text: Cybersecurity Governance The Board, primarily through the Audit Committee, provides oversight of our ERM process, including the management of risks arising from cybersecurity threats. The Audit Committee receives regular, quarterly presentations and reports from our Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO") on cybersecurity risks and management's mitigation activities, which address a wide range of topics including our cybersecurity risk profile, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment and significant newly identified risks, technological trends, and information security considerations arising with respect to our industry peers and third parties. In addition, the CTO and CISO provide the Audit Committee with timely information regarding significant cybersecurity incidents, as applicable. During 2023, the Audit Committee also held an informational meeting with an external advisor regarding the cybersecurity landscape.


text: The IPRC is the management-level governance body that oversees our management of cybersecurity threats and data privacy risks and supports the strategic goals of our information security programs. The IPRC also oversees the appropriate remediation and response to cybersecurity incidents in accordance with applicable legal and regulatory requirements as well as our Information Security Incident Response Plan. The executive sponsors of the IPRC are our Chief Financial Officer, Chief Operations Officer, Wyndham Destinations, the CTO, and General Counsel and Corporate Secretary. The IPRC members include our CISO, the senior legal officer in the privacy function, the business segments general counsel, the Chief Accounting Officer, and the Managing Director RCI North America & Global Marketing and Operations. The CISO leads a team of information security professionals in the day-to-day execution of our information security program, which is discussed in more detail above under the heading "Cybersecurity Risk Management and Strategy."

companyName: Travel & Leisure Co.

ticker: TNL

secItem: Item 1C

stage1Category: Management Role

stage1Method: unanimous


text: The CISO has served in various roles in information security and information technology for over 20 years for global travel, hospitality, casino, and energy companies along with consulting for both the U.S. Department of Defense and intelligence community. He holds an undergraduate degree in computer information systems, a master's degree in business administration, and has attained the Certified Information Systems Security Professional certification. The CTO holds an undergraduate degree in computer science and a master's degree in business administration, and has served in various roles in information technology for over 30 years for global travel, hospitality, and finance companies, including serving as either the Chief Technology Officer or Chief Information Officer of Qatar Airways Group and MGM Resorts International.

stage1Method: majority


text: Our Board and management recognize the importance of maintaining the trust and confidence of our customers, business partners and employees. The Board provides oversight of our risk management program and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, processes, and practices are integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST") and other applicable industry standards. In general, we seek to address cybersecurity risks through a cross-functional approach that is designed to preserve the confidentiality, security and availability of the digital information that we collect and store by identifying and mitigating cybersecurity threats and appropriately responding to cybersecurity incidents if and when they occur.


text: Cybersecurity Risk Management and Strategy Our ERM program is designed to identify the top risks applicable to us and document risk mitigation plans and initiatives by management. We have identified, and we expect to continue to identify, cybersecurity threats as among the top risks that we face. As one of the critical elements of our overall ERM approach, our information security program is focused on the following key areas: • Governance: As discussed in more detail below under "Cybersecurity Governance," the Board's oversight of cybersecurity risk management is supported primarily by the Audit Committee of the Board (the "Audit Committee") and our Information and Privacy Risk Committee ("IPRC"), which is the key management-level governance body that oversees management of cybersecurity threat and data privacy risks. • Cross-Functional Approach: Through the IPRC, we have implemented a cross-functional approach to managing cybersecurity threats and incidents, while also implementing controls and procedures that provide for the escalation of significant cybersecurity incidents, either in the form of a single unauthorized occurrence or a series of unauthorized occurrences, so that decisions regarding the public disclosure and reporting of such incidents can be made by appropriate members of management in a timely manner. • Threat Assessment: We engage in an annual cybersecurity-focused risk assessment process, which helps identify our cybersecurity risks by comparing our processes to standards set by the NIST and by engaging third-party experts to attempt to infiltrate our information systems. • Technical Safeguards: While no system is impenetrable, we deploy sophisticated technical safeguards that are intended to provide multiple layers of security designed to identify cybersecurity threats and protect our information systems from such threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which we evaluate and seek to improve through vulnerability assessments and cybersecurity threat intelligence. We leverage both internal and third-party resources to implement and monitor our technical security controls and perform threat and vulnerability assessments. Assessment results feed an iterative process intended to improve our cybersecurity posture and address the constantly evolving threat landscape on an on-going basis. • Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: We provide training for employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, processes and practices. • Incident Response and Recovery Planning: We have established and maintain incident response and recovery plans for critical systems, applications and business functions that address our response to a cybersecurity incident, and such plans are tested and evaluated on a periodic basis.

stage1Category: Risk Management Process


text: We describe whether and how risks from identified cybersecurity threats, including as a result of previous incidents, may materially affect, or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, under the heading "Failure to maintain the integrity of internal or customer data or to protect our systems from cyber-attacks could disrupt our business, damage our reputation, and subject us to significant costs, fines or lawsuits" included as part of our risk factor disclosures included in Part I, Item 1A of this Annual Report filed on Form 10-K.

stage1Category: None/Other


text: Cybersecurity Governance The Board, primarily through the Audit Committee, provides oversight of our ERM process, including the management of risks arising from cybersecurity threats. The Audit Committee receives regular, quarterly presentations and reports from our Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO") on cybersecurity risks and management's mitigation activities, which address a wide range of topics including our cybersecurity risk profile, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment and significant newly identified risks, technological trends, and information security considerations arising with respect to our industry peers and third parties. In addition, the CTO and CISO provide the Audit Committee with timely information regarding significant cybersecurity incidents, as applicable.

stage1Category: Board Governance


text: The IPRC is the management-level governance body that oversees our management of cybersecurity threats and data privacy risks and supports the strategic goals of our information security programs. The IPRC also oversees the appropriate remediation and response to cybersecurity incidents in accordance with applicable legal and regulatory requirements as well as our Information Security Incident Response Plan. The executive sponsors of the IPRC are our Chief Financial Officer, Chief Operations Officer, CTO, and General Counsel and Corporate Secretary. The IPRC members include our CISO, the senior attorney in the privacy function, the senior attorney in the corporate and securities function, the Chief Accounting Officer, and the Managing Director, Travel and Membership. The CISO leads a team of information security professionals in the day-to-day execution of our information security program, which is discussed in more detail above under the heading "Cybersecurity Risk Management and Strategy."


text: The CISO has served in various roles in information security and information technology for over 20 years for global travel, hospitality, casino, and energy companies along with consulting for both the U.S. Department of Defense and intelligence community. He holds an undergraduate degree in computer information systems, a master's degree in business administration, and has attained the Certified Information Systems Security Professional certification. The CTO holds an undergraduate degree in computer science and a master's degree in business administration and has served in various roles in information technology for over 30 years for global travel, hospitality, and finance companies, including serving as the Chief Technology Officer for Qatar Airways Group and Chief Information Officer for MGM Resorts International.


text: As a critical infrastructure company, we regularly face cybersecurity threats from malicious third parties that could obtain unauthorized access to our internal systems, networks and data. It is virtually impossible for us to entirely mitigate the risk of these and other security threats we face. The security, performance, and reliability of our network may in the future be disrupted by third parties, including nation-states, competitors, hackers, disgruntled employees, former employees, or contractors. While we have implemented security measures internally and have integrated security measures into our systems, network, and products, these measures have not always functioned as expected and have not always detected or prevented all unauthorized activity, prevented all security breaches or incidents, mitigated all security breaches or incidents, or protected against all attacks or incidents.

companyName: Allegiant Travel CO

ticker: ALGT


text: We have implemented processes and procedures for the assessment, identification, and management of material risks from cybersecurity threats. These processes implement both qualitative and quantitative measurements that have been agreed upon with our third-party consultants, our auditors, and integrated into our overall risk management process.


text: Our process includes assessing, mitigating, and managing risk in three categories: cybersecurity or technical risk, vendor risk, and compliance and regulatory risk. To support those risk management categories, we partner with third parties in the implementation of tooling to help us decrease cyber risks and ensure compliance within Allegiant and with third parties. We verify third-party compliance, such as suppliers and business partners, by aligning with several standards. For example, we subject our IT suppliers to the Sarbanes-Oxley (SOX) and payment card industry (PCI) compliance standards where applicable.


text: To certify our policies and processes to International Standards Organization (ISO)/ International Electrotechnical Commission (IEC) 27001, we are engaging a third-party consulting firm to conduct a gap analysis on our cybersecurity compliance. After achieving compliance, we expect to engage a third-party auditor to ensure we are compliant on an annual basis. Achieving compliance with any cybersecurity standard does not guarantee that controls cannot be broken, bypassed, or circumvented by zero-day vulnerabilities, or malicious threat actors.


text: Cybersecurity Program Given the importance of cybersecurity to our business, we maintain a comprehensive information security program for assessing, identifying, managing and reporting on material risks from threats to our information security. Our information security program is based on industry standards and best practices, following the National Institute of Standards and Technology (NIST) Cybersecurity Framework. As part of our information security program, we also require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. We also train employees on how to identify potential cybersecurity risks and protect our information and resources. This training is mandatory for all employees globally upon hire and on an annual basis.

companyName: Enstar Group LTD


text: Our overall approach to cybersecurity risk management includes the following key elements: • Multi-layered defenses, coupled with in-depth and continuous monitoring – We utilize data analytics to detect anomalies and search for cybersecurity threats. From time to time, we engage third party consultants or other advisors to assist in assessing, identifying and managing cybersecurity threats. We also periodically use our internal audit function to conduct additional assessments and reviews. • Insider Threats – We maintain an insider threat program, designed to identify, assess, and address potential risks from within Allegiant. Our program evaluates potential risks consistent with industry best practices, customer requirements and applicable law, including privacy and other considerations. • Information Sharing and Collaboration – We work with government, customer, industry and supplier partners including government-industry partnerships and critical infrastructure threat intelligence sharing platforms. These relationships enable the rapid sharing of threat intelligence and vulnerability mitigation across the industry and the defense industrial base and supply chain. • Third Party Risk Assessments – We conduct information security assessments before sharing or allowing the hosting of sensitive information in our computing environments, and those managed by third parties. Our standard terms and conditions with third parties include contractual provisions requiring certain security protections. • Training and Awareness – We seek to create a culture of security. We provide training to our employees to help identify, avoid, and mitigate cybersecurity threats. Our employees are required to participate in cybersecurity training at least annually and our training includes spear phishing and other awareness training. We regularly remind our employees and partners of the importance of handling and protecting customer and employee data, including through annual privacy and security training. We also host periodic tabletop exercises and drills with management and other employees to practice rapid response to cyber incidents. • Supplier Engagement – We require our suppliers to comply with our standard information security terms and conditions and require them to complete information security questionnaires to enable us to review and assess any potential cyber-related risks depending on the nature of the services provided. • Scalability – We continue to invest directly in our cybersecurity program, as well as augmentation of those cybersecurity services through managed services and third parties, depending on the maturity and risk of the operating model of the business unit.


text: As of the date of this report, we have not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although we have not experienced cybersecurity incidents that are individually, or in the aggregate, material, we have experienced cyberattacks in the past, which we believe have thus far been largely mitigated by preventative, detective and responsive measures implemented by us. For a detailed discussion of our cybersecurity related risks, see Item 1A Risk Factors – "A breach in the security of personal information, breach in credit card data or system disruptions caused by security breaches or cyberattacks – including attacks on those parties we do business with – could harm our ability to conduct our operations and could have a material adverse effect on our financial position or results of operations."

stage1Category: Strategy Integration


text: Our board is responsible for overseeing our enterprise risk management activities in general, the appropriate committees assist the board in the role of risk oversight. Our chief information security officer (CISO) presents a quarterly update to the full board, including an update on our risk management process and risk trends related to cybersecurity.


text: We have a dedicated cybersecurity team, composed of individuals with a diverse set of information security, cybersecurity, and governance, risk and compliance backgrounds, collectively giving our cybersecurity program significant experience. Our CISO leads our day-to-day data security and customer privacy efforts — overseeing operations, cybersecurity, privacy risk and compliance. The CISO, who has more than 30 years of experience reports daily to our chief information officer (CIO), monthly to the risk and compliance committee (consisting of the president and executive leadership) and quarterly to our board.


text: Our process includes assessing, mitigating, and managing risk in three categories: cybersecurity or technical risk, vendor risk, and compliance and regulatory risk. To support those risk management categories, we partner with third parties in the implementation of tooling to help us decrease cyber risks and ensure compliance within Allegiant and with third parties. We verify third-party compliance, such as suppliers and business partners, by aligning with several standards. For example, we subject our IT suppliers to the Sarbanes-Oxley ("SOX") and payment card industry ("PCI") compliance standards where applicable.


text: As a publicly traded company and given the industry in which we operate, we have established a risk-based strategy informed by numerous cybersecurity frameworks from regulatory bodies such as PCI, SOX, FAA, TSA, DOT, NIST and DoD. We use the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that we meet all of the technical standards, specifications or requirements under any of these frameworks. Achieving compliance with any cybersecurity standard does not guarantee that controls cannot be broken, bypassed, or circumvented by zero-day vulnerabilities, or malicious threat actors.


text: We have a dedicated cybersecurity team, composed of individuals with a diverse set of information security, cybersecurity, and governance, risk and compliance backgrounds, collectively giving our cybersecurity program significant experience. Our CISO leads our day-to-day data security and customer privacy efforts — overseeing operations, cybersecurity, privacy risk and compliance. The CISO, who has more than 30 years of experience reports regularly to our chief executive officer (CEO), monthly to the risk and compliance committee (consisting of executive leadership) and quarterly to our board.


text: We are increasingly dependent on sophisticated software applications and computing infrastructure to conduct key operations. We depend on both our own systems, networks and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.


text: Cybersecurity Program Given the importance of cybersecurity to our business, we maintain a comprehensive information security program for assessing, identifying and managing material risks from threats to our information security. Our information security program is based on industry standards and best practices, following the National Institute of Standards and Technology (NIST) Cybersecurity Framework. As part of our information security program, we also require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. We also train employees on how to identify potential cybersecurity risks and protect our information and resources. This training is mandatory for all employees globally upon hire and on an annual basis.


text: We use the Three Lines Model in order to ensure our information security program's effectiveness and readiness. Our first line is our IT Security Operations, which implements and executes upon a robust control framework, while our Information Security Assurance function maintains an information security assurance program that includes external penetration management. Our second line is our Risk and Compliance functions. Our Risk function performs table top exercises, "red team" testing and stress testing, while our Compliance function ensures regulatory requirements are identified proactively and monitors compliance with our internal policies and procedures. Our third line consists of our Internal Audit function, which provides objective assurance and testing over internal policies and procedures related to our information security program.


text: We use the Three Lines Model in order to ensure our information security program's effectiveness and readiness. Our first line is our IT Security Operations, which implements and executes upon a robust control framework, while our Information Security Assurance function maintains an information security assurance program that includes external penetration management and performing third-party risk assessments. Our second line is our Risk and Compliance functions. Our Risk function performs table top exercises, "red team" testing and stress testing, while our Compliance function ensures regulatory requirements are identified proactively and monitors compliance with our internal policies and procedures. Our third line consists of our Internal Audit function, which provides objective assurance and testing over internal policies and procedures related to our information security program.


text: Management Oversight Our management plays an active role in assessing and managing the risks posed to us by cybersecurity threats. Our strategy for managing cybersecurity risk is embedded within the IT function, which reports to our Chief of Business Operations (CBO) and our Information Security function, which reports to our CRO. The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Global Chief Information Officer (CIO) and our Global Head of Information Security (GHIS). Our CIO has over 24 years of experience in the area of information technology. He previously served in related roles, including IT strategy and delivery roles at Arthur Andersen Consulting and Deloitte Consulting, and has served in his current role since joining us in 2017. Our GHIS has over 18 years of information security experience. His experience includes driving our information security strategy, awareness and training, third party cyber risk management, compliance, and providing assurance of the security activities conducted by the IT Security Operations team. He has served in his current role since joining us in 2006. Our CIO and GHIS are responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and are regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats.


text: The Board of Directors actively oversees the Company's management of cybersecurity risk. Primary responsibility for the Board's role in oversight of the Company's management of cybersecurity risk is delegated to the Risk Committee of the Board. The Risk Committee is responsible for reviewing, discussing with management, and overseeing the Company's data privacy, information technology and security and cybersecurity risk exposures.


text: Our CIO and GHIS provide regular updates on cybersecurity risk and our information security program to the Risk Committee. These reports typically occur on a quarterly basis and include updates on current cyber risks, cybersecurity strategies and initiatives, event preparedness, the status of projects to strengthen our information security program, and the emerging cybersecurity threat landscape.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a breach, we have a comprehensive plan in place for assessing and addressing any potential threats to our information security. We maintain a Cyber and Data Incident Response Plan and Framework, which identifies and describes the roles and responsibilities of the Cyber Incident and Response Team and the Cyber Incident Oversight Committee. The Cyber Incident Response Team is responsible for receiving information relating to possible incidents, investigating and analyzing them, and taking action to avoid and mitigate the damage caused by such incidents. The Crisis Oversight Committee, chaired by our CBO, is responsible for support and oversight of the Cyber and Data Incident Response Plan and Framework and oversight of the Cyber Incident Response Team's execution of the plan in the event of a cyber incident.


text: We also maintain a Cyber and Data Incident Reporting Portal, which allows employees to notify our cybersecurity and data protection teams if they believe they have been the victim of a cyber incident or data breach, or have become aware that a third party service provider has suffered a cyber incident or data breach.


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall Enterprise Risk Management ("ERM") Framework. As part of our ERM Framework, we maintain the traditional Three Lines Model (Management, Risk & Compliance and Internal Audit) to delineate accountabilities and establish a 'check and balance' management of risks. For additional information on our ERM Framework, refer to "Item 1. Business - Enterprise Risk Management."


text: Although our information security program is designed to attempt to prevent, detect and respond to a cybersecurity incident, there can be no assurance that such an incident will not occur. A cybersecurity incident could cause the failure of our information security systems or those of our third-party service providers, which could materially impact our ability to perform certain critical functions, affect the confidentiality, availability or integrity of our proprietary information and expose us to litigation and increase our administrative expenses.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents.


text: For additional information on the risks we face from cybersecurity threats, refer to "Item 1A. Risk Factors - Risks Relating to Our Operation."


text: Our program is based on frameworks provided by the Center for Internet Security Controls. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CIS Controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Douglas Emmett Inc

ticker: DEI


text: Management Oversight Our management plays an active role in assessing and managing the risks posed to us by cybersecurity threats. Our strategy for managing cybersecurity risk is embedded within the IT function, which reports to our Chief of Business Operations (CBO) and our Information Security function, which reports to our CRO. The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Global Chief Information Officer (CIO) and our Group Information Security Officer (GISO). Our CIO has over 25 years of experience in the area of information technology. He previously served in related roles, including IT strategy and delivery roles at Arthur Andersen Consulting and Deloitte Consulting, and has served in his current role since joining us in 2017. Our GISO has over 19 years of information security experience. His experience includes driving our information security strategy, awareness and training, third-party cyber risk management, compliance, and providing assurance of the security activities conducted by the IT Security Operations team. He has served in his current role since joining us in 2006. Our CIO and GISO are responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and are regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats.


text: Our CIO and GISO provide regular updates on cybersecurity risk and our information security program to the Risk Committee. These reports typically occur on a quarterly basis and include updates on current cyber risks, cybersecurity strategies and initiatives, event preparedness, the status of projects to strengthen our information security program, and the emerging cybersecurity threat landscape.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a breach, we have a comprehensive plan in place for assessing and addressing any potential threats to our information security. We maintain a Cyber and Data Incident Response Plan and Framework, which identifies and describes the roles and responsibilities of the Cyber Incident and Response Team and the Crisis Oversight Committee. The Cyber Incident Response Team is responsible for receiving information relating to possible incidents, investigating and analyzing them, and taking the appropriate action to avoid and mitigate the damage caused by such incidents. The Crisis Oversight Committee, chaired by our CBO, is responsible for support and oversight of the Cyber and Data Incident Response Plan and Framework and oversight of the Cyber Incident Response Team's execution of the plan in the event of a cyber incident.


text: We maintain an operational incident portal that allows employees to log instances where they believe they have been the victim of a cyber incident, encountered a data breach or have become aware that a third-party service provider has suffered a cyber incident or data breach. In respect of cyber incidents and data breaches, timely reporting helps to contain the breach, recover faster, minimize business impacts, and comply with laws and regulations including time sensitive notifications. Cyber security is considered everyone's responsibility, and it is important that incidents are reported quickly and efficiently.


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall ERM Framework. As part of our ERM Framework, we maintain the traditional Three Lines Model (Management, Risk & Compliance and Internal Audit) to delineate accountabilities and establish a 'check and balance' management of risks. For additional information on our ERM Framework, refer to "Item 1. Business - Enterprise Risk Management."


text: Risk Management and Strategy We are developing a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information.


text: Our management team, led by our CIO, is responsible for assessing and managing our significant risks from cyber security threats. The team has primary responsibility for our overall cybersecurity risk management program. Our management team's experience includes multiple team members with 56 collective years of relevant experience with Douglas Emmett, Inc. The team has extensive knowledge of the technologies and applications addressed by the cybersecurity risk management program.


text: Our CIO supports the management team in staying informed about and monitoring efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy We have developed a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas.


text: Our cybersecurity risk management program includes among other things: a. Risk assessments designed to help identify significant cybersecurity risks to our critical systems, information and services;


text: b. A security team principally responsible for managing (1) our cybersecurity risk assessment process, (2) our security controls, and (3) our response to cybersecurity incidents;


text: c. The use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; d. An incident response plan with procedures for responding to cybersecurity incidents;


text: e. Cybersecurity awareness training of our employees, and senior management; and f. A third-party risk management process for service providers, suppliers and vendors.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors in Item 1A."


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to our Audit Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee as necessary, regarding any significant cybersecurity incidents.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Officer (CIO), internal security staff, or external experts as part of the Board 's continuing education on topics that impact public companies.


text: Our executive management team has established an enterprise risk management ("ERM") program, which includes an evaluation of our cybersecurity program as well as associated risks and risk mitigation strategies. Our ERM program is led by the Senior Director of Internal Audit and our ERM Committee, which is comprised of members of senior management, including our Chief Executive Officer, Chief Financial Officer, Chief Information Officer ("CIO"), Chief Information Security Officer ("CISO") and Chief Legal Officer. Our cybersecurity policies, standards, processes and practices are integrated into our ERM program and leverage the National Institute of Standards and Technology guidelines. Generally, we seek to address cybersecurity risk through a cross-functional approach in an effort to preserve the confidentiality, security and availability of information that we collect, store and otherwise process. For a description of the risks from cybersecurity threats that could materially and adversely impact us and how they may do so, see our risk factors under Part I, Item 1A "Risk Factors—Risks Related to Our Business" of this Report.

companyName: HERC HOLDINGS INC

ticker: HRI


text: Risk Management and Strategy As one of the critical elements of our overall ERM approach, our cybersecurity program is focused on the following key areas:


text: Governance—The Audit Committee of the Board of Directors oversees our cybersecurity program and management of the associated risks. The Audit Committee periodically receives updates regarding our cybersecurity program through meetings with and reports from our CIO and CISO (or their designees).


text: Our management team has established a cybersecurity crisis management team, led by our CIO and CISO, that includes other members of management depending on the origin, severity and other factors related to any cybersecurity incident identified. The cybersecurity crisis management team is responsible for communication of significant incidents to the Audit Committee and provides updates to the Audit Committee through incident resolution. Materiality of incidents are evaluated and determined by our cyber incident disclosure committee that includes certain cybersecurity crisis management team members and which may receive input from relevant stakeholders.


text: Operating Model—We have adopted a cross-functional operating model designed to identify, prevent, assess, manage and mitigate cybersecurity threats and incidents. We have established controls and procedures intended to promptly escalate certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by the cyber incident disclosure committee in a timely manner.


text: Technical Safeguards—We have deployed technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls. We evaluate and strive to improve upon these safeguards through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning—We have established and maintain an incident response program that governs our response to a cybersecurity incident from detection and initial assessments to incident resolution and recovery. We have a dedicated cybersecurity team led by our CISO that monitors our information systems for indications of cybersecurity threats and will employ our cybersecurity operational model within the incident response program promptly upon threat detection. Our incident response program is tested and evaluated on a regular basis.


text: Third-Party Risk Management—We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties (including vendors, service providers and other external users of our systems) as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

stage1Category: Third-Party Risk


text: Education and Training—We conduct mandatory training for all employees to communicate our policies and procedures regarding cybersecurity and to assist employees in learning how to identify potential cybersecurity threats.


text: Assessment and Testing—We engage in periodic assessments and testing of our policies and procedures that are designed to address cybersecurity threats and incidents. We use a range of activities such as audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. On occasion, we use third parties (such as outside counsel, information security consultants, and software providers) to assist in these assessment and testing exercises.


text: The Audit Committee of the Board of Directors oversees our cybersecurity program and management of the associated risks. The Audit Committee periodically receives presentations and reports on cybersecurity risks on a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Board and the Audit Committee also receive reports regarding cybersecurity incidents that meet established reporting thresholds through the process described above, as well as updates regarding any such incident.


text: The CIO and CISO are responsible for the maintenance of the incident response program that is designed to protect our information systems and information from cybersecurity threats and oversee the incident response team which responds to any cybersecurity threats or incidents in accordance with our cybersecurity incident response plan. The cybersecurity incident response team is responsible for monitoring, preventing, detecting, mitigating and remediating cybersecurity threats and incidents and reports such threats and incidents to the CISO (or other relevant stakeholders). Depending on the threat or incident level, the CISO will engage the cybersecurity crisis management team and the cyber incident disclosure committee to determine proper escalation with significant incidents being reported to the Audit Committee.


text: The CISO has served in various roles of increasing responsibility in information technology and information security for over 30 years and has attained several relevant professional certifications. The CIO has also served in various roles in information technology for over 25 years, including as chief information officer at another public company, and has extensive experience managing cybersecurity threats.


text: Our executive management team has established an enterprise risk management ("ERM") program, which includes an evaluation of our cybersecurity program as well as associated risks and risk mitigation strategies. Our ERM program is led by the Vice President of Internal Audit and our ERM Committee, which is comprised of members of senior management, including our CEO, Chief Financial Officer, Chief Information Officer ("CIO"), Chief Information Security Officer ("CISO") and Chief Legal Officer. Our cybersecurity policies, standards, processes and practices are integrated into our ERM program and leverage the National Institute of Standards and Technology guidelines. Generally, we seek to address cybersecurity risk through a cross-functional approach in an effort to preserve the confidentiality, security and availability of information that we collect, store and otherwise process. For a description of the risks from cybersecurity threats that could materially and adversely impact us and how they may do so, see our risk factors under Part I, Item 1A "Risk Factors—Risks Related to Our Business" of this Report.


text: Governance— In 2024, t he Board of Directors (the "Board") assumed direct oversight of our cybersecurity program and management of the associated risks. The Board periodically receives updates regarding our cybersecurity program through meetings with and reports from our CIO and CISO (or their designees).


text: Our management team has established a cybersecurity crisis management team, led by our CIO and CISO, that includes other members of management depending on the origin, severity and other factors related to any cybersecurity incident identified. The cybersecurity crisis management team is responsible for communication of significant incidents to the Board and provides updates to the Board through incident resolution. Materiality of incidents are evaluated and determined by our cyber incident disclosure committee that includes certain cybersecurity crisis management team members and which may receive input from relevant stakeholders.


text: Third-Party Risk Management— We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties (including vendors, service providers and other external users of our systems) as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Third-Party Risk Management—We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: Redfin Corp


text: In 2024, the Board of Directors assumed direct oversight of our cybersecurity program and management of the associated risks. The Board periodically receives presentations and reports on cybersecurity risks on a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Board also receives reports regarding cybersecurity incidents that meet established reporting thresholds through the process described above, as well as updates regarding any such incident.


text: The CIO and CISO are responsible for the maintenance of the incident response program that is designed to protect our information systems and information from cybersecurity threats and oversee the incident response team which responds to any cybersecurity threats or incidents in accordance with our cybersecurity incident response plan. The cybersecurity incident response team is responsible for monitoring, preventing, detecting, mitigating and remediating cybersecurity threats and incidents and reports such threats and incidents to the CISO (or other relevant stakeholders). Depending on the threat or incident level, the CISO will engage the cybersecurity crisis management team and the cyber incident disclosure committee to determine proper escalation with significant incidents being reported to the Board.


text: Chegg and its Board of Directors (the "Board") recognize the critical importance of maintaining the trust and confidence of our students, business partners, and employees. We have established an Information Security and Governance Program ("ISP") utilizing the National Institute of Standards and Technology Cybersecurity Framework as an authoritative source of cybersecurity standards and framework for measurement. The ISP is comprised of the following components: (i) policies which describe the core requirements and design aspects of the program, (ii) standards that provide quantifiable and prescriptive requirements to meet the program's design, (iii) processes that provide operational requirements to meet the ISP's policies and standards consistently, and (iv) implementation playbooks which are created, maintained, and used by the respective team responsible for implementation.

companyName: CHEGG, INC

ticker: CHGG


text: The ISP has three core functions underlying its design, which are intended to provide Chegg with appropriate oversight and governance to execute, monitor, measure and report on the performance of the program in a consistent manner: • management (control owners) have a responsibility to own and manage risks associated with day-to-day operations, including the design, implementation, and ongoing operation of controls; • compliance and cybersecurity teams enable the identification of emerging risks in daily operation of our business, providing compliance and oversight in the form of frameworks, policies, tools, and techniques to support management; and • independent assessors provide objective evaluation by assessing whether the first and second functions above are operating successfully, providing assurance that controls are effective in both design and operation.


text: The Audit Committee of the Board (the "Audit Committee") provides independent oversight of the ISP. As a component of the ISP, the Audit Committee receives a report on the health and performance of the ISP on at least an annual basis. The Audit Committee provides guidance and oversight to help ensure the ISP meets the needs of all interested parties and fulfills its core functions.


text: Our Trust and Security organization ("T&S") is responsible for implementing the ISP. T&S is led by our Chief Information Security Officer ("CISO"), John Heasman, who reports to our Chief Technology Officer ("CTO"), Chuck Geiger. T&S is made up of three sub-teams, each led by a director who reports to the CISO: • Information Security, which is responsible for implementing all aspects of the ISP and is structured around the following pillars: (i) Application Security, (ii) Infrastructure (Cloud) Security, (iii) Corporate IT Security, (iv) Security Operations, and (v) Governance and Risk Management. • Compliance and Privacy, which is responsible for assessing and preparing internal teams for regulatory compliance pertaining to information security, secured financial reporting, and privacy and is structured around the following pillars: (i) Privacy, (ii) Compliance, (iii) Vendor Risk Management, and (iv) Security Awareness. • Operations and Analytics, which is responsible for identifying and measuring consumer fraud and abuse of our customer-facing services, implementing manual and automated operations to ensure these are within acceptable bounds, and working with our product and engineering teams to design and implement longer term solutions.


text: T&S also partners with a dedicated engineering team, Security and Fraud Engineering, which reports to our CTO and is responsible for building libraries, services, and integrations that interface with both backend and vendor systems to support the objectives of T&S.


text: Mr. Heasman has served as our CISO for over four years and has served in various roles in information technology and information security for over 20 years, including serving as the Deputy CISO of a large public company prior to joining Chegg. Mr. Heasman holds undergraduate and graduate degrees in engineering and computer science. Mr. Geiger holds an undergraduate degree in computer science and has served in various roles in information technology for over 30 years, including serving as either the CTO or Executive Vice President of Technology of four companies prior to joining Chegg. Our CEO, CFO and General Counsel each hold degrees in their respective fields, and each have over 20 years of experience managing risks at Chegg and other companies, including risks arising from cybersecurity threats.


text: For discussion of our risk factors relating to cybersecurity and data privacy, see the "Risks Related to Data Privacy" section included in Part I, Item 1A, "Risk factors" of this Annual Report on Form 10-K.


text: Our Trust and Security organization ("T&S") is responsible for implementing the ISP. T&S is led by our Chief Information Security Officer ("CISO"), Lonnie Benavides, who reports to our Chief Technology Officer ("CTO"), Chuck Geiger. T&S is made up of two sub-teams, each led by a director who reports to the CISO: • Information Security, which is responsible for implementing all aspects of the ISP and is structured around the following pillars: (i) Application Security, (ii) Infrastructure (Cloud) Security, (iii) Corporate IT Security, (iv) Security Operations, and (v) Governance and Risk Management. • Compliance and Privacy, which is responsible for assessing and preparing internal teams for regulatory compliance pertaining to information security, secured financial reporting, and privacy and is structured around the following pillars: (i) Privacy, (ii) Compliance, (iii) Vendor Risk Management, and (iv) Security Awareness.


text: T&S also partners with other dedicated teams which report to our CTO: • Operations and Analytics, which is responsible for identifying and measuring consumer fraud and abuse of our customer-facing services, implementing manual and automated operations to ensure these are within acceptable bounds, and working with our product and engineering teams to design and implement longer term solutions. • Security and Fraud Engineering, which is responsible for building libraries, services, and integrations that interface with both backend and vendor systems to support the objectives of T&S.


text: Mr. Benavides joined Chegg in 2024 and has served various roles in information technology and security for over 25 years, including serving as CISO of a mortgage servicing company prior to joining Chegg. Mr. Benavides holds an undergraduate degree in Information Technology with a specialization in Information Assurance and Security and was a distinguished graduate of the US Air Force Secure Communications school. Mr. Geiger holds an undergraduate degree in computer science and has served in various roles in information technology for over 30 years, including serving as either the CTO or Executive Vice President of Technology of four companies prior to joining Chegg. Our CEO, CFO and General Counsel each hold degrees in their respective fields, and each have over 20 years of experience managing risks at Chegg and other companies, including risks arising from cybersecurity threats.


text: Third-Party Risk Management: We strive to proactively manage third-party risks to minimize any adverse effects on our business that may arise due to a cybersecurity incident affecting third-party systems and vendors. While we rely on third-party vendors to manage and maintain their own cybersecurity defense programs, we are developing a vendor risk management program to assess our exposure to these external cybersecurity risks.

companyName: ANAPTYSBIO, INC

ticker: ANAB


text: Cybersecurity Risk Management and Strategy Our business involves the storage, transmission, and processing of a large quantity of customer data, including confidential and sensitive information. Our management team and Board recognize the significance of maintaining the trust of our customers and business partners, including the importance of managing cybersecurity risks as part of our larger risk management strategy. While everyone at our company plays a part in managing these risks, oversight responsibility for cybersecurity is shared by our management team and our Board, including its Audit Committee.

companyName: SMARTSHEET INC


text: We have adopted a variety of data security controls, and we have a defined protocol for identifying, containing, and remediating cybersecurity incidents. Our cybersecurity program is aligned with our overall enterprise risk management strategy and leverages the National Institute of Standards and Technology security framework to drive strategic direction and maturity improvement. This program is led by our Chief Information Security Officer ("CISO"), who has served in the role since 2020, has over 10 years of experience leading cybersecurity programs at large enterprise organizations, and holds a Ph. D. and master's degree in Information Assurance and Security. We also utilize our Information Security Steering Committee ("ISSC"), a cross-functional group of senior internal stakeholders responsible for identifying and addressing significant security risks that could impact customers, our platform, or our corporate environment. The ISSC makes recommendations to escalate risks to senior leadership and our Board, and also determines, and reviews annually, our security risk tolerance including setting acceptance criteria for security related risks.


text: We follow a documented risk management procedure that involves creating and monitoring remediation plans with the aim of mitigating our exposure to cybersecurity risks. Our Active Defense and Response Team ("ADRT") is designed to monitor and detect threats to our customers, platform, and our corporate environment, and provides a regular security briefing to the ISSC on relevant threat items. This information is used to escalate items to the appropriate threat level as necessary. ADRT members also regularly test the incident response capability of our information systems, using tests and exercises to determine their effectiveness.


text: Additionally, we have adopted a Third Party Risk Management Policy ("TPRM Policy") to provide an integrated framework for the review and selection of our prospective or current third-party contractors and providers. The goal of the TPRM Policy is to identify and analyze risks before engaging in or continuing business with such third parties, so that these risks can be mitigated, monitored, and managed on an ongoing basis. In addition, our Supply Chain Review Board, composed of a cross-functional group of internal management team members, uses a risk-based due diligence approach to evaluate third-party providers. We endeavor to only engage third-party providers after completing a review of the risks associated with such engagement and in accordance with the TPRM Policy. We routinely monitor these third-party engagements, including, among other measures, by requesting regular updates to the provider's security documentation and by reviewing the scope of our agreements with the provider.


text: Further, we have achieved certifications for internationally recognized information security and data privacy standards developed by the International Organization for Standardization ("ISO"), including ISO/IEC 27001:2013; ISO/IEC 27017:2015; ISO/IEC 27018:2019; and ISO/IEC 27701:2019. We also maintain certifications through a variety of other data security standards, including SOC2 and FedRAMP. These certifications demonstrate our commitment to industry-leading security and privacy best practices.


text: To ensure adherence to our cybersecurity policies and compliance with information security standards, independent third parties audit our practices each year and conduct infrastructure and application security assessments and penetration testing. We also mandate regular cybersecurity training for our employees. Further, our security incident response policies and procedures are documented and provided to all authorized personnel to guide them in detecting, responding to, and recovering from security events and incidents.


text: Though we have previously experienced, and may experience in the future, cybersecurity incidents, we do not believe that any of these incidents have materially affected our business operations, financial condition or operating results. In the future, we may experience a material Cybersecurity Threat that could adversely affect our business operations, financial condition or operating results. For more information regarding our cybersecurity risks and the related potential impacts on our business, see the risk factor titled "Our failure to sufficiently secure our products and services may result in unauthorized access to customer data, a negative impact on our customer attraction and retention, and significant liabilities."


text: Our Board engages in risk oversight on a broad range of matters related to cybersecurity. They demonstrate independence from management and exercise oversight for the development and performance of our internal information security controls. Our CISO provides quarterly updates to the Audit Committee and meets regularly with our Chief Executive Officer and other senior management members to discuss cybersecurity matters. Our Audit Committee regularly reviews metrics and updates related to Cybersecurity Threat response preparedness, program maturity milestones, risk mitigation status, and the current and emerging threat landscape. Additionally, we consider director and Audit Committee member Alissa Abdullah to be a cybersecurity expert because of her background and experience, with a Ph. D. in information technology management, current service as Mastercard Incorporated's deputy chief security officer, and prior service in high level information and technology management roles.


text: Our cybersecurity program is integrated into our overall risk management systems and led by our data protection officer. This program is on par with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Oversight of the program is performed by our executive management and board of directors. Internal employees as well as third party advisors were involved in the development and continued maintenance of our cybersecurity program. The program is evaluated and audited on an annual basis by independent third parties through ongoing IT compliance initiatives.

companyName: Globalstar, Inc.

ticker: GSAT


text: Our formalized cybersecurity incident response plan is a framework to facilitate the detection, identification, containment, eradication and recovery from cybersecurity incidents. This framework addresses how and which risks impact our operational, financial or reputational standing and/or the ability to comply with regulatory or legal requirements. The incident response plan is evaluated and tested on an annual basis by management and independent third parties.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, we are subject to various cybersecurity risks that could adversely affect our business, financial condition and results of operations. Such risks may include harm to our employees or customers, violation of privacy laws, theft, fraud, extortion as well as legal and reputational risk. See Item 1A. Risk Factors, "Our networks and those of our third-party service providers and customers may be vulnerable to unauthorized or unlawful access, including cyber-attacks and other security breaches, that could have significant negative consequences. Our use of personal information could give rise to costs and liabilities arising from developing data privacy laws." for further discussion.


text: Risk Management and Strategy We have an enterprise-wide information security program designed to identify, protect against, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. Our information security program is integrated into our overall risk management systems and led by our Data Protection Officer. This program is on par with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Internal employees as well as third party advisors are involved in the development and continued maintenance of our cybersecurity program. We also hold cybersecurity insurance as part of our risk management program.


text: The program is evaluated and audited on an annual basis by independent third parties through ongoing IT compliance initiatives. Additionally, each year, we conduct cross-functional tabletop training exercises to rehearse our response to cyber-related breach incidents. We require that all employees complete cybersecurity trainings at least quarterly to mitigate cyber risks. We also randomly test employees with phishing simulations and provide periodic cyber and security updates. As part of the risk management program, we engaged external subject matter experts to develop a comprehensive third party and vendor due diligence program. This program strengthens our cybersecurity program by ensuring the establishment of contractual agreements and data protection clauses, documentation of processing activities performed as part of each service and identifies responsible process owners. Third parties and vendors with access to our information, systems and networks complete additional due diligence verification activities. All vendors with access to internal systems and networks must comply with our IT policies. Formal monitoring procedures of relationships with third parties are performed on at least an annual basis. This level of oversight allows us to maintain proactive visibility and security baseline requirements with our established external relationships.


text: Our formalized cybersecurity incident response plan is a framework to facilitate the detection, identification, containment and eradication of and recovery from cybersecurity incidents. This framework addresses how and which risks impact our operational, financial or reputational standing and/or the ability to comply with regulatory or legal requirements.


text: Oversight of our cybersecurity program is performed by our executive management and board of directors. Specifically, our executive management includes our Vice President of Network IT and Applications, who serves as our Data Protection Officer and has over 25 years of experience in IT systems, cybersecurity and risk management, as well as our Chief Executive Officer and Chief Financial Officer. Our Vice President of Network IT and Applications is responsible for reviewing cybersecurity risks, controls, policies and processes. This includes training, policy development and updates, while also keeping senior leadership informed on cybersecurity matters. We also have a department dedicated to monitoring our systems to prevent cybersecurity attacks. The Board of Directors receives information from management regarding any significant changes to the Company's cybersecurity policies and procedures, as well as recently identified risks and other recent information relative to cybersecurity, and on at least an annual basis our Data Protection Officer presents the Company's cybersecurity program to the Board of Directors.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, we are subject to various cybersecurity risks that could adversely affect our business, financial condition and results of operations. Such risks may include harm to our employees or customers, violation of privacy laws, theft, fraud, extortion as well as legal and reputational risk. See Item 1A. Risk Factors, "Our networks and those of our third-party service providers and customers may be vulnerable to cyber-attacks and other security breaches, which could have significant negative consequences." for further discussion.


text: The Company's cybersecurity program is aligned and integrated into the overall company risk management process through its Enterprise Risk Management Program ("ERM"). At Emergent, ERM is a centralized process that prioritizes, and groups the top risks to our organization into 12 categories, one of which is Cybersecurity. We conduct an Enterprise Risk Assessment ("ERA") annually to proactively identify, assess, respond, monitor, and report risks to our enterprise. Identified risks are assessed and we accordingly will either accept the risk or take action to reduce or avoid the risk. Mitigations against risks are developed, as necessary, and all risks are monitored, reviewed quarterly, and reported to executive leadership and the Board of Directors.

companyName: Emergent BioSolutions Inc.

ticker: EBS


text: The ERM program and ERA process is described in the company's Enterprise Risk Management Policy which was released this year. The program includes enterprise level risks grouped in 12 risk categories. Cybersecurity is included as a standing risk category. The ERM program does not itself independently review cybersecurity policies and practices. In first quarter 2024, ERM, in collaboration with Emergent's Policy and Training Center of Excellence, provided training on Emergent's Enterprise Risk Management Policy to all employees who are at the vice president level and above. We are currently working on an all-employee awareness communication to further educate the full employee population about the ERM program, policy and intranet page. Timing for this communication is expected in first half of 2024. Annually, an ERM training will be provided to all participants in advance of the Company's annual ERA. Full retraining on the ERM policy will occur every three years. The Company leverages the Committee of Sponsoring Organizations'("COSO") guidelines as the foundation for our ERM program and leverage external expertise.


text: The Company proactively reviews threats landscape, impacts to the company, and address any gaps where necessary. Also, we maintain security operations metrics, incident response plan and conduct tabletop exercises. The Company engages outside consultants to review both its Cybersecurity posture, and maturity, and perform for a cyber assessments of the Company's manufacturing/operational technology environments. The Company has a process in place to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider, namely its Third-Party Risk Management Assessment Process. We utilize the NIST framework when assessing third parties. The framework covers 23 categories. When applicable, we may request if the third party vendor is SOC1/2, GDPRS, certified.


text: The Company's Chief Information Security Officer ("CISO") is responsible for assessing and managing the Cybersecurity risks with comprehensive oversight of information security functions with an emphasis on strategic leadership, governance, risk management and technical proficiency. Moreover, the Company's CISO provides cyber security updates to the entire board of directors and the board's Quality Compliance Management Risk Committee (the "Committee"). The purpose of the Committee is to assist the Board in fulfilling its oversight responsibilities relating to the Company's compliance with laws, regulations, and industry standards that, if breached, may cause significant business, regulatory, or reputational damage to the Company, including oversight of the Company's: • Compliance with good ("x" = manufacturing, clinical, laboratory, pharmacovigilance, storage, distribution etc.) (GxP) and medical device Quality Systems Regulations (QSR); • Healthcare compliance, anti-corruption, privacy and data security landscape, medical product safety, supply chain, employee health and safety, political expenditures and lobbying activities, and government contracting; • Enterprise Risk Management program; • Cyber and information security risks.


text: The Committee is the primary oversight body to monitor the Company's cybersecurity and related information technology risks and receives periodic updates from Company management (including, the Chief Information Officer and the CISO) on the Company's policies, processes, procedures, and any significant developments related to the identification, mitigation, and remediation of cybersecurity risks. The Chair or Vice-Chair of the Committee meet as necessary with the Chief Information Officer and the CISO to engage in a more detailed review of the Company's cybersecurity and information security activities. The Committee charter also requires that the Committee ensure that Company management provides an annual cyber and information security update to the full Board. Current Committee members are: Zsolt Harsanyi, Ph. D., Sujata Dayal and Kathryn C. Zoon, Ph. D., all of whom are independent directors.


text: The Company's CISO is a Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM), and is certified in Risk and Information Systems Control (CRISC). The CISO reports to the Quality Compliance Management Risk Committee twice per year and also reports to the Board twice per year.


text: The Company has not incurred material cybersecurity incidents over the past three years The Company is not aware that any risks from cybersecurity threats, including because of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the company. The Company proactively reviews threats landscape, impacts to the company, and address any gaps where necessary. Also, we maintain security operations metrics, incident response plan and conduct tabletop exercises. In addition, the Company has: • Managed Security Service Provider (MSSP) that maintains 24 hours per day, 7 days per week, monitoring of the Company's environment; • Formed partnership with Cybersecurity Infrastructure Security Agency (CISA), to monitor the Company's external traffic and external facing web environment; • Performed an internal red campaign; • Been audited by internal and external auditors.


text: The ERM program and ERA process is described in the Company's Enterprise Risk Management Policy which was released this year. The program includes enterprise level risks grouped in 12 risk categories. Cybersecurity is included as a standing risk category. The ERM program does not itself independently review cybersecurity policies and practices. In first quarter 2024, ERM, in collaboration with Emergent's Policy and Training Center of Excellence, provided training on Emergent's Enterprise Risk Management Policy to all employees who are at the vice president level and above. As part of our ongoing Enterprise Risk Management ("ERM") enhancements, our ERM intranet page was launched in 2024 to centralize risk-related resources and policies. During the third quarter of 2024, a comprehensive reassessment of the Company's enterprise risks was conducted, with results thoroughly reviewed and communicated to executive leadership (VP and above) to align on key risks and strategic priorities. Annually, we provide an ERM training to all participants in advance of the Company's annual ERA. Full retraining on the ERM policy will occur every three years. The Company leverages the Committee of Sponsoring Organizations'("COSO") guidelines as the foundation for our ERM program and leverage external expertise.


text: The Company proactively reviews threats landscape, impacts to the company, and address any gaps where necessary. Also, we maintain security operations metrics and incident response plan and conduct tabletop exercises. The Company engages outside consultants to review both its Cybersecurity posture, and maturity, and perform for a cyber assessments of the Company's manufacturing/operational technology environments. The Company has a process in place to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider, namely its Third-Party Risk Management Assessment Process. We utilize the NIST framework when assessing third parties. The framework covers 23 categories. When applicable, we may request if the third party vendor is SOC1/2, GDPR, certified. Additionally, the Company maintains a cybersecurity insurance policy to help mitigate the impacts of potential cybersecurity incidents.


text: The Company's Chief Information Security Officer ("CISO") is responsible for assessing and managing the Cybersecurity risks with comprehensive oversight of information security functions with an emphasis on strategic leadership, governance, risk management and technical proficiency. Moreover, the Company's CISO provides cybersecurity updates to the entire board of directors and the board's Quality Compliance Management Risk Committee (the "Committee"). The purpose of the Committee is to assist the Board in fulfilling its oversight responsibilities relating to the Company's compliance with laws, regulations, and industry standards that, if breached, may cause significant business, regulatory, or reputational damage to the Company, including oversight of the Company's: • Compliance with good ("x" = manufacturing, clinical, laboratory, pharmacovigilance, storage, distribution etc.) (GxP) and medical device Quality Systems Regulations (QSR); • Healthcare compliance, anti-corruption, privacy and data security landscape, medical product safety, supply chain, employee health and safety, political expenditures and lobbying activities, and government contracting; • Enterprise Risk Management program; and • Cyber and information security risks.


text: The Committee is the primary oversight body to monitor the Company's cybersecurity and related information technology risks and receives periodic updates from Company management (including, the Chief Information Officer and the CISO) on the Company's policies, processes, procedures, and any significant developments related to the identification, mitigation, and remediation of cybersecurity risks. The Chair or Vice-Chair of the Committee meet as necessary with the Chief Information Officer and the CISO to engage in a more detailed review of the Company's cybersecurity and information security activities. The Committee charter also requires that the Committee ensure that Company management provides an annual cyber and information security update to the Board of Directors. Current Committee members are: Zsolt Harsanyi, Ph. D., Sujata Dayal and Kathryn C. Zoon, Ph. D., all of whom are independent directors.


text: The Company's CISO is certified in Risk and Information Systems Control (CRISC) and Certified Information Privacy Professional/United States (CIPP/US). The CISO reports to the Quality Compliance Management Risk Committee twice per year and also reports to the Board twice per year.


text: The Company has not incurred material cybersecurity incidents over the past three years. The Company is not aware that any risks from cybersecurity threats, including because of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the company. The Company proactively reviews threats landscape, impacts to the company, and address any gaps where necessary. Also, we maintain security operations metrics, incident response plan and conduct tabletop exercises. In addition, the Company has: • Managed Security Service Provider (MSSP) that maintains 24 hours per day, 7 days per week, monitoring of the Company's environment; and • Performed an internal phishing campaign and awareness program.


text: We maintain an information security program and governance framework that are designed to protect our information systems against operational risks related to cybersecurity.

companyName: Citizens Community Bancorp Inc.

ticker: CZWI


text: Our cybersecurity program ("Cybersecurity Program") provides a framework for compliance with applicable cybersecurity and data protection laws. Our program is designed to ensure the security and confidentiality of customer information, protect against known or evolving threats to the security or integrity of customer records and personal information and protect against unauthorized access to or use of such information. We work with our regulators to ensure that these policies are adequately designed to appropriately safeguard personal information. We use a variety of processes and technologies to monitor for and identify cybersecurity threats, including vulnerabilities scans, endpoint and network monitoring software, and email scanning software. We also have a Cyber Incident Response Policy and detailed plans. We conduct annual cybersecurity risk assessments which drive strategic decisions. Employees are required to abide by our cybersecurity and data protection policies. We maintain a corporate cyber risk insurance policy as part of our cybersecurity risk strategy that is reviewed annually. To date, the Company has not experienced a material cybersecurity incident.


text: Cybersecurity and data protection are important for the Company to maintain the trust of our customers, team members and stakeholders. Overseen by the Board of Directors and its Risk Committee, we regularly review, and as appropriate, adapt our Cybersecurity Program to an evolving landscape of emerging threats, evaluate effectiveness of key security controls, and assess cybersecurity best practices.


text: The Chief Information Security Officer ("CISO") and the Chief Technology Officer ("CTO") are key management roles responsible for assessing and managing material risks from cybersecurity threats. The CISO reports to the Risk Committee and is responsible for implementing and maintaining our enterprise cybersecurity organization. The CISO will maintain an Incident Response Plan. The CISO ensures that the Incident Response Plan is tested annually and will present testing results to the Risk Committee. The CISO and/or its delegate will share applicable threat information to ensure Board members and staff are informed on the evolving threat environment. The CISO is responsible for ensuring the Board of Directors and staff are trained annually on cybersecurity and information security awareness. Additionally, the CISO ensures staff is adequately trained on Incident Response Plan procedures. The CISO will ensure security incidents are logged and maintained. The CTO provides our Cybersecurity Program with the technical and functional resources to achieve its strategic goals and objectives, and partners and collaborates with the CISO.


text: The Risk Committee is responsible for overseeing the Company's management of cybersecurity risk, including oversight into appropriate risk mitigation, strategies, processes, systems, and controls. The CISO has regular and direct communication with the Risk Committee, providing a written cybersecurity report to the Risk Committee and a written cybersecurity report and briefing to the full Board on an annual basis (more frequently as necessary), in order to inform the Risk Committee of the state of the Company's Cybersecurity Program. These reports cover, but are not limited to, the Company's cybersecurity posture, overall status of the Company's compliance with the Cybersecurity Program, threat environment, material cybersecurity risks and events, Cybersecurity Program improvements and effectiveness, and other material matters related to the Cybersecurity Program.


text: Risk Management and Strategy Cyber risk management is a critical component of our risk management framework. Processes for assessing, identifying, and managing material risks arising from cybersecurity threats are integrated in our policies and procedures, including our enterprise risk appetite, risk assessment, risk treatment, risk acceptance or exceptions, and third party risk management policies.


text: Education and Awareness: We provide mandatory training and resources for personnel regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: The underlying processes and controls of our cyber risk management protocol incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We have undertaken, on an annual basis, to conduct an assessment of our cyber risk management processes and controls to identify, quantify, and categorize material cyber risks. In addition, we have developed a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: REMARK HOLDINGS, INC.

ticker: MARK


text: In addition, we maintain policies over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We consult with a third-party specialist with regard to our cyber risk management processes and controls.


text: Our management team is responsible for oversight and administration of our cyber risk management protocol, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes and relies on threat intelligence as well as other information obtained from governmental, public, or private sources. Our Audit Committee also provides oversight of risks from cybersecurity threats.


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services, brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. Such briefs include updates on our processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of our business. To date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. See Item 1A. "Risk Factors" for more information on cybersecurity risks.


text: We recognize the critical importance of maintaining the trust and confidence of all of our stakeholders. Our business depends on the efficient and uninterrupted operation of our information technology systems and those of our third-party CROs, CMOs, or other vendors, contractors or consultants.


text: Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with our Head of IT and our executive management team.


text: We engage in the periodic assessment and testing of our cybersecurity program. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. These activities may be performed by external cybersecurity and application security professionals.


text: The Board, in coordination with the Audit Committee, oversees our risk management process. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Audit Committee discuss our approach to cybersecurity risk management with the Head of IT.


text: Our Head of IT, in coordination with our executive management team, works collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with our entire employee base and appropriate third-party contractors, the Head of IT and the executive management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate.


text: Our Head of IT has over 20 years of IT experience in the pharmaceutical industry and oversees the cybersecurity program at AnaptysBio. He has experience developing and leading cybersecurity programs for pharmaceutical companies, including experience in evaluating and implementing tools and technologies that enable defense and response capabilities and developing critical cybersecurity procedures and training and awareness programs.


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material cybersecurity threats, that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see Item 1A "Risk Factors."


text: We recognize the critical importance of maintaining the trust and confidence of all of our stakeholders. Our business depends on the efficient and uninterrupted operation of our information technology systems and those of our third party CROs, CMOs, or other vendors, contractors or consultants.


text: Collaborative Approach: We have implemented a cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: We have established and maintain incident response and recovery plans to address our response to a cybersecurity incident. We use a manage, detection, and response (MDR) partner to provide threat detection and response capabilities. We also utilize security consultants including a vCISO to assess and continuously improve our cybersecurity program.


text: Third Party Risk Management: We strive to proactively manage third party risks to minimize any adverse effects on our business that may arise due to a cybersecurity incident affecting third party systems and vendors. Although we rely on third party vendors to manage and maintain their own cybersecurity defense programs, we continue to improve on our vendor risk management program to assess our exposure to these external cybersecurity risks, including the use of external security rating services and by evaluating vendor responses to our cybersecurity questionnaire.


text: Education and Awareness: We provide mandatory training and resources for personnel regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: The Board, in coordination with the Audit Committee, oversees our risk management process. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a quarterly basis, the Audit Committee discuss our approach to cybersecurity risk management with the Head of IT.


text: Cybersecurity Risk Management and Strategy Etsy recognizes the importance of information security, cyber readiness, and data privacy protections to our business and reputation, which includes assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks; intellectual property risks; harm to employees or members of our buyer and seller communities; violation of privacy or security laws; litigation or other legal risks; and reputational risks.

companyName: ETSY INC

ticker: ETSY


text: We use processes, technologies, and controls to assist in our efforts to assess, identify, and manage material cybersecurity-related risks. We also employ a range of tools and services, including network monitoring, vulnerability assessments, and tabletop exercises to inform our risk identification and assessment processes. We maintain an incident response plan that outlines the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes designed to triage, assess the severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with relevant legal obligations. Additionally, we conduct cybersecurity awareness and sensitive information protection training for our employees, and we periodically test the effectiveness of our training and policies through simulations, which may include simulated phishing emails and tabletop exercises.


text: We also would use similar processes, technologies, and controls to manage cybersecurity risks associated with third-party suppliers, including those who have access to our systems or our employee and other confidential data. In addition, cybersecurity considerations affect the selection and oversight of our third-party suppliers. We perform diligence on critical third-party suppliers that have access to our systems, and data or facilities that house such systems or data, and we monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require third-parties that we have identified as parties that could introduce significant cybersecurity risk to agree by contract to manage their cybersecurity risks according to standards set by us and/or to agree to be subject to cybersecurity audits conducted by our agents, which we conduct as we deem appropriate.


text: We engage third-parties to conduct information security testing, including penetration testing, on our systems including our credit card payments infrastructure. In addition, our information security program is subject to periodic self-assessments that measure the maturity of our program in a manner aligned with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: To identify and assess material risks from cybersecurity threats, using our enterprise risk management framework, we consider cybersecurity risks as part of our overall risk assessment and risk management process. Our information security team serves as a first line of defense, including managing cyber risk strategy execution and owning the day-to-day management of these risks. Our enterprise risk management program serves as a second line of defense, bringing holistic risk oversight and serving as a partner to the business to help first line teams strategically manage risk. Our enterprise risk management function also establishes a risk and governance framework to help identify, prioritize and optimize risk-reward decisions. Certain risks identified by our enterprise risk management function, including cybersecurity risks, are monitored by our Risk Steering Committee, a senior management level committee that includes our Executive Team. The Risk Steering Committee's review of these risks in turn informs the risk management updates provided to the committee of our Board of Directors responsible for assisting the Board of Directors with its oversight of cybersecurity risks. Additionally, Internal Audit will from time to time review certain aspects of our cybersecurity program and the related Internal Controls, and our external auditor will test relevant controls around our cybersecurity program and incident reporting.