text: Index to Financial Statements Internally, the CISO coordinates oversight of reviewing security alerts, identifying and monitoring ongoing and potential cybersecurity threats, evaluating strategic business impacts of cybersecurity threats and developing programs and initiatives to educate the Company's employees regarding cybersecurity. The CISO also manages the Company's Computer Security Incident Response Plan (the "Incident Response Plan"), which outlines action steps for the preparation, identification, triage, analysis, containment, eradication, recovery and reflection stages of a cybersecurity incident. The Incident Response Plan serves as the charter for the Company's Computer Security Incident Response Team (the "Incident Response Team"), which includes a strategic team comprised of executives from various cross-functional management teams, as well as a tactical team comprised of internal technical support roles and external third-party service providers. The Incident Response Plan provides how the Incident Response Team will analyze and, as necessary, escalate cybersecurity incidents both internally and with third-party service providers based on type and severity of the specific incident.


text: The Company also requires cybersecurity training for relevant employees, focusing on the appropriate protection and security of confidential company and third-party information. Additionally, the Company provides annual cybersecurity awareness training that covers a broad range of security topics, including secure access practice, phishing schemes, remote work and response to suspicious activities. In addition to online training, employees are educated through a number of methods, including event-triggered awareness campaigns, recognition programs, security presentations, company intranet articles, videos, system-generated communications, email publications and various simulation exercises.

companyName: MOHAWK INDUSTRIES INC

ticker: MHK

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: The Company has engaged a third-party managed detection and response company to monitor the security of its information systems around-the-clock, including intrusion detection, and to provide instantaneous alerting should a cybersecurity event occur. The Company also has engaged a third-party digital forensics and incident response consultant on retainer.


text: The Company does not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected the Company. However, the sophistication of cyber threats continues to increase, and the preventative actions the Company has taken and continues to take to reduce the risk of cyber incidents and protect its systems and information may not successfully protect against all cyber incidents. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.

stage1Category: Strategy Integration


text: The Company's Audit Committee and Board of Directors provide ultimate oversight of the Company's cybersecurity risk management. The Audit Committee regularly reviews and discusses with management the strategies, processes, procedures and controls pertaining to the management of the Company's information technology operations, including cyber risks and cybersecurity. The Company's Chief Information Officer ("CIO") provides quarterly reports to the Board of Directors regarding the evolving cybersecurity risk landscape, including emerging risks, as well as the Company's processes, program and initiatives for managing these risks.

stage1Category: Board Governance


text: The Company's CISO reports directly to the CIO, who in turn reports to the CEO. The CISO maintains the certified information systems security professional (CISSP) certification and has over 22 years of experience in cybersecurity. Under the direction of the CISO, the Company's information technology department continuously analyzes cybersecurity and resiliency risks to our business, considers industry trends and implements controls, as appropriate, to mitigate these risks. This analysis drives the Company's long- and short-term cybersecurity strategies, which are executed through a collaborative effort within the IT department and are communicated to the Board of Directors regularly.

stage1Category: Management Role

stage1Method: majority


text: Risk Management and Strategy The Company maintains robust and comprehensive policies, processes, procedures and controls to protect and secure its information systems and data infrastructure from cybersecurity threats. The Company's cybersecurity program is led by its Senior Director of Cybersecurity, who functions as the chief information security officer ("CISO"). The Company's cybersecurity program interfaces with other functional areas within the Company, including but not limited to the Company's business segments and information technology ("IT"), legal, risk management, human resources and internal audit departments, as well as external third-party partners, to identify and understand potential cybersecurity threats. The Company regularly assesses and updates its policies, processes, procedures and controls in light of ongoing cybersecurity developments.


text: Internally, the CISO coordinates oversight of reviewing security alerts, identifying and monitoring ongoing and potential cybersecurity threats, evaluating strategic business impacts of cybersecurity threats and developing programs and initiatives to educate the Company's employees regarding cybersecurity. The CISO also manages the Company's Computer Security Incident Response Plan (the "Incident Response Plan"), which outlines action steps for the preparation, identification, triage, analysis, containment, eradication, recovery and reflection stages of a cybersecurity incident. The Incident Response Plan serves as the charter for the Company's Computer Security Incident Response Team (the "Incident Response Team"), which includes a strategic team comprised of executives from various cross-functional management teams, as well as a tactical team comprised of internal technical support roles and external third-party service providers. The Incident Response Plan provides how the Incident Response Team will analyze and, as necessary, escalate cybersecurity incidents both internally and with third-party service providers based on type and severity of the specific incident.


text: The CISO also oversees the Company's management of third-party service providers. The Company has engaged a third-party managed detection and response company to monitor the security of its information systems, including intrusion detection, and to provide timely alerts if a cybersecurity event occurs. The Company also has engaged a third-party digital forensics and incident response consultant on retainer.


text: The Company also requires cybersecurity training for certain employees, focusing on the appropriate protection and security of confidential company and third-party information. Additionally, the Company provides annual cybersecurity awareness training that covers a broad range of security topics, which may include secure access practice, phishing schemes, remote work and response to suspicious activities. In addition to online training, employees are educated through a number of methods, including event-triggered awareness campaigns, recognition programs, security presentations, company intranet articles, videos, system-generated communications, email publications and various simulation exercises.


text: The Company's Audit Committee and Board of Directors provide ultimate oversight of the Company's cybersecurity risk management. The Audit Committee regularly reviews and discusses with management the policies, processes, procedures and controls pertaining to the management of the Company's information technology operations, including cyber risks and cybersecurity. The Company's Chief Information Officer ("CIO") provides quarterly reports to the Board of Directors regarding the evolving cybersecurity risk landscape, including emerging risks, as well as the Company's policies, processes, procedures and controls for managing these risks.


text: The Chief Security and Trust Officer provides regular reports on the status of cybersecurity risks, priorities, and focus areas to our executive leadership team. In addition, information on cybersecurity risks is further integrated into our broader enterprise risk management program through our internal audit function, which incorporates such information in regular audits of our cybersecurity and data protection controls and processes.

companyName: CISCO SYSTEMS, INC.

ticker: CSCO


text: The Company's acting CISO reports directly to the CIO, who in turn reports to the Chief Executive Officer. The CISO maintains the certified information systems security professional certification and has more than 23 years of experience in cybersecurity. Under the direction of the CISO, the Company's information technology department continuously analyzes cybersecurity risks to its business, considers industry trends and implements controls, as appropriate, to mitigate these risks. This analysis drives the Company's long- and short-term cybersecurity strategies, which are executed through a collaborative effort within the IT department and are communicated to the Board of Directors regularly.


text: Cybersecurity Risk Management and Strategy We have established processes for assessing, identifying, and managing material risks from cybersecurity threats. We are committed to periodically reviewing these processes internally as well as discussing these threats and our processes with members of our Board as part of our overall cybersecurity risk management system.

companyName: DIGI INTERNATIONAL INC

ticker: DGII


text: We have implemented information security policies and standards across the company. We provide ongoing cybersecurity training for employees and conduct employee phishing tests. We maintain business continuity, disaster recovery, and incident management plans. We conduct tabletop exercises and penetration testing. We use third-party security tools that help prevent, identify, investigate and resolve vulnerabilities in our systems and products. Certain Ventus offerings are PCI DSS 4.0 compliant, which requires auditing by an external auditor. We also have processes to oversee and identify cybersecurity threat risks associated with our use of new third-party service providers, including those who have access to our customer and employee data or our systems.


text: To date, we do not believe we have encountered cybersecurity threats or previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition. However, there can be no assurance that our controls and procedures will be sufficient, and that we will not be materially affected in the future. While we have customary insurance coverage in place designed to address certain cybersecurity risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise. For more information regarding our cybersecurity risks, see "Technology and Cybersecurity Risks" included as part of our risk factor disclosures in Part I, Item 1A of this report.


text: Cybersecurity Governance Our Board of Directors and executive management team oversee cybersecurity risk. Our Chief Information Officer is responsible for day-to-day management of cybersecurity risk. Our Chief Information officer periodically provides reports to executive management and our Board (which receives a report at least annually) on information security, including cybersecurity risk and the prevention, detection, mitigation and remediation of cybersecurity incidents. Our executive management is notified of potentially material cybersecurity incidents according to our cybersecurity incident management procedures.


text: Our Chief Information Officer, who reports to the Chief Executive Officer, has over twenty years of experience in IT, including IT security. In addition, one of our Board members, Hatem Naguib, is the President and Chief Executive Officer of Barracuda, a cybersecurity solutions provider, and brings expertise in IT security.


text: We have implemented information technology and product security policies and standards across the company. We provide ongoing cybersecurity training for employees and conduct employee phishing tests. We maintain business continuity, disaster recovery, and incident management plans. We conduct tabletop exercises and penetration testing. We use third-party security tools that help prevent, identify, investigate and resolve vulnerabilities in our systems and products. Certain Ventus offerings are PCI DSS 4.0 compliant, and SmartSense and Jolt have achieved SOC 2 Type II attestation. These certifications require independent audits by external auditors. We are actively pursuing similar certifications for other product lines. We also have processes to oversee and identify cybersecurity threat risks associated with our use of new third-party service providers, including those who have access to our customer and employee data or our systems.


text: Technological Tools Chubb uses information security tools designed to protect information and systems. Our Information Security team regularly monitors these tools to discover and respond promptly to anomalous and suspicious patterns. We also participate in information sharing networks (government and private) and deploy system updates and other technologies.

companyName: Chubb Ltd

ticker: CB


text: We maintain strong cybersecurity systems to guard against unauthorized access, malicious software, corruption of data, disruption of our networks and systems and unauthorized release of confidential information. We employ an experienced and dedicated information security team, strive to follow industry best practices, and work with our employees globally to create awareness and mitigate cyber risk. On an ongoing basis, we assess risks (including our exposure from significant information technology suppliers, significant software as a service providers and major vendors with access to our information technology systems) and implement procedures and practices designed to improve the security, confidentiality, integrity and availability of our systems. We voluntarily engage third-party security auditors to test our systems and controls at least annually against the most widely recognized security standards and regulations. We have developed and continue to implement a continuing cyber awareness training program which is designed to increase awareness of cybersecurity threats throughout our company and reduce the risk of human error. We conduct periodic phishing testing on all our employees with e-mail access and emphasize information security in training events and programs we host throughout the year.

companyName: MERIT MEDICAL SYSTEMS INC

ticker: MMSI


text: We have established controls and procedures to escalate enterprise-level issues, including cybersecurity matters, to the appropriate management levels within our organization and our Board of Directors, or members or committees thereof, as appropriate. Our Board of Directors provides oversight of our enterprise risk management, including our approach to managing cybersecurity risk, and has delegated responsibility for review of information security risks to its Audit Committee. The Audit Committee regularly reviews information security risks and receives reports from our Chief Information Officer and other members of the Company's management regarding those risks. Our cybersecurity program is managed by a dedicated Chief Information Officer whose global team, including the Director, Information Security, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our Chief Information Officer has over 28 years of relevant industry experience, including 17 years with Merit. Our Director, Information Security, functions as our senior information security officer and has over 17 years of relevant industry experience. Further, team members who support our cybersecurity program have relevant educational and industry experience through various roles involving information technology, security, auditing, compliance, systems and programming, as well as cybersecurity certifications such as Certified Information Systems Security Professional.


text: Under our framework, cybersecurity issues are analyzed by subject matter experts for potential financial, operational, and reputational risks, based on, among other factors, the nature of the matter and breadth of impact. Matters determined to present potential material impacts to the Company's financial results, operations, and/or reputation are immediately reported by management to our Board of Directors or the Audit Committee, as appropriate, in accordance with our escalation framework. In addition, we have established procedures to ensure that management responsible for overseeing the effectiveness of disclosure controls is informed in a timely manner of known cybersecurity risks and incidents that may materially impact our operations and that timely public disclosure is made as appropriate.


text: We maintain cyber insurance coverage that may, subject to policy terms, conditions and limitations, cover certain aspects of cybersecurity risks; however, such insurance coverage may be unavailable or insufficient to cover all losses or all types of claims that may arise in the continually evolving area of cyber risk.


text: During the last three years, we have not experienced a material security breach and, as a result, we have not incurred any material expenses from such a breach. Furthermore, during such time, we have not been penalized or paid any amount under any information security breach settlement.


text: Following a cybersecurity incident, and during its investigation and the formulation of a response, our processes also envision measures designed to contain and/or eradicate the incident and prevent further effects. Once it is determined that the incident has been resolved, we then work to establish appropriate controls (if applicable) to address similar future events and/or prevent another similar event from occurring in the future. We have experienced, and will continue to experience, cyber incidents in the normal course of business. To date, however, we have not experienced any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: UNITED COMMUNITY BANKS INC

ticker: UCB


text: We have established controls and procedures to escalate enterprise-level issues, including cybersecurity matters, to the appropriate management levels within our organization and our Board of Directors, or members or committees thereof, as appropriate. Our Board of Directors provides oversight of our enterprise risk management, including our approach to managing cybersecurity risk, and has delegated responsibility for review of information security risks to its Audit Committee. The Audit Committee regularly reviews information security risks and receives reports from our Chief Information Officer and other members of the Company's management regarding those risks. Our cybersecurity program is managed by a dedicated Chief Information Officer whose global team, including the Vice President, Information Security, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our Chief Information Officer has over 29 years of relevant industry experience, including 18 years with Merit. Our Vice President, Information Security, functions as our senior information security officer and has over 18 years of relevant industry experience. Further, team members who support our cybersecurity program have relevant educational and industry experience through various roles involving information technology, security, auditing, compliance, systems and programming, as well as cybersecurity certifications such as Certified Information Systems Security Professional.


text: Policy statements and regulations by state and federal bank regulators indicate that financial institutions should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution. For example, a financial institution's management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution's operations after a cyberattack involving destructive malware.

stage1Category: None/Other


text: On April 1, 2022, a final rule issued by federal financial regulatory agencies became effective – that rule imposes upon banking organizations and their service providers notification requirements for significant cybersecurity incidents. Specifically, the rule requires banking organizations to notify their primary federal regulator as soon as possible and no later than 36 hours after the discovery of a "computer-security incident" that rises to the level of a "notification incident" as those terms are defined in the rule. Banks' service providers are required under that rule to notify any affected bank to or on behalf of which the service provider provides services "as soon as possible" after determining that it has experienced an incident that materially disrupts or degrades, or is reasonably likely to materially disrupt or degrade, covered services provided to such bank for as much as four hours.


text: Additionally, effective December 9, 2022, amendments to the GLB Act's Safeguards Rule went into effect. That rule requires financial institutions to: (i) appoint a qualified individual to oversee and implement their information security programs; (ii) implement additional criteria for information security risk assessments; (iii) implement safeguards identified by assessments, including access controls, data inventory, data disposal, change management, and monitoring, among other things; (iv) implement information system monitoring in the form of either "continuous monitoring" or "periodic penetration testing;" (v) implement additional controls including training for security personnel, periodic assessment of service providers, written incident response plans, and periodic reports from the qualified individual to the board of directors. Additionally, multiple states and Congress are considering laws or regulations which could create new individual privacy rights and impose increased obligations on companies handling personal data.


text: As part of its oversight responsibilities over the Company risks and controls, the Board ultimately is responsible for overseeing our cyber and information security risks. The Board has delegated this responsibility to its Risk Committee. At each quarterly meeting of the Risk Committee, our CISO reports to the Risk Committee regarding security testing, training, audits, key cybersecurity metrics, and our efforts to identify, prepare for, prevent, and respond to critical threats. The Risk Committee receives regular updates on the status of our information security program, penetration testing results, infrastructure assessments, threat environment, security operations, operational events, vendor and supply chain security, and application/data security. On an annual basis, the CISO presents a cybersecurity program update to the Risk Committee.


text: Risk management and strategy The regulatory requirements referenced above recognize that, in the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and store sensitive data. "Information systems" means electronic information resources that we own or use, including physical or virtual infrastructure controlled by these information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of the information necessary to maintain or support our operations. We face significant and persistent cybersecurity risks due to: the breadth of geographies, networks, and systems we must defend against cybersecurity attacks; the complexity, technical sophistication, value, and widespread use of our systems, products and processes; the attractiveness of our systems, products and processes to threat actors (including state-sponsored organizations) seeking to inflict harm on us or our customers; the substantial level of harm that could occur to us and our customers were we to suffer impacts of a material cybersecurity incident; and our use of third-party products, services and components. Because cybersecurity threats continue to evolve, we have been required and may continue to be required to expend significant resources to continue to implement, modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. Financial expenditures may also be required to meet regulatory changes in the information security and cybersecurity domains. Risks and exposures related to cybersecurity attacks are expected to remain significant for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as the expanding use of internet banking, mobile banking and other technology-based products and services by us and our customers. See "Item 1A. – Risk Factors" in this Report for a further discussion of risks related to cybersecurity.


text: The underlying controls of our cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including frameworks such as the Center for Internet Security's Critical Security Controls and the Federal Financial Institutions Examination Council's Cybersecurity Assessment. We periodically engage third-parties to assess our cyber risk program and technical controls. To address cybersecurity threats (defined as potential unauthorized occurrences on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of those systems or any information residing in those systems therein), we have implemented an incident and event response program. That program, which is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, is integrated within our overall enterprise risk management and business continuity frameworks. We employ an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity relative to our information systems, as well as to report on any suspected advanced persistent threats. An ongoing enterprise-wide security awareness training program is in place to help protect our data, systems, and networks from malicious attacks and cyber threats. The program is designed to allow for the detection and timely and efficient recovery from cybersecurity incidents (defined as unauthorized occurrences, or a series of related unauthorized occurrences, on or conducted through our information systems that jeopardize the confidentiality, integrity, or availability of those systems or any information residing therein) and events by providing a well-defined, organized approach for handling any potential threats to the confidentiality, integrity, and/or availability of our information systems.


text: In many instances we rely on third-party providers to facilitate providing products and services to our customers. As a part of our overall cybersecurity risk management framework and, in addition to assessing our own cybersecurity preparedness, we also have a process in place to manage cybersecurity risks associated with third-party service providers. To help mitigate adverse impacts from a cybersecurity incident, we assess third-party vendors as a part of our vendor onboarding and continued due diligence which includes processes to assess information security posture. Depending upon the level of perceived security risk, we may impose security requirements upon a supplier, including: maintaining an effective security management program; abiding by information handling and asset management requirements; and notifying us in the event of any known or suspected cyber incident. We periodically conduct (or engage a third party to conduct) reviews of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of hosted applications, depending upon the level of risk, are required to provide a report as to their controls (e.g., a System and Organization Controls (SOC) 2 or ISO 27001 (Information and Security Certification) or similar report).

stage1Category: Third-Party Risk


text: Our information security team in combination with other third-party vendors monitor our information systems for suspicious activity, such as unauthorized intrusions. Suspected or confirmed threats, incidents, or events, however, also may be reported by bank employees, customers, intrusion detection systems, third-party servicers, or government entities. Once reported, cybersecurity incidents are to be brought to the attention of our Information Technology and Security Team. Depending upon the nature and perceived threat level of the reported event, our overall enterprise risk management process would require the involvement of other management and response teams representing other groups (e.g., Information Technology, Information Security, Legal/Compliance, Corporate Security, Internal Audit, Human Resources, Finance/Accounting, Corporate Communications, Designated Cyber Coach) within our organization.


text: Incident and risk event levels each vary from no (or low) risk to crisis (high) risk. The determination of the incident and risk level will dictate the level of personnel that will be responsible for addressing the incident, controlling the effects of the incident and formulating the response to the incident. Responses may include, when appropriate and/or required, notification to regulatory agencies (e.g., FDIC, FinCEN, SEC), authorities (e.g., F.B.I., Department of Justice), customers, third parties or internal personnel.


text: Each of the management and response teams, within its assigned level, is responsible for providing an orderly response to security incidents and risk events; preventing a serious loss of profits, public confidence, or information assets by providing an immediate, effective, and skillful response to any unexpected event which negatively impacts the confidentiality, integrity, and/or availability of our systems, network, or the non-public personal information of its customers, interruptions to customers' experiences, or other anomalous situations; taking the steps it deems necessary to contain, mitigate, or resolve a security incident or risk event; and investigating suspected security incidents and risk events in a timely and cost effective manner, reporting findings to management, determining an appropriate course of action, and coordinating communications to customers, regulatory authorities, and law enforcement agencies as necessary.


text: As part of the above processes, we regularly engage with consultants, auditors and other third parties, including annually having a third-party review our cybersecurity program to help identify areas for continued focus, improvement and compliance.

companyName: TMC the metals Co Inc.

ticker: TMC


text: Our cybersecurity program is headed by our Chief Information Security Officer (CISO), who reports to our Chief Information Officer. Our CISO is informed about and monitors prevention, detection, mitigation and remediation efforts through regular communication and reporting from professionals in the information security team, several of whom have extensive records of service in financial institutions and cybersecurity. Our CISO has over 20 years of experience in IT operations/security roles in the financial services industry and holds a cybersecurity certification as a Certified Information Systems Security Professional ("CISSP"). Other members of his team also hold CISSP certifications as well as CompTIA Security+, SANS Institute Cloud Security Essentials, SANS Institute GIAC Certified Enterprise Defender, SANS Institute Security Awareness Professional, Certified Information Security Manager, GIAC Certified Incident Handler, Certified in Risk and Information Systems Control, and GIAC Cyber Threat Intelligence certifications.


text: A rule issued by federal financial regulatory agencies imposes upon banking organizations and their service providers notification requirements for significant cybersecurity incidents. Specifically, the rule requires banking organizations to notify their primary federal regulator as soon as possible and no later than 36 hours after the discovery of a "computer-security incident" that rises to the level of a "notification incident" as those terms are defined in the rule. Banks' service providers are required under that rule to notify any affected bank to or on behalf of which the service provider provides services "as soon as possible" after determining that it has experienced an incident that materially disrupts or degrades, or is reasonably likely to materially disrupt or degrade, covered services provided to such bank for as much as four hours.


text: The GLB Act's Safeguards Rule requires financial institutions to: (i) appoint a qualified individual to oversee and implement their information security programs; (ii) implement additional criteria for information security risk assessments; (iii) implement safeguards identified by assessments, including access controls, data inventory, data disposal, change management, and monitoring, among other things; (iv) implement information system monitoring in the form of either "continuous monitoring" or "periodic penetration testing;" (v) implement additional controls including training for security personnel, periodic assessment of service providers, written incident response plans, and periodic reports from the qualified individual to the board of directors. Additionally, multiple states and Congress are considering laws or regulations which could create new individual privacy rights and impose increased obligations on companies handling personal data.


text: Our Board of Directors, with assistance from our Audit Committee, oversees our risk management program, which includes technology and cybersecurity risks. Our management team, including our Vice President - Information Technology ("VP - IT"), provides periodic updates on risk management to the Audit Committee and to the Board of Directors. Such periodic updates include presentations regarding cybersecurity matters, including any new cybersecurity threats, events, incidents, risks, risk management solutions, trainings or education, strategy pivots, or governance changes. The Audit Committee regularly reports its actions, findings and recommendations to the Board of Directors. The Audit Committee relies in large part on such periodic updates and presentations from our management team in developing its reports to the Board of Directors.

companyName: Coterra Energy Inc.

ticker: CTRA


text: Incident and risk event levels each vary from no (or low) risk to crisis (high) risk. The determination of the incident and risk level will dictate the level of personnel that will be responsible for addressing the incident, controlling the effects of the incident and formulating the response to the incident. Responses may include, when appropriate and/or required, notification to regulatory agencies (e.g., Federal Reserve, FinCEN, SEC), authorities (e.g., F.B.I., Department of Justice), customers, third parties or internal personnel.


text: Following a cybersecurity incident, and during its investigation and the formulation of a response, our processes also envision measures designed to contain and/or eradicate the incident and prevent further effects. Once it is determined that the incident has been resolved, we then work to establish appropriate controls (if applicable) to address similar future events and/or prevent another similar event from occurring in the future. We have experienced, and will continue to experience, cyber incidents in the normal course of business. To date, however, we have not experienced any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: Risk Management and Strategy We maintain a cybersecurity Incident Response Plan ("IRP") designed to identify, assess, manage, mitigate, and respond to cybersecurity risks, threats and incidents. The IRP was developed in consultation with common cybersecurity frameworks, including NIST Cybersecurity Framework, to provide efficiency, familiarity and consistency in design. As part of our IRP, we have established a Cybersecurity Incident Management Team ("CIMT"), comprised of senior level executives and management, that defines overall policy and strategy when faced with a cybersecurity incident. The CIMT provides cross-functional and geographical visibility, as well as executive leadership oversight, to address and mitigate associated risks. Among our CIMT, our VP - IT holds the highest level of executive responsibility for assessing and managing cybersecurity threats, incidents, and risks, as well as developing and implementing all cybersecurity risk management, strategy, and governance recommendations. Our VP - IT leads all components of our information technology functions and reports to our Executive Vice President and Chief Financial Officer.


text: The CIMT is supported by a dedicated Cybersecurity Incident Response Team ("CIRT"), comprised generally of security and networking team members with responsibilities to monitor and assess events, cybersecurity incidents, and technical activities throughout our organization. Our CIRT members possess critical skill sets, experience, and competencies related to the management of cybersecurity risks and matters. In particular, our VP - IT has over 28 years of experience in the field of information systems and cybersecurity and leads an experienced security and networking team with 67 years of additional combined experience in developing and executing cybersecurity strategies. Our CIRT members also hold over 29 certifications in risk and information security from organizations such as International Information System Security Certification Consortium (ISC2), The SANS Institute, Global Information Assurance Certification (GIAC), CompTIA and Cisco, including Certified Information Systems Security Professional (CISSP), GIAC, Certified Incident Handler Certification (GCIH), GIAC Critical Controls Certification (GCCC), GIAC Continuous Monitoring Certification (GMON), SANS Security Awareness Professional (SSAP), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), and Certified Information Systems Auditor (CISA).


text: Our CIRT is supported by dedicated Information Technology ("IT") and Operational Technology ("OT") security resources, and further supported by various external parties, including but not limited to, cybersecurity service providers, assessors, consultants, auditors, and other third parties engaged on an as-needed basis.


text: The CIRT determines whether a cybersecurity incident warrants escalation to the CIMT. In the event of a cybersecurity incident, the IRP describes processes to detect, analyze, contain, eradicate and remediate such incident. These processes include, but are not limited to: • Maintaining an updated inventory and management of digital assets; • Conducting risk assessments to validate our cybersecurity policies, practices, and tools; • Employing appropriate next generation firewalls, endpoint detection and response (EDR) software, identity and access management (IAM), multifactor authentication (MFA), virtual private network (VPN), account change monitoring, encryption, patch management, web content filter, spam filter and reporting, and security information and event management (SIEM) software; • Conducting regular vulnerability scans of our IT and OT infrastructure; • Obtaining and applying vulnerability patches appropriately; • Conducting penetration tests and assessing recommended corrective actions; • Requiring employees to complete a security awareness training program; • Conducting regular phishing simulations and tabletop exercises to test familiarity with cybersecurity policies and procedures; and • Reviewing and evaluating developments in the cyber threat landscape.


text: Our IRP also describes processes to identify material risks from cybersecurity incidents associated with our use of third-party service providers.


text: Currently, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our operations. However, the nature of potential cybersecurity risks and threats are uncertain, and any future incidents, outages or breaches could have a material adverse effect on our reputation, business strategy, results of operations or financial condition.


text: Our Board of Directors, with assistance from our Audit Committee and Cybersecurity Steering Committee, oversees our risk management program, which includes technology and cybersecurity risks. Our management team, including our Vice President - Information Technology ("VP - IT"), provides periodic updates on risk management to the Audit Committee and to the Board of Directors. Such periodic updates include presentations regarding cybersecurity matters, including any new cybersecurity threats, events, incidents, risks, risk management solutions, trainings or education, strategy pivots, or governance changes. The Audit Committee regularly reports its actions, findings and recommendations to the Board of Directors. The Audit Committee relies in large part on such periodic updates and presentations from our management team in developing its reports to the Board of Directors.


text: To help identify, assess, and mitigate cybersecurity threats that we face to our business, S&TO, in addition to its own capabilities, partners with Cisco's Talos Threat Intelligence Group and third parties, including governments and peer companies, to share and receive threat intelligence and other information. S&TO actively monitors for and evaluates cybersecurity vulnerabilities, threats, and incidents observable on the internet and the dark web. In addition to monitoring risks from threats to our own business, we operate third-party risk management programs to help identify and manage risks from cybersecurity threats arising from third-party suppliers and service providers on which we rely. These programs leverage on-going security-focused risk assessments based on industry practices, audits, and contractual requirements.


text: Risk Management and Strategy We maintain a cybersecurity Incident Response Plan ("IRP") designed to identify, assess, manage, mitigate, and respond to cybersecurity risks, threats and incidents. The IRP was developed in consultation with common cybersecurity frameworks, including the Center for Internet Security (CIS) Critical Security Controls Framework, to provide efficiency, familiarity and consistency in design. As part of our IRP, we have established a Cybersecurity Incident Management Team ("CIMT"), comprised of senior level executives and management, that defines overall policy and strategy when faced with a cybersecurity incident. The CIMT provides cross-functional and geographical visibility, as well as executive leadership oversight, to address and mitigate associated risks. Among our CIMT, our VP - IT holds the highest level of executive responsibility for assessing and managing cybersecurity threats, incidents, and risks, as well as developing and implementing all cybersecurity risk management, strategy, and governance recommendations. Our VP - IT leads all components of our information technology functions and reports to our Executive Vice President and Chief Financial Officer.


text: The CIMT is supported by a dedicated Cybersecurity Incident Response Team ("CIRT"), comprised generally of security and networking team members with responsibilities to monitor and assess events, cybersecurity incidents, and technical activities throughout our organization. Our CIRT members possess critical skill sets, experience, and competencies related to the management of cybersecurity risks and matters. In particular, our VP - IT has over 29 years of experience in the field of information systems and cybersecurity and leads an experienced security and networking team with 71 years of additional combined experience in developing and executing cybersecurity strategies. Our CIRT members also hold over 31 certifications in risk and information security from organizations such as International Information System Security Certification Consortium (ISC2), The SANS Institute, Global Information Assurance Certification (GIAC), CompTIA and Cisco, including Certified Information Systems Security Professional (CISSP), GIAC, Certified Incident Handler Certification (GCIH), GIAC Critical Controls Certification (GCCC), GIAC Continuous Monitoring Certification (GMON), SANS Security Awareness Professional (SSAP), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), and Certified Information Systems Auditor (CISA).


text: We recognize the critical importance of maintaining the trust and confidence of our customers, employees, and other stakeholders. To help mitigate the cybersecurity risks that we face, we maintain processes for identifying, assessing, and managing such risks.


text: Our incident response functions, which include our Security and Trust Organization ("S&TO") under the leadership of our Chief Security and Trust Officer, have established internal policies, processes, and procedures to monitor, detect, investigate, respond to, and escalate management of internal and external cybersecurity threats and incidents. We maintain policies and procedures for the escalation of cybersecurity incidents, assessed as potentially being or becoming material, to designated members of our senior management for further assessment. We also, as necessary, inform our independent registered public accounting firm of significant cybersecurity matters and any relevant developments.


text: S&TO engages third parties in connection with our cybersecurity risk management processes, including cybersecurity consultants and auditors, to conduct evaluations of our IT security controls and provide certifications for industry-standard security frameworks. In addition, we maintain a global privacy program to assess and manage privacy risks related to how we are collecting, using, sharing, and storing personal data, which is subject to assessment by an independent, third-party privacy assessor.


text: We strive to embed security into our products and services through the Cisco Secure Development Lifecycle (CSDL). The CSDL introduces security and privacy considerations throughout the lifecycle of our products and services. In addition, S&TO advises business units and functional areas on addressing cybersecurity risks and monitors initiatives to mitigate and manage such risks over time. Our business units or functional areas are responsible for managing risks and ensuring that security policies and standards are implemented within the respective business unit or function. S&TO also conducts mandatory cybersecurity training for our employees and provides employees with tools to report suspected incidents.


text: Our Chief Security and Trust Officer, who reports to our Executive Vice President, Operations, works collaboratively across our business to implement policies and procedures designed to protect our IT environment and our products and services from cybersecurity threats, and to promptly respond to cybersecurity incidents in accordance with our incident response policies and procedures. Our Chief Security and Trust Officer has extensive cybersecurity experience and has served in various roles in information technology and information security for over 25 years.


text: The Chief Security and Trust Officer provides regular reports on the status of cybersecurity risks, priorities, and focus areas to our executive leadership team. In addition, information on cybersecurity risks is further integrated into our broader enterprise risk management program through our internal audit function, which incorporates such information in regular audits of our cybersecurity and data protection controls and processes.


text: Our Board of Directors oversees risks related to cybersecurity threats to our business directly and through its Audit Committee. The Audit Committee receives regular reports on cybersecurity risks, priorities, and focus areas from our Chief Security and Trust Officer at least four times a year and receives a live presentation at least twice a year. Our Board of Directors also regularly receives updates from the Audit Committee on its oversight activities and, on occasion, receives updates directly from our Chief Security and Trust Officer. Additionally, the Chief Security and Trust Officer provides more frequent updates to the Board of Directors and Audit Committee if necessary due to a cybersecurity threat, incident, or other development.


text: As of the date of this Annual Report on Form 10-K, we do not believe our business, operating results, or financial condition have been materially affected by cybersecurity risks, including as a result of previously identified cybersecurity incidents. For more information on our cybersecurity related risks, see "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: To help identify, assess, and mitigate cybersecurity threats that we face to our business, S&TO, in addition to its own capabilities, partners with Cisco's Talos Threat Intelligence Group and third parties, including governments and peer companies, to share and receive threat intelligence and other information. S&TO actively monitors for and evaluates cybersecurity vulnerabilities, threats, and incidents observable on the Internet and the dark web. In addition to monitoring risks from threats to our own business, we operate third-party risk management programs to help identify and manage risks from cybersecurity threats arising from third-party suppliers and service providers on which we rely. These programs leverage on-going security-focused risk assessments based on industry practices, audits, and contractual requirements.


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures designed to protect the security, confidentiality, integrity, and availability of our business systems and information. We base our cybersecurity risk management program upon and measure it against the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0.

companyName: HOLOGIC INC

ticker: HOLX


text: Our cybersecurity risk management program includes the following: • A dedicated staff of cybersecurity and risk management professionals; • Defined security policies and standards; • Annual mandatory employee cybersecurity and privacy compliance awareness training; • Cybersecurity tooling for detecting and responding to cyber incidents; • Cybersecurity incident response and major crisis plans that govern activities such as detection, coordination, remediation, recovery, and escalation to senior management and, where appropriate, our Audit and Finance Committee and our Board; • Disaster recovery plans; • Periodic tabletop exercises to promote awareness and improve internal processes; • Periodic penetration testing and vulnerability management processes; and • Third-party risk assessments for suppliers and vendors, which may require such third parties to sign data processing agreements, comply with particular security controls, or complete an additional security and privacy assessment.


text: Our program also utilizes third-party security providers for specialized areas, including penetration testing, staff augmentation, consulting and other on-demand cybersecurity services. We also leverage a managed security service provider to augment our cybersecurity organization and to provide additional monitoring and response capabilities.


text: We have integrated cybersecurity related risks into our enterprise risk management program, which is designed to identify, prioritize, assess, monitor and mitigate the various risks confronting our Company, including both external and internal cybersecurity risks. When identified, risks are reported to relevant business and governance leaders within the Company for appropriate action. When potential improvements are identified, we weigh the costs and benefits of such improvements (including against other potential improvements) and, if selected, the improvements are added to a roadmap for possible implementation.


text: As a global company, we manage a variety of cybersecurity threats and cannot wholly eliminate the risk of adverse impacts from such incidents. Further, the scope and impact of any future incident cannot be predicted. However, as of the date of this Form 10-K, we are not aware of cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of our operations or financial condition. For additional information on the risks from cybersecurity threats that we face, please refer to the "Risk Factors" in Part I, Item 1A. of this Form 10-K.


text: Our cybersecurity risk management program is led by our Chief Information Security Officer (CISO), who oversees a dedicated cybersecurity and risk management team, which works in partnership across the Company, under the direction of our Chief Information Officer (CIO). Our CISO has over 20 years of experience working in defense and cybersecurity and has served in various cybersecurity leadership roles within Fortune 500 companies. He and our cybersecurity team have extensive experience in leading and addressing IT risk management, security architecture and engineering, security operations, data security, and identity and access management. Our CISO also works closely with our legal team to oversee compliance with legal, regulatory and contractual security requirements.


text: As part of management's oversight of our cybersecurity program, we also maintain an executive-level cybersecurity steering committee, comprised of Hologic's Chief Financial Officer, General Counsel, Head of Internal Audit, Chief Information Officer, Head of Human Resources, Head of Global Supply Chain, and Division President of Breast and Skeletal Health, to help address cybersecurity risks at an enterprise level. The cybersecurity steering committee is a decision-making body that coordinates and communicates the direction, current state, and oversight of our cybersecurity and risk management programs.


text: The Board oversees the Company's risk associated with cybersecurity matters with the support of the Risk Committee of the Board (the "Risk Committee"). Management is responsible for identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment. All employees, including members of our information technology ("IT") team, are also required to report any known or suspected security event, pursuant to our policies and procedures.

companyName: FIRST INTERSTATE BANCSYSTEM INC

ticker: FIBK


text: While our Board oversees our overall risk management process, as part of its oversight, the Board has delegated primary responsibility for the oversight of cybersecurity risks, including management's steps to monitor and control such risks, to our Audit and Finance Committee. On a quarterly basis, our CIO and CISO provide updates to the Audit and Finance Committee on the cybersecurity and related risk management programs, including recent developments and current risk assessments. Our CIO and CISO typically also meet in person with the Audit and Finance Committee twice annually for a more detailed discussion of significant threats, risk mitigation strategies, any security program assessments and identified improvements. Additionally, our CIO and CISO meet at least annually with the full Board and report on the Company's Information Technology program and more specifically, cybersecurity matters.


text: Our cybersecurity risk management program includes the following: • A dedicated staff of cybersecurity and risk management professionals; • Defined security policies and standards; • Annual mandatory employee cybersecurity and privacy compliance awareness training; • Cybersecurity tooling for detecting and responding to cyber incidents; • Cybersecurity incident response and major crisis plans that govern activities such as detection, coordination, remediation, recovery, and escalation to senior management and, where appropriate, our Audit and Finance Committee and our Board; • Back-up & recovery plans; • Periodic tabletop exercises to promote awareness and improve internal processes; • Periodic penetration testing and vulnerability management processes; and • Third-party risk assessments for suppliers and vendors, which may require such third parties to sign data processing agreements, comply with particular security controls, or complete an additional security and privacy assessment.


text: Our cybersecurity risk management program is led by our Chief Information Security Officer ( CISO), who oversees a dedicated cybersecurity and risk management team, which works in partnership across the Company, under the direction of our Chief Information Officer (CIO). Our CISO has over 20 years of experience working in defense and cybersecurity and has served in various cybersecurity leadership roles within Fortune 500 companies. He and our cybersecurity team have extensive experience in leading and addressing IT risk management, security architecture and engineering, security operations, data security, and identity and access management. Our CISO also works closely with our legal team to oversee compliance with legal, regulatory and contractual security requirements.


text: The Company provides cybersecurity services to the Bank. In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data. Cybersecurity risk management is overseen both as a critical component of our overall risk management program and as a standalone program. As further described below, we have implemented a risk-based, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. We also offset cyber risk through internal training and testing of our employees, among other processes, in accordance with our policies and procedures.


text: Risk Management and Strategy We have developed policies and procedures to provide processes and guidelines for managing cybersecurity incidents with the goal of minimizing disruption, damage, protecting data, and helping recover from a cybersecurity incident as quickly as possible.


text: In addition, in furtherance of our fiduciary responsibility to protect and account for information and information systems that are recognized as critical bank assets, we have established policies that require, among other things, that we perform an information security risk and vulnerability assessment at least annually, and implement corresponding risk management controls; implement a defense-in-depth security architecture, which may include firewalled network segmentation, malicious software protection, and data loss prevention; leverage data loss prevention technology to assist in preventing unauthorized disclosure of non-public information; and engage independent third parties to review, audit, and test the information security control structure and program to ensure processes and controls are functioning properly.


text: As part of our overall cybersecurity risk management process, employees receive annual training on incident preparedness, response, and recovery which we believe to be commensurate with their responsibilities. Employees are given directions on where to report actual or suspected incidents, both with respect to cybersecurity incidents as well as other risks, such as office closures, robbery, physical security, and employee or client injury. In addition to employees, individuals with a leadership role in the cybersecurity incident response processes are trained on their responsibilities annually, and the processes and those responsible for implementing them will be tested at least annually to assist in improving performance of the incident handlers and to identify issues with policies, procedures, and communication process.


text: To manage the information security processes related to relationships with third parties and contractors, we maintain a policy which requires all third parties and contractors to implement controls and abide by a non-disclosure agreement, and we regularly evaluate existing critical third-party service providers to ensure they continue to meet our minimum information security practices. Proposed relationships with new third-party service providers are evaluated to ensure the technology provided is in alignment with our standards and guidelines.


text: We have not experienced a significant compromise, significant data loss, or any material financial losses related to cybersecurity attacks, and no risks from cybersecurity threats that are known to us are believed to be reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Risks and exposures related to cybersecurity attacks, however, are expected to remain high for the foreseeable future, due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of third-party service providers, internet banking, mobile banking, and other technology-based products and services.


text: While all employees, including members of our information technology ("IT") team, are required to report any known or suspected security event, pursuant to our policies and procedures, the following members of Company management and the Board of Directors are tasked specifically with the responsibilities described below: • Cybersecurity Incident Response Team ("CIRT") – The CIRT was established to provide quick, effective, and orderly responses to serious successful cybersecurity related incidents such as system and application outages, virus infections, hacker attempts, system compromises, improper disclosure of confidential information, system service interruptions, breach of personal identifiable information, or other technology related events with serious security implications or business disruptions.


text: The CIRT consists of various IT groups with the knowledge and expertise needed to execute the technical aspect of the Company's cybersecurity policies and procedures, including our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"). As further described below, these officers are responsible for facilitating communications with the Risk Committee.


text: When an incident is reported, the CIRT determines the scope, scale and severity of the event and determines if the event is an incident. When the CIRT has determined an incident has occurred, the team is responsible for responding to such incident in a timely, cost-effective manner and reporting findings as necessary and appropriate, including communicating to other key stakeholders for the duration of such incident. In general, the CIRT reports such findings to the CISO, the CISO reports the information to the Chief Risk Officer ("CRO"), and the CRO ultimately reports those findings to the Risk Committee.


text: • Risk Committee – The Risk Committee of our Board of Directors is responsible for overseeing our enterprise-wide risk management program and corporate risk function, including cyber risk. The Risk Committee assesses whether the risk-management programs are capable of managing our significant risks and monitors whether our most significant enterprise-wide risk exposures are in alignment with our appetite for risk. • Enterprise Risk Management Committee ("ERMC") – The ERMC is a management committee of the Bank. The Risk Committee delegates oversight responsibility of the Company's cybersecurity programs to the ERMC. The ERMC presents summary reporting to the Risk Committee pertaining to the status of such programs. • Chief Risk Officer ("CRO") – Karlyn M. Knieriem has served as our Executive Vice President and CRO since 2022. As CRO, Ms. Knieriem is responsible for reporting serious incidents to external authorities pursuant to advice from internal or external legal counsel, unless otherwise delegated. Ms. Knieriem has over 25 years of experience in financial services across a variety of roles including finance, treasury, retail, credit, and risk management. • Chief Information Officer ("CIO") – Lori Meyer has served as our CIO since June 30, 2023, after serving in several leadership roles in the Company, including Director of Enterprise Program Management, Director of IT Business Management, Director of IT Business Relations, and Business Process Improvement Lead. As CIO, Ms. Meyer is responsible for oversight of the Company's cybersecurity policies and informing the ERMC on current computer security readiness, information security standards, procedures, regulatory compliance, data security and privacy concerns, and the remediation plans annually, or as needed. • Chief Information Security Officer ("CISO") – Dale Daugherty has served as our CISO since 2021. As CISO, Mr. Daugherty is responsible for establishing and monitoring the effectiveness of the Company's cybersecurity policies and reporting the status and a summary of cybersecurity incidents to the CRO, CIO, ERMC, and Risk Committee. In this role, Mr. Daugherty serves as an intermediary between the CRO and the CIRT. Since 2002, Mr. Daugherty has served in the roles of Information Security Officer, AVP – IT Audit Manager, and Director of IT Compliance, Risk, and Security for the Bank and holds the CISSP, CISA, GCIH, GCIA, and GSEC certifications. • Chief Human Resources Officer ("CHRO") – Rachel B. Turitto has served as our CHRO since 2019. As CHRO, Ms. Turitto is responsible for appropriate administration of the Company's cybersecurity policies with respect to employee-related cybersecurity incidents. Ms. Turitto joined us with over 15 years of diverse experience across multiple human resource disciplines, including human resource information systems.


text: The Company believes its risk management strategy and governance programs related to cybersecurity matters are appropriate for a growing banking system of its size, but we continue to monitor them and improve upon them as warranted under our programs, policies, and procedures. Finally, we maintain customary cybersecurity insurance that we believe is appropriate for our industry and comparable to our peers.


text: The Company's Information Technology Technician (the "IT Technician") is responsible for completing additional mandatory training to understand the processes, procedures, and technical requirements for securing information assets across the Company.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: The following members of Company management are tasked specifically with the responsibilities described below: • Cybersecurity Incident Response Team ("CIRT") – The CIRT was established to provide quick, effective, and orderly responses to serious successful cybersecurity related incidents such as system and application outages, virus infections, hacker attempts, system compromises, improper disclosure of confidential information, system service interruptions, breach of personal identifiable information, or other technology related events with serious security implications or business disruptions.


text: • Enterprise Risk Management Committee ("ERMC") – The ERMC is a management committee of the Bank and has primary oversight responsibility of the Company's cybersecurity programs. • Chief Risk Officer ("CRO") – Tawnya Schoolitz is serving as our interim CRO, after serving in several leadership roles in the Company, including Chief Compliance Officer. In her current role, Ms. Schoolitz is responsible for reporting serious incidents to external authorities pursuant to advice from internal or external legal counsel, unless otherwise delegated. • Chief Information Officer ("CIO") – Lori Meyer has served as our CIO since June 30, 2023, after serving in several leadership roles in the Company, including Director of Enterprise Program Management, Director of IT Business Management, Director of IT Business Relations, and Business Process Improvement Lead. As CIO, Ms. Meyer is responsible for oversight of the Company's cybersecurity policies and informing the ERMC on current computer security readiness, information security standards, procedures, regulatory compliance, data security and privacy concerns, and the remediation plans annually, or as needed. • Chief Information Security Officer ("CISO") – Dale Daugherty has served as our CISO since 2021. As CISO, Mr. Daugherty is responsible for establishing and monitoring the effectiveness of the Company's cybersecurity policies and reporting the status and a summary of cybersecurity incidents to the CRO, CIO, ERMC, and Risk Committee. In this role, Mr. Daugherty serves as an intermediary between the CRO and the CIRT. Since 2002, Mr. Daugherty has served in the roles of Information Security Officer, AVP – IT Audit Manager, and Director of IT Compliance, Risk, and Security for the Bank and holds the CISSP, CISA, GCIH, GCIA, and GSEC certifications. • Chief Human Resources Officer ("CHRO") – Rachel B. Turitto has served as our CHRO since 2019. As CHRO, Ms. Turitto is responsible for appropriate administration of the Company's cybersecurity policies with respect to employee-related cybersecurity incidents. Ms. Turitto joined us with over 15 years of diverse experience across multiple human resource disciplines, including human resource information systems. • Risk Committee – The Risk Committee reviews periodic updates on cybersecurity matters from the CISO, CIO and the CRO. These updates include the information security risk and vulnerability assessment, the overall status of the information security program, and compliance with regulatory guidelines. In addition, reporting includes periodic assessments of business resiliency including oversight and management of incidents.


text: (a) As discussed in Item 1A, Risk Factors, we face risks associated with security breaches and other significant disruptions of our IT networks and related information systems, which are essential to our business operations. Due to our Defense/IT strategy and the nature of the customers and activities it serves, we may have a heightened likelihood of being targeted for cyber-attacks or -intrusions, including by governments, organizations or persons hostile to the USG.

companyName: COPT DEFENSE PROPERTIES

ticker: CDP


text: Our cybersecurity risk management efforts are informed by a cyber risk assessment, a continuous evaluation of our risks and vulnerabilities and risk tolerances. Our processes for assessing, identifying and managing cybersecurity risks are led by our Vice President – Information Technology and Chief Information Officer (our "CIO"), a management-level position reporting directly to our Executive Vice President and Chief Financial Officer (our "CFO"). Our CIO, a Certified Information Systems Security Professional ("CISSP") with over 20 years of information systems and information security leadership experience, leads our information technology team members, many of whom have USG security clearances and include one additional CISSP certified team member, in supporting our cybersecurity risk management efforts. This team's efforts are further informed through their participation in external cybersecurity-related panels, industry presentations and advisory boards, tabletop exercises and information-sharing collaborations and partnerships.


text: Our information technology team executes a series of preventive, detective and responsive measures aimed towards managing our cybersecurity risks, including the following:


text: >administering a series of processes and automated tools to monitor and alert for potentially malicious activities and vulnerabilities on our network, systems, applications and devices, with the ability to terminate processes and isolate potential vulnerabilities;


text: >employing tools and controls to support our efforts in identity and access management and device and user management and authentication;


text: To date, we have not (to our knowledge) encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Report.

companyName: Tivic Health Systems, Inc.

ticker: TIVC


text: >ongoing cybersecurity maintenance activities, including scheduled maintenance time windows for comprehensive system updates to occur, with additional ad hoc updates occurring as needed, monitoring of all Company devices for timeliness of security updates and pushing time-sensitive updates to our system infrastructure and devices, as appropriate; >recurring, redundant backups of our applications, servers and data, with replication to remote storage locations;


text: >assessing audit reports issued on controls of certain outsourced, or externally-hosted, systems or applications; and >periodically evaluating our readiness by performing testing of our process and system for responding to cyber events, including our ability to recover following such events.


text: >on an ongoing basis for certain aspects of our information technology team's recurring monitoring and alert processes and round-the-clock support, as needed; and >periodically to perform penetration testing and vulnerability scanning of our systems, websites and properties, run or support tabletop exercises and complete cyber risk-based assessments of us.


text: >purchase and contracting controls aimed at preventing our entry into purchases or service arrangements: with entities blocked or banned by OFAC or the Federal Trade Commission; or outside of manufacturer authorized distribution channels; and >education of our employees, including cybersecurity-related training and periodic reminders and promotions regarding potential risks.


text: Our CIO routinely apprises our CFO regarding cyber risk management activities and provides updates and data, as needed, to our executive team to facilitate decisions regarding our cyber risk posture and related considerations regarding our enterprise risk management assessment. Our CIO and CFO provide to the Audit Committee of our Board of Trustees: quarterly updates on our cybersecurity risk management strategy and related activities; annual reviews of our cyber risk assessment; and other information as needed to facilitate the committee's oversight of our cybersecurity risk. Two members of this committee possess cybersecurity and information systems experience, which we believe brings valuable insight and perspective to our risk management strategy. Our CIO and CFO also provide an annual review of our cyber risk assessment to our full Board of Trustees.


text: While to date, we have not experienced cybersecurity events that were individually, or in the aggregate, material, we have developed a cyber-incident response playbook that sets forth our process for responding in the event of certain defined cyber incidents. Under our response protocols, following identification of such an incident, our CIO or other members of the information technology team would notify our executive team, which then would notify the Chairman of our Board of Trustees and assemble an Incident Management Team, comprised of certain defined management team members and external consultants, who collectively would assess and monitor the situation and manage internal and external communications.


text: We also are subject to legal and regulatory requirements that affect our response to cybersecurity-risk management, including the Sarbanes-Oxley Act, state data breach notification requirements and certain requirements under our leases with tenants.


text: (a) As discussed in Item 1A, Risk Factors, we face risks associated with security breaches and other significant disruptions of our IT networks and related systems that are essential to our business operations. Due to our Defense/IT strategy and the nature of the customers and activities it serves, we may have a heightened likelihood of being targeted for cyber-attacks or -intrusions, including by governments, organizations or persons hostile to the USG.


text: Our cybersecurity risk management efforts are informed by a cyber risk assessment, a continuous evaluation of our risks and vulnerabilities and risk tolerances. Our processes for assessing, identifying and managing cybersecurity risks are led by our Vice President – Information Technology and Chief Information Officer (our "CIO"), a management-level position reporting directly to our Executive Vice President and Chief Financial Officer (our "CFO"). Our CIO, a Certified Information Systems Security Professional ("CISSP") with over 20 years of information systems and information security leadership experience, leads our information technology team ("IT team") members, many of whom have USG security clearances (including our CIO) and include one additional CISSP team member, in supporting our cybersecurity risk management efforts. This team's efforts are further informed through their participation in external cybersecurity-related panels, industry presentations and advisory boards, tabletop exercises and information-sharing collaborations and partnerships.


text: Our IT team executes a series of preventive, detective and responsive measures aimed towards managing our cybersecurity risks, including the following:


text: >administering a series of processes and automated tools to monitor and alert for potentially malicious activities and vulnerabilities on our network, systems, applications and devices, with the ability to terminate processes and isolate potential vulnerabilities; >employing tools and controls to support our efforts in identity and access management, device and user management, and authentication;


text: >ongoing cybersecurity maintenance activities, including scheduled maintenance time windows for comprehensive system updates to occur, with additional ad hoc updates, monitoring of all Company devices for timeliness of security updates and pushing time-sensitive updates to our system infrastructure and devices, as appropriate; >recurring, redundant backups of our applications, servers and data, with replication to remote storage locations;


text: >on an ongoing basis for certain aspects of our IT team's recurring monitoring and alert processes and round-the-clock support, as needed; and >periodically to perform penetration testing and vulnerability scanning of our systems, websites and properties, run or support tabletop exercises and complete cyber risk-based assessments of us.


text: >purchase and contracting controls aimed at preventing our entry into purchases or service arrangements: with entities blocked or banned by OFAC or the Federal Trade Commission; or outside of manufacturer authorized distribution channels; and >education of our employees, including cybersecurity-related training and periodic reminders regarding potential risks.


text: Our CIO routinely apprises our CFO regarding cyber risk management activities and provides updates and data, as needed, to our executive team to facilitate decisions regarding our cyber risk posture and related considerations regarding our enterprise risk management assessment. Our CIO and CFO provide to the Audit Committee of our Board of Trustees: quarterly updates on our cybersecurity risk management strategy and related activities; annual reviews of our cyber risk assessment; and other information as needed to facilitate the committee's oversight of our cybersecurity risk. Two members of this committee possess technology and cybersecurity experience, which we believe brings valuable insight and perspective to our risk management strategy. Our CIO and CFO also provide an annual review of our cyber risk assessment to our full Board of Trustees.


text: While to date, we have not experienced cybersecurity events that were individually, or in the aggregate, material, we have developed a cyber-incident response playbook that sets forth our process for responding in the event of certain defined cyber incidents. Under our response protocols, following identification of such an incident, our CIO or other members of the IT team would notify our executive team, which then would notify the Chairman of our Board of Trustees and assemble an Incident Management Team, comprised of certain defined management team members and external consultants, who collectively would assess and monitor the situation and manage internal and external communications.


text: Tyler is committed to remaining vigilant in an ever-changing security environment. Our public sector clients are attractive, data-rich targets for threat actors. We partner closely with our clients to assist them in following evolving best practices, and constantly evaluate our own policies and procedures to help ensure that we are implementing safeguards that protect their data and ours.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: The same cybersecurity threats that predominate across most industries challenge Tyler and our clients as well. These threats range from crude phishing attempts to distributed denial-of-service disruptions to sophisticated malware and ransomware, among others. We are acutely aware that these same threats exist for our acquisition targets, our suppliers, and our third-party business partners, and a cybersecurity incident or vulnerability experienced by any of these entities could also materially and/or adversely impact our business operations and/or performance, both operational and financial, and could harm our reputation and/or competitive position. Given the criticality of a strong cybersecurity posture, we continuously and conscientiously invest in our security infrastructure, tooling, and related resources.


text: Cyber Risk Management Strategy The Board of Directors is responsible for overseeing Tyler's senior management in the execution of its risk-management responsibilities and for assessing Tyler's overall approach to risk management. The Board exercises these responsibilities periodically as part of its meetings and through its committees, each of which examines various components of enterprise risk. The Audit Committee oversees management of financial risks, as well as Tyler's policies with respect to risk assessment and risk management, including but not limited to information security risk.


text: Tyler's Chief Information Security Office ("CISO") leads the information security responsibility at Tyler. He has spent his career in information security, joining Tyler in 2018 and previously working in the payments and semiconductor manufacturing industries. He is a Certified Information Systems Security Professional ("CISSP") and a Certified Data Privacy Solutions Engineer ("CDPSE").


text: The CISO reports directly to Tyler's Chief Operations Officer ("COO"), who in turn reports to the President & Chief Executive Officer. Tyler believes this organizational structure provides a holistic and collaborative approach to cybersecurity risk management, as the COO also oversees Tyler's information technology, technology, and cloud operations teams, with whom the CISO works regularly and closely. The CISO also has a dotted line to the Chair of the Audit Committee.


text: The CISO leads a full-time Security Risk & Compliance team that assesses, identifies and manages material risks from cybersecurity threats and oversees our Information Security Risk Management Program. These efforts include the identification, assessment, and treatment of potential harms to Tyler's technology, data, and intellectual property. The team continually monitors the potential for harm to help manage the level of risk.


text: To help protect client information and Tyler data, Tyler leverages both internal and external resources, including third-party assessments, to work to identify and respond to information security risks. For example:


text: Internal Resources: Our full-time information security team focuses on managing incoming security risks and developing preventative responses to potential future risks, using tools targeted at people, processes, and technology. These efforts include security training for all employees at hire and on an annual basis thereafter, unannounced security testing (particularly on topics such as phishing), and periodic security alert messages for education or urgent security communications.


text: We repeatedly test our software, during the development cycle and once out in the field, including internal assessments of our flagship solutions. We work closely with Tyler's Data Privacy Officer and her team to educate Tyler team members on complementary privacy-by-design principles. We continuously iterate on access management policies for both technological and physical resources.


text: Tyler staffs an internal incident response team designed to launch when a potential or suspected security incident is reported to or identified by Tyler. That team is composed of a multi-disciplinary group of Tyler team members, including representatives from the security, privacy, communications, and relevant business unit teams, as well as outside forensic and legal advisors that are called on as needed. The incident response team's goal is to confirm, contain, mitigate, and remediate the incident, as applicable, and conducts a "lessons learned" process when the incident response is completed.


text: To help ensure disaster recovery and business continuity, Tyler maintains a business continuity plan with comprehensive procedures designed to recover Tyler and client assets quickly and effectively following a service disruption. Tyler's policies and procedures with respect to disaster recovery, as well as its process to help recover critical technology platforms, data center infrastructure, and operations, are updated regularly, tested annually, and reviewed by third-party auditors. We also partner with our Internal Audit team to regularly assess and respond to evolving risk management findings.


text: External resources: Tyler leverages third-party assessments, audits, and reporting obligations to provide additional layers of accountability, monitoring and testing. This includes a bug reporting program that we publish that invites any third party to report a security vulnerability they have identified. We also use a Qualified Security Assessor to perform an annual Payment Card Industry Data Security Standards assessment that tests our credit card data controls, and we undergo an annual System & Organizational Control audit to generate a report of our key compliance controls and objectives, among other things. Given our technology in the courts and public safety markets, we also manage compliance with Criminal Justice Information Systems security standards that are established by the Federal Bureau of Investigation ("FBI"), and we partner with our clients and third-party Criminal Justice Information Services ("CJIS") compliance consultants to ensure that we adhere to the requirements applicable to us.


text: Technology: Tyler also utilizes technology to help harden our environment from internal and external threats. We leverage a third-party endpoint detection management solution and threat intelligence software, as well as web-filtering tools, a multi-factor authentication tool, and related tools that support our "defense-in-depth" strategy. These tools are operated by subject-matter experts that report to the CISO, and Tyler employees are educated on the tooling to the extent applicable.


text: Third Parties: Our management of third-party security risks is an area of heightened focus for us. Over the past several years, we have worked to formalize our security due diligence process for each acquisition target, such that security is a formally embedded component of our due diligence and typically involves our independent testing of the target technology prior to closing the acquisition. Where a vulnerability or risk is identified, we generally require remediation by the target or attempt to ensure a remediation path post-closing, with contractual protections and liability parameters set forth in the purchase agreement.


text: Honda's Risk Management Committee, chaired by the Risk Management Officer, has been established to deliberate on important matters related to risk management, including risk from cybersecurity threats. Honda has established the Honda Global Risk Management Policy, which stipulates Honda's basic policy for risk management, the collection of risk information, and the response system in the event of risk occurrence.

companyName: AMERICAN HONDA FINANCE CORP


text: We strive to enhance our vendor risk analysis, with a goal of universalizing the use of form cybersecurity questionnaires and/or security addenda where applicable. We consider the results of a security and privacy review of material vendor contracts, as well as our material contracts with business partners. Our goal is to proactively identify and manage potential security risks and vulnerabilities, and to clearly articulate the responsibility – whether shared, divided, flow-down, or otherwise – of Tyler, our acquisition targets, our vendors, and/or our business partners. We expect third parties – including our clients – to report cybersecurity incidents to us so that we can assess the impact of the incident on us.


text: Cybersecurity Governance In 2022, we formalized a multi-layered security governance structure, with the goal of ensuring that responsibilities are clear, information is effectively communicated, priorities are coordinated, and proper oversight is provided. Each "layer" of the governance structure has unique meeting, reporting, and action cadences to help ensure consistent communication between our security working groups, our leadership team, and our Board of Directors.


text: On at least a quarterly basis, Tyler's CISO provides a formal report to the Audit Committee and to the Board of Directors. Our Audit Committee Chair and CISO also communicate on an as-needed basis between those quarterly reports. In 2022, Tyler's Lead Independent Director completed the requirements to receive the CERT Certificate in Cybersecurity Oversight from the Software Engineering Institute at Carnegie Mellon University. Another Tyler director possesses more than 37 years of Department of Defense experience in cyberspace operations and major computer network architectures.


text: Tyler's governance practices are supported by several segments of Tyler's senior leadership, management, and teams. This includes security working groups and a security governance committee. The security governance committee, which meets on a quarterly basis to review the threat landscape and security initiatives at Tyler, is led by the CISO and includes senior leadership from Tyler's legal and operational teams, as well as the president of each of Tyler's three operating groups and Tyler's President & CEO.


text: Operationalizing Cybersecurity Risk Management We firmly believe – and communicate regularly – that all Tyler team members have a vital role to play in cybersecurity risk management. We identify their responsibilities as falling into three key areas: • Participating in training to identify and promptly report risks; • Staying informed by reading all pertinent information and security communications; and • Actively engaging in ongoing training initiatives.


text: We observe Cybersecurity Awareness month with interactive weekly training, workshops, and additional resources on strong cybersecurity practices. In addition to Cybersecurity Awareness month, additional cybersecurity training and awareness initiatives occur throughout the calendar year, including annual security compliance training; a monthly Cybersecurity Awareness Series composed of articles and training highlighting current cybersecurity concerns; company-wide communication as necessary to alert team members of potential threats; and weekly security-related videos with opportunities to win prizes through participation. We track participation in training events and boast high participation rates, with continuous reflection on strategies for driving participation yet higher.


text: In 2022, we expanded our Security Champions Program to identify a resource on our various application teams who proactively operationalizes security best practices on their team. This program helps to ensure that security measures are built into our programs from development to deployment. We have over 100 security champions who can collaboratively advocate security tools throughout the lifecycle of our applications.


text: Measuring Cybersecurity Risks In order to evaluate whether a cybersecurity risk is material to Tyler, we take a multi-disciplinary approach to assessing qualitative and quantitative factors. The cross-functional team includes senior leadership from Tyler's information security, legal, finance, and accounting teams, as well as senior leadership from the impacted business unit(s).


text: When an incident is reported, Tyler assembles its incident response team and initiates its incident response process as soon as possible. Working with the incident response team, the CISO aims to take an initial measurement of qualitative and quantitative metrics, typically within 24 hours of the incident report, to help determine whether Tyler's Chief Financial Officer ("CFO") and Chief Accounting Officer ("CAO") should be engaged to do a deeper analysis of quantitative factors. The CFO and CAO are expected to engage with the Company's Chief Legal Officer ("CLO") and Audit Chair to evaluate, holistically, not just the quantitative factors but the qualitative factors as well. If that team determines that the incident may represent a risk of national security, the CLO may contact the US attorney general for a disclosure delay of up to 30 days, or if applicable the team may coordinate to prepare and publish an 8-K, if management believes the materiality threshold has been reached. Whether or not the incident is deemed material, the incident response team will monitor the incident on an ongoing basis to attempt to ensure containment, mitigation, and remediation, as well as to monitor for evolving factors that subsequently push the incident to a materiality threshold that requires disclosure and reporting.


text: We also engage external experts to evaluate our cybersecurity programs. These evaluations include regular audits, threat assessments, simulated attacks, vulnerability scans and advice on information security practices. We routinely conduct incident response exercises with key stakeholders.

companyName: MATRIX SERVICE CO

ticker: MTRX


text: Quantitative metrics for evaluating a security incident include the potential or actual financial loss, the costs of impacted data records, remediation costs, and/or third-party expenses. Qualitative factors include potential or actual impacts to Tyler's reputation and/or competitiveness, disruptions to Tyler's business, and/or risk of litigation or regulatory action. In evaluating an incident, Tyler also works to assess whether the incident is related to another recent incident and whether the incident may represent a threat to national security. Tyler does not expect an incident to rise to that level unless Tyler infrastructure is deemed "critical infrastructure" by the Cybersecurity and Infrastructure Security Agency ("CISA").


text: Notwithstanding these ongoing efforts and our multi-layered approach to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While Tyler maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. Please see Item 1A, "Risk Factors," for a discussion of cybersecurity risks.


text: Tyler is committed to remaining vigilant in an ever-changing security environment. Our public sector clients are attractive, data-rich targets for threat actors. We partner closely with our clients to assist them in following evolving best practices, and constantly evaluate our own policies and procedures to help ensure that we are implementing safeguards that protect their data and ours.