text: The same cybersecurity threats that predominate across most industries challenge Tyler and our clients as well. These threats range from crude phishing attempts to distributed denial-of-service disruptions to sophisticated malware and ransomware, among others. The evolving use of artificial intelligence increases the risk of cyberattacks and data breaches, which themselves can evolve more rapidly when artificial intelligence is used to facilitate the attack. We are acutely aware that these same threats exist for our acquisition targets, our suppliers, and our third-party business partners, and a cybersecurity incident or vulnerability experienced by any of these entities could also materially and/or adversely impact our business operations and/or performance, both operational and financial, and could harm our reputation and/or competitive position. In addition, vulnerabilities in our clients' on-premises infrastructure have in the past and may in the future be exploited by bad actors, with the resulting impacts being linked to or attributed to, correctly or incorrectly, our software or services, which could also harm our business, reputation, and future financial results, even if our software or services were not the cause of the exploitation. Given the criticality of a strong cybersecurity posture, we continuously and conscientiously invest in our security infrastructure, tooling, and related resources.


text: Cyber Risk Management Strategy The Board of Directors is responsible for overseeing Tyler's senior management in the execution of its risk-management responsibilities and for assessing Tyler's overall approach to risk management. The Board exercises these responsibilities periodically as part of its meetings and through its committees, each of which examines various components of enterprise risk. The Audit Committee oversees management of financial risks, as well as Tyler's policies with respect to risk assessment and risk management, including but not limited to information security risk.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL

secItem: Item 1C


text: Tyler's Chief Information Security Office ("CISO") leads the information security responsibility at Tyler. He has spent his career in information security, joining Tyler in 2018 and previously working in the payments and semiconductor manufacturing industries. He is a Certified Information Systems Security Professional ("CISSP") and a Certified Data Privacy Solutions Engineer ("CDPSE").


text: The CISO reports directly to Tyler's Chief Operations Officer ("COO"), who in turn reports to the President & Chief Executive Officer. Tyler believes this organizational structure provides a holistic and collaborative approach to cybersecurity risk management, as the COO also oversees Tyler's information technology, technology, and cloud operations teams, with whom the CISO works regularly and closely. The CISO also has a dotted line to the Chair of the Audit Committee.


text: The CISO leads a full-time Security Risk & Compliance team that assesses, identifies and manages material risks from cybersecurity threats and oversees our Information Security Risk Management Program. These efforts include the identification, assessment, and treatment of potential harms to Tyler's technology, data, and intellectual property. The team continually monitors the potential for harm to help manage the level of risk.


text: To help protect client information and Tyler data, Tyler leverages both internal and external resources, including third-party assessments and threat intelligence services, to work to identify and respond to information security risks. For example:

stage1Category: Risk Management Process

stage1Method: unanimous


text: Internal Resources: Our full-time information security team focuses on managing incoming security risks and developing preventative responses to potential future risks, using tools targeted at people, processes, and technology. These efforts include security training for all employees at hire and on an annual basis thereafter, unannounced security testing (particularly on topics such as phishing), and periodic security alert messages for education or urgent security communications.


text: We repeatedly test our software during the development cycle, including internal assessments of our flagship solutions. We work closely with Tyler's Data Privacy Officer and her team to educate Tyler team members on complementary privacy-by-design principles. We continuously iterate on access management policies for both technological and physical resources.

stage1Method: majority


text: Tyler staffs an internal incident response team designed to launch when a potential or suspected security incident is reported to or identified by Tyler. That team is composed of a multi-disciplinary group of Tyler team members, including representatives from the security, privacy, communications, and relevant business unit teams, as well as outside threat intelligence, forensic and legal advisors that are called on as needed. The incident response team's goal is to confirm, contain, mitigate, and remediate the incident, as applicable, and to conduct a "lessons learned" process when the incident response is completed.


text: To help ensure disaster recovery and business continuity, Tyler maintains a business continuity plan with comprehensive procedures designed to recover Tyler and client assets quickly and effectively following a service disruption. Tyler's policies and procedures with respect to disaster recovery, as well as its process to help recover critical technology platforms, data center infrastructure, and operations, are updated regularly, tested annually, and reviewed by third-party auditors. We also partner with our Internal Audit team to regularly assess and respond to evolving risk management findings.


text: External resources: Tyler leverages third-party assessments, intelligence services, audits, and reporting obligations to provide additional layers of accountability, monitoring and testing. This includes a bug reporting program that we publish that invites any third party to report a security vulnerability they have identified. We also use a Qualified Security Assessor to perform an annual Payment Card Industry Data Security Standards assessment that tests our credit card data controls, and we undergo an annual System & Organizational Control audit to generate a report of our key compliance controls and objectives, among other things. Given our technology in the courts and public safety markets, we also manage compliance with Criminal Justice Information Systems security standards that are established by the Federal Bureau of Investigation ("FBI"), and we partner with our clients and third-party Criminal Justice Information Services ("CJIS") compliance consultants to ensure that we adhere to the requirements applicable to us.


text: Technology: Tyler also utilizes technology to help harden our environment from internal and external threats. We leverage a third-party endpoint detection management solution and threat intelligence software, as well as web-filtering tools, a multi-factor authentication tool, and related tools that support our "defense-in-depth" strategy. These tools are operated by subject-matter experts that report to the CISO, and Tyler employees are educated on the tooling to the extent applicable.


text: Third Parties: Our management of third-party security risks is an area of heightened focus for us. Over the past several years, we have worked to formalize our security due diligence process for each acquisition target, such that security is a formally embedded component of our due diligence and typically involves our independent testing of the target technology prior to closing the acquisition. Where a vulnerability or risk is identified, we generally require remediation by the target or attempt to ensure a remediation path post-closing, with contractual protections and liability parameters set forth in the purchase agreement.


text: We strive to enhance our vendor risk analysis, with a goal of universalizing the use of form cybersecurity questionnaires and/or security addenda where applicable. We consider the results of a security and privacy review of material vendor contracts, as well as our material contracts with business partners. Our goal is to proactively identify and manage potential security risks and vulnerabilities, and to clearly articulate the responsibility – whether shared, divided, flow-down, or otherwise – of Tyler, our acquisition targets, our vendors, and/or our business partners. We expect third parties – including our clients – to report cybersecurity incidents to us so that we can assess the impact of the incident on us.


text: Cybersecurity Governance In 2022, we formalized a multi-layered security governance structure, with the goal of ensuring that responsibilities are clear, information is effectively communicated, priorities are coordinated, and proper oversight is provided. Each "layer" of the governance structure has unique meeting, reporting, and action cadences to help ensure consistent communication between our security working groups, our leadership team, and our Board of Directors.


text: On at least a quarterly basis, Tyler's CISO provides a formal report to the Audit Committee and to the Board of Directors. Our Audit Committee Chair and CISO also communicate on an as-needed basis between those quarterly reports. In 2022, Tyler's Lead Independent Director completed the requirements to receive the CERT Certificate in Cybersecurity Oversight from the Software Engineering Institute at Carnegie Mellon University. Another Tyler director possesses more than 38 years of Department of Defense experience in cyberspace operations and major computer network architectures.

stage1Category: Board Governance


text: Tyler's governance practices are supported by several segments of Tyler's senior leadership, management, and teams. This includes security working groups and a security governance committee. The security governance committee, which meets on a quarterly basis to review the threat landscape and security initiatives at Tyler, is led by the CISO and includes senior leadership from Tyler's legal and operational teams, as well as the president of each of Tyler's three operating groups and Tyler's President & CEO.


text: Operationalizing Cybersecurity Risk Management We firmly believe – and communicate regularly – that all Tyler team members have a vital role to play in cybersecurity risk management. We identify their responsibilities as falling into three key areas: • Participating in training to identify and promptly report risks; • Staying informed by reading all pertinent information and security communications; and • Actively engaging in ongoing training initiatives.


text: We observe Cybersecurity Awareness month with interactive weekly training, workshops, and additional resources on strong cybersecurity practices. In addition to Cybersecurity Awareness month, additional cybersecurity training and awareness initiatives occur throughout the calendar year, including annual security compliance training; a monthly Cybersecurity Awareness Series composed of articles and training highlighting current cybersecurity concerns; company-wide communication as necessary to alert team members of potential threats; and weekly security-related videos with opportunities to win prizes through participation. We track participation in training events and boast high participation rates, with continuous reflection on strategies for driving participation yet higher.


text: In 2022, we expanded our Security Champions Program to identify a resource on our various application teams who proactively operationalizes security best practices on their team. This program helps to ensure that security measures are built into our programs from development to deployment. We have over 100 security champions who can collaboratively advocate security tools throughout the lifecycle of our applications.


text: Measuring Cybersecurity Risks In order to evaluate whether a cybersecurity risk is material to Tyler, we take a multi-disciplinary approach to assessing qualitative and quantitative factors. The cross-functional team includes senior leadership from Tyler's information security, legal, finance, and accounting teams, as well as senior leadership from the impacted business unit(s).


text: When an incident is reported, Tyler assembles its incident response team and initiates its incident response process as soon as possible. Working with the incident response team, the CISO aims to take an initial measurement of qualitative and quantitative metrics, typically within 24 hours of the incident report, to help determine whether Tyler's Chief Financial Officer ("CFO") and Chief Accounting Officer ("CAO") should be engaged to do a deeper analysis of quantitative factors. The CFO and CAO are expected to engage with the Company's Chief Legal Officer ("CLO"), Chief Administrative Officer ("CAdO"), and Audit Committee Chair to evaluate, holistically, not just the quantitative factors but the qualitative factors as well. If that team determines that the incident may represent a risk of national security, the CLO may contact the US attorney general for a disclosure delay of up to 30 days, or if applicable the team may coordinate to prepare and publish a Form 8-K, if management believes the materiality threshold has been reached. Whether or not the incident is deemed material, the incident response team will monitor the incident on an ongoing basis to attempt to ensure containment, mitigation, and remediation, as well as to monitor for evolving factors that subsequently push the incident to a materiality threshold that requires disclosure and reporting.


text: Quantitative metrics for evaluating a security incident include the potential or actual financial loss, the costs of impacted data records, remediation costs, and/or third-party expenses. Qualitative factors include potential or actual impacts to Tyler's reputation and/or competitiveness, disruptions to Tyler's business, and/or risk of litigation or regulatory action. In evaluating an incident, Tyler also works to assess whether the incident is related to another recent incident and whether the incident may represent a threat to national security. Tyler does not expect an incident to rise to that level unless Tyler infrastructure is deemed "critical infrastructure" by the Cybersecurity and Infrastructure Security Agency ("CISA").


text: Notwithstanding these ongoing efforts and our multi-layered approach to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While Tyler maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. Please see Item 1A, "Risk Factors," for a discussion of cybersecurity risks.


text: The Company has developed an information security program to assess, identify, and monitor cybersecurity risks. Each year, the Company assesses cybersecurity risks arising from the operating environment. In developing the assessment process, the Company reviews guidance from national standards organizations such as the NIST and the Center for Internet Security. In evaluating the risks identified as a part of this assessment, the Company's information security team considers the likelihood and severity of the risk and the possible impact of the risk on the Company, its customers, and its employees. These risks are then monitored by the Company's information security team.

companyName: KEMPER Corp

ticker: KMPR


text: The Company conducts periodic testing of software, hardware, defensive capabilities, and other information security systems. Tests are conducted by both internal security teams and third-party consultants. In developing the testing procedures, the Company considers its individual risks and industry standards. Testing procedures are supplemented by executive cyber threat exercises and employee training. Executive exercises such as "tabletops" are used to develop and refine the Company's incident response plans. Employees undergo security awareness training annually and upon hire.


text: As a part of its information security program, the Company addresses cyber risks posed by its relationships with third-party service and application providers. The Company assesses third parties as a part of the procurement process, including through pre-acquisition diligence. Contractual provisions based on regulatory requirements and industry standards are used in the contracting process, and the Company conducts on-going performance monitoring of key vendors. Security audits are also performed on certain vendors to review compliance with contractual requirements and industry standards.

stage1Category: Third-Party Risk


text: The Company maintains an incident response plan that includes procedures for evaluating and addressing a cybersecurity event. The initial impact of each cybersecurity event is evaluated by a designated team using pre-established risk criteria. If an event meets certain parameters, it is escalated to a cross-functional core team of executives, including the Company's Chief Information Security Officer ("CISO") and designated internal legal counsel. The Company has a cyber incident disclosure committee that evaluates and considers whether public disclosure of an event is required. The incident response plan identifies certain third-party advisors, consultants and legal counsel who have been designated to assist if necessary. The plan contains procedures for escalating cybersecurity incidents to the Board of Directors.


text: The Company's CISO is primarily responsible for management of the Company's information security program. The Company's current CISO has significant experience in information security, as do members of the information security team. The Company participates in certain industry cybersecurity intelligence and risk sharing organizations, such as FS-ISAC and the Domestic Security Alliance Council.

stage1Category: Management Role


text: Kemper's information security program is an element of the Company's broader Enterprise Risk Management (ERM) framework. This framework employs a management committee structure to review technology, compliance, and operational risks. The Company's Enterprise Risk Committee ("ERC"), composed of the Chief Executive Officer, the Chief Risk Officer, all executive vice presidents and the head of internal audit, meets at least quarterly to oversee the Company's ERM framework. This committee monitors the implementation of the ERM framework and makes modifications to the program from time to time as it believes appropriate. The ERC has several subcommittees that oversee particular risks, including cyber and information security.


text: Through its role in providing oversight for the Company's ERM framework, the Risk Committee of the Kemper Board of Directors (the "Risk Committee") provides oversight of the Company's information security program. On a quarterly basis, management discusses Kemper's information security program, cybersecurity risks, and related developments with the Risk Committee. The Risk Committee periodically reviews and evaluates information security and cybersecurity risks and provides oversight of events that have been escalated as a part of the incident response plan.


text: The Company's CISO is primarily responsible for management of the Company's information security program. The Company's current CISO has significant experience in information security, as do members of the information security team. The Company participates in certain industry cybersecurity intelligence, risk sharing organizations and law enforcement organizations.


text: With regard to personal information protection regulations and cybersecurity-related laws and regulations in various countries, in addition to current regulations, Honda collects and monitors information on regulatory trends that are expected to be enforced in the future. Data security incident response plans have been established at AHFC and HCFI that guides the analytical processes, response phases, and procedures to follow during a data security incident of personally identifiable information.

companyName: AMERICAN HONDA FINANCE CORP


text: Kemper's information security program is an element of the Company's broader Enterprise Risk Management ( ERM) framework. This framework employs a management committee structure to review technology, compliance, and operational risks. The Company's Enterprise Risk Committee ("ERC"), composed of the Chief Executive Officer, the Chief Risk Officer, all executive vice presidents and the head of internal audit, meets at least quarterly to oversee the Company's ERM framework. This committee monitors the implementation of the ERM framework and makes modifications to the program from time to time as it believes appropriate. The ERC has several subcommittees that oversee particular risks, including cyber and information security.


text: Our Board of Directors views the identification and effective management of cybersecurity threats as a critical component of overall risk management and oversight responsibilities and has delegated responsibility for oversight of this risk to the Audit/Compliance Committee of the Board of Directors (the "Audit Committee"). The Audit Committee oversees the management of risks arising from cybersecurity threats and regularly reports to the Board of Directors regarding cybersecurity. Our Risk Committee of the Board of Directors oversees our enterprise risk management ("ERM") process, and cybersecurity represents an important component of our overall approach to ERM. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on identifying, assessing, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: GRANITE CONSTRUCTION INC

ticker: GVA


text: Governance: As discussed in more detail under the heading "Governance" below, the Board of Directors' oversight of cybersecurity risk management is supported by the Audit Committee, the Risk Committee, our Chief Information Officer ("CIO"), other members of management and management's Cybersecurity Committee.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response Planning: We have established and maintain an incident response plan that outlines our response in the event of a cybersecurity incident.


text: Third-Party Assessments: We periodically assess and test our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and, if warranted, the Board of Directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Third-Party Risk Management: We review and evaluate material cybersecurity risks related to the use of third parties, including vendors, service providers and other external users of our systems.


text: Education and Awareness: We provide regular training regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: The Audit Committee receives regular presentations and reports from management on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Audit Committee then provides regular reports to the Board of Directors. The Risk Committee also receives timely updates on material and potentially material cybersecurity matters from management as part of the ERM process. The Audit Committee and the Board of Directors also receive timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been resolved.


text: Our CISO is an experienced cybersecurity executive with more than 20 years of experience building and leading cybersecurity, risk management, and information technology teams. Our CISO holds industry-recognized cybersecurity certifications, including Certified Information Systems Security Professional (CISSP) certification.

companyName: FLEX LTD.

ticker: FLEX


text: The CIO, who acts as our chief information security officer, leads our Cybersecurity Committee. The Cybersecurity Committee is a multidisciplinary team of corporate and operational leaders who work collaboratively to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response plan. The Cybersecurity Committee reports to our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Chief Operating Officer ("COO"), Senior Vice President, Human Resources ("SVP HR") and Senior Vice President and General Counsel. The CIO, working together with a team of cybersecurity professionals and third-party consultants, monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents, and reports such threats and incidents to the senior leadership team when appropriate.


text: Our CIO has served in various roles in information technology and information security for over 25 years, including serving as the Head of Cybersecurity for public and private companies. Our CIO holds an undergraduate degree in computer science and has attained a professional certification in Cybersecurity Governance. The Cybersecurity team (including the CIO) have a combined 80+ years of cybersecurity experience and hold multiple certifications across the cybersecurity landscape. Our CEO, CFO, COO, SVP HR and Senior Vice President and General Counsel each hold undergraduate degrees, graduate degrees or professional certifications in their respective fields, and each have significant experience managing risk.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations or financial condition. See "Risks Related to Information Technology" in Item 1A. Risk Factors.

stage1Category: Strategy Integration


text: Honda, including AHFC and HCFI, have been targeted by cyberattacks in the past; however, no risks from cybersecurity threats have been identified that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, over the past three fiscal years. See "Item 1A. Risk Factors—General Risk Factors—A security breach or a cyber attack may adversely affect our business, results of operations and financial condition."


text: Our CIO has served in various roles in information technology and information security for over 25 years, including serving as the Head of Cybersecurity for public and private companies. Our CIO holds an undergraduate degree in computer science and has attained a professional certification in Cybersecurity Governance. The Cybersecurity team (including the CIO) has extensive cybersecurity experience and hold multiple certifications across the cybersecurity landscape. Our CEO, CFO, COO, SVP HR and Senior Vice President and General Counsel each hold undergraduate degrees, graduate degrees or professional certifications in their respective fields, and each have significant experience managing risk.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and we do not believe are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. However, due to evolving cybersecurity threats, it may not be possible to anticipate, prevent or stop future cybersecurity incidents, including attacks on our information systems and data or those of our relevant business partners. See "Risks Related to Information Technology" in Item 1A. Risk Factors.


text: Risk Management and Strategy The Company recognizes the importance of cybersecurity and has implemented a comprehensive program to protect its information assets. Key components of our cybersecurity program include appointment of an Information Security Officer, who is the also the Chief Operating officer with extensive knowledge of cybersecurity issues, information security policies and procedures, engagement of third-party security experts, regular penetration testing, managed backup and data protection, managed threat response, hardware and software protections, physical security measures, employee training, internal cybersecurity audits, and ongoing product cybersecurity assessments. The Company maintains cybersecurity insurance covering its internal operations and customer-facing products.

companyName: ESCALON MEDICAL CORP

ticker: ESMC


text: Despite these measures, the Company cannot guarantee that it will be immune from cybersecurity threats. A successful attack could result in unauthorized access to our systems, data breaches, disruptions to our operations, and financial losses. We are committed to continually evaluating and enhancing our cybersecurity program to mitigate these risks.

stage1Category: None/Other


text: The Company's Board of Directors receives regular reports from the Information Security Officer regarding the Company's cybersecurity program. The Board ensures that the Company has the necessary resources and authority to implement and maintain a sufficient cybersecurity program. The Information Security Officer reports directly to the Chief Executive Officer and is responsible for working with internal and third-party resources to develop and implement the Company's cybersecurity strategy, manage cybersecurity risks, and oversee the Company's cybersecurity operations.


text: There have been an increasing number of cyberattacks on companies around the world, which have caused operational failures, compromised sensitive corporate or customer data, and/or resulted in significant financial damages. These attacks have occurred over the internet, through malware, viruses or attachments to e-mails, or through inside actors with access to systems within the organization.

companyName: ARTESIAN RESOURCES CORP

ticker: ARTNA


text: Risk Management and Strategy We have implemented security measures and will continue to devote resources to address security vulnerabilities in an effort to prevent cyberattacks. All employees receive cybersecurity training and other education regarding their use of computers, information technology, and sensitive data. We utilize third parties to support our information technology, or IT, resources, including disaster recovery intended to safeguard our ability to access and use our IT resources during a disaster or cyber incident. Our business continuity plans are evaluated against evolving security and service level standards, which includes evaluating those cybersecurity threats associated with our use of key third party service providers.


text: Our cybersecurity management process consists of utilizing a combination of employee education, preventative controls, detective controls, and periodic third-party cybersecurity testing. We have installed and utilize enterprise scale technology to support an appropriate cybersecurity posture including: endpoint detection and response, firewalls, security information and event management, email security, multifactor authentication, and vulnerability management. We receive cybersecurity related alerts from our membership in a number of industry groups. These alerts are evaluated and in the event an alert requires action within our environment, such actions are taken promptly. Our process and cybersecurity posture is refined based on the results of periodic third party cybersecurity assessments. We engage with the Cybersecurity and Infrastructure Security Agency through their cyber hygiene service offerings. Cybersecurity is addressed in IT's reports to the Corporate Automation Steering Committee, which consists of all Officers and the Director of Customer Service, as well as in IT's reports to the Board of Directors.


text: Should a cyber event occur, depending on the severity of an event, our cyber incident reporting process includes informing, as early as practicable, our senior corporate management.


text: The Audit Committee of the Board of Directors, as overseen by the full Board of Directors, is responsible for oversight of cybersecurity risk. Our IT executives report on our cybersecurity practices and risks at each meeting of the Audit Committee of our Board of Directors. In addition, our IT executives provide periodic updates on cybersecurity risks to our management at regularly held executive committee meetings. Should any cybersecurity threat or incident be detected, our IT executives would timely report such threat or incident to the management executive committee and provide regular communications and updates to the executive committee throughout the incident and any subsequent investigation, in order that the impact, materiality, and reporting requirements of such incident are appropriately identified and assessed for further necessary or appropriate action to be taken. Any incident identified by the management executive committee as having a material impact would be promptly escalated to all members of the Board of Directors. Should there be an incident which does not rise to the level of being material, such incident would, at minimum, be included in the subsequent IT reports to both the management executive committee and the Board of Directors.


text: We believe we are appropriately staffed to support a healthy cybersecurity posture. All IT personnel have a combination of professional experience, education, and/or certifications for their area of responsibility. For IT leadership, our Chief Information Officer earned a Masters of Business Administration and also a Master of Science degree in Information Systems & Technology Management.


text: Our Vice President of Information Technology earned a Bachelor of Science in Computer Science and Business and a Bachelor of Science in Business and Economics. The Vice President of Information Technology is also a Certified Public Accountant, a Certified Information Systems Auditor, and a Chartered Global Management Accountant. Our Director of Cybersecurity earned an Associates Degree in Computer Network Engineering and is a Certified Information Systems Security Professional.


text: To date, there have been no risks identified from cybersecurity threats or previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the company. However, despite all of the above aforementioned efforts, a cyberattack, if it occurred, could cause water or wastewater system operational problems, disrupt service to our customers, compromise important data or systems or result in an unintended release of customer or other confidential information. See "Item 1A. Risk Factors—Risks Related to Cybersecurity and Technology" for additional discussion of cybersecurity risks impacting our Company.


text: There have been an increasing number of cyberattacks on companies around the world, which have caused operational failures, compromised sensitive corporate or customer data, and/or resulted in significant financial damages. These attacks have occurred over the internet, through malware, viruses or attachments to e-mails, or through inside actors with access to systems within the organization. In addition, there have been reports of other water utility companies being subjected to such attacks, resulting in widespread operational outages.


text: Risk Management and Strategy We have implemented security measures and will continue to devote resources to address security vulnerabilities in an effort to prevent cyberattacks. All employees receive cybersecurity training and other education regarding their use of computers, information technology, and sensitive data.


text: When implementing third-party packaged software and cloud services, Honda makes decisions based on risk assessments following established security standards and conducts annual checks after implementation. In response to cyberattacks on production facilities and suppliers, Honda verifies the status of security measures at both domestic and overseas production facilities and suppliers. Based on the results of these verifications, Honda takes measures to strengthen security, such as supporting the introduction of solutions for managing cybersecurity incident information, and monitoring malicious activities. For such activities to strengthen security, Honda has concluded outsourcing agreements with security consulting companies and external specialists to receive support.


text: Incidence Response and Recovery Planning: An Incident Response Plan that dictates how the Manager prepares, identifies, contains, remediates, and recovers from various vulnerabilities, threats, and events, including cybersecurity events impacting the Fund.

companyName: RIDGEWOOD ENERGY T FUND LLC


text: We utilize third parties to support our information technology, or IT, resources, including disaster recovery intended to safeguard our ability to access and use our IT resources during a disaster or cyber incident. Our business continuity plans are evaluated against evolving security and service level standards, which includes evaluating those cybersecurity threats associated with our use of key third party service providers. Our cybersecurity management process consists of utilizing a combination of employee education, preventative controls, detective controls, and periodic third-party cybersecurity testing. We have installed and utilize enterprise scale technology to support an appropriate cybersecurity posture including: endpoint detection and response, firewalls, security information and event management, email security, multifactor authentication, and vulnerability management. We receive cybersecurity related alerts from our membership in a number of industry groups. These alerts are evaluated and in the event an alert requires action within our environment, such actions are taken promptly. Our process and cybersecurity posture are refined based on the results of periodic third party cybersecurity assessments. We engage with the Cybersecurity and Infrastructure Security Agency through their cyber hygiene service offerings. Cybersecurity is addressed in IT's reports to the Corporate Automation Steering Committee, which consists of all Officers and the Director of Customer Service, as well as in IT's reports to the Board of Directors. Should a cyber event occur, depending on the severity of an event, our cyber incident reporting process includes informing, as early as practicable, our senior corporate management.


text: The Audit Committee of the Board of Directors, as overseen by the full Board of Directors, is responsible for oversight of cybersecurity risk.


text: Our IT executives report on our cybersecurity practices and risks at each meeting of the Audit Committee of our Board of Directors. In addition, our IT executives provide periodic updates on cybersecurity risks to our management at regularly held executive committee meetings.


text: Should any cybersecurity threat or incident be detected, our IT executives would timely report such threat or incident to the management executive committee and provide regular communications and updates to the executive committee throughout the incident and any subsequent investigation, in order that the impact, materiality, and reporting requirements of such incident are appropriately identified and assessed for further necessary or appropriate action to be taken.


text: Any incident identified by the management executive committee as having a material impact would be promptly escalated to all members of the Board of Directors. Should there be an incident which does not rise to the level of being material, such incident would, at minimum, be included in the subsequent IT reports to both the management executive committee and the Board of Directors. We believe we are appropriately staffed to support a healthy cybersecurity posture.


text: All IT personnel have a combination of professional experience, education, and/or certifications for their area of responsibility. For IT leadership, our Chief Information Officer earned a Masters of Business Administration and also a Master of Science degree in Information Systems & Technology Management. Our Vice President of Information Technology earned a Bachelor of Science in Computer Science and Business and a Bachelor of Science in Business and Economics. The Vice President of Information Technology is also a Certified Public Accountant, a Certified Information Systems Auditor, and a Chartered Global Management Accountant. Our Director of Cybersecurity earned an Associates Degree in Computer Network Engineering and is a Certified Information Systems Security Professional.


text: Risk Management and Strategy HMC and its consolidated subsidiaries, including AHFC and HCFI (Honda), have established a management system and standards for information system security in order to minimize the negative impact on its business and business results from the occurrence of cybersecurity incidents. Based on these standards, Honda has implemented security measures in both hardware and software aspects to strengthen the security of its information systems. To address security, including product security, Honda has established a cross-functional system across business and manufacturing systems, software, quality, and other areas.


text: Honda develops rules and procedures based on laws and regulations, formulate response flows, verify and implement measures for improvement through cybersecurity exercises, and develop human resources, among other things. Honda also utilizes solutions for managing cybersecurity information and monitoring malicious activities to monitor and analyze cybersecurity threats and vulnerabilities, and in the event of a security incident related to a cyberattack with a significant impact on Honda, a Global Emergency Headquarters will be established under the supervision and monitoring of Honda's Risk Management Officer, and the supervisory division in charge of risks from cybersecurity threats plays a central role in quickly ascertaining the actual situation and taking measures to minimize the impacts of cybersecurity incidents from a company-wide perspective.


text: In accordance with the aforementioned Policy, Honda has designated its cybersecurity supervisory divisions to conduct risk assessments and report the status of cybersecurity risk responses to the Risk Management Officer through Honda's Risk Management Committee. The designated cybersecurity supervisory divisions consisted of 64 members as of the filing date of this Annual Report with practical experience in various roles related to information technology, including security, auditing, and systems are established in both the Quality Innovation Operations and Corporate Administration Operations divisions. Honda's Risk Management Officer, who has knowledge and experience in overall risk management, receives technical support from the cybersecurity risk supervisory divisions, and monitors and supervises the responses to risks from cybersecurity threats.


text: In the event of a material cybersecurity incident, the cybersecurity risk supervisory divisions are to immediately report it to Honda's Risk Management Officer. Upon receiving the report, a Global Emergency Headquarters will be established, which coordinate with relevant organizations affected by the incident in order to prevent and contain the crisis. Such response status is reported to Honda's Board of Directors and the Executive Council as necessary based on the judgment of the Risk Management Officer.


text: The North American Regional Risk Management Officer and Risk Management Officers of local companies in North America receive technical support from the Cyber Security, Risk & Architecture (CSRA) division of AHM when applying the procedures under the Honda Global Risk Management Policy at the regional and local company levels. The CSRA division includes the Office of the Chief Information Security Officer. The North American Cybersecurity Steering Committee (NACSC) has been established by the North American Regional Operating Board and is responsible for the oversight and monitoring of all North American cybersecurity activities including providing immediate direction and decision-making when threats or incidences of high severity occur. Roles supporting the NACSC include the North American Risk Management Officer who is the chair of the committee, the Chief Information Security Officer, and senior leaders representing various key business functions. The NACSC is also supported by the business through an Advisory Group.


text: AHFC's and HCFI's Company Operating Committees advise and support each company's President on company operations and other matters of corporate importance which includes, among other things, matters regarding cybersecurity. The Company Operating Committees may report on certain matters directly to the North American Regional Operating Board. Confidentiality Committees have also been established at AHFC and HCFI whose roles includes, among other things, the safeguarding of personally identifiable information of our customers and associates from data security breaches. Members of our Confidentiality Committees include the Risk Management Officers, the Chief Information Security Officer or other information technology representative, and members from various areas throughout our companies.


text: Honda develops rules and procedures based on laws and regulations, formulates response flows, verifies and implements measures for improvement through cybersecurity exercises, and develops human resources, among other things. Honda also utilizes solutions for managing cybersecurity information and monitoring malicious activities to monitor and analyze cybersecurity threats and vulnerabilities, and in the event of a security incident related to a cyberattack with a significant impact on Honda, a Global Emergency Headquarters will be established under the supervision and monitoring of Honda's Risk Management Officer, and the supervisory division in charge of risks from cybersecurity threats plays a central role in quickly ascertaining the actual situation and taking measures to minimize the impacts of cybersecurity incidents from a company-wide perspective.


text: With regard to personal information protection regulations and cybersecurity-related laws and regulations in various countries, in addition to current regulations, Honda collects and monitors information on regulatory trends that are expected to be enforced in the future. Data security incident response plans have been established at AHFC and HCFI that guide the analytical processes, response phases, and procedures to follow during a data security incident of personally identifiable information.


text: Incident Response and Recovery Planning: We have established and maintained comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.

companyName: UNIVERSAL TECHNICAL INSTITUTE INC

ticker: UTI


text: Honda, including AHFC and HCFI, have been targeted by cyber-attacks in the past; however, no risks from cybersecurity threats have been identified that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, over the past three fiscal years. See "Item 1A. Risk Factors—General Risk Factors—A security breach or a cyber-attack may adversely affect our business, results of operations and financial condition."


text: Based on the resolution of Honda's Board of Directors, the Board of Directors has appointed the Senior Managing Executive Officer and Chief Officer for Automobile Operations as Honda's Risk Management Officer, who monitors and supervises the response status of significant risks, including risks from cybersecurity threats.


text: Honda's Risk Management Committee, chaired by the Risk Management Officer, has been established to deliberate on important matters related to risk management, including risk from cybersecurity threats. Honda has established the Honda Global Risk Management Policy, which stipulates Honda's basic policy for risk management, the collection of risk information, and the response system in the event of risk occurrence.


text: In accordance with the aforementioned Policy, Honda has designated its cybersecurity supervisory divisions to conduct risk assessments and report the status of cybersecurity risk responses to the Risk Management Officer through Honda's Risk Management Committee. The designated cybersecurity supervisory divisions consist of members with practical experience in various roles related to information technology, including security, auditing, and systems are established in both the Quality Innovation Operations and Corporate Administration Operations divisions. Honda's Risk Management Officer, who has knowledge and experience in overall risk management, receives technical support from the cybersecurity risk supervisory divisions, and monitors and supervises the responses to risks from cybersecurity threats.


text: In the event of a material cybersecurity incident, the cybersecurity risk supervisory divisions are to immediately report it to Honda's Risk Management Officer through the Risk Management Committee. Upon receiving the report, a Global Emergency Headquarters will be established, which coordinate with relevant organizations affected by the incident in order to prevent and contain the crisis. Such response status is reported to Honda's Board of Directors and the Executive Council as necessary based on the judgment of the Risk Management Officer.


text: AHFC's and HCFI's Company Operating Committees advise and support each company's President on company operations and other matters of corporate importance which includes, among other things, matters regarding cybersecurity. The Company Operating Committees may report on certain matters directly to the North American Regional Operating Board. Confidentiality Committees have also been established at AHFC and HCFI whose roles include, among other things, the safeguarding of personally identifiable information of our customers and associates from data security breaches. Members of our Confidentiality Committees include the Risk Management Officers, the Chief Information Security Officer or other information technology representative, and members from various areas throughout our companies.


text: The Company takes a multifaceted approach to assessing, identifying, and managing material risks from cybersecurity threats. The cybersecurity risk management processes described below are integrated into the Company's overall risk management system.

companyName: TRIMBLE INC.

ticker: TRMB


text: Each Trimble sector has identified a dedicated expert to assess vulnerabilities, calculate risks and determine where risk mitigation efforts are needed. These experts work with the Company's Chief Information Security Officer ("CISO") and alongside product engineering personnel, to review technical risk data that comes from our central risk tracking system, prioritize risk mitigation activities, and manage other risk management processes. We employ a variety of security protections in our digital systems, including access controls and logging, denial of service protection, and automated intrusion-prevention tools. We have an information security training program, including an annual program of general security awareness for all employees and developer training throughout the year. We maintain an information security risk insurance policy.


text: Our CISO is an experienced cybersecurity executive with more than 20 years of experience building and leading cybersecurity, risk management, and information technology teams. Our CISO holds industry-recognized cybersecurity certifications, including having held Certified Information Systems Security Professional (CISSP) certification.


text: As part of our product development activities, we have implemented the Trimble Secure Development Life Cycle ("TSDLC"), which uses overlapping security activities and controls to build robust security into the cloud-based products and services we provide, some of which are also deployed across our own IT infrastructure. TSLDC includes vulnerability scanning, intrusion prevention, tracking of security metrics, and code analysis vulnerability tools. Over 100 of our products are certified to ISO/IEC 27001:2013, which addresses secure information, resilience to cyber-attacks, existence of a centrally managed framework, organization-wide protection, responses to evolving security threats, and protection of data.


text: Core information technology systems supporting our business operations are backed up and stored outside of our network infrastructure. Our cloud-based systems, including products we sell, utilize configurations for backup designed to prevent data from being destroyed as a result of a cyber event.


text: Trimble's incident response process is based on widely accepted industry frameworks, such as the cybersecurity framework set forth by the National Institute of Standards and Technology ("NIST"). Our framework includes steps to: identify threat actors, contain the affected infrastructure, eradicate threat actor access, recover affected data or systems, and study lessons learned to help ensure any root causes are mitigated outside of the affected area.


text: Each year, our team of cybersecurity specialists builds a strategic vision of shared outcomes which provides the basis for how cybersecurity risks are factored into the Company's risk management initiatives. Along with the rest of the Company, the cybersecurity team, led by the CISO, sets goals for cybersecurity risk management that are then periodically tracked and reported back to the cybersecurity team and to our CEO and Audit Committee.


text: We utilize a set of third parties for technical and non-technical evaluation of our security posture, including regular assessment of our products for vulnerabilities. We also perform an annual external "red team" assessment that provides an attack simulation for our security operations team to identify and triage. We perform a vendor security assessment process for purchases over a certain minimum threshold.


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and the Company is not aware of a basis to believe that such risks are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition. For additional information, see Item 1A. Risk Factors—Our internal and customer-facing systems, and systems of third parties we rely upon, may be subject to cybersecurity breaches, disruptions, or delays.


text: The Board has overall responsibility for the oversight of risk management for the Company, and it exercises this oversight through Board committees and regular engagement with the Company's senior management. The Audit Committee is responsible for oversight of cybersecurity risk exposure and mitigation, and receives regular updates on cybersecurity risk management as well as timely notice of any material cybersecurity developments from the CISO through our escalation processes. The CISO presents quarterly or as needed at the Audit Committee meetings on the Company's cybersecurity risk management activities.


text: We have a dedicated team that is led by the CISO, who has a technical degree in computer science from an accredited public university and has over 20 years of information technology and cybersecurity experience in multiple industries, including financial services and defense. The team comprises security engineers, detection specialists, and business cybersecurity experts. When the team identifies credible risks, we invoke our incident response process to track and manage the details, quickly manage exposures, assess potential customer impact, and facilitate consistent reporting to our CEO and to our Audit Committee.


text: Each Trimble business has identified a dedicated expert to assess vulnerabilities, calculate risks, and determine where risk mitigation efforts are needed. These experts work with the Company's Chief Information Security Officer ("CISO") and alongside product engineering personnel, to review technical risk data that comes from our central risk tracking system, prioritize risk mitigation activities, and manage other risk management processes. We employ a variety of security protections in our digital systems, including access controls and logging, denial of service protection, and automated intrusion-prevention tools. We have a cybersecurity awareness program which covers topics such as phishing, social networking safety, password security, and mobile device usage. We have an information security training program, including an annual program of general security awareness for all employees and developer training throughout the year. We also conduct regular phishing simulations, with follow-up training as needed, for employees and contractors. We maintain an information security risk insurance policy.


text: Risk Management and Strategy The Company is dedicated to upholding strong cybersecurity measures to protect its operations, data, and stakeholders' interests. By keeping a close eye on the cybersecurity landscape, the Company is able to adjust its strategies and governance practices to minimize risks in this rapidly changing area.

companyName: SCHOLASTIC CORP

ticker: SCHL


text: We implement controls and procedures designed to measure and mitigate risk with third-party vendors and business partners who have access to sensitive information, including conducting a security risk assessment. Identified security risks are remediated or documented, and in some cases, the business relationship may be ended or not pursued. We also perform a vendor security assessment process for purchases over a certain minimum threshold.


text: Trimble's incident response process is based on widely accepted industry frameworks, such as the cybersecurity framework set forth by the National Institute of Standards and Technology ("NIST"). Our framework includes steps to identify threat actors, contain the affected infrastructure, eradicate threat actor access, recover affected data or systems, and study lessons learned to help ensure any root causes are mitigated outside of the affected area.


text: Each year, our team of cybersecurity specialists builds a strategic vision of shared outcomes, which provides the basis for how cybersecurity risks are factored into the Company's risk management initiatives. Along with the rest of the Company, the cybersecurity team, led by the CISO, sets goals for cybersecurity risk management that are then periodically tracked and reported back to the cybersecurity team and to our CEO and Audit Committee.


text: We utilize a set of third parties for technical and non-technical evaluation of our security posture, including regular assessment of our products for vulnerabilities. We also perform an annual external "red team" assessment that provides an attack simulation for our security operations team to identify and triage.


text: We have a dedicated team that is led by the CISO, who has a technical degree in computer science from an accredited public university and extensive experience in information technology and cybersecurity across multiple industries, including financial services and defense. The team comprises security engineers, detection specialists, and business cybersecurity experts. When the team identifies credible risks, we invoke our incident response process to track and manage the details, quickly manage exposures, assess potential customer impact, and facilitate consistent reporting to our CEO and to our Audit Committee.


text: Risk Management and Strategy We have implemented a cybersecurity program to assess, identify and manage risk from cybersecurity threats. This program aims to protect the confidentiality, availability and integrity of our information systems from potential threats. Our cybersecurity risk management program includes, among other things, risk assessments designed to identify threats to our critical systems and information services, and a team comprising IT Security, IT Infrastructure and IT Compliance personnel that administer the program with oversight by senior management.

companyName: MATRIX SERVICE CO

ticker: MTRX


text: We have incorporated cybersecurity risk into our extensive risk management framework by aligning it with our overall risk strategy. This involves identifying potential cybersecurity threats, assessing their impact and developing mitigation strategies. These governance processes apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas, ensuring that cybersecurity risks are managed effectively and are in line with the organization's risk tolerance and business objectives. Our cyber risk program leverages internationally recognized standards as appropriate. All employees participate in multiple information security training programs. Employees receive training on how to identify and report cyber risks and events through our cybersecurity awareness program. Additionally, we hold cybersecurity risk insurance.


text: To manage risks associated with third-party service providers, the information security team categorizes suppliers based on factors such as volume and criticality of data handled, potential impact on business operations and level of access to our information systems. We conduct risk assessments to identify potential threats and vulnerabilities associated with each supplier. We screen suppliers to ensure they meet proper security standards and compliance requirements. We monitor all supplier activities to ensure compliance with information security policies and conduct regular reviews and audits of supplier relationships to ensure ongoing compliance. We strive to ensure that our contracts with such vendors require them to maintain security controls in line with industry best practices, applicable laws and our policies. We rely on vendors to alert us promptly of material cybersecurity incidents by virtue of the documents governing their relationship with us or applicable law.


text: Our Board of Directors, with assistance from the IT Steering Committee, oversees cybersecurity. Our Board of Directors receives reports as needed, but no less than biannually, from management on various cybersecurity and IT topics, including trends, data security policies and practices, cybersecurity incidents, current and projected threat assessments, regulatory developments and ongoing efforts to protect, detect and respond to critical threats. Our IT Steering Committee, which is responsible for cybersecurity management oversight, includes members of management such as our Chief Executive Officer, our Chief Financial Officer, and our Vice President of Information Technology. The IT Steering Committee periodically reviews and confers with management risk issues associated with cybersecurity and policies and controls intended to alleviate those risks.


text: Our IT Security team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards and processes. Team members are afforded opportunities to attend external training, conferences and other events to remain on top of most recent cybersecurity trends. Our team is led by our Director of IT Infrastructure and Security, who brings over 30 years of experience, which includes implementing and verifying the effectiveness of cybersecurity controls in a Defense Industrial Base environment and defining and executing cybersecurity strategy to enable business delivery while simultaneously protecting intellectual property and privacy. Our Director maintains the following internationally recognized certifications: Global Information Assurance Certification ("GIAC") Security Essentials, GIAC Certified Enterprise Defender, GIAC Certified Incident Handler Certification, GIAC Certified Windows Security Administrator, and GIAC Critical Controls Certification. Our Director reports to our Vice President of Information Technology, who receives continuous updates regarding the prevention, detection, mitigation and remediation of cybersecurity incidents. Our Vice President of Information Technology has over 19 years of experience in developing and executing strategic initiatives to drive organizational growth and innovation, with responsibilities for IT governance, technology strategy development, and cybersecurity. In additional to a Masters of Business Administration, our Vice President of Information Technology holds a Certified Information Systems Security Professional certification.


text: Our Vice President of Information Technology meets with our IT Steering Committee on a routine basis. Regular topics for discussion with the IT Steering Committee include cybersecurity initiatives and strategies, cybersecurity events, emerging threats, regulatory requirements and industry standards.


text: We use a combination of technology controls and human oversight to actively monitor and protect our network and systems. In the event of a cybersecurity incident, we have an incident response plan which sets forth a framework for reporting and documenting such incidents by our cybersecurity incident response team. This same framework is designed with the goal of enabling the response team to take actions to monitor, mitigate and remediate such incidents promptly. Cybersecurity incidents are reported to our Vice President of Information Technology, and critical events are reported to our CEO and our Chief Legal Counsel. In the event a cybersecurity incident is determined to be potentially material, the incident is reported in a timely manner to our Board of Directors as part of their cybersecurity oversight.


text: Cybersecurity Risks, Threats and Material Incidents We describe whether and how risks from identified cybersecurity threats, including as a result of any prior cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial conditions under Item 1A. Risk Factors, Risks Related to our Business and Operations, "A failure or outage in our operations systems or cybersecurity attacks on any of our systems, or those of third parties, may adversely affect our financial results."


text: We have incorporated cybersecurity risk into our extensive risk management framework by aligning it with our overall risk strategy. This involves identifying potential cybersecurity threats, assessing their impact and developing mitigation strategies. These governance processes apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas, ensuring that cybersecurity risks are managed effectively and are in line with the organization's risk tolerance and business objectives.


text: Our security program generally incorporates the guidelines of the widely utilized National Institute of Standards and Technology Cybersecurity Framework, though this does not imply we meet any particular technical standards, specifications or requirements. As part of our enterprise-wide risk management strategy and commitment to continuous improvement, we are actively pursuing ISO/IEC 27001 certification, the internationally recognized standard for information security management systems. We have initiated the formal implementation process, including a comprehensive gap assessment and roadmap development. Progress toward certification is regularly reviewed by the IT Steering Committee and reported to the Board of Directors.


text: All employees participate in multiple information security training programs. Employees receive training on how to identify and report cyber risks and events through our cybersecurity awareness program. Additionally, we hold cybersecurity risk insurance.


text: We also engage external experts to evaluate our cybersecurity programs. These evaluations include regular audits, threat assessments, simulated attacks, vulnerability scans and advice on information security practices. We routinely conduct incident response exercises with key stakeholders.


text: Our IT Security team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards and processes. Team members are afforded opportunities to attend external training, conferences and other events to remain on top of most recent cybersecurity trends. Our team is led by our Director of IT Infrastructure and Security, who brings over 30 years of experience, which includes implementing and verifying the effectiveness of cybersecurity controls in a Defense Industrial Base environment and defining and executing cybersecurity strategy to enable business delivery while simultaneously protecting intellectual property and privacy. Our Director maintains the following internationally recognized certifications: Global Information Assurance Certification ("GIAC"), GIAC Certified Enterprise Defender, GIAC Certified Incident Handler Certification, GIAC Certified Windows Security Administrator, and GIAC Critical Controls Certification. Our Director reports to our Vice President of Information Technology, who receives continuous updates regarding the prevention, detection, mitigation and remediation of cybersecurity incidents. Our Vice President of Information Technology has over 20 years of experience in developing and executing strategic initiatives to drive organizational growth and innovation, with responsibilities for IT governance, technology strategy development, and cybersecurity. In additional to a Masters of Business Administration, our Vice President of Information Technology holds a Certified Information Systems Security Professional certification.


text: Risk Management and Strategy Our cybersecurity risk management program is intended to protect the confidentiality, integrity, and availability of our critical information technology ("IT") systems and information. Our program is integrated into, and among the risks evaluated and considered by, our broader enterprise risk management program, which is designed to identify, assess, prioritize and mitigate risks across the organization to enhance our resilience and support the achievement of our strategic objectives. We designed and assess our cybersecurity risk management program based on multiple cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, as well as information security standards issued by the International Organization for Standardization, including ISO 27001, which we use as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our global information security management program is ISO 27001:2013 certified.


text: Our cybersecurity risk management program is led by our Chief Information Security Officer ("CISO"), who manages our security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents. Our program includes protocols for preventing, detecting and responding to cybersecurity incidents, and cross-functional coordination and governance of business continuity and disaster recovery plans. Components of our program include: • risk assessments designed to help identify cybersecurity threats to our critical IT systems, information, and our broader enterprise IT environment; • the periodic engagement of independent security firms and other third-party experts, where appropriate, to assess, test, and certify components of our cybersecurity program, and to otherwise assist with aspects of our cybersecurity processes and controls; • annual cybersecurity awareness training for our employees; • regular assessments of the design and operational effectiveness of the program's key processes and controls by our internal audit team as well as external consultants; and • a risk management process for third-party service providers and vendors that includes due diligence in the selection process and periodic monitoring regarding adherence to applicable cybersecurity standards.


text: We also have a cybersecurity incident response plan to assess and manage cybersecurity incidents, which includes escalation procedures based on the nature and severity of the incident including, where appropriate, escalation to the Audit Committee and the Board. We periodically (at least annually) perform tabletop exercises to test our incident response procedures, identify gaps and improvement opportunities and exercise team preparedness.


text: As part of our overall risk mitigation strategy, we maintain insurance coverage that is intended to address certain aspects of cybersecurity risks; however, such insurance may not be sufficient in type or amount to cover us against claims related to cybersecurity breaches, cyberattacks and other related breaches.


text: As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information on our cybersecurity related risks, see Item IA,, "Risk Factors - "A breach of our IT or physical security systems, or violation of data privacy laws, may cause us to incur significant legal and financial exposure and adversely affect our operations."


text: The Audit Committee of our Board of Directors has primary responsibility for overseeing our cybersecurity risks and other information technology risks, including our plans to mitigate cybersecurity risks and to respond to data breaches.


text: The Audit Committee receives regular reports (at least quarterly) from our CISO and our Chief Information Officer ("CIO") on cybersecurity matters. These reports include a range of topics, including our cybersecurity risk profile, the current cybersecurity and emerging threat landscape, the status of ongoing cybersecurity initiatives, incident reports, and the results of internal and external assessments of our information systems. The Audit Committee also annually reviews the adequacy and effectiveness of our information and technology security policies and the internal controls regarding information and technology security and cybersecurity, and periodically receives updates from our internal audit function on the results of our cybersecurity audits and related mitigation activities. The Chair of the Audit Committee reports to the full Board on these discussions as appropriate.


text: The full Board also receives briefings from our CISO and CIO on cybersecurity matters twice annually. In addition, Board members periodically receive presentations on cybersecurity matters from external experts as part of the Board's continuing education and overall risk oversight.


text: At the management level, our CISO leads our enterprise-wide cybersecurity program, and is responsible for assessing and managing our materials risks from cybersecurity threats. In performing his role, our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through the management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. Our CISO reports to our CIO who, in turn, reports directly to our CEO.


text: Risk Management and Strategy Our cybersecurity risk management program is intended to protect the confidentiality, integrity, and availability of our critical information technology ("IT") systems and information. Our program is integrated into, and among the risks evaluated and considered by, our broader enterprise risk management program, which is designed to identify, assess, prioritize and mitigate risks across the organization to enhance our resilience and support the achievement of our strategic objectives. We designed and assess our cybersecurity risk management program based on multiple cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, as well as information security standards issued by the International Organization for Standardization, including ISO 27001, which we use as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our global information security management program is ISO 27001:2022 certified.


text: The Audit Committee receives regular reports (at least quarterly) from our CISO on cybersecurity matters. These reports include a range of topics, including our cybersecurity risk profile, the current cybersecurity and emerging threat landscape, the status of ongoing cybersecurity initiatives, incident reports, and the results of internal and external assessments of our information systems. The Audit Committee also annually reviews the adequacy and effectiveness of our information and technology security policies and the internal controls regarding information and technology security and cybersecurity, and periodically receives updates from our internal audit function on the results of our cybersecurity audits and related mitigation activities. The Chair of the Audit Committee reports to the full Board on these discussions as appropriate.


text: The full Board also receives briefings from our CISO on cybersecurity matters annually. In addition, Board members periodically receive presentations on cybersecurity matters from external experts as part of the Board's continuing education and overall risk oversight.


text: At the management level, our CISO leads our enterprise-wide cybersecurity program, and is responsible for assessing and managing our material risks from cybersecurity threats. In performing his role, our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through the management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. Our CISO reports to our Interim Chief Information Officer who, in turn, reports to our Chief Operating Officer and member of our executive leadership team.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.

companyName: ProPhase Labs, Inc.

ticker: PRPH


text: The Company has embraced the NIST-CSF as a blueprint for its cybersecurity program since 2018. This framework's key domains guide the establishment and continuous improvement of processes to identify, assess, and manage cyber risks and threats. The Company's controls are routinely monitored by its Security Operations Center. Its cybersecurity program, security posture, incident response, and security awareness training are tested by an external party to evaluate their effectiveness and maturity rating.


text: The Company maintains a comprehensive cybersecurity risk management program designed to identify, assess, manage, and mitigate cybersecurity risks. This program provides a framework for addressing threats and incidents, including those associated with third-party service providers. To secure its technology environment, the Company leverages the latest software and security capabilities, employing a defense-in-depth and layered strategy. This includes deploying next-gen endpoint detection and response, network anomaly detection, and multi-factor authentication across most of its environment. Additionally, the Company engages with third-party consultants and utilizes threat intelligence services to assist in its oversight and risk identification efforts. Furthermore, all employees and consultants with access to the Company's information systems are required to complete annual data protection and cybersecurity training, as well as ongoing phishing simulation exercises, as part of a broader training. Based on the information known as of the date of this Annual Report on Form 10-K, the Company does not believe that any cybersecurity incident experienced has materially affected or is reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional information about cybersecurity risks, see Item 1A. "Risk Factors."


text: The Board of Directors is responsible for the overall oversight of the Company's enterprise risk management. The Board of Directors receives regular updates on the key risks to the organization on a quarterly basis. The Board of Directors has delegated oversight of cybersecurity risks to the Technology, Data and Supply Chain Committee. The Technology, Data and Supply Chain Committee receives quarterly cybersecurity updates from the Company's Chief Information Officer (CIO) and Chief Information Security Officer (CISO), which include updates on the Company's cybersecurity policies and strategies, cyber risk posture, improvements and threats, the status of projects designed to continuously improve the Company's information security systems, assessments of the Company's security program, employee training and awareness programs, emerging threat landscape and engagement with external cybersecurity experts and advisors, as needed.


text: Management's Role Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Risk mitigation strategies and key performance indicators are defined, and tracked, as part of the quarterly internal reporting. The Information Security & Compliance team consists of subject matter experts in the field on Information Security, Risk Management, Compliance and Data Protection. The Information Security & Compliance team monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures, and regularly report to the CISO. The CISO is part of the senior management team and regularly updates the Technology and Data Management Committee on the Company's cybersecurity program, including cybersecurity risks, incidents, and mitigation strategies.


text: The Information Security & Compliance team is led by the Executive Director, Information Security and Compliance, who has 27 years of experience in IT and Security, including business risk management and cybersecurity, and reports to the Chief Information Security Officer (CISO), who has over 26 years in information technology and security roles. The Information Security & Compliance team has established processes and procedures that guide and enable continuous monitoring, detection, prevention, mitigation, and remediation of cybersecurity incidents. These processes are carried out using various security platforms tools, capabilities and strategies including tests of the Company's information security program, tabletop exercises, penetration and vulnerability testing, disaster recovery (DR) simulations, and other exercises to evaluate the effectiveness of the information security program and improve the security measures and planning. The Incident Response team utilizes procedures that identify escalation paths when security events are identified. Incident priorities dictate the escalation of events and how an Incident manager reports them, to the executive leadership team within the Company, and the Board of Directors.


text: Cybersecurity risks remain a persistent challenge, as the threat landscape continues to evolve alongside technological advancements. While diligent efforts are made, complete risk elimination or incident assurances are not feasible.


text: Risk Management and Strategy The Company is dedicated to upholding strong cybersecurity measures to protect its operations, data, and stakeholders' interests. By keeping a close eye on the cybersecurity landscape, the Company is able to adjust its strategies and governance practices to minimize risks in this rapidly changing area.


text: The Board of Directors is responsible for the overall oversight of the Company's enterprise risk management. The Board of Directors has delegated oversight of cybersecurity risks to the Technology, Data and Supply Chain Committee. The Technology, Data and Supply Chain Committee receives quarterly cybersecurity updates from the Company's Chief Information Officer (CIO) and Chief Information Security Officer (CISO), which include updates on the Company's cybersecurity policies and strategies, cyber risk posture, improvements and threats, the status of projects designed to continuously improve the Company's information security systems, assessments of the Company's security program, employee training and awareness programs, emerging threat landscape and engagement with external cybersecurity experts and advisors, as needed.


text: Management's Role Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Risk mitigation strategies and key performance indicators are defined, and tracked, as part of the quarterly internal reporting. The Information Security & Compliance team consists of subject matter experts in the field on Information Security, Risk Management, Compliance and Data Protection. The Information Security & Compliance team monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures, and regularly report to the CISO. The CISO is part of the senior management team and regularly updates the Technology, Data and Supply Chain Committee on the Company's cybersecurity program, including cybersecurity risks, incidents, and mitigation strategies.


text: The Information Security & Compliance team is led by the Executive Director, Information Security and Compliance, who has 27 years of experience in IT and Security, including business risk management and cybersecurity, and reports to the Chief Information Security Officer (CISO), who has over 26 years in information technology and security roles. The Information Security & Compliance team has established processes and procedures that guide and enable continuous monitoring, detection, prevention, mitigation, and remediation of cybersecurity incidents. These processes are carried out using various security platforms tools, capabilities and strategies including tests of the Company's information security program, tabletop exercises, penetration and vulnerability testing, disaster recovery (DR) simulations, and other exercises to evaluate the effectiveness of the information security program and improve the security measures and planning. The Incident Response team utilizes procedures that identify escalation paths when security events are identified. Incident priorities dictate the escalation of events and how an Incident manager reports them to the executive leadership team within the Company and to the Board of Directors.


text: RISK MANAGEMENT AND STRATEGY Our cybersecurity program is designed to monitor, detect, prevent and respond to cyber threats. We take a multi-faceted approach to identifying and mitigating information security risks. This includes but is not limited to penetration tests of our external network, the utilization of third-party scanning tools to monitor our network, maintenance of software and implementing applicable updates timely, training employees to recognize security risks and encouraging employees to report suspicious activity. Annual cybersecurity awareness training is provided to onshore and offshore users. The training seeks to demonstrate to users the risks in using technology and how to effectively defend against cyber threats.

companyName: HELIX ENERGY SOLUTIONS GROUP INC

ticker: HLX


text: We assess, identify and manage material risks from cybersecurity threats and vulnerabilities according to our Cybersecurity Incident Response Plan (the "IRP"). The IRP uses the six-stage model of the National Institute of Standards and Technology Cybersecurity Framework (Preparation, Detection, Containment, Investigation, Remediation, and Recovery) to outline steps for reporting, responding, and mitigating various aspects of a cybersecurity incident. Execution of the IRP's incident response activities are coordinated by the Cybersecurity Incident Response Team, and communications planning via the Helix Crisis Assistance Team and the Cybersecurity Incident Communication Group. There are also separate processes in place for the effective management of cyber incidents involving our offshore assets and certain regional business units.


text: We engage external parties to aid in processing and managing cybersecurity incidents as needed, including utilization of the services and expertise of local law enforcement and government entities, partnering financial institutions, a third-party security operations center ("SOC"), and managed service providers. In addition, we collaborate with our internal auditors to ensure our processes are documented and followed appropriately.


text: In connection with our external SOC and managed service providers, we have implemented change control measures that allow for the continual oversight and assessment of the services provided and threats identified. Notifications and remediation of cyber threats are tracked, reviewed, and archived. Processes implemented and lessons learned involving these third parties are evaluated after each incident to ensure efficiency and replication.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We have experienced, and may continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Risk Factors – General Risks – Cybersecurity breaches or business system disruptions may adversely affect our business."


text: Risks relating to cybersecurity are overseen by the Audit Committee. Certain members of our management, including the Executive Vice President and Chief Financial Officer (the "CFO"), the Chief Accounting Officer and Corporate Controller (the "CAO") and the Vice President of Internal Audit, report to the Audit Committee regarding cybersecurity risks. IT management presents an annual update of cybersecurity related activities to the Audit Committee. Interim updates are provided to the Audit Committee by the CFO on an as needed basis should an incident warrant immediate notification or escalation.


text: Within Helix's IT department, several IT management positions are responsible for assessing and managing cybersecurity risk, including the Chief Information Officer, Director of Information Technology and Manager of Information Technology. Each of the IT department's management personnel has over 20 years of IT experience. The Director of Information Technology and the Manager of Information Technology positions are tasked with the daily and per incident assessment and management of cybersecurity risks, while the Chief Information Officer is tasked with oversight.


text: Helix's IT department keeps management involved and informed throughout the entire process of any cybersecurity incident from initial monitoring and discovery through the remediation and restoration, all in accordance with the processes outlined in our IRP. Initial notification regarding a cybersecurity incident may come through our third-party SOC or managed service providers, or from employees reporting internally to our IT helpdesk. Investigations are then performed to determine the appropriate actions per the IRP guidelines. Incidents that warrant further escalation are promptly shared with the CFO and continually updated, as appropriate, until remediation and restoration is achieved.


text: Helix's IT department holds regular quarterly meetings with the CFO, CAO, and Vice President of Internal Audit to recap cybersecurity risks and incidents and to determine any actions required as a result.


text: Risk management and strategy Cybersecurity is an integral part of risk management at the Company. Our Board and management appreciate the evolving nature of threats presented by cybersecurity incidents and is committed to the prevention, timely detection, and mitigation of the effect any such incidents may have on the Company.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an IT consultant who reports to our Chief Operating Officer, to manage the risk assessment and mitigation process.


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight through the audit committee.


text: Our Chief Information Officer and Chief Operating Officer are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.


text: Our Chief Information Officer and Chief Operating Officer oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.