text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides regular updates to our Board of Directors regarding such oversight. The Audit Committee regularly meets with members of management responsible for data privacy, technology, and information security risks to discuss these risks, risk management activities, incident response plans, best practices, the effectiveness of our security measures, and other related matters.


text: Our Vice President, Information Security and Technology, who reports to our Chief Technology Officer, leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Specific cybersecurity related responsibilities include overseeing our processes and strategies for the detection, mitigation, and remediation of cybersecurity incidents. Our Vice President, Information Security and Technology has extensive experience assessing and managing cybersecurity and risk programs having served in the current position for us since December 2020 and prior Senior Director level positions in security and privacy at several private and public Software as a Service, or SaaS, companies. Specialized knowledge also results from our Vice President, Information Security and Technology holding a Master of Information Security and Assurance from Norwich University.

companyName: CarGurus, Inc.

ticker: CARG

secItem: Item 1C


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time employees, with a data protection, cybersecurity, and incident response and prevention training program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use, and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity threats and risks and to bolster our employee-based cybersecurity programs.


text: Despite our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Part I, Item 1A, Risk Factors, in this Annual Report for a discussion of cybersecurity risks.


text: We believe cybersecurity is a necessity for operating our business. As a global leader in computational science and artificial intelligence, we face many cybersecurity threats that range from common attack patterns, such as ransomware and denial-of-service, to attacks from sophisticated and persistent adversaries, including nation state actors, that target companies with innovative technology. Our customers, vendors and other third-party partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. These cybersecurity threats and related risks make it imperative that we carefully execute our cybersecurity operations, strategy and governance.

companyName: Altair Engineering Inc.


text: Risk Management and Strategy Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats We primarily assess, identify and manage material risks from cybersecurity threats through our enterprise information security program, which is maintained by our Chief Information Security Officer ("CISO") and overseen by our Executive Vice President and Chief Information Officer ("CIO").

companyName: MKS INC

ticker: MKSI


text: The Board of Directors are informed of cybersecurity risks and provide oversight to the executive management team with the day-to-day responsibility of cybersecurity functions, auditing and budget. Senior leadership, including our Chief Information Security Officer (CISO), regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to impair data confidentiality, integrity and/or availability. In the event of an incident, we intend to follow our customized incident response playbooks, which outline the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g. legal), as well as senior leadership and the Board, as appropriate. Our procedures vary slightly depending on the type of incident at issue (e.g., account compromise, malware, data loss) as well as the data compromised.


text: Our corporate information security team, led by our CISO, is responsible for our overall information security strategy, policy, security engineering, security operations (as a second line of defense) and cyber threat detection and response. The current CISO has more than ten years' experience in cybersecurity and 35 years as an information technology professional. Given that our CISO has more than 25 years at the Company in multiple positions, he helped incubate and grow our corporate information security team into what it is today. During 2024 Altair chose to grow its security team further, recognizing the ever-increasing threats; a Director for IT Security was brought on board and a number of global staff were added to the Security Operations team. Our information security management philosophy is one of cyber risk prevention and we have the ultimate goal of preventing cyber incidents. Simultaneously, our information security team focuses on increasing our system resilience to minimize data breach (or other compromise) business impact should an incident occur. Cybersecurity is not the sole responsibility of our information security team. During 2024 and into 2025 we have increased the Security team involvement with business leaders. Our Security team works closely with internal departments to keep security at the forefront. Our employees and vendors also play a role in our company's cybersecurity efforts. Through our cybersecurity awareness training and other team training we are fostering a culture that all employees and vendors have a role in our cybersecurity defenses.

stage1Category: Management Role

stage1Method: unanimous


text: The corporate information security team has implemented a governance structure and processes to assess, identify, manage and report cybersecurity risks. We also have threat intelligence and insider threat programs to identify external and internal threats, and to mitigate those threats in a timely manner to the best of our ability. In addition, we have further developed security corporate practices, controls, and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks.

stage1Category: Risk Management Process


text: We employ a data privacy counsel to specifically improve our responses to growing international privacy laws. We believe that this enhances our data control and thus may reduce risk.

stage1Method: majority


text: Third parties also play a role in our cybersecurity and supplement our program. We engage third-party services in some vital areas of our business to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. Additionally, we leverage a Security Operations Center ("SOC")-as-a-Service provider to ensure continuous monitoring and rapid response to potential threats, enhancing our ability to maintain a robust security posture at all times.


text: We employ risk management functionality and document enterprise information security risks. Our information security team maintains documentation to assess risk and mitigate cyber risk in alignment with risk (understanding general impact and likelihood of risk exploitation), resources, and business process. Cybersecurity risks are tracked throughout the risk management process from risk mitigation to ultimate completion of remediation. From time-to-time significant risks may be escalated to the executive management team and/or the Board in the existing executive management processes for cybersecurity and Board briefing schedule.


text: We rely on our indirect sales channel partners and supply chain to deliver our products and services to our customers, and a cybersecurity incident at a channel partner, supplier, subcontractor or joint venture partner could materially adversely impact us. We also contractually flow cybersecurity regulatory requirements to our subcontractors in alignment with legal and contractual obligations. Extensive international law and US-sector specific laws pertaining to privacy and data security may create challenges for our supply chain and increase costs as we continue to flow down legal obligations.


text: Despite our careful planning, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: As of the date of this filing, we have not identified any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, there can be no assurance that we, or our third-party partners or service providers, will not experience a cybersecurity threat or incident in the future that could materially adversely affect our business strategy, results of operations, or financial condition.

companyName: MERCER INTERNATIONAL INC.

ticker: MERC

stage1Category: Strategy Integration


text: We are committed to protecting Company information and the confidential information of our employees, customers, partners, and suppliers. To that end, we have in place various policies, procedures, and processes to identify, assess, manage, and prevent potential cybersecurity risks, and to timely detect the occurrence, and mitigate the effects of cyberattacks and data breaches. Our Chief Information Officer ("CIO"), who has more than 25 years of information security and cybersecurity experience, manages cybersecurity, and oversees a team of dedicated cybersecurity personnel with various experience and certifications in information security and cybersecurity. Our personnel, along with external parties engaged to assess the sufficiency of our risk management processes (e.g., through penetration testing), continuously work to maintain and improve our cybersecurity program and the security and integrity of our information systems and infrastructure through our ongoing risk management program, including (i) by conducting cybersecurity assessments and audits to address threats and to stay in step with emerging malicious trends, and (ii) by performing due diligence on partners and suppliers to ensure similar values and appropriate security standards and safeguards are maintained by such partners and suppliers with respect to our information security assets and to third-party systems on which we rely. In addition, our Incident Response Team is trained to identify, quarantine, and remediate cybersecurity threats, and all of our employees are regularly trained to increase awareness of threats and to identify how to spot and avoid them.

companyName: Ryerson Holding Corp

ticker: RYZ


text: Cybersecurity is a formal component of our overall risk management program, and our management, including our Chief Information Officer, regularly update the Audit Committee of the Board of Directors on the status of our cybersecurity program. In the event that management identifies significant cybersecurity risk exposures, it will present such exposures to the Audit Committee, which oversees the actions, security, and risk mitigation efforts taken across our cybersecurity framework. With this input from management, the Audit Committee evaluates our cybersecurity risks and the responses implemented to prevent and/or mitigate any such risks.

stage1Category: Board Governance


text: We have adopted an incident response plan that applies in the event of a cybersecurity incident involving a breach of our information technology systems and applications. Pursuant to this response plan, in the event of an incident, a multi-disciplinary team is assembled that is led by our CIO. The team in turn may leverage the expertise of third-party consultants, external legal counsel, and other resources. The plan includes procedures designed to facilitate containment of, and responses to, a cybersecurity incident, which are based on the type of incident, the location of the incident, and the breadth of the incident. The plan also establishes procedures for escalating incidents depending on severity and for notifying any impacted parties, including our customers, law enforcement and regulatory authorities, third-party vendors, and insurance providers. Our CIO will provide periodic updates to the Audit Committee and, when appropriate, the Board of Directors during this process. In addition to internal resources, we utilize third-party service providers to supplement and maintain our cybersecurity and our information technology systems.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any cybersecurity incident, which have materially affected, or are reasonably likely to materially affect, us, our business strategy, our results of operations, or our financial condition.


text: We maintain comprehensive programs and technologies to ensure that our information systems are effective and prepared for data privacy and cybersecurity risks, including regular oversight of our security programs for monitoring internal and external threats to ensure the confidentiality and privacy of our data. As the volume and complexity of cyberattacks continue to evolve, we continue to enhance our security capabilities by continued investment in cyber technologies, further developing our internal cybersecurity personnel and educating our workforce regarding cybersecurity, and leveraging emerging technologies.


text: Risk Management and Strategies We regularly perform evaluations of our security program and continue to implement controls aligned with industry guidelines to identify threats, detect attacks and protect data. Our risk management strategy is focused on three areas: (i) technology, being our hardware and software systems; (ii) processes, being our cybersecurity reporting, testing and other processes; and (iii) people, which refers to our internal cybersecurity personnel, external service providers and individual training and human interaction within our information technology and cybersecurity processes. We seek to align our cybersecurity program with practices recommended under ISO 27001 and by the National Institute of Standards and Technology and the Center for Internet Security Critical Security Controls.


text: When reviewing key third-party information technology service providers, our engagement process customarily includes, among other things, a review of such providers' cybersecurity measures. Additionally, we use third-party data, such as Security Scorecard, to review and monitor such providers and as an indicator in respect of our cybersecurity environments.

stage1Category: Third-Party Risk


text: We periodically undertake cybersecurity audits or other independent assessments, the results of which are reported to our Audit Committee. We have also implemented security monitoring programs designed to alert us of any suspicious activity, and have developed an incident response program in the event of a security breach. We have also engaged a third-party vendor to, among other things, provide continuous monitoring and respond to cybersecurity events.


text: We implement various training programs periodically to ensure that our employees and other personnel comply with internal processes and to enhance their cybersecurity awareness.


text: Our board of directors oversees our risk management processes and has tasked our Audit Committee with oversight of our cybersecurity and information governance, including periodically reviewing and discussing with management our risk exposures relating to data privacy and cybersecurity, and reviewing the steps we have taken to identify, assess, monitor, mitigate and manage such exposure and cybersecurity risks. At the management level, our Director of Cybersecurity is responsible for overseeing our cybersecurity processes and risk management, working together with our Chief Information Officer to implement our cybersecurity initiatives.


text: Our Audit Committee and management meet with the Board on a quarterly basis to provide updates on cybersecurity risks, material cyberattacks and security incidents as they occur, as well as to promote company-wide cyber risk and security awareness. Additionally, our Chief Information Officer and Director of Cybersecurity meet periodically with the Board or the Audit Committee to brief them on technology and information security matters.


text: Our Director of Cybersecurity is informed of cybersecurity incidents by applicable personnel, and oversees remediation efforts in accordance with our policies and processes. Our Chief Information Officer reports to our Audit Committee on significant incidents periodically. Our Chief Information Officer has over 30 years of technology leadership experience and is, among other things, a Certified Information Systems Security Professional and a Certified Secure Infrastructure Specialist. Our Director of Cybersecurity has over 20 years of experience as a cybersecurity and information technology professional. He has held various leadership positions where he developed, managed and implemented security programs and controls. He also holds, among other information technology certifications, the Certified Information Systems Security Professional designation.


text: Risk Management and Strategy The Company's processes for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall Enterprise Risk Management (ERM) process. As part of the ERM, the Company focuses on developing multi-layered, collaborative processes to identify, monitor, and manage risks from cybersecurity threats. Risks are grouped into categories that management can then assess, monitor, and prioritize based on the likelihood of an occurrence, level of impact, and mitigating factors.

companyName: Alcoa Corp

ticker: AA


text: Our various cybersecurity risk management processes apply to various functions, including but not limited to, third-party suppliers and vulnerability management. We employ processes and technologies to bring visibility to, and protect against, cybersecurity risk, to include real time monitoring of network traffic and email. The Company also has a comprehensive body of policies and standards for assessing, identifying, and managing material risks from cybersecurity threats, including an incident response plan, business continuity plan, crisis management plan, as well as disaster recovery mechanisms, which are tested and updated. Additionally, the Company employs staff that are specifically dedicated to raising cybersecurity awareness and training within the organization.


text: The Company engages third-party assessors, consultants, and auditors to assist in assessing, identifying, and managing risk from cybersecurity threats. Third parties assist the Company by (i) providing regular penetration testing and vulnerability assessments; (ii) assessing and maintaining our formal incident response policies, including the use of tabletop testing; and (iii) providing multiple sources of threat intelligence information that are fed directly into our technical security platforms and our awareness campaigns, including ongoing network monitoring. The Company also has a comprehensive third-party information security audit program in place.


text: Alcoa has implemented processes designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to a security risk assessment prior to engagement to determine if they meet defined levels of security capabilities. Our master services agreements with third-party service providers generally carry a number of security requirements, including audit rights for the Company. After engagement, third-party service providers are subject to audits in which contract owners within Information Technology Automation Solutions (ITAS) validate that any certifications a vendor had upon engagement are maintained throughout the life of the agreement.


text: We have in the past experienced attempts and incidents by external parties to penetrate our, our service providers', and our business partners' networks and systems. Such attempts and incidents to date have not had a material adverse effect on our business, financial condition, or results of operations. See Part I Item 1A of this Form 10-K for more information on risks.


text: The Alcoa Board of Directors (Board), in coordination with the Audit Committee, is responsible for the oversight of our cybersecurity risk management program, and specifically, reviews and oversees the Company's risk management and strategy relating to cybersecurity, including cybersecurity developments and threats and the Company's process for assessing, managing, and mitigating material cybersecurity risks and threats. The Audit Committee and the Board receive regular updates regarding the state of the Company's cybersecurity program, cybersecurity developments, and emerging threats. The Chief Information Security Officer (CISO) and the Chief Information Officer (CIO) regularly update the Audit Committee and the Board regarding the Company's strategy to mitigate cybersecurity risks, which includes regular vulnerability assessments and employee training on cybersecurity matters. Alcoa's CISO is responsible for maintaining identified material cybersecurity risks within the Company's ERM platform. On a quarterly basis, the CISO reviews and updates risks, as well as the control procedures in place. These risks are regularly reported to the Audit Committee and Board.


text: Alcoa's CISO has thirty years of experience in information technology, including over fifteen years in cybersecurity, and prior to joining Alcoa, was the CISO of the U.S. business of a large global insurance and asset company and was responsible for the security of data, systems, and processes supporting customer assets. Alcoa's CISO maintains professional certifications in information security, participates in intelligence sharing organizations, and has extensive cybersecurity risk management experience in manufacturing organizations and reports to the CIO. Alcoa's CIO has almost thirty years of information technology experience, including a diverse knowledge in manufacturing and process control solutions, corporate applications, infrastructure, and service delivery operations. The CISO closely collaborates with the CIO and Chief Financial Officer (CFO) in managing material risks from cybersecurity threats. Alcoa also maintains an information security steering committee (ISSC), which oversees current and emerging cybersecurity risks and investments in the cybersecurity risk protections for the Company. The steering committee is comprised of a cross-functional team of leaders from across Alcoa's business groups, including the CISO (the ISSC Chair) and CIO.


text: The Company has established comprehensive incident response plans that set forth the processes through which cybersecurity incidents are managed, including how management is informed of cybersecurity incidents. As part of these plans, incidents are evaluated, classified, and elevated to an executive team which includes the CISO and executives on the Crisis Response Team. Once elevated, these executives are ultimately responsible for the management, mitigation, and remediation of incidents.


text: Risk Management and Strategy We have instituted policies and processes dedicated to assessing, identifying, and managing risks from cybersecurity threats. Cybersecurity risks are managed as part of our enterprise risk management program. We are committed to safeguarding our critical information assets and data and have implemented a defense-in-depth strategy that is informed by industry standard cybersecurity frameworks. We benchmark against these frameworks and our internal risk assessment process to inform how we identify, protect, detect, respond to, and recover from risks, threats, vulnerabilities, and cybersecurity incidents across our information assets.

companyName: TPI COMPOSITES, INC

ticker: TPICQ


text: We incorporate reputable third-party vendors and solutions into our cyber risk management strategies to fortify our cyber defense mechanisms. We have processes to oversee and identify material risks from cybersecurity threats associated with or use of third-party vendors. We collaborate with internal stakeholders across the Company to integrate cybersecurity principles into our operations, including deployment of multiple layers of cybersecurity defenses, restricted access based on business need, and integrity of our business information. We also train our employees during onboarding and annually thereafter on matters including cybersecurity awareness, confidential information protection, and phishing attacks.


text: We actively enhance our cybersecurity program through testing by third-party assessors and measure the results against industry standards. We also have standing engagements with incident response experts and external counsel to provide timely support to our incident response capabilities, and we regularly engage with external experts to analyze the threat landscape.


text: Our cybersecurity risk management is integrated into our business continuity program and enterprise risk management framework, which promotes proactive planning and preparedness to address potential threats. Members of our global information security team collaborate with subject matter experts within our organization to assess and refine our cybersecurity posture and incident response and preparedness, including evaluating and updating contingency plans, participating in tabletop exercises, threat hunting, red team engagements, and simulating real-world scenarios related to cyber incidents.


text: Although risks from cybersecurity threats have to date not materially affected us, and we do not believe they are reasonably likely to materially affect our Company, business strategy, results of operations or financial condition, we could, from time to time, experience threats and security incidents relating to our and our third party vendors' information systems. For more information, please see the section entitled "Risk Factors" included in Part I, Item 1A of this Annual Report on Form 10-K.


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure, and administers its cybersecurity risk oversight function through the Audit Committee. The Audit Committee receives quarterly updates on our enterprise risk management program, including information on cybersecurity risks and initiatives undertaken to identify, assess and mitigate such risks.


text: Our chief information security officer is the senior director responsible for the cybersecurity organization, which has primary oversight of material risks from cybersecurity threats. Our chief information security officer reports to our chief information officer. Our chief information officer is responsible for the overall Information Technology (IT) organization.


text: Our chief information officer and chief information security officer assess our cybersecurity readiness through internal assessment tools, as well as third-party assessments, audits, penetration tests, and evaluation against industry standards. We have governance and compliance structures that are designed to elevate issues relating to cybersecurity to our chief information officer and chief information security officer, as appropriate.


text: Risk Management and Strategy — The Company maintains a cybersecurity risk management program, led by a Chief Information Security Officer (CISO), who is responsible for the Company's overall cybersecurity strategy, policy, architecture and cyber threat detection and response. The CISO, who reports to the Company's Chief Information Officer (CIO), has a Bachelor's degree in Information Systems and Master of Business Administration degree and is a Certified Information Systems Security Professional with over a decade of professional cybersecurity experience. The Company's program is aligned to industry frameworks and controls from the National Institute of Standards and Technology that allow the Company to identify the fundamental security capabilities and controls necessary to maintain and enhance the program. The Company utilizes a wide range of capabilities to maintain cybersecurity, including threat intelligence, multi-factor authentication, endpoint detection and response and security automation.

companyName: OSHKOSH CORP

ticker: OSK


text: As part of the cybersecurity risk management program, the Company has a set of Company-wide cybersecurity policies and procedures, including an Acceptable Use Policy as well as other policies covering subjects such as Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Media Protection, System and Communications Protection and Incident Response. These policies and procedures go through an internal review process and are approved by appropriate members of management. The Company requires all personnel, including contingent workers and business partners handling information on the Company's behalf to follow its cybersecurity policies and procedures. Regular training modules educate the Company's team members on relevant cyber threats and trends and help prepare them for real-life phishing threats.


text: The Company implements processes to assess and manage risks associated with using third-party information system service providers. This risk assessment process assesses both the service provider's security posture as well as the security controls available from the third-party information system. The service provider's security posture assessment includes reviewing any third-party attestations as well as third-party controls in the following areas: assets, data flows, authentication, access, monitoring, response and recovery. Depending on the type of system or data, additional controls may be assessed.


text: The Company maintains an Incident Response Plan that includes processes for detecting, containing, and responding to incidents including processes for reporting incidents to management and the Board of Directors. The Company periodically performs simulations and tabletop exercises at a management level and incorporates external advisors as needed. The Company engages third-party service providers to conduct evaluations of its security controls, whether through penetration testing, independent audits or consulting on best practices to address cybersecurity risks.


text: Assessing, identifying and managing cybersecurity-related risks is integrated into the Company's overall Organization Risk Management (ORM) program. Cybersecurity related risks are included in the risk universe that the ORM program evaluates to assess top risks to the enterprise on an annual basis. To the extent the ORM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion.


text: Governance — The Board of Directors is responsible for general oversight of the Company's risk management program, including cybersecurity risks. The Board of Directors receives an annual report from senior management through the ORM program and material risk assessments and mitigation strategies, including with respect to cybersecurity risks.


text: The Audit Committee of the Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align the Company's risk exposure with its strategic objectives. The CIO provides periodic updates to the Audit Committee on the status of the Company's cybersecurity risk management program; the Company's information systems, cybersecurity, data privacy and other risks; and the steps management has taken to identify, monitor and mitigate such risks. The Audit Committee is also briefed on cyber crisis contingency planning, incident recovery capabilities and matters related to any material cybersecurity incident the company may experience.


text: The Company's business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but the Company cannot provide assurance that it will not be materially affected in the future by cybersecurity risks, threats or incidents. See Item 1A under the caption "Increased cybersecurity threats and more sophisticated computer crime pose a risk to our systems, networks, operations, products and services." for additional information on cybersecurity risks applicable to the Company.


text: Risk Management and Strategy We employ information systems to support our business. As is the case for other manufacturing companies of comparable size and scope, we, from time to time, experience attempted cyber-attacks on our information system. We also face risks associated with other potential significant failures or disruptions of our information technology networks. We utilize a risk-based, multi-layered information security approach that incorporates some of the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We have adopted and implemented this approach to identify and mitigate information security risks in a manner that we believe is commercially reasonable for manufacturing companies of our size and scope.

companyName: KAISER ALUMINUM CORP

ticker: KALU


text: The review of cybersecurity risks and threats is integrated into our enterprise risk management ("ERM"). Our ERM program includes an annual risk prioritization process to identify key enterprise risks. Each key risk is assigned risk owners to establish action plans and implement risk mitigation strategies. The cybersecurity threat risk action plan is managed at the enterprise level by our Chief Information Officer ("CIO"), who reports to our Executive Vice President and Chief Financial Officer. Management employs in-depth defense mechanisms throughout the enterprise. We regularly engage and consult with independent third-party consultants as part of our overall ERM, including penetration testing and periodic tabletop exercises to better prepare us for potential cyber threats. We also conduct annual information security training to educate employees and make them aware of information security risks and to enable them to take steps to mitigate those risks. As part of this program, we take reasonable steps to provide our executive management and employees who may come into possession of confidential financial information with appropriate information security awareness training. In addition, we employ multi-factor authentication and vulnerability management to mitigate and/or prevent cybersecurity incidents.


text: A cybersecurity incident may be detected in a number of ways, including, but not limited to, through automated reporting mechanisms, network and system indicators, intrusion detection systems, employee reports, law enforcement reports, or other third-party notification. To oversee and identify cybersecurity threat risks on a day-to-day basis, including from third-party service providers, the Company maintains a cybersecurity operations team with round-the-clock monitoring, and the CIO and Director of Cybersecurity receive regular reports on industry activity. Upon receiving notification of a cybersecurity incident, the cybersecurity operations team acts to isolate and contain the threat. The CIO along with the Director of Cybersecurity will consult and determine the incident severity level, which determines whether the incident should be escalated. Critical and high severity incidents must be reported to our President and Chief Executive Officer, Executive Vice President and Chief Financial Officer, Executive Vice President, Chief Administrative Officer and General Counsel and Executive Vice President - Manufacturing. The Company may engage third-party experts for assistance with crisis management, including forensic investigations, ransom negotiation, or crisis communication. During this process, the cybersecurity operations team will take steps to preserve evidence as soon as possible, including, but not limited to, memory dumps, log preservation and forensic hard drive collection. In addition, our Executive Vice President, Chief Administrative Officer and General Counsel, in consultation with the CIO and Director of Cybersecurity, will promptly evaluate whether the incident requires legal notifications or disclosure, including whether the incident requires disclosure under the U.S. securities laws. Following a cybersecurity incident, the Executive Vice President and Chief Financial Officer will direct the development of documentation regarding lessons learned in the response, including evaluation of preparedness capability, to continuously strengthen the cybersecurity posture of the Corporation.


text: Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents involving us or third-parties, that have materially affected or are reasonably likely to materially affect the Company in 2024, including its business, strategy, results of operations, or financial condition. See "Item 1A. Risk Factors - Risks Related to Cybersecurity and Privacy" for additional information. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third-party providers. In the event an attack or other intrusion were to be successful, we have a response team of internal and external resources engaged and prepared to respond. We also have a cyber risk insurance policy to help us mitigate risk exposure by offsetting costs involved with recovery and remediation in the event of a successful attack or other intrusion.


text: The Audit Committee is responsible for the review of risks relating to our information technology system, including cybersecurity, emerging cybersecurity developments and threats and our strategy for mitigating cybersecurity risks. Our entire Board of Directors is responsible for overseeing management's risk assessment and risk management processes designed to monitor and mitigate information security risks. The CIO and Director of Cybersecurity reports on cybersecurity matters semi-annually to the Board, primarily through the Audit Committee. Management provides benchmarking information and updates on key operational and compliance metrics to the Audit Committee. In addition, cybersecurity training is provided to the Audit Committee, to educate directors on the current cybersecurity threat environment and measures companies can take to mitigate the risk and impact of cyberattacks. As described above, management is actively involved in assessing and managing the Company's material cybersecurity risks. The CIO and the Director of Cybersecurity primarily lead these efforts. The CIO, reporting to the Company's Executive Vice President and Chief Financial Officer, manages the global information technology and cybersecurity programs. The CIO holds bachelor's and master's degrees in business administration, specializing in information systems and quantitative methods from Loyola Marymount University. The CIO has over 25 years of information technology expertise with extensive experience in enterprise risk management, including analysis, development, evaluation, and testing of control objectives and procedures to mitigate risks. The Director of Cybersecurity oversees and helps to ensure appropriate capabilities and controls are implemented in the areas of network security, endpoint protection, data protection, incident response, identity, and access management. Additionally, in this role, the Director of Cybersecurity works closely with third-party security partners surrounding monitoring and incident response services.


text: Risk Management and Strategy The Trust's cybersecurity risk management is established and governed by the Sponsor. The Sponsor determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for the Trust and the Trust relies on the Sponsor for assessing, identifying and managing material risks to the Trust's business from cybersecurity threats. The Sponsor's cybersecurity policies and practices are set out in the Sponsor's compliance manual and are reviewed on an annual basis. In addition, all officers of the Sponsor and all employees of Bitwise receive annual compliance training and annual cybersecurity training. Attendance at the annual cybersecurity training and the annual compliance training is tracked and recorded.

companyName: Bitwise 10 Crypto Index ETF

ticker: BITW


text: The Sponsor engages a selection of third-party security experts ("Experts") to assist its internal legal, compliance and engineering personnel in developing, implementing and testing its cybersecurity policies and procedures. The Experts assist in performing assessments, penetration tests and reviewed areas of potential vulnerability. In addition, the Experts work with the Sponsor to conduct cybersecurity training, exercises and quarterly internal phishing tests. The Sponsor uses the findings of such exercises and campaigns to improve its practices, procedures, and technologies. The Sponsor also engages the Experts to support its cybersecurity threat and incident response management and maintains information security risk insurance coverage.


text: The Sponsor conducts due diligence on the Experts and all third-party service providers both at the beginning of any contractual relationship and on an ongoing, periodic basis. The Sponsor reviews a selection of all of its service providers on an annual basis, with specific emphasis on any service providers deemed to be high risk and utilizes external compliance partners to assist with this review. As part of this review, the Sponsor tracks any identified deficiencies and requires that its third-party service providers have in place appropriate technical and organizational security measures and security-control principles based on recognized cybersecurity standards. The Sponsor also obtains contractual assurances from third-party service providers relating to their security responsibilities, controls, reporting, and roles and responsibilities as it pertains to cybersecurity incident response policies and notification requirements.


text: While neither the Sponsor no r the Trust has experienced a material cybersecurity incident, cybersecurity threat risks may materially affect either the Sponsor or the Trust, including the Trust's business strategy, results of operations or financial condition. For further discussion of the risks the Trust faces from cybersecurity threats, see "Item 1A. Risk Factors—Risks Related to Trust Investment—Investing in the Trust may result in the total loss of investment due to passive management strategies, cybersecurity vulnerabilities, and inadequate recovery options for lost assets."


text: The Trust does not have any directors, officers or employees. Under the Trust Agreement, all management functions of the Trust have been delegated to and are conducted by the Sponsor, its agents and its affiliates. As a result, Katherine Dowling, the General Counsel and Vice President of the Sponsor, is responsible for assessing and overseeing the Sponsor's and the Trust's cybersecurity risks and providing direction and oversight for risk mitigation action, in conjunction with Hong Kim, the Chief Technology Officer of Bitwise. Ms. Dowling has served as a Chief Compliance Officer at various companies since 2015 and has more than ten years of experience as an Assistant U.S. Attorney, most recently in the Economic Crimes Unit of the U.S. Attorney's Office for the Northern District of California. Ms. Dowling receives periodic reports from the Experts, outside legal representatives and members of the Sponsor's Legal and Compliance team who take part in cybersecurity review, implementation and testing. Mr. Kim graduated from the University of Pennsylvania with a Bachelor of Science in Computer Science, and, prior to Bitwise, worked on Google's backend infrastructure for Google Drive and worked in software security for the South Korean military.


text: Bitwise, the parent of the Sponsor, has a board of directors that is ultimately responsible for managing and directing the affairs of the Sponsor, including maintaining oversight of risks from cybersecurity threats. Mr. Kim serves on the Bitwise board of directors. Ms. Dowling serves as the General Counsel and Chief Compliance Officer of Bitwise and therefore is able to report directly to Bitwise's board of directors regarding cybersecurity risks to the Trust and the Sponsor.


text: Our process of assessing, identifying and managing material risks from cybersecurity threats is integrated into our overall enterprise risk management ("ERM") process. The audit committee of the board of directors (the "Audit Committee") oversees our ERM framework, including cybersecurity and other information technology risks. This involves collaboration with key personnel, including the Chief Financial Officer ("CFO"), the Chief Information Security Officer ("CISO"), IT operational management and Internal Audit. We also have a cross-functional team led by the CISO, which meets weekly with a fixed agenda to discuss mitigation and action-items related to ERM cyber risk updates, cyber statistics dashboards and threat vectors. Our CISO has a comprehensive background in various enterprise-wide information technology and cybersecurity leadership roles within the global energy and oil and gas sectors and strategy consulting. The Audit Committee receives a report from our Director of Internal Audit on the ERM risk register at least three times a year.

companyName: Great Lakes Dredge & Dock CORP

ticker: GLDD


text: The CISO and Chief Legal Officer ("CLO") are key members of management responsible for strategic cybersecurity leadership. They lead tactical threat assessment, keep an updated risk register and develop and maintain governance and procedures. The CISO reports to the CFO and presents at least annually to the Audit Committee and the full board of directors on cybersecurity processes. The CLO reports to the CEO, and to the Audit Committee and the full board of directors with regard to significant cybersecurity incidents, as further described below. Our CLO has specific training in cybersecurity awareness and holds a certificate of Cybersecurity Governance for the Board of Directors from the Massachusetts Institute of Technology Sloan School of Management.


text: To help manage cybersecurity risks, we have implemented a cybersecurity program consisting of security risk assessments, testing, continuous surveillance, dynamic incident response services and business continuity planning. Our cybersecurity program utilizes the guidelines of the National Institute of Standards and Technology Cybersecurity Framework to define material risks and establish controls designed to protect, detect, respond to and recover from cybersecurity incidents. In addition, we engage consultants to assess our resilience against applicable practices and standards for our industry.


text: Our cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") cybersecurity framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Kimco Realty OP, LLC


text: We use threat intelligence, vulnerability scanning and security assessments to identify and classify risks and impact. We engage multiple third-party cybersecurity services and experts who collaborate with our internal team to provide a multilayered approach for real-time threat detection across cloud services, networks and endpoints. Our security measures are under continuous scrutiny, with regular enhancements and updates to our policies and operational protocols integrated with a feedback loop from tabletop exercises. Our business continuity and response plan outlines our plans, procedures and policies governing our general information security program. As part of our business continuity plan and security awareness, we conduct tabletop exercises and regular mandatory training for all employees. We have also implemented a cybersecurity enhancement program, focusing on special initiatives which include automating security incident response, including systems that can provide quicker business recovery from multi-geographical locations, strengthening the governance framework, upgrading the hybrid server environment on our vessels and improving wireless communication system resilience. In addition, we have a process in place to manage cybersecurity risks associated with third-party service providers. We are in the process of imposing the new regulatory security requirements upon our suppliers, which will include: maintaining an effective security management program, abiding by information handling and asset management requirements and notifying us in the event of any known or suspected cyber incident.


text: The status of our cybersecurity is reported to senior management as needed, and formal incident reports are made for incidents with risk of significant impact to the Company. Such incidents are escalated to our Incident Response Team, led by the Business Continuity Coordinator ("BCC"), which follows our business continuity plan and includes executive summary for management, along with compliance reports to regulators within the required timeframes. The BCC is responsible for providing timely information to the CLO, who reports to the Audit Committee and the full board of directors.


text: Although we have not experienced any material cybersecurity events to date, new advanced cybersecurity threats and attack vectors could materially affect our business strategy, results of operation or financial condition, as further discussed in the risk factors "Disruption, failure, data corruption, cyber-based attacks or security breaches of our IT systems could adversely affect our business and results of operations" in Part I, Item 1A of this Annual Report on Form 10-K.


text: We recognize the critical importance of maintaining the safety and security of our systems and data and take a holistic approach to overseeing and managing cybersecurity, which is supported by both management and our Board of Directors. The Company's Board, the Audit Committee of the Board and management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our approach to cybersecurity risk management is multi-layered and includes governance and risk, monitoring and incidence response, data security, application security, endpoint security, network security and perimeter security.

companyName: First American Financial Corp

ticker: FAF


text: The Company's Board of Directors has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee of the Board. The Audit Committee receives quarterly reports from our Chief Information Security Officer ("CISO") regarding cybersecurity matters. The CISO also briefs the full Board of Directors on cybersecurity matters semi-annually.


text: The Company maintains an extensive and structured enterprise risk management ("ERM") program encompassing senior executive leaders from all facets of its business, including operations, human resources, finance, accounting, treasury, information security, information technology, legal/regulatory, internal audit, compliance, underwriting, and real estate. As part of our ERM program, the Company maintains an Information Security Oversight Committee ("ISO Committee") that oversees the Company's cybersecurity program from a management perspective.


text: The ISO Committee meets quarterly and is comprised of the Company's Chief Executive Officer, Chief Financial Officer and Chief Legal Officer, whose relevant expertise and experience can be found in the Company's Proxy Statement on Schedule 14A filed on April 1, 2024.


text: The ISO Committee also includes the Co-Presidents of First American Title Insurance Company, the Vice-Chairman of our data and analytics business and the President of our international division, who bring deep operational experience specific to our businesses; the Chief Intellectual Property and Privacy Officer, who is responsible for protecting and advising on innovation, data privacy and intellectual property; and is chaired by the Company's Chief Risk Officer, who has over 25 years of experience in risk management. The Company's CISO and Chief Technology Officer ("CTO") are participants on the ISO Committee.


text: The Company's CISO is primarily responsible for assessing and managing cybersecurity risks and threats and is responsible for developing and implementing our information security program, working closely with the ISO Committee. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity governance, cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Our CISO has been with the Company for 14 years in various information security leadership roles and has over 20 years of experience in the cybersecurity field. The CISO provides regular reports to the ISO Committee that are shared with the Company's Board of Directors.


text: As part of our risk management process, the Company maintains an overall risk management program that encompasses cybersecurity, conducts security audits, annual System and Organization Controls ("SOC 2") testing, and ongoing risk assessments using a company-wide risk framework. We also require employees with access to information systems to undertake data protection and cybersecurity training. The Company has processes in place for assessing, identifying, and managing material risks from potential cybersecurity incidents, including vulnerability identification, intrusion prevention, encryption, endpoint protection, behavior analysis, mitigation and the processes and protocols set forth in the Company's incident response plans. Certain of our subsidiaries manage their own cybersecurity functions and coordinate with the Company's CISO. The Company also employs systems and processes designed to oversee and identify cybersecurity threats associated with third-party vendors, including a risk assessment and rigorous evaluation of each vendor that may access, process or store highly sensitive or proprietary data or that is systematically integrated with the Company's systems or network. In addition to our in-house cybersecurity capabilities, we engage assessors, consultants, auditors, and other third parties to assist with assessing, identifying, mitigating and managing cybersecurity risks, including the maintenance of a Security Operations Center that is co-managed between the Company and a managed security service provider ("MSSP"), which continuously reviews the Company's network using threat intelligence from a variety of sources and reports potential incidents from users.


text: While the Company has experienced cybersecurity threats to its data and systems, such threats have not materially affected the Company, including our business strategy, results of operations or financial condition, with the exception of an incident in the fourth quarter of 2023, as disclosed in a Current Report filed by the Company on Form 8-K on December 22, 2023, as amended on December 29, 2023 and January 12, 2024 and followed by a Current Report on Form 8-K on May 28, 2024. On June 21, 2024, the Company received a complaint, on a class action basis, relating to the incident in the fourth quarter of 2023. For additional information on cybersecurity risks we face, see Item 1A. Risk Factors of this Annual Report, which should be read in conjunction with the foregoing information.


text: Cybersecurity Risk Management and Strategy As a component of our overall risk management system and processes, we have a risk-based cybersecurity program, dedicated to protecting our data as well as data belonging to consumers (including UWC Members), employees and suppliers. We devote significant resources and utilize a defensive in-depth strategy, with multiple layers of security controls to protect the security of our computer systems, software, networks, and other technology assets. Our security efforts are designed to preserve the confidentiality, integrity, and continued availability of all information we own, or is in our care, and protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt or degrade service, sabotage systems, or cause other damage. These processes include technical, administrative and physical controls and processes, as well as contractual mechanisms to mitigate risk. We also have policies and procedures to oversee and identify the cybersecurity risks associated with our use of third-party service providers, including the regular review of System & Organization Controls ("SOC") reports, relevant cyber attestations, and other independent cyber ratings.

companyName: Mister Car Wash, Inc.

ticker: MCW


text: Through a combination of governance, risk, and compliance (GRC) resources, we • proactively monitor IT controls to ensure compliance with legal and regulatory requirements, • perform third-party risk management assessments, • implement processes designed to ensure essential business functions remain available during business disruptions, • develop and update incident response plans to address potential weaknesses, and • maintain cyber incident management and reporting procedures.


text: These processes are overseen by our Chief Technology Officer, who has over 30 years of experience consulting and leading technology teams at several global multi-unit brands, including Blockbuster, FedEx, and Yum! Brands.


text: Our systems are periodically the target of directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our customers) and other data, confidential information or intellectual property. However, to date, we are not aware of any incident or cybersecurity risks having a material impact on our business, results of operations or financial condition.


text: Board Oversight and Governance Our Board recognizes the important role of information security and mitigating cybersecurity and other data security threats. While the full Board has overall responsibility for risk oversight, it is supported in this function primarily by its committees. The Audit Committee is responsible for reviewing and discussing our policies with respect to risk assessment and risk management, including risks related to cybersecurity and other technology issues. The Board periodically evaluates our cybersecurity strategy to help ensure its effectiveness. Management provides periodic reports to the Audit Committee regarding cybersecurity and other information technology risks, as well as our plans to mitigate cybersecurity risks and to respond to any breaches, and to the Nominating and Corporate Governance Committee regarding governance matters related to cybersecurity and other information technology risks.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: TEC assesses, identifies, and manages material risks from cybersecurity threats under the governance of its Cyber Security Framework and Information Security Policy, as well as several related policies and procedures addressing areas such as threat vulnerability management, cyber risk management, data protection and classification, network security, access control, incident response, security awareness, employee training and asset management. These policies and related standards require identification of all Information Technology (IT) and Operational Technology (OT) critical facilities and/or cyber assets, and sufficient controls for IT and OT asset inventory, including responsibilities for assets, information owners, and asset disposition processes. From a security perspective, TEC's Information Security group is directed at protecting all aspects of data and how information is stored, transmitted, processed, and used in business processes. TEC's Corporate Security group is responsible for protecting physical assets including critical facilities, protection of employees, and related physical security risks.

companyName: TAMPA ELECTRIC CO


text: TEC's Information Security group of the Information Technology department has the direct responsibility for developing, monitoring, and enforcing information security standards and procedures; reviewing and approving all network interconnections for compliance to security standards; and assisting, consulting, and training individuals throughout TEC in the use of appropriate information security practices. This group is responsible for ensuring that all IT and OT cyber systems, assets, and networks are aligned with Emera and affiliate cybersecurity framework. TEC engages independent third-party consultants from time to time to assess the adequacy of its cybersecurity measures and assist in implementing any appropriate actions to address any vulnerabilities identified. In addition, TEC participates in an Electric Power Research Institute (EPRI) research project to develop cybersecurity performance metrics. EPRI offers a web-based platform, which supports automated cybersecurity data collection, security metrics calculation, visualization, and analysis. The Vice President of Information Technology and Chief Information Officer (CIO), who reports to the President and Chief Executive Officer, oversees this group and is responsible for managing the program, in collaboration with TEC's businesses and functions. TEC's CIO has advanced degrees in computer science and extensive experience in cybersecurity and information technology, including many years of experience at large organizations leading cybersecurity, IT processes and controls, strategy, architecture, delivery and support of IT applications, and overseeing large groups of employees and contractors responsible for carrying out these responsibilities.


text: TEC's Vendor Risk Management process includes conducting risk assessments to identify and monitor cybersecurity risks associated with third-party service providers, including threat detection and security event notifications. TEC also has requirements for third-party service providers which include regulatory compliance and meeting policies and standards based on the National Institute of Standards and Technology Cybersecurity Frameworks. TEC's processes also provide for mitigating cybersecurity risk from third parties through seeking to include in its agreements with third-party service providers, as applicable, cybersecurity provisions designed to appropriately address such risks.


text: TEC's IT Business Continuity – Emergency Contingency Response Plan is updated periodically and reviewed at least annually. This plan includes guidelines for the escalation and communication of cybersecurity incidents, including a requirement to timely report to TEC's executive leadership and Board of Directors based on an assessment of the risk and other specified criteria. TEC has established a cyber incident response team to prepare for, mitigate, and remediate cybersecurity incidents, which is integrated within Emera's enterprise crisis management framework.


text: Cybersecurity risks are integrated into TEC's overall risk management process through the collaboration of the cybersecurity professionals and TEC's and Emera's risk management functions to assess threat levels on an affiliate and corporate basis and identify steps and resources appropriate to manage such risks. The Board of Directors oversees the management of risks from cybersecurity threats through receiving regular reports from the CIO, which include updates on TEC's performance with preparing, preventing, detecting, responding to, mitigating, and recovering from cybersecurity incidents. Should a cybersecurity threat or incident pose a significant risk to TEC, TEC's processes provide that the CIO, through the CEO, as appropriate, would promptly inform the Board regarding any such threat or inciden t. The CIO also provides regular updates on the key elements of its cybersecurity program to the Emera Board's Risk and Sustainability Committee, which has oversight over Emera's enterprise risk management framework, including oversight over cybersecurity risk.


text: While to date TEC has not detected a significant compromise of its cybersecurity systems, significant data loss or any material financial losses related to cybersecurity attacks, it is possible that TEC could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. See Item 1A. Risk Factors, "TEC is exposed to potential risks related to cyberattacks and unauthorized access, which could cause system failures, disrupt operations or adversely affect safety" for a further discussion of risks related to cybersecurity.


text: Risk Management and Strategy The Company's Information Security Program ("Program") uses a variety of safeguards to protect the confidentiality, integrity, and availability of information. The Program is designed to identify, prevent, or mitigate the risks from cybersecurity threats. The Program leverages recognized security frameworks, such as National Institute of Standards and Technology (NIST) and Federal Financial Institutions Examination Council (FFEIC), to organize, improve, and assess the program and to better manage and reduce cybersecurity risk. The Program is assessed and updated annually and as needed.

companyName: FIRST FINANCIAL BANKSHARES INC

ticker: FFIN


text: The Program is integrated into the Company's enterprise risk management program. The Company regularly assesses the threats and vulnerabilities to its environment so it can update and maintain its systems and controls to effectively mitigate these risks. Layered security controls are designed to complement each other to protect customer information and transactions. The Company periodically engages third-party experts and consultants to conduct evaluations of our security controls, whether through penetration testing, audits, assessments, or consulting on best practices to address new challenges. Results are used to help drive priorities and initiatives to improve the Program. Additionally, as a regulated entity, bank regulators assess the quality of our information security program during their regular examinations of the Company and its compliance with federal regulations and requirements.


text: The Company's third-party risk management program is designed to oversee and identify the cybersecurity threats associated with the use of third-party service providers. While the optics into a third-party's operation are limited, the Company performs risk-based evaluations of third-party service providers. These evaluations including reviewing information including, but not limited to, security assessment questionnaires, security testing summaries, audit reports performed under the SSAE 18 Audit Standard, and information security policies.


text: We view security awareness as a continuous program. All Company employees receive cybersecurity and fraud training at required new employee orientation and subsequently receive information security tips via email each business day. Employees also receive monthly security awareness video training and are required to complete annual computer-based training. The Company also provides information security awareness training to business customers and individuals in our communities.


text: During the fiscal year of this Report, the Company has not identified risks from cybersecurity threats that individually or in the aggregate have materially affected or are reasonably anticipated to materially affect the organization. Nevertheless, the Company recognizes cybersecurity threats are ongoing and evolving, and we continue to remain vigilant.


text: The Company's system of internal controls also incorporates a protocol for the appropriate reporting and escalation of information and cyber security matters to management and the Board of Directors for resolution and, if necessary, disclosure of any material incidents. The Board of Directors is actively engaged in the oversight of the Company's continuous efforts to reinforce and enhance its operational resilience and receives education to enhance their oversight efforts accommodate for the ever-evolving information and cyber security threat landscape. The Chief Information Security Officer ("CISO") regularly updates these committees on the information and cyber security risks, threats, exposures, and mitigation measures. The Company's incident response process is periodically tested and includes cybersecurity scenarios.


text: The Program is included in the Company's enterprise risk management program. The CISO is responsible for developing and implementing our Program and reporting on cybersecurity matters to the Board. Our CISO has over 20 years of related experience, and others on our Corporate Information Security team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed.


text: The Program is overseen by the Company's Risk Committee, First Technology Services Board of Directors, Technology Risk Committee, and Security Advisory Committee. Additionally, the First Financial Trust and Asset Management Board of Directors oversee the Program as it relates to the trust subsidiary. Operational committees that manage risks associated with cybersecurity are Change Control Committee and Patch Management Committee.


text: The Company's Board of Directors and subsidiary technology and trust companies' Boards of Directors monitor the Program including policies and practices. The Company's Risk Committee and technology company's Board of Directors oversees areas of operational risk such as information technology activities; risks associated with development, infrastructure, and cybersecurity; oversight of information security risk assessments, strategies, policies, and programs; and disaster recovery, business continuity, and incident response process. The CISO also provides periodic cybersecurity updates to the Audit Committee and the Audit Committee Chairman is member of the Risk Committee. The management-level Technology Risk Committee and Security Advisory Committee oversee management of the Program and related assessments. Operational committees that manage risks associated with cybersecurity are Change Control Committee and Patch Management Committee.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. For more information about the cybersecurity risks we face, see the risk factor entitled "Disruptions in our information technology systems or a compromise of security with respect to our systems could adversely affect our operating results by limiting our ability to effectively monitor and control our operations, adjust to changing market conditions, implement strategic initiatives or support our customer transactions" and "Our business may be adversely affected by security breaches at third-parties." in Item 1A- Risk Factors.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for critical service providers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We have in the past experienced adverse events that have not resulted, and are not expected to result, in a material impact on the Company's business operations or financial results. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We have experienced cybersecurity attacks and could in the future be subject to significant disruption, data loss or other security incidents or breaches".


text: Cybersecurity Governance and Oversight Our Board of Directors ("Board") considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program. Our Audit Committee receives quarterly briefings from our Chief Information Security Officer regarding the emerging cybersecurity threat and risk landscape as well as our cybersecurity risk management program and related readiness, resiliency, and response efforts. In addition, management will update the Audit Committee, as necessary, regarding significant cybersecurity incidents. Our Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: We have a Cyber Risk Committee ("Cyber Committee") which reviews and reports on cybersecurity risks and related issues. The Cyber Committee is comprised of senior management from various business units within the Company and meets at least quarterly to review the status of the Company's overall cybersecurity risk management program, as well as controls and procedures and to stay up to date regarding relevant legislative, regulatory, and technical developments. The Cyber Committee is responsible for assessing and managing our material risks from cybersecurity threats. The Cyber Committee has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants, and in this capacity, the Committee works closely with the Chief Information Security Officer.


text: The Cyber Committee is informed about and monitors the prevention, detection, mitigation, and remediation of key cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants.


text: We utilize a variety of administrative, technical and physical safeguards that take into account the nature of our IT environment, information assets and cybersecurity risks posed by both internal and external threats. We have incorporated cybersecurity coverage in our insurance policies, and our goal is to keep our data and systems, as well as our employees, safe from cybersecurity threats.


text: The Company conducts employee security awareness training and internal phishing exercises. When security issues arise, the Company conducts a prompt investigation and initiates response protocols and other measures to protect the Company and its valued employees and key stakeholders.


text: Cybersecurity Risk Management and Strategy We recognize the importance of developing, implementing and maintaining the integrity of our information technology systems and safeguarding the personal data and confidential information we receive, process or transmit, and store in any format. We have a cybersecurity risk management program, which we refer to as our information security risk management program, in place designed to assess, identify, and manage material risks from cybersecurity threats to our information, data, or information technology systems utilizing a defense-in-depth security strategy that integrates our staff, technology, and operations to establish various security barriers across multiple layers of our operations. Our information security risk management program is designed to employ industry standard practices across our operations and business functions, including access controls, monitoring and analysis of the threat environment, vulnerability assessments, and third-party cybersecurity risks; resilience through detecting and responding to cybersecurity events, incidents, and data disclosures or breaches, business continuity, and disaster recovery capabilities; and investments in cybersecurity infrastructure and technology needs. Key aspects of our information security risk management program include, but are not limited to, the following: • Surveillance controls and technical protective capabilities, including a centralized security incident event management system, or SIEM, continuous threat detection and response monitoring, and full incident response; • Routine cybersecurity training for all employees, including social engineering techniques, simulated phishing campaigns, physical access such as tailgating, privacy or handling of sensitive data, and other related topics; • Established policies and procedures that govern information security and cybersecurity which apply to all employees and information systems we control; • Business continuity, incident response, and disaster recovery procedures, including routine tabletop incident response exercises, disaster recovery tests, unannounced penetration tests, and security control assessments; • Network, infrastructure, and application security such as database activity monitoring, encryption, secure file transfer protocols, and application firewalls; and • Maintaining cybersecurity insurance covering certain security and privacy damages and claim expenses resulting from cybersecurity incidents (we periodically meet with our insurer to discuss trends in cybersecurity).

companyName: CoreCivic, Inc.

ticker: CXW


text: We engage third parties in connection with assessing, identifying and managing our cybersecurity risks, including, but not limited to, the following: • Incident response expertise to provide intelligence-based cybersecurity solutions and services to assist us with preparing for, investigating, and responding to cybersecurity incidents, including attacks that target on premise, cloud, and critical infrastructure environments; • Annual security program assessment of the controls, maturity and performance of our information security risk management program and the information security risks associated with our technology and business systems; • External and internal penetration and intrusion testing using industry standard tools and techniques; • Compliance assessments with certain information security standards required under some of our federal contracts; • Established cadence of reviews, reporting and coordination with government agencies to review cybersecurity metrics, findings and any applicable remediation efforts in accordance with the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF; and • Review processes and procedures designed to control access to information systems as part of our Sarbanes-Oxley Act, or SOX, testing. In addition to the third parties described above, we regularly engage consultants, advisors, service providers and other third parties to help develop and manage our information security risk management program. Further, our internal audit team conducts annual assessments of our information security risk management program and controls.


text: To help identify and manage cybersecurity and information security risks associated with our use of third-party service providers, we have implemented processes to assess third-party systems which could be compromised in a manner that adversely impacts us and our technology systems. We conduct diligence of significant third-party service providers who will have access to our data or information technology systems and incorporate certain cybersecurity protections in our engagement contracts with such providers. In addition, we require such third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations.


text: Our information security risk management program is designed to, among other things, assess, identify and manage material risks from cybersecurity threats. Cybersecurity risks we face include cyberattacks, computer viruses, malicious or destructive code (such as ransomware), social engineering (including phishing, vishing and smishing), denial of service to information or security breach tactics as well as attacks to our website, financial applications, operational technology, telecommunications and human resources data. Our information security risk management program includes technology and processes designed to maintain active awareness of risks to the security of our information or systems. We do not believe that any risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we cannot ensure that future cybersecurity incidents will not materially affect our business strategy, results of operations or financial condition. For more information on the Company's risks associated with cybersecurity threats and incidents, information and security breaches and technology failures, see Part I, Item 1A. Risk Factors - Interruption, delay or failure of the provision of our technology services or information systems, or the compromise of the security thereof, could adversely affect our business, financial condition or results of operations.


text: Our information security risk management program is integrated into our overall risk management program. Our BOD has a formalized enterprise risk management program, or ERM Program, which the Risk Committee of the BOD, or Risk Committee, on behalf of the BOD and the Audit Committee of the BOD, oversees. Our ERM Program addresses the identification, prioritization and assessment of a broad range of risks (e.g., cybersecurity, financial, operational, business, reputational, governance and managerial), and the formulation of plans to develop and improve controls for managing these risks or mitigating their effects in an integrated effort involving our BOD, relevant committees of the BOD, management, and other personnel. Our ERM Program is led by our General Counsel and is a component of management's strategic planning process. Our BOD and Risk Committee have primary oversight responsibility regarding our information security risk management program. Our BOD and Risk Committee each receives regular and frequent updates on cybersecurity and information technology matters from management (including our Chief Information Officer, or CIO) and, periodically, from outside experts. For example, the CIO provides reports to our BOD, Technology Steering Committee and Risk Committee regarding information security risks, as well as plans and strategies to mitigate those risks, on a periodic basis.


text: In addition, our Enterprise Risk Council, or ERC, is a management-level team comprised of a select group of executive officers, vice presidents, and senior managers overseeing risk, which is responsible for managing enterprise risks and planning and organizing the activities of our organization to minimize the effects of risk on our business, operations and financial results. The ERC is led by our General Counsel and our Managing Director, Litigation & Risk Management. The ERC coordinates enterprise risk management reports to the Risk Committee and/or our BOD. Further, the Risk Committee reviews management's information security risk management program controls, including management's assessment of recent information security incidents meeting certain criteria.


text: Identifying and assessing cybersecurity risks and threats is integrated into our overall enterprise risk management program. Our Enterprise Cybersecurity Committee defines the strategy, prioritizes, and sets the expectations for execution of the cybersecurity program, leveraging an industry-standard cybersecurity framework, the National Institute of Standards and Technology cybersecurity framework (NIST CSF). (i) strategic development and continuous iteration of a risk strategy in line with our information services and business goals; (ii) engineering and architecture of cybersecurity preventative and response solutions and capabilities;

companyName: EXPEDITORS INTERNATIONAL OF WASHINGTON INC

ticker: EXPD


text: We also have a Technology Steering Committee that assists with fulfilling oversight responsibilities of information technology risks, including cybersecurity risks. The Technology Steering Committee is comprised of our executive officers and relevant business leaders from the information security, information technology, legal, human resources, audit, finance, communication and risk functions, and identifies, defines, manages and measures information technology and cybersecurity risks applicable to us on an enterprise level. The Technology Steering Committee meets quarterly, and reviews all cybersecurity risks and incidents meeting certain criteria, and provides oversight with respect to cybersecurity matters at a management level. Further, the Technology Steering Committee reviews management's information security risk management program controls meeting certain criteria.


text: Our Technology Cybersecurity Committee is comprised of a subset of our Technology Department, including our CIO. The Technology Cybersecurity Committee meets bi-weekly and reviews all cybersecurity risks and incidents meeting certain criteria, provides oversight with respect to cybersecurity matters at a technology management level, and reports through our CIO to the Technology Steering Committee.


text: We also maintain a management governance structure for reviewing and approving changes related to new and existing systems, software and infrastructure design. Any new items that would require a material change must be reviewed and approved by our architecture review board, or ARB. Non-material changes are governed by the change advisory board, or CAB. The ARB and CAB each meet on a weekly basis and take security impacts into consideration during the decision-making process. All changes, whether approved or rejected, are formally documented in our information technology service management system.


text: As mentioned above, our SIEM tool monitors threat detection and response continuously. Identified threats create alerts which are monitored and addressed by our information technology team in accordance with internal policies, industry standard practices, and regulatory requirements. Audit logs of external security threats are reviewed weekly as part of general event threat intelligence monitoring procedures. Other ongoing monitoring includes data from our information services team, which maintains an audit trail to detect risks in areas such as unauthorized local connections, network use and remote connections. Vulnerability scans are performed frequently and are supplemented on an ad-hoc basis for specific threats or to test patch status.


text: Our Sr. Director, Information Security and Privacy Compliance, prepares an incident summary and collaborates with the CIO to conduct an initial assessment of information and cybersecurity incidents. They perform an impact assessment with respect to information or cybersecurity incidents meeting certain criteria and elevate the review of any such information or cybersecurity incidents for review by our executive officers.


text: Cybersecurity incidents meeting certain criteria are escalated to our Disclosure Committee for SEC disclosure consideration. The materiality of any cybersecurity incident is ultimately evaluated and determined by our Disclosure Committee in collaboration with our CIO. Our Disclosure Committee is comprised of our executive officers, our CIO, our Chief Ethics and Compliance Officer, and relevant business leaders from our finance and legal departments. The Disclosure Committee is presented with a detailed overview of the cybersecurity incident by the CIO. The Disclosure Committee then evaluates the cybersecurity incident and its potential materiality based on SEC guidance and by considering relevant quantitative and qualitative factors.


text: We have also adopted a cybersecurity incident response plan which provides for controls and procedures in connection with cybersecurity incidents, including these escalation procedures.


text: At a management level, our information security risk management program is led by our CIO, along with our Sr. Director, Information Security and Privacy Compliance. As of the date of this Annual Report, our Technology Department, led by our CIO, along with our Sr. Director, Information Security and Privacy Compliance, is comprised of nearly 100 technology professionals, with currently 11 of such technology professionals exclusively dedicated to cybersecurity. These security professionals have an average information security/cybersecurity tenure of 6 years and over 30 active certifications from ISC2, ISACA, CompTIA and other industry certification leaders including certifications such as CISSP, CISM, Security+, and CEH, among other advanced Cybersecurity and Technology degrees, tool and process specific certifications, and cybersecurity related work experience. Our Technology Department stays current on cybersecurity issues and trends through continuing education activities such as conferences and participating in webinars, maintaining continuous education requirements for certification bodies, as well as through the monitoring of security and vendor feeds on cybersecurity trends and threats.


text: Risk Management and Strategy We and our customers and suppliers have an increasing reliance on our technology systems and infrastructure. We aim to safeguard the digital infrastructure of Expeditors, enabling the highest levels of customer service while managing and minimizing risk and maintaining global compliance. The cybersecurity and risk management program within Expeditors is defined through strategy, execution, management, and oversight, with continual assessments to verify the program's overall effectiveness.


text: (iii) governance, risk, and compliance defining policies, standards, and systems of control and measurement in line with industry best practices and regulatory requirements;


text: Our Cybersecurity and Information Services (IS) department executes and measures the delivery of the cybersecurity program and incorporates the program into the governance and internal controls framework for our Company. We engage third parties such as consultants, auditors and specialists to support, evaluate, and improve the program, and utilize cybersecurity technologies and services to prevent, identify, detect, respond, and recover from cybersecurity threats and incidents. We also maintain a third party continuous monitoring security program to identify, prioritize, assess, mitigate and remediate third party risks, which is part of our overall cybersecurity risk management framework.


text: In February 2022, we determined that our Company was the subject of a targeted cyber-attack which resulted in having to shut down most of our connectivity, operating and accounting systems globally to manage the safety of our entire global systems environment, and we initiated our cybersecurity incident response plan. We had limited ability to conduct operations for a period of approximately three weeks, including but not limited to arranging for shipments of freight or managing customs and distribution activities for our customers' shipments. While we continue to incorporate learnings from the cyber-attack, we do not expect to have a further material adverse impact on the Company's business from this cyber-attack. Since the cyber-attack, we have accelerated investments in our CSRM program, strengthened the security of our systems and networks and enhanced continued monitoring of the known information security environment. We also added a Chief Information Security Officer (CISO) to our IS leadership.


text: Our Board of Directors provides direct oversight of and evaluates our CSRM at least annually. The Board's oversight is led by James Dubois, former CISO and Chief Information Officer (CIO) with the Microsoft Corporation, who communicates with cybersecurity leadership throughout the year. The Board is provided updates via our Enterprise Risk Management program quarterly, while meeting with the CISO at least annually.


text: Our Enterprise Risk Management Committee includes a cross-functional team including the Chief Executive Officer, CIO, Chief Financial Officer and the General Counsel as members who are well versed in risk management. In addition, the Enterprise Cybersecurity Committee includes the CIO, CISO, and Vice Presidents who have the relevant risk management and cybersecurity expertise. The Cybersecurity and Information Services department is led by the CISO and includes cyber professionals who have the relevant cybersecurity expertise. The CISO reports to the CIO and has over 20 years of experience, a graduate degree and several certifications in the field of cybersecurity. Material risks are managed and monitored by persons or committees with relevant expertise and experience. The Company maintains a Cybersecurity incident response team and a Business Continuity Plan and has a well-established incident reporting protocol to inform management, the Board of Directors or third parties.


text: We face various cybersecurity threats that could adversely affect our business, financial condition, and results of operations. We have implemented processes and procedures and engaged third-party service providers to assess, identify, and manage these risks, as well as to respond to and mitigate the impact of any potential or actual cybersecurity incidents to our information systems and the information residing therein.

companyName: COMSTOCK RESOURCES INC

ticker: CRK


text: Risk Management and Strategy Our cybersecurity risk management processes have been integrated into our enterprise risk framework, which identifies, aggregates, and evaluates risks across the enterprise. We identify our enterprise risks through each member of our management team, along with counsel from our internal auditors and attorneys and we present an assessment of our enterprise risks to our board of directors on an annual basis. Our information technology management plays an integral part in the identification and communication of cybersecurity risks to our management team.