are supported through the use of third-party service providers to assist in the identification, assessment and management of risks specific to cybersecurity threats, including vendors providing threat intelligence, risk mitigation, dark web monitoring, external scanning and scoring, threat and reputation monitoring, forensics, cyber insurance, advisory services and legal counsel. We use a managed security service provider to augment our internal information security team and to provide additional monitoring capabilities.


text: We also have a vendor management program addressing cybersecurity risk associated with third-party application providers, hosting services and information technology support services we may retain. This program includes security questionnaires, review of vendor security programs, review of security assessments and assurance reports, vulnerability scans, and direct inquiries and collaboration with our vendors' security personnel. Our vendor management process involves different levels of assessment depending on the services provided by the vendor, the sensitivity of the related information systems and data, and the identity of the provider. It is designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: We have an incident response plan that includes scenario-based playbooks for addressing cybersecurity incidents and associated crisis communication procedures designed to facilitate coordination across the Company and with our partners, customers, the public and others.


text: For the year ended December 31, 2024, there have been no risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, financial condition or results of operations. For a description of risks related to our information technology systems, including cybersecurity threats, see Item 1A, "Risk Factors."


text: We have established programs in place to proactively mitigate and respond to cybersecurity risk. The Vendor Management Program provides management with a framework to evaluate new vendors and ensure ongoing monitoring of third parties, including the evaluation of cybersecurity risk. The Incident Response Plan provides a framework for management to respond to and minimize the impact of an incident involving our information technology systems, or that of one of our third-party providers. The Business Continuity Plan provides information to prepare for and manage a business disruption.


text: All employees play a critical role in managing cybersecurity risk. Our Enterprise Risk Management Framework utilizes the three lines of defense model to define roles and responsibilities to effectively manage risk. First line employees own and manage risk, the second line oversees, monitors, and reports risk, and the third line provides independent assurance of risk management activities.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our CIO and CISO, who are supported by other members of management, as necessary. Our CIO and CISO are responsible for approving budgets, cybersecurity incident preparedness, approving cybersecurity processes, reviewing security assessments and other security-related reports, and providing the Chief Financial Officer ("CFO") with regular updates on cybersecurity-related matters. Our CIO has served in this role for four years and has more than twenty-nine years of relevant experience, including previous roles as the CIO for two companies and the divisional information technology leader for two companies. Our CISO, who reports to the CIO, has served in this role for three years and has more than twenty-nine years of relevant experience, including a focus on information security and cybersecurity for the last sixteen years. He previously served as the CISO for another automotive supplier. In addition, our CISO is engaged with the cybersecurity community through current and past involvement with organizations such as Automotive Information Sharing and Analysis Center, Michigan Infragard, Domestic Security Alliance Council and the European Association of Automotive Suppliers cybersecurity workgroup. In addition, we have an information security team comprised of dozens of experienced employees who address cybersecurity matters. The CIO and CISO are also responsible for hiring appropriate personnel, assisting with the integration of cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, and mitigating and remediating cybersecurity incidents.


text: Our cybersecurity incident response program is designed to escalate certain cybersecurity incidents to various levels of management depending on the circumstances, including our CIO, CISO, General Counsel, Division Presidents, CFO and/or Chief Executive Officer (collectively, "Senior Management") and, in the instance of product cybersecurity incidents, our E-Systems Safety Committee. Senior Management works with our incident response team to help mitigate and remediate certain escalated cybersecurity incidents. In addition, our incident response program includes reporting certain cybersecurity incidents to the Audit Committee and, in certain circumstances, to the Board.


text: Cybersecurity Risk As a financial institution, we may be the target of a security breach due to a cybersecurity attack. While we have not encountered a cybersecurity incident that has materially impacted our operations or financial results, a security breach due to a cyber-attack in the future could result in a material impact to us, our customers, and our third-party vendors. The risk of such event could increase in the future due to the expansion of mobile banking and other internet-based product offerings, our use of internet-based services for internal and external purposes, acquisition and integration of new products and other offerings, increased use of third-party software solutions, and the growing reliance on mobile devices.


text: Cybersecurity incidents have increased in number and severity and it is expected that these trends will continue. Techniques used in cyberattacks evolve frequently, are increasingly sophisticated, and may not be recognized until launched. Cyber-attacks can originate from a wide variety of sources, including both internal and external sources, cyber-criminals, hacktivists, groups linked to terrorist organizations or hostile countries, or third parties whose objective is to broadly disrupt the operations of financial institutions. We may be unable to fully prevent cyber-attacks due to the inability to anticipate, detect, or recognize threats to our systems, or to implement effective preventative measures against all breaches. In addition, we do not have control over the cybersecurity of the systems of our customers, counterparty, and third-party service providers.


text: Our products, services and systems are accessed through critical company or third-party operations. These operations involve the storage, processing and transmission of sensitive data, including proprietary or confidential data, regulated data, and personal information of employees and customers. Successful breaches, employee wrongdoing, or human or technological error could result in unauthorized access, disclosure, modification, misuse, loss, or destruction of company, customer, or other third-party data or systems. Examples of a breach include theft of sensitive, regulated, or confidential data, including personal information; loss of access to critical data or systems through ransomware, destructive attacks, or other means; and business delays, service or system disruptions, or denials of service.


text: Should we, or the third parties we do business with, fall victim to successful cyber-attacks or experience other cybersecurity incidents, the result could include negative consequences. Such consequences could include, but are not limited to: significant disruption of our operations and those of our customers, including losing access to important business systems; misappropriation of confidential information related to customers, counterparties, employees, or other parties; severe damage to our reputation; the inability, or extended delays in the ability, to fully recover and restore data that has been stolen, manipulated, or destroyed, or the inability to prevent systems from processing fraudulent transactions; violations of applicable privacy and other laws; financial loss to us or our customers, counterparties, or employees; exposure to the risk of litigation, regulation, and other liability, which may include fines or other penalties and increased cybersecurity or other insurance premiums. The extent of a particular cyber-attack and the steps we must take to investigate and respond to it may not be immediately clear, and it may take a significant amount of time before such an investigation can be completed.


text: We have cybersecurity insurance intended to cover expenses related to notification, credit monitoring, investigation, crisis management, public relations, and legal advice. In addition, we maintain insurance to cover restoration of data, certain physical damage, and third-party injuries caused by potential cybersecurity incidents. However, damage and claims arising from such incidents may not be covered or may exceed the amount of any insurance available. Insurance policies and coverage are reviewed at least annually in detail.


text: We employ Information Technology staff to analyze and protect our network infrastructure. Members of our IT staff have relevant training and education in computer networks and systems, information security and intelligence, and hold industry certifications related to network security, enterprise IT governance, and risk and information systems control. In addition, our employees' network with peer banks, participate in industry groups, and attend ongoing training to stay abreast of cybersecurity threats and best practices.


text: Within the Enterprise Risk Management Framework, we have established committees, both at the management and board level, to oversee risk, and ensure cybersecurity risk is escalated appropriately to the Board.


text: The Information Technology Risk Management Committee is chaired by the Chief Technology Officer and comprised of IT management and other key stakeholders from across the Bank. They are responsible for identifying, measuring, monitoring, and controlling risk generated within IT, including cybersecurity risk. This committee reviews and updates risk assessments as necessary and monitors activity through risk reports and dashboards. A cybersecurity dashboard, which includes a summary of key risk metrics, is reviewed and monitored by the IT Risk Management. The Chief Technology Officer and Information Security Officer provide quarterly reports to the Board Risk Committee.


text: The Board Risk Committee assists the Board in fulfilling its responsibilities related to the oversight of the Bank's Enterprise Risk Management Framework. The Board Risk Committee oversees executive management's design, implementation, and maintenance of an effective risk management program to ensure compliance with laws and regulations, and operation within the parameters established in the Bank's risk appetite statement. This includes a review of the cybersecurity dashboard which summarizes key risk indicators and identifies emerging risks.


text: The Board Risk Committee provides a verbal risk report and meeting minutes to the Board at least quarterly. This includes a discussion of key risks and effectiveness of internal controls. In addition, cybersecurity incidents are escalated to the Board in a timely manner using the processes defined within the Bank's Incident Response Plan.


text: Cybersecurity Risk As a financial institution, we may be the target of a security breach due to a cybersecurity attack. While we have not encountered a cybersecurity incident that has materially impacted our operations or financial results, a security breach due to a cyber-attack in the future could result in a material impact to us, our customers, and our third-party vendors. The risk of such event could increase in the future due to the expansion of mobile banking and other internet-based product offerings, our use of internet-based services for internal and external purposes, acquisition and integration of new products and other offerings, increased use of third-party software solutions, and the growing customer reliance on mobile devices.


text: Cybersecurity incidents have increased in number and severity and it is expected that these trends will continue. Techniques used in cyber-attacks evolve frequently, are increasingly sophisticated, and may not be recognized until launched. Cyber-attacks can originate from a wide variety of sources, including both internal and external sources, cyber-criminals, hacktivists, groups linked to terrorist organizations or hostile countries, or third parties whose objective is to broadly disrupt the operations of financial institutions. We may be unable to fully prevent cyber-attacks due to the inability to anticipate, detect, or recognize threats to our systems, or to implement effective preventative measures against all breaches. In addition, we do not have control over the cybersecurity of the systems of our customers, counterparty, and third-party service providers.


text: Should we, or the third parties we do business with, fall victim to successful cyber-attacks or experience other cybersecurity incidents, the result could include negative consequences. Such consequences could include, but are not limited to: significant disruption of our operations and those with whom we do business, including losing access to important business systems; misappropriation of confidential information related to customers, counterparties, employees, or other parties; severe damage to our reputation; the inability, or extended delays in the ability, to fully recover and restore data that has been stolen, manipulated, or destroyed, or the inability to prevent systems from processing fraudulent transactions; violations of applicable privacy and other laws; financial loss to us or our customers, counterparties, or employees; exposure to the risk of litigation, regulation, and other liability, which may include fines or other penalties and increased cybersecurity or other insurance premiums. The extent of a particular cyber-attack and the steps we must take to investigate and respond to it may not be immediately clear, and it may take a significant amount of time before such an investigation can be completed.


text: Cybersecurity threats are assessed, identified, and managed within our Enterprise Risk Management Framework. We use a multi-layered approach to effectively manage risk. This approach includes, but is not limited to: (1) employees who are responsible for and manage risk; (2) employees and systems that oversee, monitor, and report risk: and (3) independent assurance, evaluation, and oversight of risk management activities.


text: Our security strategy is a layered approach. We utilize multiple layers of defense, both internally and externally, to ensure the integrity of our systems and data. We engage reputable security partners (assessors, consultants, auditors, and other third parties) for real time analysis and protection of our network infrastructure. This includes the use of preventative and detective tools to monitor, block, and alert us to suspicious activity. We utilize industry and regulator recognized assessment tools, such as the FFIEC Cybersecurity Assessment Tool and the Ransomware Self-Assessment Tool, to identify potential cybersecurity threats as well as the impact they could have on the Bank. Dashboards are used to track and monitor cybersecurity activity and trends.


text: We have established programs in place to proactively mitigate and respond to cybersecurity risk. The Vendor Management Program provides management with a framework to evaluate new vendors and ensure ongoing monitoring of third parties, including the evaluation of cybersecurity risk. The Incident Response Plan provides a framework for management to respond to and minimize the impact of an incident involving our information technology systems, or that of one of our third-party providers. The Business Continuity Plan provides information to prepare for and manage a business disruption.


text: All employees play a critical role in managing cybersecurity risk. Our Enterprise Risk Management Framework utilizes the three lines of defense model to define roles and responsibilities to effectively manage risk. First line employees own and manage risk, the second line oversees, monitors, and reports risk, and the third line provides independent assurance of risk management activities.


text: The Board Risk Committee provides a verbal risk report and meeting minutes to the Board periodically. In addition, the full Board reviews the Risk Management processes and results, and the Board's Audit Committee tracks any corrective actions identified in the Internal Audit process. Cybersecurity incidents are escalated to the Board in a timely manner using the processes defined within the Bank's Incident Response Plan.


text: Overall Risk Management and Strategy The Company manages its cybersecurity risk in a manner consistent with its overall risk management process in which recognized and emerging risks are identified, assessed, controlled, and monitored on a continual basis. The Company's cybersecurity risk management follows the "Three Lines of Defense" framework, which is as follows: (1) in the first line of defense, our Information Security function manages cybersecurity risks and controls; (2) in the second line of defense, independent internal risk management provides cybersecurity risk governance oversight; and (3) our Internal Audit function provides independent assurance over cybersecurity practices as the third line of defense.

companyName: EVANS BANCORP INC


text: The Company leverages third parties to support the development and independent validation of cybersecurity risk management practices. Third-party cybersecurity risk oversight includes engaging consultants in the development and deployment of cybersecurity control processes, and a managed security services provider to provide 24/7 alert monitoring and remediation services, semi-annual independent vulnerability and penetration tests from rotating providers, and an annual information security audit coordinated by the Company's Internal Audit function.


text: All third-party service providers to the Company are subject to risk assessments to identify the risks, including cybersecurity-related risks, posed by that individual third-party. Changes in vendor services result in a reassessment of risk. Based on the results of the risk assessment, the Company requires each third-party service provider to meet certain due diligence requirements. These due diligence requirements require third-party service providers to provide the Company with evidence of appropriate policies, an independent examination of their control environment, financial results, and operational resilience, as appropriate.


text: To date, no prior internal cybersecurity incident has materially affected the Company, however, external incidents have increased attention to risk management processes which continually identify and assess threats to the Company's operations with consideration to strategy, financial results, and business resilience.


text: The Enterprise Risk Committee of the Board of Directors is responsible for the oversight of cybersecurity risk at the Company. The Company has established a Cyber and Technology Risk Appetite Statement, which is approved annually by the Enterprise Risk Committee. Changes in cybersecurity risk are monitored throughout the year and are reported to the Enterprise Risk Committee.


text: The Enterprise Risk Committee is kept informed of these risks through reporting by the Chief Information Security Officer ("CISO") and is also charged with reviewing cybersecurity policies, results of an annual information security risk assessment, NYS DFS Compliance Status, and other information security risk assessments or analysis of significant events that may occur throughout the year. The Enterprise Risk Committee additionally reviews the results of vulnerability and penetration testing, tabletop exercises, and other examinations performed, whether internal or external, with a focus on cybersecurity. The Enterprise Risk Committee is kept informed of cybersecurity risks through the Company's first and second lines of defense, including the Company's CISO, which provide the following to the Enterprise Risk Committee on a quarterly basis, or more frequently as needed: an analysis comparing actual results against the Company's Cyber and Technology Risk Appetite Statement, an evaluation on current cybersecurity risks facing the company, and identification of any new or emerging risks associated with cybersecurity. The Audit Committee of the Board of Directors is also informed of any cybersecurity risk that is identified in annual information security specific internal audits or material cybersecurity risks that may have an impact on the financial statements and related disclosures of the Company.


text: The Company has established a clear chain of command in the management of cybersecurity risks by designating a CISO and Chief Information Officer ("CIO"), who jointly lead the Company's incident response team, which also includes the company's management team. The CISO has certifications in information security, and together, the CISO and CIO have over 25 years of cybersecurity experience combined. The CISO and CIO meet with Company senior leadership at least quarterly through an Information Technology Steering Committee in which management assess information security risk. The Company has subscribed to threat intelligence feeds that are reviewed throughout the day to ensure risks are identified and assessed in a timely manner.


text: In alignment with enterprise risk management processes and the National Institute of Standards and Technology (NIST) Cybersecurity Framework, the Company has developed a control environment to prevent, detect, respond to, and recover from cybersecurity risk events. The Company's control environment includes policies that set consistent cybersecurity control benchmarks across the organization and inform the CISO about the prevention, detection, mitigation, and remediation of cybersecurity incidents on an ongoing basis.


text: The Company's policies require it to maintain and control an inventory of the enterprise assets throughout their life cycle, including end-user devices, network devices, servers, operating systems and applications used throughout the Company. These assets are subject to secure configuration requirements as well as data protection requirements before they may be used in operations. Once appropriate configuration requirements are met, access to these assets is based on account management procedures, which include determining appropriate ownership of the account and monitoring controls over accounts using administrator privileges. Access is generally provisioned on the "least privilege" principle, meaning that a user is given the minimum levels of access or permissions needed to perform their job functions, and consistent with the requirements of the role being provisioned. On a continuous basis, these assets are monitored to assess and track vulnerabilities within the Company's infrastructure. Any identified vulnerabilities are remediated on a scheduled basis in alignment with an assessment of the associated risk. Upon termination or transfer of the user, processes are in place to remove user access from these assets, and additional monitoring controls are in place to certify access on a recurring basis.


text: Cybersecurity Governance Information technology and data security, particularly cybersecurity, is a top area of focus for our Board of Directors (the Board), which considers these areas as essential for the success of our company and the broader technology industry in which we operate.


text: The Company monitors industry events and leverages additional resources to monitor any new threats and vulnerability information. Systemic prevention controls are deployed to protect endpoints, as well as to prevent malicious code, emails, and websites from attempts to gain access to the network. Company personnel are trained on a recurring basis on best practices to protect the Company from cybersecurity risks. The Company's assets are subject to recovery procedures to bring the asset back to its required state of operations, and these recovery procedures are tested internally by the Company to verify the capabilities of these procedures. The Company has developed an Incident Response Policy and Plan that assigns appropriate responsibilities in the event of an incident. This assignment of responsibilities allows the Company to assess and respond to any incident in a timely manner. This plan is tested on a recurring basis to maintain preparedness in the event of an actual incident.


text: Risk Management and Strategy We depend on integrated information systems to conduct our business. Accordingly, we have processes in place designed to protect our information systems and to assess, identify and manage material risks from cybersecurity threats. As part of our Cyber Security Continuous Improvement Strategy, we continuously assess and improve our information systems to keep pace with the evolving threat landscape. We maintain a cybersecurity program that incorporates security measures from frameworks like the National Institute of Standards and Technology and the Center for Internet Security ("NIST"). This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Alongside the Company's preventative measures that employ traditional and artificial intelligence technologies, we actively monitor and audit our information technology and data assets to detect any anomalies and to respond quickly to potential threats that may arise. In addition to applying security controls to prevent unauthorized access to sensitive information and protecting the Company's information systems and networks from exploitation by outsiders, we also deploy cybersecurity training courses to all employees annually, maintain an incident response plan, establish cybersecurity contingency plans and conduct phishing testing on a quarterly basis.

companyName: TRIMAS CORP

ticker: TRS


text: The oversight of the Company's cybersecurity risk management process is integrated into our annual Enterprise Risk Management ("ERM") process. Our ERM process is designed to enable leaders to identify and assess leading risks facing the Company, including risks related to cybersecurity, and work collaboratively to implement plans to mitigate these risks. We also utilize third-party experts to evaluate the Company's security program and test operational effectiveness of our security controls.


text: In addition, we have processes designed to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. For example, our Terms and Conditions within our agreements with suppliers, vendors, contractors, consultants, partners and others with whom we do business (collectively "Suppliers") generally require that our Suppliers safeguard and protect the information entrusted to them, as well as information generated or developed by them, from unauthorized access, destruction, use, modification or disclosure. We also encourage the our Suppliers to maintain risked-based cybersecurity programs designed to mitigate emerging threats to their information systems, products, services and supply chain, while complying with all applicable contractual and legal requirements. However, we may have little or no oversight with respect to security measures employed by third-party service providers, which may ultimately prove to be ineffective at countering cybersecurity threats.


text: We have experienced cyber-attacks in the past and, while none of these cyber-attacks resulted in a material disruption to our business, we may experience additional cyber-attacks in the future. As of the filing of this Form 10-K, we are not aware of any such attacks that have occurred since the beginning of 2023 that have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, refer to "Risks Relating to Our Business – A major failure of our information systems could harm our business; increased IT security threats and more sophisticated and targeted computer crime could pose a risk to our systems, networks and products." in "Item 1A. Risk Factors within this Form 10-K.


text: Our Chief Information Officer ("CIO") is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity incidents. Our CIO has 20-plus years of experience in the cybersecurity industry. Our CIO is informed of such incidents through the Infrastructure and Security Team. Our CIO reports directly to the Company's Chief Financial Officer and reports information on these risks and incidents to the Board and the Audit Committee. Additionally, our CIO meets monthly with TriMas Senior Leadership in the Security Incident Management and Mitigation meetings.


text: The Board of Directors of the Company (the "Board") is presented with a cybersecurity update quarterly and is integrated within our TriMas Incident Response Plan. The Board reviews the Company's ERM process, including the design of the program, the key risks identified and the actions identified to manage and reduce those risks. Consistent with this undertaking, the Board regularly reviews the Company's cybersecurity strategy and activities in support of the strategy. As part of its compliance oversight responsibilities, the Audit Committee of the Board (the "Audit Committee") is responsible for the review of compliance with laws, regulations and internal policies and procedures of our information and cybersecurity programs. The Board and the Audit Committee receive updates from management quarterly on information and cybersecurity status and enhancements. Additionally, prompt notification of the Board is integrated into the Incident Response Plan.