text: Governance. The Company's Board of Directors (the "Board"), in coordination with its Audit Committee, oversees the Company's overall ERM process, and has delegated the management of risks arising from cybersecurity threats to the Security & Technology Committee, which regularly interacts with the Company's CSO (who maintains chief information security officer ("CISO") responsibilities at TTEC among other responsibilities), Chief Information Officer ("CIO"), the Chief Privacy Officer, Chief Legal & Risk Officer, and other members of management. The Security & Technology Committee of the Board receives regular reports on the Company's cybersecurity risks, vulnerability assessments, third-party and independent reviews, and the steps the Company is taking to address the security risks, among other relevant information, and shares information with the full Board as appropriate. The Board also has access to and periodically meets with the Company's CSO, CIO, and Chief Legal & Risk Officer about the approaches and progress that the Company is making on its cybersecurity risk management priorities.


text: The Board and the Security & Technology Committee also receive prompt information regarding cybersecurity incidents that meet established reporting thresholds, as well as ongoing updates regarding any such incidents until they have been addressed.

companyName: TTEC Holdings, Inc.

ticker: TTEC

secItem: Item 1C

stage1Category: Board Governance

stage1Method: unanimous


text: Our CSO holds an undergraduate degree in Computer Science and has served in various information technology and information security roles, including serving as the CSO for two public companies as well as various leadership roles in two medium sized private companies over the last 30 years.

stage1Category: Management Role


text: Our CIO holds an undergraduate degree in Computer and Electrical Engineering and has served in various roles in information technology for over 25 years, including serving as either the chief technology officer or chief information officer for two large public companies and a technology start-up.


text: The Company has previously experienced significant cybersecurity incidents. Although cybersecurity threats, including any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, there can be no assurances that future cybersecurity incidents, which are unavoidable, will not materially affect our results of operations, including our business strategy, results of operations, or financial condition.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical comp uter networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and trade secrets, data we may collect about trial participants in connection with clinical studies, sensitive third-party data, business plans, transactions, and financial information ("Information Systems and Data").

companyName: Structure Therapeutics Inc.

ticker: GPCR

stage1Category: Risk Management Process


text: The cybersecurity function within the Company helps identify, assess and manage the Company's cybersecurity threats and risks. Our cybersecurity function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example manual tools, internal or external audits, automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats and threat actors, conducting vulnerability assessments to identify vulnerabilities, conducting scans of the threat environment, and evaluating threats reported to us. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response policy, incident detection and response, data encryption, network security controls, system monitoring, penetration testing, employee training, a dedicated cybersecurity staff member, and physical security mechanisms.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the cybersecurity function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity software providers, managed cybersecurity service providers, and penetration testing firms. We also use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We manage cybersecurity risks associated with our use of these providers by reviewing their security assessments and applicable reports.


text: If our information technology systems or data, or those of third-parties upon which we rely, are or were compromised or experienced significant disruptions of our information technology systems or data security incidents, we could experience adverse consequences including but not limited to significant financial, legal, regulatory, business and reputational harm; litigation; fines and penalties;


text: disruptions of our business operations; loss of revenue or profits; loss of customers or sales; or other adverse consequences; and We rely on trade secret and proprietary know-how which can be difficult to trace and enforce and, if we are unable to protect the confidentiality of our trade secrets, our business and competitive position would be harmed.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. Our Audit Committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Director of Internal Controls and SOX Compliance, who has over 20 years in the areas of internal controls and SOX compliance reporting; our Director of IT Security and Compliance, who has over 20 years of IT experience, the past four of which have been in security; and our CFO, who has over 20 years of business development experience.


text: Our cybersecurity function is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CFO and cybersecurity function are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our response process to cybersecurity incidents is designed to escalate certain incidents to members of management depending on the circumstances, including the CFO. Our CFO and others work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the Audit Committee for certain cybersecurity incidents.


text: The Audit Committee receives periodic reports from our cybersecurity function concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

stage1Category: Strategy Integration

stage1Method: majority


text: Risk Management and Strategy We implement and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, products and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature (collectively, Information Systems and Data).

companyName: EVERSPIN TECHNOLOGIES INC.

ticker: MRAM


text: Our Senior Director of Information Technology (IT), internal IT, information security and legal functions, and third-party service providers (collectively, Cybersecurity Team) help identify, assess and manage our cybersecurity threats and risks. Our Cybersecurity Team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment. The Cybersecurity Team uses various methods designed to accomplish this task including, for example: manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, scanning the threat environment, evaluating our and our industry's risk profile, maintaining policies designed to coordinate our efforts with law enforcement to respond to threats, internal and external audits, conducting threat assessments, conducting third party threat assessments, and conducting vulnerability assessments.


text: Depending on the relevant information systems environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response strategy, incident detection and response measures, a vulnerability management policy, risk assessments, encryption of certain data, network security controls, data segregation, access controls, physical security controls, systems monitoring controls, personnel training, penetration testing, cybersecurity insurance, dedicated cybersecurity personnel, background checks for certain personnel, vendor management strategies, and asset management strategy (such as tracking and disposal of Company information systems).


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the Senior Director of IT works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use service providers in an effort to identify, assess, and manage material risks from cybersecurity threats, including for example: threat intelligence service providers, cybersecurity consultants, penetration testing firms, cybersecurity software providers, managed cybersecurity service providers, and professional services firms (including legal counsel).


text: We use service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and contract manufacturing organizations. We maintain a vendor management strategy designed to manage cybersecurity risks associated with our use of these providers. The strategy includes vendor risk assessments, security assessment reviews, and imposing information security contractual obligations on a vendor as appropriate. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management strategy may involve different levels of assessment designed to help identify, mitigating and manage cybersecurity risks associated with a particular provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Interruptions in or other compromises of our information technology systems or data or that of third parties upon whom we rely could adversely affect our business."

stage1Category: None/Other


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our Senior Director of IT, the Chief Executive Officer, and the Chief Financial Officer. Our Senior Director of IT has approximately 25 years of experience in IT and cybersecurity.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents and threats to management members depending on the circumstances, including the Chief Executive Officer and Chief Financial Officer. The Chief Executive Officer and Chief Financial Officer work with our incident response team in an effort to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our management and its designees report to the board of directors for certain cybersecurity incidents.


text: The board of directors receives periodic reports from management and its designees concerning our significant cybersecurity threats and risks, and the processes we have implemented in an effort to address them. The board of directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: Risk Management and Strategy We are committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, have implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats. Liberty's corporate level IT and cybersecurity functions assess, identify, and manage risks from cybersecurity threats at the corporate level, while Formula 1 and QuintEvents operate their own cybersecurity functions with oversight from Liberty.

companyName: Liberty Media Corp

ticker: FWONA


text: Live Nation, an equity affiliate, as a separate publicly traded company from Liberty, operates its own cybersecurity function. Oversight for Live Nation's cybersecurity functions rests with its board of directors, of which an employee of Liberty is a member, in collaboration with Live Nation's Global Data Governance Board and Audit Committee.


text: Cybersecurity risks are assessed as part of our enterprise risk assessment and risk management program and our cybersecurity risk management program is designed and assessed based on recognized frameworks, including the National Institute of Standards and Technology Cybersecurity Framework.


text: We rely on a multidisciplinary team, including our information security function, legal department, management, and third-party consultants, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, using manual and automated tools such as vulnerability scanning software, monitoring existing and emerging cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and assessments, and conducting threat and vulnerability assessments.


text: To manage and mitigate material risks from cybersecurity threats to our information systems and data, we implement and maintain various technical, physical and organizational measures, processes and policies. These measures include risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our IT, Security and other departments, encryption of data, network security controls, access controls, physical security, asset management, system monitoring, vendor risk management program, employee cybersecurity awareness and training, phishing tests, and penetration testing. Cybersecurity awareness training is also made available annually to our Board of Directors.


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place at the corporate level, Formula 1 and QuintEvents. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary.


text: To operate our businesses, we utilize certain third-party service providers to perform a variety of operational functions. We have implemented a third-party risk management program to evaluate the cybersecurity practices of higher risk vendors and vendors that encounter our systems or data. We additionally engage and retain third-party consultants, legal advisors and assessors to keep us apprised of emerging third-party risk, defense and mitigation strategies, and governance best practices.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: For additional information on our cybersecurity risks, see " The degradation, failure or misuse of the Company's information systems could cause a disruption of services or improper loss, use and disclosure of personal data or other confidential information, resulting in increased costs, liabilities or loss of revenue. " in Part I, Item 1A of this Annual Report on Form 10-K.


text: Role of the Board of Directors Our Board of Directors has overall responsibility for risk oversight and has delegated to the Audit Committee primary enterprise risk oversight responsibility, including privacy and cybersecurity risk exposures, policies and practices, the steps management takes to detect, monitor and mitigate such risks and the potential impact of those exposures on our business, financial results, operations and reputation. The Audit Committee receives quarterly updates on the enterprise risk management program, including cybersecurity risks and the initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates, employee education initiatives, and internal audit observations, if applicable. In addition to the efforts undertaken by the Audit Committee, the full Board of Directors regularly reviews matters relating to cybersecurity risk and cybersecurity risk management. Any material cybersecurity events would be brought to the attention of the full Board of Directors once the event is deemed material. We additionally use our incident response framework as part of the process we employ to keep our management and Board of Directors informed and to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Role of Management We have established a cross functional Information Security Steering Committee ("ISSC") with executives from our Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at the corporate level and our subsidiaries.


text: At Formula 1, the Head of Information Security, together with the Director of IT, are responsible for day-to-day management and oversight of subsidiary cybersecurity, including assessing, monitoring and mitigating cybersecurity risk as well as regular reporting to Formula 1 executive management and the ISSC.


text: Liberty and Formula 1 have also established a Risk and Compliance Committee responsible for overseeing and monitoring all corporate compliance initiatives at Formula 1, including cybersecurity. The Risk and Compliance Committee is composed of members of Liberty's ISSC as well as members of Formula 1's executive leadership team, including the Chief Financial Officer and General Counsel. The Head of Information Security provides quarterly updates to the Risk and Compliance Committee on cybersecurity risks and initiatives as well as any cybersecurity events, as applicable.


text: Our management team's experience includes a diverse background in telecom, technology, media and other industries, with decades of experience in various aspects of cybersecurity. Liberty's Head of Cybersecurity has more than 25 years of cybersecurity and IT experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications. Formula 1's Head of Information Security and Director of IT together have more than 30 years of experience and the Head of Information Security has multiple certifications, including Certified Information Security Manager and Certified Information Systems Security Professional. All have worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, business applications, customer facing applications and customer payment systems.


text: We operate in the biopharmaceutical sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and the results of operations, including intellectual property theft, fraud, extortion, harm to employees, third party vendors or customers, violation of privacy laws and other litigation and legal risk, and reputational risk.

companyName: IOVANCE BIOTHERAPEUTICS, INC.

ticker: IOVA


text: Risk Management and Strategy We have designed and implemented a cybersecurity program which includes administrative, technical, and physical controls and processes to manage and mitigate material risks from internal and external cybersecurity threats, including but not limited to the following: A team responsible for designing, implementing, and continually improving our policies, procedures, and technology. A risk management process to identify, assess, and treat internal and external ( third-party) cybersecurity risks.


text: An incident management program to effectively and efficiently identify, review, and escalate incidents with the appropriate stakeholders (e.g., CEO, CFO, Legal, Finance, and others, as required).


text: A vulnerability management program to scan and penetration test, on an ongoing basis, our systems and networks to identify and treat identified vulnerabilities.


text: A security awareness program that educates our team members on an ongoing basis on internal security policies and secure behaviors.


text: Engage with key vendors, industry participants and intelligence and law enforcement communities as part of continuing efforts to evaluate and enhance the effectiveness of our information security program.


text: Periodically reporting risks, previous and current incidents, and ways to mitigate risks to the Chief Executive Officer, the Audit Committee of the Board of Directors, and other members of senior management.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected our business strategy, results of operations, or financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition. Refer to Item 1A – " Our internal computer systems, or those used by our CROs or other contractors or consultants, may fail or suffer security breaches " and " We are dependent on information technology, systems, infrastructure and data," which are incorporated by reference into this Item 1C. As cybersecurity threats become more sophisticated and coordinated, it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures as we pursue our business strategies.


text: Board of Directors The Audit Committee operates under a written charter adopted by the Company's Board of Directors. The Audit Committee oversees, among other things, a system of internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee is also responsible for the adequacy and effectiveness of the Company's internal controls, including those internal controls that are designed to assess, identify, and manage material risks from cybersecurity threats. For further information about the Audit Committee's role in assessing and managing the registrant's material risks from cybersecurity threats, see "Risk Management and Strategy," under this Item 1C.


text: Our team of cybersecurity professionals is led by our Vice President, Infrastructure and Security, who along with other members of the IT team collectively over extensive experience in the cybersecurity space in both the pharmaceutical and non-pharmaceutical sectors, many of whom have obtained professional security certifications. The IT team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. For further information about Management's role in assessing and managing the registrant's material risks from cybersecurity threats, see "Risk Management and Strategy," under this Item 1C.


text: Risk Management and Strategy QVC Group's corporate level IT and cybersecurity functions are provided by LMC as part of the services agreement described in Item 1. Business. Through the services agreement, we participate in LMC's processes for assessing, identifying, and managing risks from cybersecurity threats at the corporate level, as detailed below. QVC operates its own cybersecurity function with oversight from QVC Group.

companyName: QVC Group, Inc.

ticker: QVCGA


text: We are committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, have implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats.


text: Cybersecurity risks are assessed as part of our enterprise risk assessment and risk management program and our cybersecurity risk management program is designed and assessed based on recognized frameworks, including the National Institute of Standards and Technology Cybersecurity Framework.


text: Our executive management team, with regulatory and governance oversight from our Audit Committee, are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.

companyName: HOOKIPA Pharma Inc.

ticker: HOOK


text: We rely on a multidisciplinary team, including our information security function, legal department, management, and third-party consultant s, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, using manual and automated tools such as vulnerability scanning software, monitoring existing and emerging cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and assessments, and conducting threat and vulnerability assessments.


text: To manage and mitigate material risks from cybersecurity threats to our information systems and data, we implement and maintain various technical, physical and organizational measures, processes and policies. These measures include risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our IT, security and other departments, encryption of data, network security controls, access controls, physical security, asset management, system monitoring, vendor risk management program, employee cybersecurity awareness and training, phishing tests, and penetration testing. Cybersecurity awareness training is also made available annually to our board of directors.


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place at the corporate level and at QVC. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary.


text: To operate our business, we utilize certain third-party service providers to perform a variety of operational functions. We have implemented a third-party risk management program to evaluate the cybersecurity practices of higher risk vendors and vendors that encounter our systems or data. We additionally engage and retain third-party consultants, legal advisors and assessors to keep us appraised of emerging third-party risk, defense and mitigation strategies, and governance best practices.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: For additional information on our cybersecurity risks, see "Risks Related to Technology and Information Security." in Part I, Item 1A of this Annual Report on Form 10-K.


text: Role of the Board of Directors Our board of directors has overall responsibility for risk oversight and has delegated to the audit committee primary enterprise risk oversight responsibility, including privacy and cybersecurity risk exposures, policies and practices, the steps management takes to detect, monitor and mitigate such risks and the potential impact of those exposures on our business, financial results, operations and reputation. The audit committee receives quarterly updates on the enterprise risk management program, including cybersecurity risks and the initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates, employee education initiatives, and internal audit observations, if applicable. In addition to the efforts undertaken by the audit committee, the full board of directors regularly reviews matters relating to cybersecurity risk and cybersecurity risk management. Any material cybersecurity events would be brought to the attention of the full board of directors once the event is deemed material. We additionally use our incident response framework as part of the process we employ to keep our management and board of directors informed and to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Role of Management Through our services agreement with LMC discussed in Item 1, "Business" of this Annual Report on Form 10-K, we have established a cross functional Information Security Steering Committee ("ISSC") with executives from our Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at the corporate level and at QVC.


text: At QVC, the VP Information Security is responsible for day-to-day management and oversight of subsidiary cybersecurity, including assessing, monitoring and mitigating cybersecurity risk. The VP Information Security provides regular reporting to the ISSC and QVC executive management, including quarterly updates on security hot topics, threat intelligence, incidents (if any) and the status of the cybersecurity program to the Chief Executive Officer and the broader executive management team. In addition to real time notification to the ISSC of privacy and security incidents, the ISSC and QVC have a bi-monthly meeting to discuss incidents, incident trends, developments in laws and regulations, and other privacy and cybersecurity hot topics, as applicable.


text: Our cybersecurity function, led by our head of IT and supported by our third-party service providers, is responsible for our cybersecurity risk management and strategy processes. These functions have significant prior work experience in various roles involving managing information security, developing cybersecurity strategy and implementing effective information and cybersecurity programs.


text: Our management team's experience includes a diverse background in telecom, retail and other industries, with decades of experience in various aspects of technology and cybersecurity. LMC's Head of Cybersecurity, who sits on the ISSC, has more than 25 years of cybersecurity and IT experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications. QVC's VP Information Security has more than 30 years of IT experience and holds multiple certifications, including Certified Information Security System Professional and Certified Information Security Manager. Together, this management team has worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, business applications, customer facing applications and customer payment systems.


text: Cybersecurity Risk Management and Strategy We have implemented and maintain various cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and clinical trial data ("Information Systems and Data").


text: Our cybersecurity function, led by our head of IT and supported by third -party service providers, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: maintaining manual and automated tools, subscribing to reports and services that identify cybersecurity threats, conducting scans of our threat environment, evaluating our and our industry's cybersecurity risk profile, evaluating threats reported to us, completing internal and external cybersecurity audits, completing third-party cybersecurity threat assessments, conducting vulnerability assessments, leveraging external intelligence feeds, and tabletop incident response exercises.


text: Depending on the environment, we implement and maintain technical, physical, and organizational measures, processes, standards, practices, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These measures, processes, standards, practices, and policies address, for example: incident detection and response, risk assessments, security certifications, encryption, network security controls, data segregation, access controls, physical security, asset management (such as tracking and disposal), systems monitoring, employee cybersecurity awareness training, and systems monitoring. We also have cybersecurity insurance.


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall enterprise risk assessment process. We have a cybersecurity-specific risk assessment process designed to assess identified material risks from cybersecurity threats. This process is designed to help us manage our material risks from cybersecurity threats and protect against, detect, and respond to cybersecurity incidents.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity software providers and cybersecurity consultants that provide threat intelligence, managed cybersecurity, forensic, and penetration testing services.


text: Further, we use third-party service providers to perform a variety of functions throughout our business, such as software-as-a-service providers, data hosting companies, contract research organizations, and contract manufacturing organizations. We have certain vendor management processes designed to help manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management processes may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including, for example, security questionnaires and the imposition of contractual obligations related to cybersecurity on the provider.

stage1Category: Third-Party Risk


text: For a description of the cybersecurity risks and related impacts that may materially affect the Company and how they may do so, see our risk factors in Part I, Item 1A of this Annual Report on Form 10-K, including "Cybersecurity risks and the failure to maintain the security, confidentiality, integrity, and availability of our information technology systems or data, and those maintained on our behalf, could result in adverse consequences that materially affect our business, including without limitation regulatory investigations or actions, a material disruption of the development programs of our product candidates, damage to our reputation and/or subject us to costs, loss of customers or sales, fines and penalties or lawsuits."


text: Cybersecurity Governance Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats and data breaches. On a quarterly basis, the Audit Committee receives an overview from our head of IT regarding our cybersecurity threat risk management and strategy processes, which may include, for example, covering topics such as data security posture, results from third-party assessments, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The Chair of the Audit Committee periodically updates our Board of Directors on its oversight of cybersecurity and data breach risk management and strategies.


text: Our cybersecurity incident response plan provides for escalation of certain cybersecurity incidents to members of management depending on the circumstances, including our CFO, CDO, and CEO. Management works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. Our incident response team also reports material cybersecurity incidents to the Chair of the Audit Committee.


text: Axcelis implements an enterprise risk management ("ERM") process in which management annually identifies and reviews the principal risks to which the Company's business is subject, rating each risk in terms of likelihood of occurrence and severity of impact. Risks that have either a high likelihood or a high potential impact on our business are assessed quarterly with respect to the trend (an increasing or decreasing risk) and whether additional mitigation actions are needed. These quarterly risk assessments are shared with our Board of Directors, with the Audit Committee reviewing any changes in risk identification or ranking on an annual basis.

companyName: AXCELIS TECHNOLOGIES INC

ticker: ACLS


text: Cybersecurity risks are integrated into our overall ERM, and our Chief Information Officer assesses the trends and need for additional mitigations on a quarterly basis. Our main concerns are (i) the unauthorized exfiltration of personal information pertaining to Axcelis employees, (ii) the unauthorized exfiltration of confidential business or technical information, and (iii) an inability to use our business systems for a period of time following a cybersecurity event.


text: Management has adopted a Cybersecurity Incident Response plan which lays out the roles of IT personnel, senior leadership, and legal resources in responding to a cybersecurity incident. This plan is shared with our Board of Directors and reviewed annually. These risks could materially impact the business of the Company. To date, the Company has not experienced a material cybersecurity incident.


text: To implement risk management and protective strategies, management implements a "Layered Security Strategy" that aligns with National Institute of Standards and Technology Cybersecurity Framework. We consider the various factors that can play a role in the occurrence of a cybersecurity incident, such as: Unauthorized system access User errors Undetected system vulnerabilities Mobile device risks Vulnerabilities in software applications and specific hardware Third party cybersecurity risks Insider threats


text: Management has implemented specific mitigation strategies for each of these factors, such as (i) user training to avoid fraud and other scams, (ii) utilizing multi-factor authentication processes for system access, (iii) engaging in vulnerability scanning applications, (iv) upgrading software and hardware to those with the greatest security protections, and (v) ensuring third parties to whom sensitive information is provided have appropriate security. Management has also developed a vendor assessment form to evaluate potential "Software as a Service" providers, which is incorporated in the Company's RFP processes. The Company routinely obtains and reviews SOC 2 reports from third parties who have access to the Company's information, some of which are part of management's internal controls over financial reporting. The Company accesses cybersecurity consultants and legal counsel to assist in the identification of vulnerabilities and advise on appropriate mitigation and preparedness actions.


text: Overall, we devote resources to network security, data encryption, employee training and other measures to protect our systems and data from unauthorized access or misuse. This includes the emerging need to protect our data from the unauthorized incorporation in large language models or other artificial intelligence systems. The Audit Committee and full Board of Directors receive quarterly reports on cybersecurity risks and annual reports on management initiatives to promote cybersecurity.


text: Risk Management and Strategy In the ordinary course of our business, we collect and store sensitive data, including legally protected personal information, such as test results and other patient health information, credit card and other financial information, insurance information, and personally identifiable information, as well as sensitive intellectual property and other proprietary business information, including that of our customers, payers and collaboration partners. We are highly dependent on information technology networks and systems – our own as well as those of third-party vendors and their subcontractors – to securely process, transmit, and store this sensitive data and business critical information.

companyName: Natera, Inc.

ticker: NTRA


text: Although we take measures to protect sensitive information from unauthorized access, use or disclosure, our information technology and infrastructure, and that of our technology and other third-party service providers and their subcontractors, are nevertheless inherently vulnerable to, and from time to time experience, various cybersecurity threats. We continue to invest in the security and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Item 1A. Risk Factors" included elsewhere in this Annual Report on Form 10-K.


text: The Board has delegated primary responsibility for oversight of our cybersecurity risk exposures to the Audit Committee of the Board, and the Audit Committee of the Board receives routine updates on cybersecurity matters from our Director of Information Technology and other members of management. Our Director of Information Technology leads our cybersecurity efforts and has 15 years of information technology experience. There are no management positions directly responsible for overseeing our cybersecurity risk. Rather, our Director of Information Technology and our broader information technology department work closely with members of management to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Solid Power, Inc.

ticker: SLDP


text: Risk Management Processes Our Information Security Execution Team is responsible for the day-to-day execution of our information security strategy and operations, and comprises key stakeholders across the Company's information services & technology, engineering, legal, privacy, compliance, finance, human resources, and product teams. The Information Security Execution Team coordinates cross functionally to identify, assess, and address immediate and emerging risks from cybersecurity threats, including leading the formation and activities of working groups and response teams to address cybersecurity matters that arise from time to time. We maintain a cybersecurity incident response plan that addresses critical aspects of incident management, including detection, impact analysis, containment, mitigation, remediation, recovery, and long-term strategies for remediation and prevention of future incidents. In carrying out our incident response plan, our Information Security Execution Team also assesses incidents, or multiple related incidents, by reference to a set of specified criteria and, if one or more of such criteria are met, reports such incidents to management.


text: Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology, or NIST, Cybersecurity Framework. We use various tools and methodologies to monitor and manage cybersecurity risks. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. Our Information Security Execution Team conducts annual tabletop exercises to ensure preparedness for information security, including cybersecurity, incidents. In addition, we promote a company culture of awareness and discipline in cybersecurity matters through annual employee training and education, including periodic phishing simulations.


text: We engage with a range of external experts, including cybersecurity assessors, consultants, and auditors, in evaluating and attesting to our risk management systems, including an annual Systems and Organization Controls 2, or SOC 2, audit with respect to the security, availability, confidentiality, and process integrity trust services criteria, or TSC. Our collaboration with these third-party service providers includes regular audits, threat assessments, and consultation on cybersecurity strategy and enhancements. Recognizing the risks associated with these and other third-party service providers, we also conduct risk assessments on selected systems and third-party service providers on an ongoing basis.


text: Cybersecurity is an important area of focus for our board of directors. Our audit committee is responsible for carrying out, on behalf of our board of directors, oversight of information security, including cybersecurity, risks. Our audit committee is composed of directors with diverse expertise relevant to such committee's responsibilities, and includes two directors who have expertise or certifications in cybersecurity. Our management team provides updates on cybersecurity matters to our audit committee on a quarterly basis, with more frequent or interim communications as warranted. In addition to the oversight by our audit committee, our board of directors receives an annual report on cybersecurity matters from our Chief Technology Officer, or CTO. Our Chief Compliance & Privacy Officer, or CCPO, and CTO also attend regular meetings of our board of directors, and engage in discussions on an ad hoc basis relating to cybersecurity and information security matters.


text: We maintain an Information Security Leadership Committee, or ISLC, that is accountable for enterprise-level information security risk strategy, identification, prioritization, and mitigation, including establishing objectives and priorities. The ISLC comprises company executives that, collectively, represent experience and expertise in information technology, enterprise security and risk management, cybersecurity, engineering, technology, privacy, data security, and healthcare compliance. Members of this committee include our CTO, CCPO, Chief Information Officer, Chief Information Security Officer, and Chief Accounting Officer. The ISLC meets on at least a quarterly basis to review matters including updates on existing and emerging cybersecurity risks and threats including prioritization, mitigation, and remediation; the status of projects to strengthen our information security systems; assessments of our information security program and operations; and prioritized information security incidents, if any. The ISLC oversees the Information Security Execution Team.


text: Risk Management and Strategy We use various tools and methodologies, including third-party services, to assess, identify, and manage cybersecurity threats. For example, we utilize third-party services to monitor the security and integrity of our information systems and the other third-party information systems upon which we rely on an ongoing basis. We also engage a third-party cybersecurity auditor for periodic penetration and vulnerability testing and assessment of our processes. Our information technology department oversees cybersecurity risk management and reports significant incidents to management. We consult with our advisors as appropriate, including on materiality analysis and disclosure matters, and management makes the final materiality determinations and disclosure and other compliance decisions.


text: We have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, but we cannot guarantee that we will not be materially affected in the future by such risks or any future cybersecurity incidents. For more information, see "Part I, Item A. Risk Factors—Risks Related to Legal and Regulatory Compliance—We may be adversely impacted by a disruption or failure of our information technology infrastructure, data security breach, or failure to comply with privacy laws."


text: This information security program is a key part of our overall risk management system, which is administered by our Chief Risk Officer. The program includes administrative, technical and physical safeguards to help ensure the security and confidentiality of customer records and information. These security and privacy policies and procedures are in effect across all of our businesses and geographic locations.

companyName: QCR HOLDINGS INC

ticker: QCRH


text: Risk management and strategy: Matson's information security, internal audit, business continuity and risk management teams help to identify and assess cyber and information security threats and vulnerabilities, and establish the appropriate business systems, preventive controls and risk mitigation strategies. The main objectives of Matson's approach to cyber and information security are to protect confidential information while maintaining data integrity and availability; support legal and regulatory compliance; and prevent disruptions to business operations. The Company regularly enhances its systems, controls and strategies in an effort to guard against security breaches and unauthorized access to Matson systems or data and develops policies to guide the appropriate handling and protection of sensitive information by Matson. This includes managing third-party supply chain risks with its key vendors and business partners. It also maintains incident response and remediation plans which provide that cybersecurity incidents be communicated to the Company's senior leaders who are responsible for assessing the risks associated with a cybersecurity incident and initiating the Company's incident response plan. The Company's incident response and remediation plans are further supported by ongoing security monitoring services as well as a dedicated management team focused on business continuity to help support operations and mitigate disruptions should a breach, unauthorized access or other disruption event occur. In addition, the Company has established a zero trust network access roadmap that includes key security controls designed to help protect Matson employees and contractors with access to Matson systems against phishing and brute force password attacks.

companyName: Matson, Inc.

ticker: MATX


text: The risk management process occurs throughout the organization, but is facilitated through a risk management steering committee comprised of senior management whose members meet regularly to identify and address specific significant risks. At least twice a year, management assesses and categorizes key risks based on their potential impact to the Company and the likelihood of the risk occurring as part of Matson's enterprise risk management ("ERM") program. The ERM program includes regular cyber and information security risk assessments conducted by independent, third-party cybersecurity professionals, including assessors, consultants, auditors and penetration testers. Results from these risk assessments, along with remediation recommendations, are provided to executive leadership and the Company's Board of Directors (the "Board"). The Board also consults with outside advisors and experts, when appropriate, to anticipate future threats and trends, and their impact on the Company's risk environment. In addition, the Company utilizes third-party audits to test its cybersecurity systems, incident response and remediation plans to help spot vulnerabilities and improve its ability to respond to unexpected events. For more information on Matson's ERM program, see "—Governance " below.


text: As part of its approach, the Company conducts varied due diligence on its key technology vendors to review their cybersecurity risk profiles and scores. This includes pre-contract award due diligence reviews of such vendors and cyber and information security requirements within its vendor contracts. Additionally, the Company leverages independent, third-party services to monitor the cyber and information security posture of key suppliers and vendors. The Company's quarterly information security update to the Chief Executive Officer and Chief Financial Officer includes an update on the results of these reviews.


text: Training, education and awareness-building are mechanisms Matson uses to help embed a strong culture of cyber and information security within its workplace. The Company's long-term aim is to have a workforce with high-functioning knowledge of cybersecurity. In furtherance of this aim, the Company conducts training annually for employees that addresses cyber and information security, and holds additional training typically at least three times per year for specific topics such as data and email security. Furthermore, Matson requires enhanced training for employees with access to particularly sensitive information. The Company also has specific escalation processes and resources in place for employees to raise a concern should they notice anything suspicious.


text: IMO MSC-FAL.1/Circ.3/Rev.2 BIMCO's Guidelines for Cyber Security Onboard Ships IAPH's Cybersecurity Guidelines for Ports and Port Facilities In addition, Matson participates in the following organizations in its effort to better understand best practices and advance its systems and policies over time:


text: National Security Administration ("NSA")'s Cybersecurity Collaboration Center U.S. Cybersecurity and Infrastructure Security Agency's Critical Partnership Federal Bureau of Investigation ("FBI") InfraGard U.S. Coast Guard Area Maritime Security Committees and Cybersecurity Subcommittees Cyber-Hawaii Maritime Transportation System Information Sharing and Analysis Center ("MTS-ISAC")


text: Since the beginning of the last fiscal year, Matson has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected the Company, but the Company faces certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect the Company. For more information on the risks and impacts of these matters to Matson, see Part I, Item 1A. Risk Factors – "The Company's information technology systems have in the past and may in the future be exposed to cybersecurity risks and other disruptions that could impair the Company's ability to operate and adversely affect its business. "


text: Governance: The Board has oversight of the Company's risk management process, which includes overseeing our process for identifying, assessing and mitigating significant financial, operational, legal, strategic, and other risks that may affect the Company. These risks include, among other things, risks related to cybersecurity and information security. Risk oversight plays a role in major Board decisions, and the evaluation of key risks is a core part of the decision-making process – from guidance on strategy to review of major capital expenditures.


text: The Board administers its oversight role in part through its committees. The Audit Committee is responsible for overseeing and reviewing cyber and information security risks, policies and programs and reviews the Company's risk assessment, risk management and compliance policies twice a year. Senior leaders, including Matson's Chief Information Officer, review the Company's cybersecurity program with the Board at least annually, and the Chief Information Officer meets with the Audit Committee at least twice per year. Matson's information security efforts are led by its Chief Information Officer, who has over 25 years of experience in enterprise software development, infrastructure and management, including over 18 years with Matson and 7 years at Charles Schwab as Senior Manager of Middleware Security, and the Chief Information Security Officer, who is a Certified Information Systems Security Professional, Certified Information Systems Auditor, and is AWS Certified. The Chief Information Officer and the Chief Information Security Officer provide regular briefings to the Chief Executive Officer, the Chief Financial Officer, the Board, and the Audit Committee. In addition, the Corporate Compliance Committee, comprised of business unit leaders, helps oversee cybersecurity initiatives and reports twice per year to the Audit Committee. These processes are part of the risk management processes described in the risk management and strategy section above.


text: The Audit Committee also oversees Matson's ERM program, which includes cyber and information security risks. The ERM process, which follows the Committee of Sponsoring Organization Framework, is designed to promote visibility to the Board and management of critical risks and risk mitigation strategies across various time frames, including the short-, medium- and long-term. Risk mitigation efforts are integrated into strategic plans and budgets. The Chief Financial Officer and the head of internal a udit review the Company's risk management activities with the Audit Committee and the Board on a regular basis. Management also regularly updates the full Board at and between Board meetings on the ERM program and other risk-related matters. In addition, executive sessions of the Board, which are led by the Lead Independent Director, have focused on certain risk oversight topics from time to time. The Lead Independent Director consults with the Chairman of the Board regarding risk-focused topics at Board meetings.


text: Risk Management and Strategy The Company believes that a strong cybersecurity program is vital to effective cybersecurity risk management. The Company recognizes the importance of developing, implementing, and maintaining robust cybersecurity measures to help safeguard sensitive information and its business operations, and to protect the confidentiality, integrity, and availability of its information systems and the nonpublic information transmitted, processed and stored on its systems or those of third-party service providers.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: Managing Material Risks & Integrated Overall Risk Management The Company has integrated cybersecurity risk management into its broader risk management framework in order to promote a culture that values protecting sensitive information. This integration is intended to promote the inclusion of cybersecurity considerations in decision-making processes throughout the Company. The Bank's general risk management personnel, including the Chief Risk Officer ("CRO"), work closely with their information technology and security counterparts to evaluate and address cybersecurity threats in alignment with our business objectives and operational needs.


text: The Company also maintains a system-wide information security program that applies to all employees. All employees are expected to assist in safeguarding the Company's information systems and to assist in the detection and reporting of cybersecurity incidents. This Company-wide program is intended to identify and assess internal and external cyber and information security risks that may threaten the security or integrity of nonpublic information stored on the Company's information systems or those of third-party providers from unauthorized access, use or other malicious acts.


text: The Board of Directors is responsible for overseeing the Company's cybersecurity program. The Board of Directors has established oversight mechanisms that are intended to promote effective governance in managing risks associated with cybersecurity threats because it recognizes the significance of these threats to the Company's operational integrity and the information stored on the Company's information systems or those of third-party service providers. See "—Governance— Board of Directors Oversight."


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts from time to time, including cybersecurity assessors, risk management professionals, and other consultants, in evaluating and testing our risk management systems. We also engage third-party services on an ongoing basis to conduct independent audits of our risk management systems. These engagements enable us to leverage specialized knowledge and insights and assist the Company with its goal of maintaining cybersecurity strategies and processes that are consistent with industry best practices. Our collaboration with these third-parties includes table top exercises, penetration testing and other cyber-support services.


text: The CISO plays an important role in the prevention, detection, mitigation, and remediation of cybersecurity incidents and in informing management, the Risk Committee and the Board of Directors on cybersecurity risks and issues. The CISO provides quarterly briefings to the Risk Committee on any significant information security issues, relevant cybersecurity metrics and the status of the Company's security-related strategic initiatives. As discussed above, the CISO also provides mid-year and annual reports to the full Board of Directors regarding the state of the Company's information security program. The annual reports encompass a broad range of topics, including: Confidentiality of nonpublic information and the integrity and security of the Company's information systems; Cybersecurity policies and procedures; Material cybersecurity risks;


text: Oversee Third-party Risk Because the Company is aware of the risks associated with third-party service providers, the Company has implemented policies and processes to oversee and assist with managing these risks. The Company's Third-Party Risk Management Officer (the "TPRM") conducts security and risk assessments of all third-party providers before engagement and monitors these third-party providers on an ongoing basis to assess each provider's compliance with the Company's cybersecurity standards, which are intended to be commensurate with the level of risk and complexity of the relationship with, and the activities performed by, a given provider engaged by the Company. In addition, the TPRM conducts an annual risk assessment of any third-party provider that provides critical services to the Company or has access to customers' protected data. This approach is designed to help identify and mitigate risks related to data breaches or other cybersecurity incidents originating from third-parties in order to better protect our customers' personally identifiable information and the Company's assets and data.


text: Risks from Cybersecurity Threats We have not encountered cybersecurity threats or incidents that have materially and adversely affected, or are reasonably likely to materially and adversely affect, the Company's business strategy, results of operations or financial condition. Notwithstanding the defensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats, incidents or disruptions may not be fully insured. For more information regarding the risks we face from cybersecurity threats, see Part I, Item 1A., "Risk Factors— Risks Related to the Company's Operations—A failure in the Company's operation and/or information systems or infrastructure, or those of third parties, including cyber-attacks, could impair the Company's liquidity, disrupt its businesses, result in the unauthorized disclosure of confidential information, damage its reputation, and cause financial losses."


text: Board of Directors Oversight Our information security program is designed to ensure adequate governance, and oversight is in place while evolving to meet changes in applicable laws and regulations, and industry best practices. Cybersecurity is a significant risk to the enterprise and matters related to information security are regularly featured as part of management's enterprise risk profile updates to the Risk Committee of the Board of Directors (the " Risk Committee "), which occur at least on a quarterly basis. The Chair of the Risk Committee reports to the Board of Directors on the committee's proceedings and activities, including in connection with the committee's deliberation on information security matters, on a regular basis. In addition to regular touchpoints on cyber matters at the Risk Committee, the Board of Directors receives briefings from the Bank's Chief Information Security Officer (the "CISO") semi-annually.


text: The Board of Directors directly, and through its standing committees (particularly the Risk Committee and the Audit Committee of the Board of Directors) also engage in broader discussions regarding existing and emerging operational and technology risks with members of management across all lines of defense. To supplement the Board of Directors' regular engagement regarding the Company's information security program, the director education program includes cybersecurity-related training opportunities, which assists the directors in staying current on developments and maintaining appropriate knowledge regarding the evolving cybersecurity and threat landscape.


text: Reporting to Board of Directors The CISO provides management, the Risk Committee and the Board of Directors with information regarding the Company's cybersecurity program and potential cybersecurity threats or incidents. In addition, the CISO is empowered to escalate material cybersecurity threats or incidents and strategic risk management decisions to the Board of Directors so that they can provide appropriate oversight and guidance on these critical cybersecurity issues within the context of the Company's overall strategic objectives and business operations. Management, the Company's Chief Digital Officer (the "CDO"), the CRO, and the Incident Management Team (the "IMT") are also required to report cybersecurity threats and incidents to the Risk Committee and/or the Board of Directors, as applicable.


text: Management's Role Managing Risk The Company's Enterprise Risk Management Committee (the "ERMC"), an interdepartmental, management-level committee, meets at least quarterly and is responsible for ensuring that the Company has appropriate policies and procedures in place to help identify, measure, monitor and control potentially significant business risks. In connection with these responsibilities, the ERMC receives quarterly risk and control self-assessments and action plans for risk remediation, if required, to reduce residual risks. This includes information security action plans from the CISO, the CDO, and/or other key stakeholders. The incorporation of these reports into the ERMC's meetings is intended to promote the inclusion of cybersecurity considerations in the risk management decision-making processes throughout the Company.


text: The Information Technology/Information Security Steering Committee (the "IT Steering Committee") reports directly into the ERMC and meets at least quarterly. The IT Steering Committee is composed of senior members of management, including the CDO, the CRO and the CISO. The IT Steering Committee oversees information technology matters at the Company, including the implementation of all cybersecurity policies, standards, guidelines and procedures. The responsibilities of the IT Steering Committee include, among other things, updating the Company's information technology policies, reviewing the architecture of the Company's information system infrastructure and monitoring the progress of any significant hardware or software updates or installation. In addition, the IT Steering Committee provides quarterly reports to the ERMC and the Risk Committee regarding any information-technology-related matters that, in the opinion of the IT Steering Committee, should be escalated.


text: Any material cybersecurity incidents. In addition to these scheduled meetings, the Risk Committee, the CISO, the CDO, the CRO, and other members of management maintain ongoing dialogues with respect to emerging or potential cybersecurity threats. The Risk Committee also receives reports and updates from management regarding significant cybersecurity developments so that the Board of Directors can be promptly notified, as and when appropriate, of any threats or incidents as well as management's proposed responses.


text: Risk Management Personnel The Company's CISO has extensive experience in the field of cybersecurity and is responsible for managing the Company's cybersecurity risks and ensuring that the Company's security posture is aligned with its business objectives. Our CISO's technical and business experience is helpful for developing and executing our cybersecurity strategies. The CISO helps to oversee the Company's information security policies and programs, perform risk and vulnerability assessments of the Company's information systems, and coordinate responses to cybersecurity incidents in conjunction with the CDO, the Company's Incident Response Team (the "IRT"), the IMT and management.


text: The Company's CDO has extensive experience in establishing and maintaining scalable and secure technology systems and is responsible for maintaining the Company's various digital platforms. Our CDO worked in various systems, information technology and digital managerial roles at a global financial and investment firm prior to joining the Company. Our CDO's technical and managerial experience is helpful for developing and executing our cybersecurity strategies. The CDO helps to oversee the Company's efforts to improve its system's capabilities, reliability, scalability and security.


text: The Company's CRO is responsible for identifying, controlling and mitigating risks that could impact the Company's operations. Our CRO's decades of experience managing the various risks faced by financial institutions is helpful for developing and executing our cybersecurity strategies in a manner that is aligned with the overall risk management framework of the Company.


text: If the Company is notified of a cybersecurity incident affecting the Company's information systems, either by an employee, our defensive infrastructure, a regular system audit or another mechanism, the IRT, led by the CDO, will perform the technical functions required to analyze and contain such an incident, including, but not limited to, technical triage, in-depth analysis, technical mitigation and any necessary recovery actions. The IMT will be activated by the CISO, the CRO or another member of the team to assist in the response and evaluate the cybersecurity threat and coordinate the business decisions necessary to limit the impact of the cybersecurity incident during and after the response. The IMT will also perform similar functions if we detect or are alerted to a cybersecurity threat or incident involving a third-party service provider.


text: The Company's Network and Cloud Administration is led by the CDO and is also responsible for managing security infrastructure and deploying, configuring, and managing various security solutions, tools and products to assist in safeguarding the Company's information system infrastructure and operations.


text: Monitor Cybersecurity Incidents The IT Steering Committee, which is a subcommittee of the ERMC, established the Information Technology and Information Security Working Group (the "IT/IS Working Group"), which is comprised of the CDO, the Head of Information Technology Infrastructure, the CISO, the Information Security Officer, the Information Security Assurance Program Manager and certain other members of the Company's information technology engineering staff. The mission of the IT/IS Working Group is to foster the sharing of information among departments regarding existing and emerging threats and risks related to cybersecurity and related compliance issues in order to better integrate cybersecurity risk management and increase awareness of cybersecurity threats throughout the Company. This group meets on a weekly basis to discuss, among other things, vulnerability management, threat and risk analysis and the status of our continued enhancements to the Company's information security infrastructure that are intended to further manage and mitigate future risks.


text: The CISO implements and oversees policies and processes for the regular monitoring of our information systems. This includes the deployment of additional security measures, including defensive infrastructure, and regular system audits to identify potential vulnerabilities. If the CISO, the IRT and/or management believe a cybersecurity incident is potentially material, the CISO, the CRO or another member of the team can convene the IMT to further assist in the Company's remediation and response efforts. Following the remediation of the cybersecurity incident, the IRT and/or IMT will review the effectiveness and appropriateness of the Company's response in order to identify and implement potential enhancements to the Company's security infrastructure and the broader risk management framework.


text: We manage risks from cybersecurity threats through our overall companywide risk management process, which is overseen by our Board of Directors and specific Board Committees. Management has created a global information security program, which encompasses a dedicated global information security team and policies, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats. Our policies, procedures, and processes follow recognized frameworks established by the National Institute of Standards and Technology ("NIST"), as well as other relevant standards. Our program is designed to maintain the confidentiality, integrity, security, and availability of the data that is created, collected, stored, and used to operate our business.

companyName: STEEL DYNAMICS INC

ticker: STLD


text: Overseeing the performance of ongoing monitoring to remain nimble and agile in addressing evolving areas of cybersecurity risk; and Overseeing the Bank's cybersecurity preparedness.

companyName: Bank First Corp

ticker: BFC


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, utilizing, from time to time, tabletop exercises, business unit assessments, threat modeling, impact analyses, internal audits, external audits, third party vulnerability scans, third party penetration tests, and engagement of third parties to conduct analysis of our information security programs, including an overall assessment utilizing the NIST standards. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to team members or customers, and violations of data privacy or security laws.


text: Our Director of Information Security is responsible for leading the Information Security Team which has established a cybersecurity risk management program of policies and processes for assessing, identifying, and managing risk from cybersecurity threats. We have integrated these processes into our overall risk management systems and processes, and routinely assess risks from cybersecurity threats, including any potential unauthorized access to or activity conducted through our information systems that may result in material adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. This program includes established reasonable safeguards to minimize the identified risks; processes to reasonably address any identified gaps in existing safeguards; updates to existing safeguards as necessary; and monitoring the effectiveness of those safeguards.


text: Our safeguards include continuous network monitoring, complex passwords, team member training that reinforces our policies, standards, and practices, incident response capability reviews and exercises, and cybersecurity insurance and disaster recovery plans for the protection of our assets. The information security training and awareness program engages personnel through training modules on how to identify potential cybersecurity risks and protect the Company's resources and information. This training is mandatory for all team members monthly, and is supplemented by companywide testing initiatives, including periodic phishing tests.


text: Our cybersecurity risk management program also assesses third party providers, such as vendors, suppliers, and other business partners. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third party providers and potential risks when handling or processing our employee, business, or customer data.


text: Further, we have designated a member of our senior leadership team, our Chief Financial Officer, to oversee the management of the safeguards, cybersecurity risk assessment, and mitigation process. From time to time, the Company's program is reviewed and validated by internal and external experts.


text: In general, our incident response process follows the NIST framework and focuses on four phases: (i) preparation; (ii) detection and analysis; (iii) containment, eradication, and recovery; and (iv) post-incident remediation. As cybersecurity incidents occur, including at third party providers, the Director of Information Security leads the Information Security Team through a standardized incident response process that focuses on responding to and containing the threat, minimizing any business impact, and evaluating its severity level. The severity level assessment determines how widespread the incident is and to what degree it could impact our overall business and manufacturing environment. In the event an incident is determined by the Information Security Team to be a high severity level, our cross functional team, with expertise in various disciplines, will assess the incident to determine if it has had a material affect or is reasonably likely of having a material effect on the Company's business strategy, results of operations, or financial condition.


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our overall business strategy, results of operations, or financial condition over the long term. In the last three years, the Company has not been aware of any material cybersecurity incidents occurring and we have not incurred material expenses from cybersecurity incidents (including penalties and settlements, of which there were none). For additional discussion of whether and how risks from cybersecurity threats could materially affect or are reasonably likely to materially affect the Company, see Item 1A. Risk Factors – "We are subject to cybersecurity threats and may face risks to the security of our sensitive data and information technology which may adversely affect our business, results of operations, financial condition and cash flows. "


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our senior leadership team is responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as directly through the Audit Committee. Management and members of the Information Security Group ("ISG") regularly present to the Board of Directors regarding information security and an in-depth review of our processes for assessing, identifying, and managing material risks from cybersecurity threats. On a quarterly basis, the Audit Committee is informed by management concerning the status of existing and new cybersecurity risks, status of how management is addressing and mitigating those risks, cybersecurity and data privacy incidents (if any), and status of key information security initiatives. Additionally, on a biennial basis, we engage third parties to assess our information security program using the NIST framework, as well as perform penetration testing.


text: We have allocated substantial cross functional internal resources with expertise in information security, information technology, operations, risk management, human resources, finance, and legal to form a governance counsel known as the ISG. The ISG is an internal working group that collaborates with the Director of Information Security to ensure our cybersecurity program is adequately responsive to the evolving threat landscape. Our Director of Information Security has over twenty years of cybersecurity experience, has completed a Masters in Homeland Security, with an emphasis on cybersecurity, and holds several cybersecurity certifications.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These material risks are managed across Riot, our subsidiaries, and third-party contractors, and monitoring such risks and threats is integrated into our overall risk management program. Our risk management program is comprised of, among other things, policies that are designed to identify, assess, manage, and mitigate cybersecurity risk, and is based on applicable laws and regulations, informed by industry standards and best practices.

companyName: Riot Platforms, Inc.

ticker: RIOT


text: We conduct risk assessments to evaluate the effectiveness of our systems and processes in addressing threats and to identify opportunities for enhancements. Additionally, we conduct privacy and cybersecurity reviews, as well as annual employee training, and monitor emerging laws and regulations related to information security and data protection. We utilize third party tools and techniques to test and enhance our security controls, perform annual cybersecurity framework assessments, conduct ongoing penetration testing of our systems, and benchmark against industry practices. Our internal audit function provides independent assessment on the overall operations of our cybersecurity program and the supporting frameworks.


text: In support of our risk management program, we have adopted an Information Security Policy (the "Info-Sec Policy") and an Incident Response Plan (the "Response Plan") that establish administrative, physical, and technical controls and procedures to protect the integrity, confidentiality, and accessibility of sensitive data that may exist throughout the Company as well as processes to assess, identify, manage, and report cybersecurity risks and incidents. Our Info-Sec Policy applies to all persons working for the Company, as well as any third parties working with us in any capacity. Violation of our Info-Sec Policy may result in revocation of access privileges, and disciplinary action up to and including termination of employment or service relations for third parties.


text: Our cybersecurity team analyzes all third-party vendors for compliance with our internal Info-Sec Policy in order to help us assess potential risks associated with their security controls. We also generally require third parties to, among other things, maintain security controls to protect our confidential information or data, and to notify us promptly, but in any case, no later than twenty-four (24) hours after the occurrence of any data breach or cybersecurity incident that may impact our data. After coordinating a response to any third-party cybersecurity incident, the incident response team reviews service providers' compliance with the privacy and data security requirements of our Info-Sec Policy, obtains written assurance of corrective actions, as appropriate, and considers whether additional measures need to be taken to protect the Company.


text: Our cybersecurity team engages and utilizes third-party services as it monitors and actively responds to cybersecurity threats. We utilize an Endpoint Detection and Response (EDR) platform, an anti-virus application, through which incoming electronic communications are filtered, and an email security platform which seeks out identifiers in communications that disguise, impersonate, or otherwise misrepresent the source of the communication. Any such communications are then subject to quarantine or removal depending on the severity of issue. Additionally, we use a Security Information and Event Management (SIEM) system, which allows us to store logs off the system of record to prevent log tampering and provides the cybersecurity team functionality to build alerts on specific use cases that are important and unique to our business. We also implement robust network security protections and enterprise hardware for firewalls to safeguard our infrastructure against unauthorized access and cyber threats. Our strategy for 2025 includes leveraging AI and machine learning for enhanced threat detection and response, adopting a Zero Trust architecture, and using quantum-resistant encryption methods for data protection. We also focus on ransomware defense, regular backup and recovery processes, and continuous employee training and awareness programs. Additionally, we ensure compliance with the latest regulations, participate in threat intelligence sharing, and explore emerging technologies like post-quantum cryptography and blockchain security. If our applications fail or our software does not successfully block malicious electronic communications, employees are required to notify an immediate supervisor or the cybersecurity team promptly, but in no circumstances later than twenty-four (24) hours after such occurrence.


text: Our Board has ultimate oversight of our strategic and business risk management and, as such, has oversight responsibilities for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. The Board has delegated to the Audit Committee oversight risks of cybersecurity risk policies, practices and procedures. Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing and updating processes to ensure such potential risks are monitored, putting in place appropriate mitigation measures, and providing regular reports on cybersecurity trends and risks, and should they arise, any material incidents with our Board.


text: Our Chief Financial Officer is responsible for our cybersecurity program, and our Director of Cyber Security is our incident response team leader. In this position, our Director of Cyber Security oversees our cybersecurity team, and guides our incident response team, which is comprised of members from across our organization, including cybersecurity, IT support, mining operations, software engineering, compliance and legal, as well as contractors and other partners, as they support our cybersecurity functions. Our Director of Cyber Security has nearly two decades of experience in cybersecurity management and policy, achieved through job training, college education, and work in security and alignment of information technology solutions.


text: The Response Plan, developed by management and our cybersecurity team, and IT support team, serves as a Company-wide guide to facilitate coordinated, prompt, and systematic responses to any cybersecurity incidents and utilizes four interconnecting phases: (1) Preparation; (2) Detection and Analysis; (3) Containment, Eradication, and Recovery; and (4) Post-Incident Activity.


text: Finally, the Company has established an Information Technology Committee to support the ISO in implementing the CAT, document formal action plans to be presented to the Board of Directors, enforce and implement the controls established by the CAT, and ensure employee compliance with internal controls


text: Upon detection of a cybersecurity incident and initial intake and validation by our cybersecurity team, our incident response team triages and evaluates the cybersecurity incident, and, depending on the severity, escalates the incident to management and a cross-functional working group. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and reported to executive management. Determination of what resources are needed to address the incident, prioritizing of response activities, forming of action plans, and notification of external parties as needed are then undertaken by executive management and the cross-functional working group, led by our Chief Financial Officer and Director of Cyber Security. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our executive management makes the final materiality and disclosure determinations, among other compliance decisions.


text: During 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we may not be successful in eliminating all risks from cybersecurity threats and can provide no assurances that undetected cybersecurity incidents have not occurred. See Part I, Item 1A. "Risk Factors" of this Annual Report for more information regarding the cybersecurity risks we face.


text: Risk Management and Strategy In the course of our operations, the Company receives and maintains sensitive information from our guests, employees, partners, and business operations. To address cybersecurity threats to this information, the Company uses a risk-based approach to create and implement a detailed set of information security policies and procedures based on frameworks established by the National Institute of Standards and Technology. The Company's Head of Information Security manages the Company's cybersecurity efforts and leads the cybersecurity team under the direct oversight of our Chief Technology Officer. These individuals, including all members of the cybersecurity team, have an average of over 16 years of experience involving information technology, including security, auditing, compliance, systems, and programming. Additionally, the Company engages in the use of external cybersecurity experts for training, contingency planning, consultation, and process documentation.

companyName: Texas Roadhouse, Inc.

ticker: TXRH


text: The Company has implemented detective and preventative controls designed to ensure the appropriate level of protection for the confidentiality, integrity, and availability of data stored on or transferred through our information technology resources. The Company has a risk assessment process to identify risks associated with our use of third-party service providers and has implemented specific processes and controls designed to mitigate those identified risks. Both internal and third-party audits are performed routinely to verify that these controls are effective. Additionally, the Company has implemented companywide security awareness training programs designed to provide best practices for protecting our network and systems, and routinely leads exercises for employees to reinforce the risk and proper handling of targeted emails. The Company's Head of Information Security is responsible for developing and implementing these controls and training exercises with support from our information technology department.


text: The Company's enterprise risk management program has established an internal risk committee to evaluate information governance risks including risks associated with the Company's use of artificial intelligence. This committee comprises members of management of the Company's information technology, human resources, marketing, accounting, risk, procurement, training, finance, and legal functions, and is focused on performing risk assessments to identify areas of concern and implement appropriate changes to enhance its cybersecurity and privacy policies and procedures. The internal risk committee is informed of the Company's risk prevention and mitigation efforts on a regular basis. The committee is also briefed on detection and remediation of cybersecurity incidents in a timely manner following the detection of any potential events.


text: The Company has a crisis response team comprising senior members of various corporate functions to oversee the response to various crises including potential crises arising from cybersecurity incidents that may impact the Company and/or its vendor partners. This team conducts regular tabletop exercises to simulate responses to cybersecurity incidents. To the extent there is a cybersecurity incident impacting the Company and/or a vendor partner, the crisis response team's process would be to ensure that our Head of Information Security and Chief Technology Officer are informed immediately and that the potential impact of the incident and remedial measures arising from the incident are communicated to the executive officers of the Company.