text: The Company's Information Security team monitors information security risks that target both technology and manufacturing environments and identifies potential risks to Simpson's information security posture. Any identified risks are prioritized in terms of impact to Simpson's information security posture and, if critical, addressed immediately or added to Simpson's information security roadmap. To supplement our internal cybersecurity resources, we also engage external third parties to perform information security assessments, penetration tests and related services to enhance our information security program.


text: Risks from Cybersecurity Threats Despite our security measures, our information technology and infrastructure may remain vulnerable to disruptions, including as a result of attacks by increasingly sophisticated intruders or others who attempt to cause harm to, or otherwise interfere with the normal use of our systems. We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past that have resulted in unauthorized persons gaining access to our information systems and computer networks, and we could in the future experience similar attacks. When we do experience cybersecurity incidents like these and the one we disclosed in October 2023, we aim to utilize that experience to inform and strengthen our cybersecurity management efforts. In response to the October 2023 incident, we increased our phishing awareness training and testing, deployed a cybersecurity tool that continuously monitors and verifies the security posture of individual devices within our network, and deployed technology that provides visibility into our sensitive data across different cloud environments, allowing the identification of potential vulnerabilities and take proactive measures to protect data from unauthorized access, misuse, or theft.

companyName: Simpson Manufacturing Co., Inc.

ticker: SSD

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: majority


text: We do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incident, have materially affected or are reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats we face, see the section captioned "Risks Relating to Our Intellectual Property and Information Technology" under Part I, Item 1A "Risk Factors" above.


text: Board and Committee Oversight Although our full Board of Directors is ultimately responsible for risk oversight, our Board is assisted in discharging its risk oversight responsibility by its committees. The Audit and Finance Committee of the Board is responsible for providing oversight of our information security program and cybersecurity risks. In connection with this oversight role, the Audit and Finance Committee receives information technology updates from management at least quarterly. Cybersecurity risks facing the Company and updates on the Company's practices and progress to mitigate such risks are also the subject of management reports to the Audit and Finance Committee on a more frequent basis, as necessary or appropriate.


text: Management's Role in Assessing and Managing Risk The Company's information security efforts are led by our Executive Vice President, Chief Technology Officer ("CTO") and our Director of Information Security ("IT Director"), supported by our executive management team. These efforts are designed to address information security governance and risk, product security, identification and protection of critical assets, third-party risk, security awareness, cyber defense operations, artificial intelligence and data protection governance, and related risk management matters. Our CTO and IT Director have an average of over 25 years of prior work experience in various roles involving information technology, including security, auditing compliance, systems and programming. These individuals have relevant educational and industry experience, including holding similar positions at other large companies.

stage1Category: Management Role


text: Our CTO provides relevant cybersecurity and information technology reports to the Audit and Finance Committee, and to the executive and senior leadership teams. These reports are provided at quarterly Audit and Finance Committee meetings and at our Digital Quarterly Business Review ("Digital QBR") meetings. These reports typically include analyses of recent significant cybersecurity threats and incidents at the Company and across the industry, as well as a review of our security controls, assessments and program maturity, top risks, risk mitigation status, and a review of our third-party service providers as appropriate. Simpson's information security roadmap and posture are also reviewed quarterly with members of the executive leadership team and the Audit and Finance Committee. In accordance with our information security program, any information security event is assessed and reviewed by our Digital Leadership team and members of the executive leadership team.


text: Through the Digital QBR process, the executive leadership team is responsible for assessing and reviewing our information security program and the Company's material risks from cybersecurity threats. Additional supervision and management is provided by our Digital Leadership team, comprised of our CTO; VP, Digital Infrastructure and Operations; VP, Digital Enterprise Applications; and International IT Director.

stage1Method: unanimous


text: Risk Management and Governance Cybersecurity is a material part of Unity Bank's business. As a technology forward financial institution offering products through multiple digital delivery channels, cybersecurity incidents could have a material effect on the Company, its results of operations and its reputation. To date, the Company has not experienced any cybersecurity incident which has had a material effect on the Company's business strategy, results of operations or financial condition. See "Item 1A- Risk Factors – The Company cannot predict how changes in technology will impact its business"; as increased use of technology may expose us to service interruptions or breaches in security.

companyName: UNITY BANCORP INC /NJ/

ticker: UNTY

stage1Category: Strategy Integration


text: Cybersecurity risk is initially overseen by the management Information Technology Steering Committee (the "ITSC"). The members of this committee include the Company's Chief Technology Officer, Chief Compliance Officer (who is also the Information Security Officer), Chief Executive Officer, Chief Financial officer and other critical executive management members. The ITSC also includes a non-voting member that is an outsourced cybersecurity expert. The ITSC includes multiple members, including the Chief Technology Officer and an outsourced consultant, who serves as the Company's Virtual Information Security Officer.


text: Over his 16-year career, the Company's Chief Technology Officer has served in multiple Information Technology and Cybersecurity roles, such as Senior Engineer, responsible for implementing hardened infrastructure for both physical and cloud applications; Solutions Architect, designing infrastructures for highly regulated industries including Financial Services, Local/State Government and Healthcare; Director of Service Delivery, overseeing engineering, solutions architecture and maintains the System and Organization Controls (SOC) program prior to joining Unity Bank. During his tenure at Unity Bank, he is a member of various Risk and Cybersecurity Committees of the New Jersey Bankers Association, is a member of FS-ISAC, The Independent Community Bankers of America and our primary banking vendors advisory and risk management committees. The Company's Chief Compliance Officer was appointed as the Company's Information Security Officer in 2016.


text: The Virtual Information Security Officer (vISO) has an over 18-year career in Information Technology, Cybersecurity and both Internal/External Audit experience. He presently holds a position of Partner of Herbein, COA Advisor & Audit, where he's held multiple positions within Information Technology and Cybersecurity.


text: The Company's Information Technology Manager has an over 25-year career in Information Technology, during which the prior 13-years have been in Information Technology, Security and Cybersecurity, working primarily in regulated industries.


text: In order to ensure that cybersecurity risk management is integrated into the Company's overall risk management plans, systems and processes, the ITSC and Chief Technology Officer provide reports and updates to the Board of Directors, or a Committee thereof on a quarterly basis.


text: The Company's cybersecurity risk mitigation program involves a combination of internal resources and the use of third parties. The Company's internal IT team performs monthly vulnerability scanning and performs an annual risk assessment based on the National Institute of Standards and Technology Cybersecurity Framework. The results are reported to the ITSC. The Company's IT and compliance staff also review potential cybersecurity threats associated with the Company's third party vendors, including performing a review of and obtaining a System of Organization Controls report from all vendors rated as "high risk" by the Company's internal vendor management program. The Company also has an internal Incident Response Plan and Team, which is charged with overseeing the Company's response to any cybersecurity incident. The team performs a table top exercise at least annually to prepare to respond in the event of any actual cybersecurity incident. In addition to these internal resources, the Company uses a third party vendor to complete annual penetration and vulnerability testing, with the results reported to the ITSC. Finally, the Company's cybersecurity compliance program is audited by the Bank's outsourced internal auditor.


text: The Company also maintains insurance which may provide coverage for expenses and certain losses incurred in connection with a cybersecurity incident.


text: Risk Management and Governance Cybersecurity is a material part of Unity Bank's business. As a technology forward financial institution offering products through multiple digital delivery channels, cybersecurity incidents could have a material effect on the Company, its results of operations and its reputation. To date, the Company has not experienced any cybersecurity incident which has had a material effect on the Company's business strategy, results of operations or financial condition, although increased use of technology will expose us to greater risk of breaches in security and or service disruptions.


text: Cybersecurity risk is initially overseen by the management Information Technology Steering Committee (the "ITSC"). The members of this committee include the Company's Chief Information Officer, Chief Compliance Officer (who is also the Information Security Officer), Chief Executive Officer, Chief Financial officer and other critical executive management members. The ITSC also includes a non-voting member that is an outsourced cybersecurity expert.


text: Over his 17-year career, the Company's Chief Information Officer has served in multiple Information Technology and Cybersecurity roles, such as Senior Engineer, responsible for implementing hardened infrastructure for both physical and cloud applications; Solutions Architect, designing infrastructures for highly regulated industries including Financial Services, Local/State Government and Healthcare; Director of Service Delivery, overseeing engineering, solutions architecture and maintaining the System and Organization Controls (SOC) program prior to joining Unity Bank. During his tenure at Unity Bank, he is a member of various Risk and Cybersecurity Committees of the New Jersey Bankers Association, is a member of FS-ISAC, The Independent Community Bankers of America and our primary banking vendors advisory and risk management committees. The Company's Chief Compliance Officer was appointed as the Company's Information Security Officer in 2016.


text: The Virtual Information Security Officer (vISO), an outsourced consultant, has an over 19-year career in Information Technology, Cybersecurity and both Internal/External Audit experience. He presently holds a position of Partner of Herbein, COA Advisor & Audit, where he's held multiple positions within Information Technology and Cybersecurity.


text: The Company's Information Technology Manager has an over 26-year career in Information Technology, the prior 13-years of which have been in Information Technology, Security and Cybersecurity, working primarily in regulated industries.


text: Cybersecurity Incident Response Planning The Company has established a comprehensive cybersecurity incident response plan to ensure the swift and effective handling of any potential security breaches. This plan includes detailed procedures for identifying, assessing, and mitigating cybersecurity threats, as well as protocols for communication and coordination with relevant stakeholders. Regular training and simulations are conducted to keep the Company's response team prepared for various scenarios, ensuring minimal disruption to its operations and safeguarding the Company's customers' data.


text: The Company has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of its critical systems and information. The Company's cybersecurity risk management program employs several different measures, including perimeter monitoring, endpoint monitoring and user management, designed to assess and identify cybersecurity risks. The Company's technology management team is principally responsible for managing the Company's cybersecurity risk assessment and management processes. The Company's technology management team performs enterprise-level risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment. The Company's technology management team and third-party professionals perform penetration tests, vulnerability scans, and patch management to assess and protect the confidentiality, integrity and availability of its critical systems and information. The Company provides training to its employees on cybersecurity matters, performs periodic awareness testing to facilitate compliance with the Company's cybersecurity policies, and maintains a method for its employees and consultants to communicate any suspected cybersecurity incident. In addition, the Company evaluates key third-party service providers before the Company grants the service provider access to its information systems and has a process in place to ensure that future access is appropriate.

companyName: ESSEX PORTFOLIO LP


text: The Company has an established incident response plan for responding to cybersecurity incidents. The goal of the incident response plan is to detect and react to cybersecurity incidents, evaluate the scope and risk, respond appropriately, communicate effectively to all stakeholders, and ultimately reduce the likelihood of an incident recurrence. The Company's incident response team consists of seasoned information technology, legal and financial reporting Company personnel. The incident response plan, members of the incident response team and the steps to respond to a security incident are evaluated for appropriateness and effectiveness, and key personnel from cross-functional departments are involved.


text: The Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of enterprise level risks, including any cybersecurity-related risks faced by the Company. At least quarterly, the Audit Committee reviews cyber risks and mitigation strategies with senior management. The Audit Committee reports to the full Board regarding its activities, including those relating to cybersecurity. Additionally, on an annual basis, the Chief Technology Officer ("CTO") presents to the Audit Committee on any material updates to the cybersecurity program, such as process improvements, new initiatives and key vendor performance. Material cybersecurity events, if any, are escalated to the Board on an ongoing basis. The Board is also briefed annually on all major enterprise risks, including cybersecurity risks.

stage1Category: Board Governance


text: The Company's management team, including the CTO, is responsible for assessing and managing the Company's material risks from cybersecurity threats. The CTO leads the technology management team and has extensive cybersecurity knowledge and expertise developed through a career of serving in various roles in information technology for over 20 years. The CTO oversees the Company's initiatives to address existing or evolving cyber risks and is a member of the Enterprise Risk Committee. The CTO reports to the Chief Executive Officer ("CEO") and provides updates to the Company's senior leadership team on a regular basis, at least quarterly, about risks from cybersecurity threats, the results of penetration tests, vulnerability scans and userbase issues.


text: The Company may use third-party programs and software and engage assessors, consultants, cybersecurity auditors, or other third parties to review, test, and advise on improvements to the Company's cybersecurity infrastructure.

companyName: IMAX CORP

ticker: IMAX


text: Over the past fiscal year, the Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its operations, business strategy, results of operations or financial condition. See "Risk Factors – We are subject to laws and regulations relating to the handling of personal information and we rely on information technology to sustain our operations. Any failure by us to comply with applicable requirements or material failure, inadequacy, interruption or breach of the Company's privacy or information systems, or those of our vendors or other third parties, could materially adversely affect the Company's business, results of operations and financial condition".


text: The Company has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of its critical systems and information. The Company's cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational and financial risk areas.


text: The Company's cybersecurity risk management program employs several different measures, including perimeter monitoring, endpoint monitoring and user management, designed to assess and identify cybersecurity risks. The Company's technology management team is principally responsible for managing the Company's cybersecurity risk assessment and management processes. The Company's technology management team performs enterprise-level risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment. The Company's technology management team and third-party professionals perform penetration tests, vulnerability scans, and patch management to assess and protect the confidentiality, integrity and availability of its critical systems and information. The Company provides training to its employees on cybersecurity matters, performs periodic awareness testing to facilitate compliance with the Company's cybersecurity policies, and maintains a method for its employees and consultants to communicate any suspected cybersecurity incident. In addition, the Company evaluates key third-party service providers before the Company grants the service provider access to its information systems and has a process in place to ensure that future access is appropriate.


text: The Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of enterprise level risks, including any cybersecurity-related risks faced by the Company. At least quarterly, the Audit Committee reviews cyber risks and mitigation strategies with senior management. The Audit Committee periodically reports to the full Board regarding its activities, including those relating to cybersecurity. Additionally, on an annual basis, the Chief Technology Officer ("CTO") presents to the Audit Committee on any material updates to the cybersecurity program, such as process improvements, new initiatives and key vendor performance. Material cybersecurity events, if any, are escalated to the Board on an ongoing basis. The Board is also briefed annually on all major enterprise risks, including cybersecurity risks.


text: The Company's management team, including the CTO, is responsible for assessing and managing the Company's material risks from cybersecurity threats. The CTO leads the technology management team and has extensive cybersecurity knowledge and expertise developed through a career of serving in various roles in information technology for over 20 years. The CTO oversees the Company's initiatives to address existing or evolving cyber risks and is a member of the Enterprise Risk Committee. The CTO reports to the Chief Executive Officer ("CEO") and provides updates to the Company's senior leadership team on a regular basis, at least quarterly, about risks from cybersecurity threats, the results of penetration tests, vulnerability scans and userbase issues. The CTO and other members of the Company's management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, such as briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged; and alerts and reports produced by security tools deployed in our IT environment.


text: Over the past fiscal year, the Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its operations, business strategy, results of operations or financial condition. See the discussion under the caption, "Risks Related to Our Real Estate Investments and Operations - We are subject to laws and regulations relating to the handling of personal information and we rely on information technology to sustain our operations. Any material failure, inadequacy, interruption or breach of the Company's privacy or information systems, or those of our vendors or other third parties, could materially adversely affect the Company's business, financial condition and results of operations. " in Item 1A, Risk Factors of this Form 10-K for further information.


text: We face risks associated with security breaches through cyber attacks, cyber intrusions or otherwise, and other significant disruptions of information technology networks and related systems. See also "Item 1A. Risk Factors – Risks Related to our Operations – We face risks associated with security breaches through cyber attacks, cyber intrusions, ransomware or otherwise, as well as other significant disruptions of our information technology ("IT") networks and related systems." We have never experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. With the assistance of a third party technology consulting firm, we have adopted and implemented an approach to identify and mitigate cybersecurity risks. For example, we are in the process of adopting and implementing many of the voluntary practices recommended under the National Institute of Standards and Technology cybersecurity framework, which we believe is a best practice for U.S.-based real estate companies.

companyName: HIGHWOODS PROPERTIES, INC.

ticker: HIW


text: Management's information technology steering committee, which is led by the chief information officer and includes all of our executive officers, is responsible for assessing and managing material risks from cybersecurity threats from our own information technology networks and systems we use that are owned by third party service providers. Ryan Hunt has served as our chief information officer since June 2021. Mr. Hunt joined us in 1997 and quickly transitioned his focus to technology. He began his technology career on the IT help desk, served in various other roles within the technology department and most recently served in the role of senior director of application development. Mr. Hunt earned his Bachelor of Science degree in Management Information Systems from North Carolina State University.


text: Under the direction of our chief information officer with oversight from management's steering committee, the Company has implemented a cybersecurity incident response plan that sets forth a process for detecting and responding to cybersecurity incidents, determining their scope and risk, developing an appropriate response to mitigate and remediate the incident, communicating effectively to all stakeholders and participants and reducing the likelihood of similar future incidents. In the event of a real or perceived cybersecurity incident, the chief information officer would, as soon as practicable, inform management's steering committee, the members of which would then collaborate with the chief information officer to manage material risks.


text: As part of our overall enterprise risk management processes and to better evaluate our cybersecurity risks, we have conducted a business impact analysis by leveraging our annual company-wide enterprise risk management assessment to understand the relationship between our critical business operations and our information technology systems. We partner with a third party service provider to assist us on a real-time basis with detecting advanced threats, streamline and collaborate on investigations and recommend actions to further strengthen our systems and, if and when necessary, respond to incidents. In addition, we regularly engage independent third parties to test our cybersecurity processes and systems through consulting, independent audits and penetration testing. We also have a cyber risk insurance policy designed to help us mitigate risk exposure by offsetting costs involved with recovery and remediation after a cybersecurity breach or similar event.


text: We regularly conduct cybersecurity training to ensure all employees are aware of cybersecurity risks and to enable them to take steps to mitigate such risks. For example, all employees are required to successfully complete a cybersecurity risk module and assessment on a quarterly basis. As part of this program, we also take reasonable steps to ensure any employee who may come into possession of confidential financial or health information has received appropriate cybersecurity awareness training and, if applicable, payment card industry (PCI) training.


text: The audit committee of the Company's Board of Directors is responsible for overseeing management's information technology steering committee as well as management's risk assessment and risk management processes designed to monitor and control cybersecurity threats. Management's steering committee, led by the Company's chief information officer, regularly briefs the audit committee on cybersecurity matters. These briefings generally occur on a quarterly basis. In the event we experience a cybersecurity incident that could materially affect us, including our business strategy, results of operations or financial condition, the Company's chief information officer and other members of management's steering committee (which include executive officers who are also part of our disclosure committee) would review the incident with the audit committee to consider whether and to what extent disclosure is required under Item 1.05 of Form 8-K.


text: We face risks associated with security breaches through cyber attacks, cyber intrusions or otherwise, and other significant disruptions of information technology networks and related systems. See also "Item 1A. Risk Factors – Risks Related to our Operations – We face risks associated with security breaches through cyber attacks, cyber intrusions, ransomware or otherwise, as well as other significant disruptions of our information technology ("IT") networks and related systems." We have never experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. With the assistance of a third party technology consulting firm, we have adopted and implemented an approach to identify and mitigate cybersecurity risks. For example, we have adopted and implemented, or are in the process of adopting and implementing, many of the voluntary practices recommended under the National Institute of Standards and Technology cybersecurity framework 2.0, which we believe is a best practice for U.S.-based real estate companies.


text: The Company is not aware of any cybersecurity threats or incidents to date that have materially affected its strategy, results of operations, or financial condition. However, the scope and impact of any future cybersecurity incident cannot be predicted with certainty. More information on how material cybersecurity attacks may impact the Company's business is provided in "Item 1A. Risk Factors ".


text: CYBERSECURITY RISK MANAGEMENT FRAMEWORK The Company employs a multi-faceted cybersecurity risk management framework, which is integrated into its enterprise risk management system. The Company aligns its security policies and practices with the ISO 27001 framework and manages its cybersecurity risks through a dedicated information security team, reporting to the Head of Information Security. The information security team is tasked with, among other things, assessing, identifying and managing material cybersecurity risks and overseeing the implementation of the Company's cybersecurity strategy. The Company's cybersecurity risk management includes, but is not limited to, the following elements.


text: Risk Identification and Assessment The information security team conducts periodic risk assessments, which includes penetration testing and vulnerability scanning, on the Company's Information Technology ("IT") infrastructure, systems, and networks to identify potential vulnerabilities, weaknesses, and risks, and evaluates the potential impact of cybersecurity risks on the Company's operations, financials, and business.


text: Risk Mitigation Measures The information security team implements and maintains a multi-layered defense approach to safeguard the Company's information technology infrastructure in accordance with industry best practices and updates the Company's systems and software to address identified vulnerabilities. The Company has also developed an incident response and disaster recovery plan to respond to cybersecurity incidents.


text: ROLE OF THE BOARD OF DIRECTORS The Audit Committee oversees the Company's risk management and assessment, including its mitigation strategies, and updates the entire Board on the Company's risk profile and exposures on an as needed basis. With respect to cybersecurity, the Company's Chief Technology Officer ("CTO") and Head of Information Security updates the Audit Committee on at least an annual basis on matters such as external cybersecurity threats and attack trends; updates to threat monitoring processes; the composition of the Company's information security team; cybersecurity awareness training and testing; cybersecurity strategy; cybersecurity metrics, and assessments the progress of cybersecurity programs; and the potential scope and impact of cybersecurity risks and incidents on the Company's operations and financial condition. The Audit Committee may also meet with management on an ad hoc basis to discuss and review any material cybersecurity incidents or threats.


text: Management is responsible for managing risks and informing the Board of the Company's material near- and long-term risks and risk management strategies. Management presents the Company's risk assessment, which includes its cybersecurity risks, to the Audit Committee on at least an annual basis.


text: The CTO leads management's assessment and management of cybersecurity risks. The Company's Head of Information Security leads the information security team, which is responsible for managing day-to-day cybersecurity risks and implementing and maintaining the Company's cybersecurity strategy. The Head of Information Security reports to and regularly briefs the CTO on cybersecurity matters, including results of vulnerability testing and remediation, cyber incident responses, and progress on cybersecurity infrastructure initiatives. The CTO and Head of Information Security update the Audit Committee about cybersecurity risks and any investigation of a material cybersecurity incident.


text: The Company's current CTO has over 20 years of experience in senior technology leadership roles, involving oversight of all aspects of technology development and technical operations, including cybersecurity.


text: The Company's current Head of Information Security has over 20 years of experience in cybersecurity roles, including in cybersecurity engineering, information security assessment, and development and management of corporate security policies and governance problems.


text: Risk Management and Strategy The strength and resilience of the Company's information systems, assets, data, and network infrastructure is critical to its business operations. The Company takes cybersecurity risk seriously and has implemented a cybersecurity risk management program that is integrated in the Company's enterprise risk management system and processes. The enterprise risk management program, which is led by our executive leadership team, includes a process that identifies, assesses, mitigates and manages the risks from both internal and external factors that could significantly impact the Company and influence our business strategy and performance.

companyName: SSR MINING INC.

ticker: SSRM


text: Our cybersecurity risk management program is centered on the following principles: • Risk-based approach to managing controls, cost benefit and control effectiveness; • Defense-in-depth approach with the assumption of breach mindset; • Resiliency to mitigate, manage and recover from incidents or disasters; • Zero-trust architecture with services well secured and networks be untrusted; and • Least privilege identity and access management.


text: The cybersecurity risk management program is designed to provide ongoing detection and monitoring of cybersecurity threats and intrusions. The Company's Information Technology ("IT") department leads the identification of critical applications, systems and data, and possible points of failure and takes a proactive approach to the detection of unauthorized activity, intrusion attempts and compromised equipment. The IT department also carries out automated and ad hoc network-based vulnerability, compromise and business impact assessment and guideline compliance scans of our networks, systems and devices to detect vulnerabilities, compromised hosts and compliance failures. We rely on information technology systems provided by third parties, and our IT department implements procedures that seek to identify cybersecurity risks of these third-party providers to whom we outsource certain of our services or functions, or with whom we interface, store or process company, employee or other confidential information. The Company also provides regular information security training to its employees. The Company engages external consultants and other third parties to provide cybersecurity controls assessment relying on the National Institute of Standards and Technology's Cybersecurity Framework and for other advisory support. The Company will continue to take additional steps designed to further protect its networks, information and operations as needed.


text: The Company's Cybersecurity Committee, which is comprised of cross-functional management team members, is notified following discovery of a potential or actual cybersecurity breach. Subject to the severity of the actual or potential breach, the Company's Executive Committee may also be notified, and an external breach team may be retained, including mitigation experts and external legal counsel. The Cybersecurity Committee will convene to evaluate the materiality of the breach, with input from the external breach team as required. Internal and external legal counsel will determine whether any disclosures are required pursuant to all relevant jurisdictional rules and regulations. The Company's Board of Directors will be notified as necessary.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Unity Biotechnology, Inc.


text: The Company's Vice President of Finance and Technology ("VP FT"), assisted by the Company's Information Technology ("IT") Director and Cyber Security and Architecture Manager ("CSA"), is responsible for leading the team assessing, identifying and managing cybersecurity risks, including implementation of our cybersecurity risk management program and leading day-to-day cybersecurity operations. The VP FT has more than eight years of experience overseeing and managing IT operations, including cybersecurity, within the mining industry and has extensive hands-on, practical experience navigating real-world cyber challenges. The Company's CSA has more than 25 years of IT, cyber security, and cyber auditing experience. The CSA holds both a bachelor's degree and master's degree in IT/Cyber, several certifications in the industry, including the Certified Information Systems Security Professional ("CISSP") and Information Systems Security Architecture Professional ("ISSAP") credentials, Certified Information Systems Auditor ("CISA") certification, Certified in Risk and Information Systems Control ("CRISC") certification, Certified Data Privacy Solutions Engineer ("CDPSE") certification, and other IT technical, cloud, and cyber governance certifications.


text: Longer term cybersecurity risk management strategic planning is addressed by the Company's management Cybersecurity Committee, which is comprised of the VP FT, the CSA and members from various departments within the Company, including Legal, Operations and Internal Audit. The Cybersecurity Committee meets quarterly to review cybersecurity threats and risks, strategic objectives, and progress on the Company's cybersecurity initiatives.


text: The Board recognizes the importance of robust cybersecurity risk management programs and is actively engaged in overseeing and reviewing the Company's cybersecurity risk profile and exposures. The Board has overall responsibility for the oversight of the Company's enterprise risk management, including cybersecurity risks and ensuring the implementation of appropriate controls to manage these risks. The Board receives updates on the Company's ongoing cybersecurity risk management efforts, and updates on the activities of the Cybersecurity Committee at least twice per year, with more frequent updates as needed. The Board has also directed management to inform them promptly of any investigation of a material cybersecurity incident. The Board may, from time to time, engage third party advisors and experts, and meet with the Company's external advisors on cybersecurity matters, as appropriate.


text: The cybersecurity risk management program is designed to provide ongoing detection and monitoring of cybersecurity threats and intrusions. The Company's Information Technology ("IT") department leads the identification of critical applications, systems and data, and possible points of failure and takes a proactive approach to the detection of unauthorized activity, intrusion attempts and compromised equipment. The IT department also carries out automated and ad hoc network-based vulnerability, compromise and business impact assessment and guideline compliance scans of our networks, systems and devices to detect vulnerabilities, compromised hosts and compliance failures. We rely on IT systems provided by third parties, and our IT department implements procedures that seek to identify cybersecurity risks of these third-party providers to whom we outsource certain of our services or functions, or with whom we interface, store or process company, employee or other confidential information. The Company also provides regular information security training to its employees. The Company engages external consultants and other third parties to provide cybersecurity controls assessment relying on the National Institute of Standards and Technology's Cybersecurity Framework and for other advisory support. The Company will continue to take additional steps designed to further protect its networks, information and operations as needed.


text: The Company's Cybersecurity Committee, which is comprised of cross-functional management team members, is notified following discovery of a potential or actual cybersecurity breach. Subject to the severity of the actual or potential breach, the Company's Executive Committee may also be notified, and an external breach team may be retained, including mitigation experts and external legal counsel. The Cybersecurity Committee will convene to evaluate the materiality of the breach, with input from the external breach team as required. Internal and external legal counsel will determine whether any disclosures are required pursuant to all relevant jurisdictional rules and regulations. The Board will be notified as necessary.


text: The Company has not experienced a cybersecurity incident during the year ended December 31, 2024, or prior, that resulted in an interruption of our operations, known losses of critical data or otherwise had a material impact on our strategy, financial condition or results of operations. The Company's Turkish subsidiary, Anagold Madencilik Sanayi ve Ticaret Anonim irketi ("Anagold"), was the target of a minor ransomware attack in November 2022, which did not cause serious disruption to the Company's or Anagold's operations. The scope of any future incident cannot be predicted. See Item 1A. Risk Factors for more information.

stage1Category: Incident Disclosure


text: The Company's Director of Cybersecurity, assisted by the Company's IT department, is responsible for leading the team assessing, identifying and managing cybersecurity risks, including implementation of our cybersecurity risk management program and leading day-to-day cybersecurity operations. The Director of Cybersecurity has more than thirty years of experience overseeing and managing cybersecurity, cyber auditing, and IT operations within the U.S. federal defense, commercial and mining sectors and has extensive hands-on, practical experience navigating real-world cyber challenges. The Director of Cybersecurity holds both a bachelor's degree and master's degree in IT/Cyber, several certifications in the industry, including the Certified Information Systems Security Professional ("CISSP") and Information Systems Security Architecture Professional ("ISSAP") credentials, Certified Information Systems Auditor ("CISA") certification, Certified in Risk and Information Systems Control ("CRISC") certification, Certified Data Privacy Solutions Engineer ("CDPSE") certification, and other IT technical, cloud, and cyber governance certifications.


text: Longer term cybersecurity risk management strategic planning is addressed by the Company's management Cybersecurity Committee, which is comprised of the Director of Cybersecurity and members from various departments within the Company, including Legal, Operations and Internal Audit. The Cybersecurity Committee meets quarterly to review cybersecurity threats and risks, strategic objectives, and progress on the Company's cybersecurity initiatives.


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards, and practices are fully integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by the Company's Board of Directors (the "Board"). The Company's cybersecurity policies, standards, and practices follow recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization, and other applicable industry standards. The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with the specific goals of: (i) identifying, preventing, and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security, and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, clients, and business partners; and (v) providing appropriate public disclosure of cybersecurity risks, and incidents when required.

companyName: PENN Entertainment, Inc.

ticker: PENN


text: Risk Management and Strategy Consistent with overall ERM policies and practices, the Company's cybersecurity program focuses on the following areas: • Vigilance: The Company maintains a global presence, with cybersecurity threat operations functioning 24/7 with the specific goal of identifying, preventing, and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards, and practices. This training includes certain periodic and mandatory training for Company personnel regarding cybersecurity threats as well as the handling and processing of payment cards. All periodic and mandatory training is scaled to reflect the roles, responsibilities and information systems access of applicable personnel. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, accounting, risk management, internal audit, and other key business functions, as well as the members of the Board and the Audit Committee of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. • Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the Company's ERM function, the Company's Chief Information Officer, other members of management, and relevant management committees and councils, including the Company's Cyber Security Committee.


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The Company engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits, and reviews are reported to the Company's Cyber Security Committee, and when appropriate, the Audit Committee, and the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices at least annually, or more frequently as necessary, based on the information provided by the assessments, audits, and reviews.


text: This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Cyngn Inc.

ticker: CYN


text: The Company's Cyber Security Committee, in coordination with the Board and Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes, and practices that the Company's Chief Information Officer and its Vice President of Information Security, in coordination with the Company's Cyber Security Committee, develop and implement to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee are also informed of any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least once each quarter, the Board discusses the Company's approach to cybersecurity risk management with the Company's Chief Information Officer, and at least annually, or more frequently as necessary, the Company's Chief Information Officer meets with the Audit Committee to discuss cybersecurity risk management.


text: The Company's Chief Information Officer and its Vice President of Information Security are members of the Company's management that are principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Company's Chief Information Officer serves as Chair of the Company's Cyber Security Committee and works in coordination with the other members of the Cyber Security Committee, which includes our Vice President of Information Security, EVP, Operations, EVP, Chief Financial Officer, Chief Compliance Officer, and VP, Legal – Intellectual Property and Privacy, who also serves as the Company's Privacy Compliance Officer and Data Protection Officer.


text: The Company's Chief Information Officer has served in various roles in information technology and information security for over 27 years, including serving in technology leadership roles such as Chief Information Officer, Senior Director of Commercial Technologies, Senior Director of Corporate Systems, Senior Director of Business Intelligence and Analytics, and Quality Assurance leadership roles for large public companies. The Company's Chief Information Officer was also a Client Director for the Department of Army/Department of Defense for a large public research and advisory services firm and holds a B.A. in Economics from Miami University and an MBA in Information Technology from The University of Maryland.


text: The Company's Vice President of Information Security has served in various roles in information technology and information security for over 25 years, including serving as Vice President of Information Security and Product Security Officer for large public companies. In addition, the Company's Vice President of Information Security has previously held roles including Security Risk Assessor, Security Policy Development, and Security Architect. The Company's Vice President of Information Security has also contributed to the development and review of various security-related publications including the National Institute of Standards and Technology, the International Organization for Standardization, and the Cloud Security Alliance, has served in numerous roles on various cybersecurity-related advisory boards, and holds a B.S. in Electrical Engineering from Fairleigh Dickinson University.


text: The Company's Chief Information Officer and Vice President of Information Security, in coordination with the Company's Cyber Security Committee, work collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's Security Incident Response Plan. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through the ongoing communications from these teams, the Chief Information Officer, the Vice President of Information Security, and the Company's Cyber Security Committee monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.


text: We do not currently believe cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition; however, we could experience a cybersecurity incident that materially affects us in the future. See Item 1A. Risk Factors, "Risks Related to our Information Systems and Technology" for additional discussion of cybersecurity risks to our business.


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards, and practices are integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by the Company's Board of Directors (the "Board"). The Company's cybersecurity policies, standards, and practices are intended to align with recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization, and other applicable industry standards. The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with the specific goals of: (i) identifying, preventing, and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security, and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, clients, and business partners; and (v) providing appropriate public disclosure of cybersecurity risks, and incidents when required.


text: Risk Management and Strategy Consistent with overall ERM policies and practices, the Company's cybersecurity program focuses on the following areas: • Vigilance: The Company maintains a global presence, with cybersecurity threat operations functioning 24/7 with the specific goal of identifying, preventing, and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through regular vulnerability assessments and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides training for personnel regarding cybersecurity threats, which is designed to reinforce the Company's information security policies, standards, and practices. This training includes certain periodic and mandatory training for Company personnel regarding cybersecurity threats as well as the handling and processing of payment cards. All periodic and mandatory training is scaled to reflect the roles, responsibilities and information systems access of applicable personnel. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, accounting, risk management, internal audit, and other key business functions, as well as the members of the Board and the Audit Committee of the Board in a dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds designed to help ensure that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. • Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the Company's ERM function, the Company's Chief Information Officer, other members of management, and relevant management committees and councils, including the Company's Cyber Security Committee.


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the assessment and testing of the Company's processes and practices through auditing, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The Company engages third parties to perform assessments of our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits, and reviews are reported to the Company's Cyber Security Committee, and when appropriate, the Audit Committee and the Board. The Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by the assessments, audits, and reviews.


text: The Company's Cyber Security Committee, in coordination with the Board and Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes, and practices that the Company's Chief Information Officer and its Chief Information Security Officer, in coordination with the Company's Cyber Security Committee, develop and implement to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee are also informed of identified cybersecurity incidents that meet established reporting thresholds, as well as ongoing updates regarding each such incident until it has been addressed. The Board discusses the Company's approach to cybersecurity risk management with the Company's Chief Information Officer, and, as necessary, the Company's Chief Information Officer meets with the Audit Committee to discuss cybersecurity risk management.


text: The Company's Chief Information Officer and its Chief Information Security Officer are members of the Company's management that are principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Company's Chief Information Officer serves as Chair of the Company's Cyber Security Committee and works in coordination with the other members of the Cyber Security Committee, which includes our Chief Technology Officer; Chief Information Security Officer; EVP, Operations; EVP, Chief Financial Officer; Chief Compliance Officer; Chief Accounting Officer; Chief Legal Officer; Deputy Chief Compliance Officer; SVP, Public Affairs; VP, Risk Management; VP, Internal Audit; and VP, Legal – Intellectual Property and Privacy, who also serves as the Company's Privacy Compliance Officer and Data Protection Officer.


text: The Company's Chief Information Security Officer has served in various roles in information technology and information security for over 25 years, including serving as Vice President of Information Security and Product Security Officer for large public companies. In addition, the Company's Chief Information Security Officer has previously held roles including Security Risk Assessor, Security Policy Development, and Security Architect. The Company's Chief Information Security Officer has also contributed to the development and review of various security-related publications including the National Institute of Standards and Technology, the International Organization for Standardization, and the Cloud Security Alliance, has served in numerous roles on various cybersecurity-related advisory boards, and holds a B.S. in Electrical Engineering from Fairleigh Dickinson University.


text: The Company's Chief Information Officer and Chief Information Security Officer, in coordination with the Company's Cyber Security Committee, work collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and designed to allow the Company to promptly respond to any cybersecurity incidents in accordance with the Company's Security Incident Response Plan. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through the ongoing communications from these teams, the Chief Information Officer, the Chief Information Security Officer, and the Company's Cyber Security Committee monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.


text: To date, we do not believe cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition; however, we could experience a cybersecurity incident that materially affects us in the future. See Item 1A. Risk Factors, "Risks Related to our Information Systems and Technology" for additional discussion of cybersecurity risks to our business.


text: Cybersecurity risk is an important and continuously evolving focus for us, and significant resources are devoted to protecting and enhancing the security of computer systems, software, networks and our other technology assets. We have controls and systems in place to safely receive, protect and store information; collect, use, and share that information appropriately; and detect, contain and respond to data security and denial-of-service incidents.

companyName: FIRST INDUSTRIAL LP


text: We identify material cyber risks by continually assessing external threats to understand evolving threats, developing issues and industry trends. Cybersecurity is an important and integrated part of the Company's enterprise risk management function that identifies, monitors and mitigates business, operational and legal risks. We view our main cyber risk areas to be attempts to gain unauthorized access to our data and computer systems and the data of third parties to which we may owe a duty of care through malware, ransomware, computer fraud, insider threat from persons inside our Company or persons with access to systems inside our Company, and other significant disruptions of our information technology networks and related systems. Our processes and controls to mitigate these cyber risks, categorized by five functional areas, Identify, Protect, Detect, Respond and Recover, are addressed below.


text: The first step in our process is to Identify the risks related to our data, personnel, devices, systems and facilities. In connection with this phase, we do the following: • Perform global risk assessments which include information technology risk areas including cyber and, in conjunction with this assessment, we engage leading security and technology vendors to periodically perform specific technical information technology risk assessments; • Maintain a matrix that delineates roles and responsibilities for information security supporting significant financial applications, database and networks; • Participate in various consortiums, associations and groups allowing us to share threat intelligence and collaborate with organizations across different industries to share best practices, fight cybercrime, enhance privacy, discuss new technologies, better understand the evolving regulatory environment, and advance capabilities in these areas; • Conduct mandatory information security training for all employees and regularly test our employees several times a year for information security awareness and adherence to our information security recommendations; and • Disclose our computer usage policy on our intranet and distribute to new employees.


text: Next, we perform certain controls and processes in order to Protect against the identified risks. In connection with this phase, we do the following: • Maintain controls and processes over access to our networks and computer systems including: (i) approval and restriction to appropriate personnel as well as ensuring powerful privileges are restricted and segregated to select information technology employees; (ii) utilize a password manager to protect encrypted passwords of power users; (iii) disable system and physical access of terminated employees in a timely manner; (iv) utilize two-factor authentication for remote access to the network; and (v) segregate internal network through the use of internal firewalls; • Maintain physical security at our data center and backup recovery location including door access control system at the primary data center with surveillance; • Block data intrusion to maintain confidentiality and integrity of our data via the following: (i) capacity of our servers and networks have an automated monitoring system; (ii) patch management controls on our key software including monitoring resources for patch criticality and reported issues as well as running vulnerability scans; (iii)


text: change logs are kept and updated on all of our key software; (iv) all major changes to hardware and infrastructure devices are performed and approved prior to production migration; (v) remote access is fully encrypted for all users; and (vi) internal firewalls are used to limit access to sensitive systems and applications; and • Maintain controls and processes relating to payments we make to third parties by using a combination of internal controls around the setup, maintenance and archiving of records to reduce fraud and erroneous payments.


text: Our Board of Directors has a process in place to monitor management's oversight of cybersecurity. This is done primarily through regular reports to its Risk Committee as well as the full Board of Directors. Management provides reports on the emerging cybersecurity threat landscape and our cybersecurity risk management program, including our risk evaluation, the results of independent third-party security assessments, and our efforts to manage cyber related risks.

companyName: ERIE INDEMNITY CO

ticker: ERIE


text: We continually monitor our information system in order to Detect anomalous activity and verify the effectiveness of our protective measures. In connection with this phase, we do the following: • Run extended detection and response software on our network at all times, which is comprehensive company-wide personal computer device security monitoring and active threat remediation software that is fully supported by staff and backed by a prevention warranty; • Engage third-party specialists to periodically perform: (i) penetration testing, which is a simulated cyberattack against our computer system, in order to assess our ability to resist potential threats and attacks from external and internal sources; (ii) cyber dwelling, which determines if a threat actor has made its way or could make its way into our computer network and if confidential information was or could be compromised; and (iii) tabletop mock ransomware exercises to gauge our ability to react to an attack; • Evaluate the technical control structure and competency for all new third-party software vendors and review "cloud" third-party software vendor's Service Organization Control reports, or reasonable substitutes, which give comfort on the maturity of the vendor's security controls; and • Perform monthly mock phishing email exercises with our employees and provide additional training if needed.


text: We have plans in place in order to Respond to detected cybersecurity incidents: • Maintain written playbooks, which provide sequential instructions on the appropriate steps to take in the wake of various cyberattacks, including a playbook for each of the following: ransomware attack, a data breach, loss of third-party data and partial and full disaster recovery plans; and • Retain a leading provider of incident response to assist us with a security incident as well as an attorney that serves as our data breach coach who specializes in data privacy and cyber security, and has relationships with third-party forensics investigators, crisis communications professionals and other services and organization we may need if a data breach is encountered.


text: In order to Recover systems or assets affected by a cybersecurity incident, full backups of our business systems data are created, tested and kept at multiple locations in online and offline formats.


text: While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business, operations or financial condition, there can be no guarantee that we will not experience such an incident in the future. See Risk Factors for more information on our cybersecurity risks.


text: Our Chief Information Officer, our Senior Director of Information Technology, our Director of Business Systems Applications and our Information Technology Security Manager oversee our cybersecurity program. Collectively, the team has decades of information technology experience and our Information Technology Security Manager holds a masters degree in Network Security. They meet on a regular basis and report to the Audit Committee at least annually on key cybersecurity risks as well as current and future cybersecurity strategy. As delegated by our Board of Directors, our Audit Committee is responsible for reviewing, with management, our internal control systems with respect to information technology security. The Audit Committee Chairperson is also involved in our annual overall risk assessment process. In addition to the foregoing, from time to time, the Board of Directors is updated concerning the Company's internal control systems with respect to information technology security.


text: The first step in our process is to identify the risks related to our data, personnel, devices, systems and facilities. In connection with this phase, we do the following: • Perform global risk assessments which include information technology risk areas including cyber and, in conjunction with this assessment, we engage leading security and technology vendors to periodically perform specific technical information technology risk assessments; • Maintain a matrix that delineates roles and responsibilities for information security supporting significant financial applications, database and networks; • Participate in various consortiums, associations and groups to share threat intelligence and collaborate with organizations across different industries to share best practices, fight cybercrime, enhance privacy, discuss new technologies, better understand the evolving regulatory environment, and advance capabilities in these areas; • Conduct mandatory information security training for all employees and regularly evaluate their information security awareness and adherence to our information security recommendations; and • Disclose our computer usage policy on our intranet and require employees to acknowledge the policy annually.


text: Next, we perform certain controls and processes in order to protect against the identified risks. In connection with this phase, we do the following: • Maintain controls and processes over access to our networks and computer systems including: (i) approval and restriction to appropriate personnel as well as ensuring powerful privileges are restricted and segregated to select information technology employees; (ii) utilize a password manager to protect encrypted passwords of power users; (iii) disable system and physical access of terminated employees in a timely manner; (iv) utilize two-factor authentication for remote access to the network; and (v) segregate internal network through the use of internal firewalls; • Maintain physical security at our data center and backup recovery location including door access control system with surveillance; • Block data intrusion to maintain confidentiality and integrity of our data via the following: (i) capacity of our servers and networks have an automated monitoring system; (ii) patch management controls on our key software including monitoring resources for patch criticality and reported issues as well as running vulnerability scans; (iii) change logs are kept and updated on all of our key software; (iv) all major changes to hardware and infrastructure devices are performed and approved prior to production migration; (v) remote access is fully encrypted for all users; and (vi) internal firewalls are used to limit access to sensitive systems and applications; and • Maintain controls and processes relating to payments we make to third parties by using a combination of internal controls around the setup, maintenance and archiving of records to reduce fraud and erroneous payments.


text: We continually monitor our information system in order to detect anomalous activity and verify the effectiveness of our protective measures. In connection with this phase, we do the following: • Run extended detection and response software on our network at all times, which is comprehensive company-wide personal computer device security monitoring and active threat remediation software that is fully supported by staff and backed by a prevention warranty; • Engage third-party specialists to periodically perform: (i) penetration testing, which is a simulated cyberattack against our computer system, in order to assess our ability to resist potential threats and attacks from external and internal sources; (ii) cyber dwelling, which determines if a threat actor has made its way or could make its way into our computer network and if confidential information was or could be compromised; and (iii) tabletop mock cybersecurity incident exercises to gauge our ability to react to an attack; • Evaluate the technical control structure and competency for all new third-party software vendors and review "cloud" third-party software vendor's Service Organization Control reports, or reasonable substitutes, which give comfort on the maturity of the vendor's security controls; and • Perform monthly mock phishing email exercises with our employees and provide additional training if needed.


text: We have plans in place in order to respond to detected cybersecurity incidents: • Maintain written playbooks, which provide sequential instructions on the appropriate steps to take in the wake of various cyberattacks, including a playbook for each of the following: ransomware attack, a data breach, loss of third-party data and partial and full disaster recovery plans; and • Retain a leading incident response provider to assist with security incidents as well as an attorney that serves as our data breach coach who specializes in data privacy and cyber security, and has relationships with third-party forensics investigators, crisis communications professionals and other services and organization we may need if a data breach is encountered.


text: In order to recover systems or assets affected by a cybersecurity incident, we maintain and regularly test full backups of our business systems data. These backups are stored in multiple locations, both online and offline.


text: Our cybersecurity program is overseen by a highly experienced team, including the Chief Information Officer (who reports directly to our Chief Executive Officer), our Senior Director of Information Technology, our Senior Director of Business Systems Applications and our Information Technology Security Manager. Collectively, this team has decades of expertise in information technology, and the Information Technology Security Manager holds a master's degree in Network Security. They meet regularly to discuss key cybersecurity risks and strategies, reporting to the Audit Committee annually or as necessary, in accordance with our cybersecurity incident protocols.


text: The Audit Committee, as delegated by our Board of Directors, is responsible for reviewing, with management, our internal control systems with respect to information technology security. The Audit Committee Chairperson also participates in our annual overall risk assessment process. In addition to the foregoing, from time to time, the Board of Directors is updated concerning the Company's internal control systems with respect to information technology security.


text: The Registrants have been subject to attempted cybersecurity threats and will likely continue to be subject to such attempts in the future. While PPL has not determined any cybersecurity incidents have materially affected the Registrants, including their business strategy, results of operations or financial condition, there can be no guarantee that the Registrants will not be the subject of future, successful attacks, threats or incidents, which may be material.

companyName: PPL ELECTRIC UTILITIES CORP


text: Processes for Identifying, Assessing and Managing Material Risks from Cybersecurity Threats PPL's Chief Security Officer (CSO) is responsible for establishing PPL's cyber-risk management strategy for PPL and the other Registrants and reports directly to PPL's Chief Executive Officer. The CSO has over 25 years of experience leading technology and security organizations, has a degree in computer science, and holds professional certifications in information security, IT auditing, and privacy. He is also a member of nationally and internationally recognized industry and security organizations, including the Information Systems Audit and Control Association, International Association of Privacy Professionals, and the Domestic Security Alliance Council. PPL's VP – Cybersecurity is responsible for implementing and executing the cyber-risk management strategy. The VP – Cybersecurity is a seasoned cybersecurity professional with a wealth of experience safeguarding digital assets across multiple industries. He maintains a globally recognized cyber certification and has held multiple certifications in the areas of cyber risk and information control, and actively contributes to industry advancement as a member of national and international industry groups. The teams managed by the CSO and VP – Cybersecurity are comprised of seasoned experts in cyber and IT security and possess appropriate experience to safeguard the company's data, networks and systems, mitigate cyber risks and help prevent and combat cyber threats.


text: The Registrants manage cybersecurity risks through monitoring, defense and response tools, including independent third-party assessments, internal audit assessments of the program's effectiveness, intelligence reports, cybersecurity threat trends, implementation of governance models, industry collaboration and employee training and awareness. The Registrants are actively engaged in cybersecurity related industry forums, public-private partnerships with law enforcement, cross-industry peer groups, and other efforts to help improve the protection of the U.S. electric grid.


text: The Registrants utilize monitoring tools, including but not limited to, cybersecurity incident and event management, penetration testing, intrusion detection and prevention, vulnerability assessments and anti-virus systems to detect anomalous or suspicious system or network activity. The Registrants may also become aware of a potential cybersecurity event or incident through employee reports, notification by a third-party service provider or business partner with potential impact to the Registrants or their systems, customers or notification by a government agency. The Registrants' subject matter specialists from across the enterprise provide input and expertise into risk governance processes, including cybersecurity, information technology, legal, compliance, operations, and enterprise risk management.


text: In developing their cybersecurity programs, the Registrants are guided by various frameworks including the NIST Cybersecurity Framework, a voluntary framework that consists of standards, guidelines and best practices for managing cybersecurity risk, that is widely used by critical infrastructure industries to help determine and address the highest priority cybersecurity risks. The Registrants conduct regular internal cybersecurity audits and vulnerability assessments and regularly engage with third-party cybersecurity experts for external assessments of their cybersecurity controls, including technical, physical and social aspects, to better comprehend the scope and magnitude of active threats to the industry and nation and their potential impact on our systems.


text: PPL and the other Registrants also maintain a process to review the cyber risks that arise from the use of third-party service providers as well as programs and procedures to mitigate such risks internally and to assess the extent to which such providers effectively manage their own cyber risks.

stage1Category: Third-Party Risk


text: The CSO chairs the Corporate Security Council, which holds regular meetings consisting of senior executive management and reviews and oversees cybersecurity risks. The VP – Cybersecurity chairs the Cybersecurity Governance Council, which governs actions to ensure that the Registrants are effectively managing cybersecurity risks, as well as the Cybersecurity Steering Committee, that drives accountability, establishes work priorities, and directs a portfolio of key cybersecurity projects and initiatives.


text: PPL has established an Executive Crisis Team comprised of PPL's executive leadership, including the Chief Executive Officer, Chief Financial Officer, Chief Human Resources Officer, Chief Legal Officer, Chief Operating Officer, VP – Public Affairs and Sustainability, VP – Corporate Communications, and additional officers as circumstances may warrant, to allow the company to respond quickly to a crisis, including a cyber event. This team governs and manages corporate crisis preparedness across the business lines, operations, and functions. Material or potentially material risks are escalated to the Executive Crisis Team and other appropriate leadership for review and action.


text: Also, the Registrants' workforce undertakes mandatory role-based annual training on identifying, reporting, and escalating cyber and physical security concerns to further assist in the identification of risks as well as the acceptable use of corporate electronic resources. Additionally, all employees and contractors are required to participate in the Registrants' ethical cyber phishing campaign program. In addition to these enterprise-wide initiatives, PPL's Kentucky, Pennsylvania and Rhode Island operations are subject to extensive and rigorous mandatory cybersecurity requirements that are developed and enforced by NERC and approved by the FERC to protect grid security and reliability. LG&E is also subject to certain security directives related to cybersecurity issued by the Department of Homeland Security's Transportation Security Administration in 2021. See Note 13 to the Financial Statements for additional information on these directives.


text: The Board has direct oversight of the Registrants' cybersecurity programs through periodic reports from the CSO, at least twice a year, regarding cybersecurity matters and risks as well as the adequacy and effectiveness of our cybersecurity risk management program. Through these reports, the Board monitors the Registrants' programs, processes and procedures related to cybersecurity. The Board has directed the CEO and CSO to promptly inform the Board in the event of a material or potentially material cybersecurity event. Each member of the Board has access to management, including the CEO and CSO, to ask questions and engage on the company's approach to prevent, detect, assess, and mitigate cybersecurity risk. PPL's Board has several Board members with experience in cybersecurity, including one with a certificate in Cyber-Risk Oversight from the National Association of Corporate Directors.


text: A primary function of the Audit Committee is to assist the Board in the oversight of the identification, assessment and management of risk. Cybersecurity risks are included in PPL's enterprise risk management process and are reported to the Audit Committee of the Board on a quarterly basis or more frequently, as needed.


text: Processes for Identifying, Assessing and Managing Material Risks from Cybersecurity Threats PPL's Chief Security Officer (CSO) is responsible for establishing, implementing and executing PPL's cyber-risk management strategy for PPL and the other Registrants and reports to PPL's Executive Vice President and Chief Technology and Innovation Officer. The CSO has over 25 years of experience leading technology and security organizations, has a degree in computer science, and holds professional certifications in information security, IT auditing, and privacy. He is also a member of nationally and internationally recognized industry and security organizations, including the Information Systems Audit and Control Association, International Association of Privacy Professionals, and the Domestic Security Alliance Council. The teams managed by the CSO are comprised of seasoned experts in cyber and IT security and possess appropriate experience to safeguard the company's data, networks and systems, mitigate cyber risks and help prevent and combat cyber threats.


text: The CSO chairs the Corporate Security Council, which holds regular meetings consisting of senior executive management and reviews and oversees cybersecurity risks. PPL and the other Registrants also maintain a process to review the cyber risks that arise from the use of third-party service providers as well as programs and procedures to mitigate such risks internally and to assess the extent to which such providers effectively manage their own cyber risks.


text: PPL has established an Executive Crisis Team comprised of PPL's executive leadership, including the Chief Executive Officer, Chief Technology and Innovation Officer, Chief Financial Officer, Chief Human Resources Officer, Chief Legal Officer, Chief Operating Officer, VP – Public Affairs and Sustainability, VP – Corporate Communications, Chief Security Officer and additional officers as circumstances may warrant, to allow the company to respond quickly to a crisis, including a cyber event. This team governs and manages corporate crisis preparedness across the business lines, operations, and functions. Material or potentially material risks are escalated to the Executive Crisis Team and other appropriate leadership for review and action.


text: We maintain an IT and cybersecurity incident management process that provides a framework for responding to actual or potential cybersecurity incidents, engagement of third parties, including external incident response professionals, and timely reporting of incidents with material impact or reasonably likely to materially impact to our Chief Technology Officer, Chief Financial Officer, who inform other senior management members and our board of directors as appropriate. The cybersecurity incident management process facilitates coordination across multiple areas of our organization.

companyName: Freedom Holding Corp.

ticker: FRHC


text: Also, the Registrants' workforce undertakes mandatory role-based annual training on identifying, reporting, and escalating cyber and physical security concerns to further assist in the identification of risks as well as the acceptable use of corporate electronic resources. Additionally, all employees and contractors are required to participate in the Registrants' ethical cyber phishing campaign program. In addition to these enterprise-wide initiatives, PPL's Kentucky, Pennsylvania and Rhode Island operations are subject to extensive and rigorous mandatory cybersecurity requirements that are developed and enforced by NERC and approved by the FERC to protect grid security and reliability. LG&E is also subject to certain security directives related to cybersecurity issued by the Department of Homeland Security's Transportation Security Administration in 2021. See Note 12 to the Financial Statements for additional information on these directives.


text: The Registrants have been subject to attempted cybersecurity threats and will likely continue to be subject to such attempts in the future. While PPL has not determined any cybersecurity incidents have materially affected the Registrants, including their business strategy, results of operations or financial condition, there can be no guarantee that the Registrants will not be the subject of future attacks, threats or incidents, the consequences of which may be material.


text: See "Risks Related to All Segments – Our business operations are continually subject to cyber-based security and data integrity risks from vulnerabilities related to our IT systems, operational technology infrastructure and supply chain relationships" in "Item 1A. Risk Factors" for a discussion of cybersecurity risks affecting the Registrants.


text: Oversight of Cybersecurity Risks by the Board of Directors and Management PPL's Board of Directors oversees the Registrants' management of cybersecurity risk through various processes identified below.


text: Cybersecurity Risk Management Our Privacy and Information Security Committee, comprised of officers and senior leaders, is responsible for overseeing the development and maintenance of information privacy and security policies and effective operation of our corporate information security and cybersecurity program in compliance with applicable state insurance regulations and other legal and regulatory requirements. This committee is sponsored by and reports directly to our Executive Council, which includes our Chief Executive Officer and executive vice presidents.


text: As part of our overall Enterprise Risk Management ("ERM") program, we employ a cybersecurity program of technical, administrative, and physical controls intended to reduce the risk of cyber threats and protect our information, as well as documented processes to determine and make appropriate disclosures regarding potential material threats and incidents. Our cybersecurity philosophy and approach align to the National Institute of Standards and Technology Cybersecurity Framework and its core elements to identify, protect, detect, respond, and recover from the various forms of cyber threats. Our practices include, but are not limited to, cybersecurity protocols and controls, system monitoring and detection, communication of incidents to appropriate management, third-party risk management, including assessments of emerging threats and vulnerabilities, and ongoing privacy and cybersecurity training for employees and contractors concerning cyber risk. A foundational element of our cybersecurity risk management processes is the annual Cybersecurity and Information Security Risk Assessment (CSRA), which includes an analysis of cybersecurity risks facing us and associated recommendations and action items to mitigate identified risks. We periodically utilize third parties to assess the effectiveness of our cybersecurity efforts through independent validations, verifications, and security assessments.


text: Our Board of Directors has a process in place to monitor management's oversight of cybersecurity. This is done primarily through regular reports to its Risk Committee as well as the full Board of Directors. Management provides reports on our cybersecurity risk management program, including our risk evaluation, the results of independent third-party security assessments, and our efforts to manage cyber related risks.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of enterprise risk management, legal, information technology, and compliance personnel of the Adviser and Lord Abbett, including the CISO, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.

companyName: Lord Abbett Private Credit Fund


text: We have a core incident response team (Core Team) consisting of dedicated, skilled leadership representatives from our Information Security, Privacy and Law teams, responsible for analyzing and assessing cyber incidents and leading response efforts. Our Chief Information Security Officer (CISO), responsible for overseeing and managing information security incidents, has over 25 years of experience in information technology (IT), including over 20 years dedicated to practicing or leading cybersecurity functions. Our CISO is also a Certified Information Systems Security Professional (CISSP). Our Privacy leader, responsible for managing privacy incidents, has over 20 years of experience in IT risk management, including over 10 years in IT risk and control functions and the remaining time focused on privacy and cybersecurity related functions and holds several information privacy and risk certifications. Our Legal leader, responsible for providing guidance on legal and other regulatory obligations in the areas of privacy, cybersecurity, technology, data use and third-party risk management, holds a Juris Doctor degree, is licensed to practice law, and has over 20 years of legal experience, including 10 years focused on privacy and cybersecurity and holds several information security and privacy certifications, including the CISSP. The Core Team leaders are members of various organizations that support cybersecurity or privacy intelligence, education, information sharing and networking, including among others the Financial Services Information Sharing and Analysis Center (FS-ISAC), Domestic Security Alliance Council (DSAC), InfraGard, and International Association of Privacy Professionals (IAPP).