text: ASGN takes an enterprise approach to data protection and cybersecurity, focusing on continual process and technology improvements to enable safety, security, and information privacy. All ASGN brands align to the Department of Defense's Cybersecurity Maturity Model Certification ("CMMC") 2.0 framework and have implemented common technology and data protection and cybersecurity controls and processes, which provides a unified approach to our cybersecurity measures. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CMMC 2.0 framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We have invested in endpoint protection, cloud security, vulnerability management, and data loss prevention, featuring insider threat detection, we also conduct regular threat actor risk assessments and assess the risk posed by third-party vendors. Further, ASGN conducts penetration tests to detect potential security gaps in cloud and on-premise systems. These tests continuously simulate cyber-attacks on physical hardware, network endpoints, and critical applications such as Oracle, SQL and web services.


text: ASGN maintains a vigilant approach to cybersecurity and operational readiness, with cybersecurity practices designed to reduce the impact of any incident. ASGN has business continuity and disaster recovery policies. Our plans are tested annually to confirm critical business functions can continue with minimal disruption in unforeseen circumstances.

companyName: ASGN Inc

ticker: ASGN

secItem: Item 1C


text: We conduct regular internal and external audits to adhere to our security policies and procedures and identify improvement areas. Our audits include: annual audits conducted by third-party service providers, internal audits, compliance audits, risk assessments, and incident response audits. In addition to these audits, ASGN collaborates with industry partners, law enforcement agencies, and government organizations to share intelligence and best practices related to cybersecurity. This collaboration helps us stay ahead of emerging threats and continuously improve our security posture.


text: In 2024, ASGN has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial conditions.

stage1Category: Strategy Integration

stage1Method: unanimous


text: ASGN's data protection and cybersecurity governance structure enables transparency and visibility to key stakeholders: the Company's Board and its Strategy and Technology and Audit Committees, and the Company's Chief Executive Officer. The Board's Strategy and Technology Committee focuses on technology and cybersecurity, while the Board's Audit Committee reviews data security breaches or other issues. Each committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from the Company's chief information officers across our brands ("CIOs") and external experts as part of the Board's continuing education on topics that impact public companies.


text: Two key enabling bodies, ASGN's Enterprise Security Council ("Council") and the Security Operations Center ("SOC"), have primary responsibility for our overall cybersecurity risk management program and provide the structure necessary to set policy and direction as well as operationalize our required security posture.

stage1Category: Risk Management Process


text: We conduct regular reviews and tests of our information security program and leverage audits by our internal audit team and ongoing testing by our red team. We employ external services to conduct tabletop exercises, penetration and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning across Match Group's businesses. The results of these assessments are reported to the Audit Committee of our Board of Directors.

companyName: Match Group, Inc.

ticker: MTCH


text: • The Council includes the CIOs and is led by the Chief Information Security Officer ("CISO"). Our CISO joined the Company in 2018 in connection with the acquisition of ECS Federal, LLC ("ECS") and has decades of experience in oversight of cybersecurity operations. Collectively, the Council represents ASGN and its brands, and reports to the Chief Executive Officer and the Board's Strategy and Technology Committee. The Council members bring a wealth of experience in security operations, business process re-engineering, software development, ERP systems, and the management of multinational wide area networks. Complementing this expertise, the Council also includes a dedicated team of Cybersecurity Information Security Professionals, consisting of brand-specific system engineers and security administrators. The Council's primary mandate is to formulate comprehensive data protection and cybersecurity policies for ASGN, oversee the management of emerging security threats, proactively mitigate security risks, and safeguard our valuable assets. • ECS, ASGN's Federal Government Segment, plays a vital role in safeguarding ASGN through its essential security control function. Serving as a managed services provider for both clients and internal operations, ECS oversees the SOC which is dedicated to monitoring, detecting, and responding to cybersecurity threats across our organization. Operating 24 hours a day, seven days a week, our SOC diligently filters system logs, leveraging proprietary AI/ML tools to identify global threats. We conduct continuous active hunts and forensic analysis inspections on our network, proactively seeking out malware and intrusions.

stage1Category: Management Role

stage1Method: majority


text: Cybersecurity Governance and Risk Management Information security is a significant operational risk for financial institutions such as Radian and includes the risk of loss resulting from cyberattacks.

companyName: RADIAN GROUP INC

ticker: RDN

stage1Category: None/Other


text: To help mitigate this risk, Radian has designed and maintains an Information Security Program that is intended to protect our corporate data as well as data entrusted to us by our customers and partners. The Information Security Program is built on a risk-based approach that identifies and prioritizes cyber threats based on their potential impact on our strategy, operations, and assets. This program extends across all business lines and encompasses written policies on cybersecurity.


text: The Company has assigned executive ownership of and accountability for the Information Security Program to the Chief Information Security Officer, who leads a dedicated team of trained staff to protect the confidentiality, integrity and availability of information assets. Our Chief Information Security Officer has over 20 years of diverse industry experience, including serving in similar roles overseeing cybersecurity programs, as well as serving in numerous board and advisory capacities. Several members of the Information Security team hold advanced degrees as well as industry-recognized certifications in cybersecurity and related disciplines. The Information Security Program also utilizes third-party managed security services where appropriate.


text: Our Information Security Program utilizes multiple layers of security controls that are intended to protect information assets and operations. As a guideline to manage our cybersecurity-related risk, we use the National Institute of Standards and Technology Cybersecurity Framework, which outlines information security measures and controls over five functions: Identify, Protect, Detect, Respond and Recover. This does not imply that we meet any particular technical standards, specifications, or requirements. Our risk management process is designed for the purpose of identifying, assessing and mitigating potential threats and uncertainties that may impact the achievement of our business objectives. This process involves engaging relevant stakeholders, conducting regular risk assessments, and staying informed about industry-specific risks and market trends. Identified risks are evaluated based on their potential impact and likelihood of occurrence.


text: As a Company, we have developed key security services, including data governance, encryption, vulnerability management, systems and network monitoring, access controls, application security, threat detection, incident response, employee awareness training, and assessment of our third-party service providers. We regularly test our incident response readiness and reporting through tabletop exercises, external and internal penetration testing and internal security testing so that identified risks and incidents are escalated and communicated for appropriate remediation activities that are intended to reduce risks to an acceptable level.


text: Our board of directors has ultimate oversight of cybersecurity risk, which it manages in coordination with our Risk Committee as part of our enterprise risk management program. The Risk Committee regularly reviews the Company's enterprise risk management program and Information Security Program with management and reports to the board of directors.

stage1Category: Board Governance


text: To maintain governance and oversight over the Information Security Program, we have established an Information Security Council and Executive Information Security Committee composed of our Chief Information Security Officer and colleagues with experience, education and ongoing training in information security, cybersecurity risk and information governance. We also utilize both internal and external auditors to provide independent assessments of our Information Security Program. Cybersecurity incidents are reviewed at least quarterly by management, the appropriate executive committees and the board of directors or its committees. The Chief Information Security Officer reports directly to our General Counsel and presents at least annually to the Company's full board of directors about the overall effectiveness of the Information Security Program, as well as quarterly to the Risk Committee of the Company's board of directors. Radian's board of directors approves the written Information Security Policy and Information Security Program documents annually. Collectively, these documents describe the structure, scope, organization and requirements of the Information Security Program, as well as the responsibility and authority of the Chief Information Security Officer.


text: Risk Management and Strategy The Company has processes, policies and procedures for identifying, assessing, managing, and responding to cybersecurity threats and incidents. These are integrated into our overall risk management systems, as overseen by our Board of Directors, primarily through the Audit Committee. Our policies and procedures include protocols for assessing potential material impact from cybersecurity threats and incidents, escalating to executive leadership and the Board of Directors, engaging external stakeholders, and reporting incidents based on applicable legal requirements. Our incident response plan provides guidance in the event of a cybersecurity incident, including processes with assigned roles and responsibilities to triage, contain, assess severity, escalate, investigate, and remediate incidents, as well as to comply with potentially applicable legal obligations and mitigate reputational damage.

companyName: MINERALS TECHNOLOGIES INC

ticker: MTX


text: We use cybersecurity technologies, products, specialized IT tools and services including cyber threat intelligence and external cyber technology experts to understand, manage, mitigate and continually remediate identified risks. A cybersecurity incident may be detected in a number of ways, including through the following avenues: Security Operations Center (SOC) events, employee reports such as helpdesk incidents, and Cybersecurity tool and service stacks (e.g., vulnerability detection, threat intelligence, anti-virus, and malware detection tools). All cybersecurity risks are logged into the Company's cyber security risk register where they are tracked for remediation. These cybersecurity risks are discussed with management for resolution planning and escalation. We leverage recognized cybersecurity frameworks to drive strategic direction and maturity improvement and engage third party security experts for risk assessments, risk mitigation actions, vulnerability identification, and program enhancements.


text: We periodically test our security controls through internal and external penetration testing that covers both corporate and plant IT networks by external specialized vendors, as well as in connection with auditing of our financial systems. We also conduct regular cybersecurity tabletop exercises to test established policies and procedures for responding to cybersecurity threats and incidents. In addition, we conduct an annual independent review of our cybersecurity posture.


text: Throughout the year, we conduct cybersecurity training and awareness for our employees to help identify, avoid and mitigate cybersecurity threats utilizing various delivery methods such as phishing campaigns, training sessions, and informational bulletins.


text: We conduct risk assessments of third-party suppliers and service providers including due diligence assessments of third-party suppliers and service providers that have access to the Company's networks, confidential information, and information systems. We provide all third-party vendors, consultants, and partners with detailed security requirements for securing their connections into our IT networks. Third parties service providers are also typically contractually responsible for identifying and remediating security issues within their technology and service environment.

stage1Category: Third-Party Risk


text: Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For more information, see "Item 1A. Risk Factors, Our operations have been and will continue to be subject to cyber-attacks that could have a material adverse impact on our business, consolidated results of operations, and consolidated financial condition ".


text: The Board of Directors is responsible for overseeing the assessment and management of enterprise-level risks that may impact the Company. The Audit Committee has primary responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. Management reports on cybersecurity matters, including material risks and threats, to the Audit Committee at regularly scheduled Audit Committee meetings, which is then discussed with the Board of Directors. The reports discuss specific risks and mitigation efforts, including critical and high cyber risks from the risk register, the results of our annual independent review of the Company's cybersecurity posture and other third party assessments and benchmarking information.


text: It is management's responsibility to manage cybersecurity risks, as described above, and bring to the Board's attention material risks. Under the oversight of the Audit Committee, and as directed by the Company's Chief Executive Officer, the Company's Chief Information Officer (CIO) is primarily responsible for the assessment and management of cybersecurity risks. The CIO, who reports to the Chief Financial Officer, is aided by a third party Chief Information Security Officer with over 40 years of experience, in addition to other external professionals. Management's risk oversight is also accomplished through the Company's Strategic Risk Management Committee and Operating Risk Management Committee, which provides cross-functional support for cybersecurity risk management, as well as the Company's Chief Compliance Officer.


text: We have established standardized and comprehensive incident response and recovery plans across Match Group's businesses. Our incident response and recovery plans address — and guide our employees, management, and our Board of Directors on — our response to a cybersecurity incident, and our procedures with regard to material incidents. We regularly test and evaluate the effectiveness of our incident response process.


text: We use cybersecurity technologies, products, specialized IT tools and services including cyber threat intelligence and external cyber technology experts to understand, manage, mitigate and continually remediate identified risks. A cybersecurity incident may be detected in a number of ways, including through the following avenues: Security Operations Center (SOC) events, employee reports such as helpdesk incidents, and cybersecurity tool and service stacks (e.g., vulnerability detection, threat intelligence, anti-virus, and malware detection tools). All cybersecurity risks are logged into the Company's cybersecurity risk register where they are tracked for remediation. These cybersecurity risks are discussed with management for resolution planning and escalation. We leverage recognized cybersecurity frameworks to drive strategic direction and maturity improvement and engage third party security experts for risk assessments, risk mitigation actions, vulnerability identification, and program enhancements.


text: Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For more information, see "Item 1A. Risk Factors, Our operations have been and will continue to be subject to cyber-attacks and other disruptions to our information systems that could have a material adverse impact on our business, consolidated results of operations, and consolidated financial condition ".


text: It is management's responsibility to manage cybersecurity risks, as described above, and bring to the Board's attention material risks. Under the oversight of the Audit Committee, and as directed by the Company's Chief Executive Officer, the Company's Chief Information Officer (CIO) is primarily responsible for the assessment and management of cybersecurity risks. The CIO, who reports to the Chief Financial Officer, is aided by a third party Chief Information Security Officer with over 40 years of experience, in addition to other external professionals.


text: Management's risk oversight is also accomplished through the Company's Strategic Risk Management Committee and Operating Risk Management Committee, which provides cross-functional support for cybersecurity risk management, as well as the Company's Chief Compliance Officer.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our users) and other data, confidential information or intellectual property.


text: Risk management and strategy Our processes for assessing, identifying, and managing material risks from cybersecurity threats are incorporated into our overall enterprise risk management framework. We take a cross-functional approach to cybersecurity risk, which includes input from information security, information technology, legal, compliance, internal audit, finance, and operations, as appropriate. Under the oversight of our Board, including its Audit and Finance Committee, our senior management, information security team, and our Cybersecurity Risk Committee (comprised of key executive and senior leaders from primary corporate functions) devote resources to cybersecurity and implement risk management processes designed to adapt to the changing cybersecurity landscape, respond to emerging threats and proactively coordinate our people, processes and procedures to respond to cybersecurity incidents. We regularly assess the threat landscape and cybersecurity risks. Our internal audit team reviews enterprise risk management-level cybersecurity risks as part of our overall enterprise risk management framework. In addition, our information security team oversees regular monitoring of our information technology and other operating systems that are designed to detect potential security incidents. We have operationalized a written incident response plan designed to assess, identify and coordinate among various functions the response activities to cyber incidents and determine the impact of any such cybersecurity incidents that may jeopardize the confidentiality, integrity or availability of our information systems or adversely affect our business and information systems. In the event of a significant cybersecurity incident, the incident response plan provides guidance on roles, responsibilities, procedures and reporting processes.

companyName: PATTERSON COMPANIES, INC.


text: Depending on the environment and system, we have implemented a number of measures and policies designed to enhance the security and resiliency of our network, information and data systems, including but not limited to: encryption standards; antivirus protection; remote access; multifactor authentication; treatment of confidential information and the use of the internet, artificial intelligence, social media, email and wireless devices; user access control management; intrusion monitoring systems; information security continuity measures, including redundant systems and information backups; network segmentation; encryption of certain data; event logging; and implementation of an application patching and update cadence. These measures and policies go through an internal review process and are approved by appropriate members of management.


text: We have performed simulations and tabletop exercises at a management level. Our employees are required to complete cybersecurity training at least once every year and have access to more frequent cybersecurity trainings online. We also require certain employees to complete additional role-based cybersecurity trainings. Our information security team regularly monitors for potential cybersecurity incidents and we have processes in place designed to escalate within the company more serious incidents, as appropriate.


text: We use consultants and other third parties to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, cybersecurity software providers, managed cybersecurity service providers, professional cybersecurity advisors, and penetration testing firms.


text: Depending on the nature of the services provided, the sensitivity of the systems and data at issue, and the identity of the service provider, we take various measures designed to help manage cybersecurity risk associated with our use of third-party service providers, which may include due diligence; monitoring of cybersecurity threat risks identified through such diligence in connection with our use of third-party service providers; and imposing certain contractual obligations.


text: While we face a number of cybersecurity risks in connection with our business and from time to time we have had to address non-material security incidents and expect to experience security incidents in the future, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For more information about the cybersecurity risks we face that may materially affect the Company, see the risk factor entitled "Risks generally associated with information systems, software products and cybersecurity attacks could adversely affect our results of operations" in Item 1A - Risk Factors.


text: Our Chief Information Security Officer (CISO) is responsible for developing and implementing our cybersecurity risk management and information security program, including regularly reporting on cybersecurity matters to management and the Audit and Finance Committee. He has a Bachelor of Science degree in Information Technology from Saint Mary's University of Minnesota and over 25 years of experience covering a wide range of enterprise IT and Information Security programs for large, global corporations. He also has multiple industry certifications, including as a Certified Information Systems Security Professional (CISSP), and participates in various security leadership forums and committees. Our CISO has led our cybersecurity program since joining our company in 2018, and was recently promoted to CISO from Senior Director, Information Security.


text: Our CISO reports to our Chief Information Officer (CIO), who has held that role for 7 years and oversees our broader information technology program. He has over 30 years of information technology experience, including over 20 years in leadership roles.


text: Cybersecurity Risks and Business Impact To date, the Company has not been subject to cyberattacks that, individually or in the aggregate, have been material to our operations or financial condition. We do not believe that risks from cybersecurity threats are reasonably likely to materially affect our strategy, results of operations or financial condition over the long term. See the discussion of cybersecurity risk in Item 1A, "Risk Factors."

companyName: UNIVERSAL INSURANCE HOLDINGS, INC.

ticker: UVE


text: The Company does not believe that any risks from cybersecurity threats to date, including as a result of any previous cybersecurity incidents of which the Company is aware, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial conditions, however, there can be no assurance in that regard.

companyName: KAANAPALI LAND LLC

ticker: KANP


text: Among other matters, our Board delegates to our Audit and Finance Committee the oversight of our programs, policies, and procedures related to cybersecurity, information asset security, and network security. Broad oversight is maintained by our full Board, which receives regular reports from the Audit and Finance Committee as well as management, as appropriate. The Audit and Finance Committee and the full Board actively participate in discussions with management and among themselves regarding cybersecurity risk. Our CIO and CISO present to the Audit and Finance Committee at least a bi-annual review of our strategies, policies and internal controls relating to information technology and cybersecurity (including network security, cloud security and physical security), with respect to corporate goals, industry trends and competitive advantages. To aid the Board with its cybersecurity oversight responsibilities, the Board also receives regular presentations on these topics. Our incident response plan is designed to escalate certain cybersecurity incidents, from our information security team and CISO, through our Chief Legal Officer and CIO, to our Audit and Finance Committee, depending on the impact of the incident.


text: Risk Management and Strategy Match Group maintains an enterprise-wide information security program designed to identify, protect against, detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. Our information security teams, led by our Senior Vice President, Security Engineering, are responsible for assessing and managing our exposure to information security risks, including by: • Implementing and enforcing physical, operational and technical security policies, procedures and controls; • Conducting, and engaging independent third-party experts to conduct, regular internal and external security assessments and audits, including assessments of the security posture of third-party vendors and partners; • Collaborating with our development teams to engineer and integrate security throughout the product development lifecycle; • Implementing scalable and continuous data protection practices; and • Detecting, monitoring, investigating, and responding to potential security threats and incidents.


text: With a focus on both product and enterprise security, the security program has been set up to protect our information systems from cybersecurity threats as part of our development lifecycles and our ongoing business operations. We implement various technical and operational processes to help prevent, identify, escalate, investigate, resolve, and recover from vulnerabilities and security incidents in a timely manner. These include, but are not limited to, monitoring and detection tools, internal and third-party penetration testing, continuous testing by a dedicated red team, a comprehensive bug bounty program to allow security researchers to assist us in identifying vulnerabilities in our services before they are exploited, and annual and ongoing security awareness training for employees.


text: We have implemented cybersecurity controls to detect and address threats arising from our use of third-party service providers. Security risk assessments are conducted during onboarding, contract renewal, and when an increased risk profile is identified. We also require specified security controls and other responsibilities from our service providers and we investigate security incidents affecting them as deemed necessary.


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the International Organization for Standardization ("ISO") and other applicable industry standards. Our cybersecurity policies, standards, processes and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. Cybersecurity processes are adjusted based on the information provided from these assessments. We have also obtained industry certifications and attestations that demonstrate our dedication to protecting the data our users entrust to us, including Tinder obtaining certification for its Information Security Management System (ISMS) under the ISO/IEC 27001:2022 standard.


text: We conduct regular reviews and tests of our information security program and leverage audits by our internal audit team and ongoing testing by our red team. We employ external services to conduct tabletop exercises, penetration and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning across Match Group's businesses. The results of these assessments are reported to the Audit Committee of our Board of Directors.


text: We have established standardized and comprehensive incident response and recovery plans across Match Group's businesses. Our incident response and recovery plans address — and guide our employees, management, and our Board of Directors on — our response to a cybersecurity incident, and our procedures with regard to material incidents. We regularly test and evaluate the effectiveness of our incident response process.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our users) and other data, confidential information or intellectual property.


text: We also simulate responses to cybersecurity incidents by conducting tabletop exercises. Our cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation, and remediation strategies.

companyName: CHART INDUSTRIES INC

ticker: GTLS


text: We have not identified risks from cybersecurity threats, including from previous cybersecurity incidents, that have materially affected us. However, we face ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, results of operations, or financial condition. Any significant disruption to our service or unauthorized access to our systems could result in a loss of users and adversely affect our business, financial condition, and results of operations. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition, and results of operations. While Match Group maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For additional discussion of cybersecurity risks, see "Item 1A Risk factors—Risks relating to our business—We may not be able to protect our systems and infrastructure from cyberattacks and may be adversely affected by cyberattacks experienced by third parties."


text: Our Board of Directors, in coordination with the Audit Committee, oversees our management of cybersecurity risk, including our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. The Audit Committee directly oversees our cybersecurity program. The Audit Committee receives quarterly cybersecurity updates from management, including risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur quarterly, or more frequently as determined to be necessary or advisable.


text: Management's Role Our cybersecurity program is managed by our SVP, Security Engineering, who reports to our Chief Business Affairs and Legal Officer. Our SVP, Security Engineering, has over 20 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Our information security program encompasses partnerships among teams that are responsible for cyber governance, prevention, detection and remediation activities within our cybersecurity environment. Team members have relevant certifications, educational and industry experience, including experience holding similar positions at other large technology companies. The information security teams provide regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings. Our information security leadership reports directly to the Audit Committee or the Board of Directors on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues. We also maintain an escalation process to inform senior management and the Board of Directors of material issues and make determinations with respect to any required disclosures.


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the International Organization for Standardization ("ISO") and other applicable industry standards. Our cybersecurity policies, standards, processes and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. Cybersecurity processes are adjusted based on the information provided from these assessments. We have also obtained industry certifications and attestations that demonstrate our dedication to protecting the data our users entrust to us, including Tinder and Hinge, obtaining certification for their Information Security Management System (ISMS) under the ISO/IEC 27001:2022 standard.


text: Management's Role Our cybersecurity program is managed by our SVP, Security Engineering, who reports to our Chief Technology Officer. Our SVP, Security Engineering, has over 20 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Our information security program encompasses partnerships among teams that are responsible for cyber governance, prevention, detection and remediation activities within our cybersecurity environment. Team members have relevant certifications, educational and industry experience, including experience holding similar positions at other large technology companies. The information security teams provide regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings. Our information security leadership reports directly to the Audit Committee or the Board of Directors on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues. We also maintain an escalation process to inform senior management and the Board of Directors of material issues and make determinations with respect to any required disclosures.


text: The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data that is created, collected, stored, and used to operate our business.


text: The Company evaluates cybersecurity risks through its comprehensive Enterprise Risk Management ("ERM") framework, which is governed by the Risk Committee of the Board and encompasses the spectrum of risks, including cybersecurity risks and threats, that are integral to the Company's strategic objectives. Cybersecurity risks and threats are managed by a dedicated security team within the Information Technology ("IT") Department, under the leadership of the Chief Information Officer ("CIO"), who is also a member of the Risk Committee (Executive Director). This team collaborates with various departments across the Company, including legal, compliance, and human resources, to ensure a comprehensive approach to cybersecurity.


text: The Risk Committee provides assurances to management and the Board that the Company has identified, and evaluated key risks and implemented mitigating controls, including the Company's Incident Management and Information Security Plan, to assess, identify, and manage cybersecurity risks.


text: Risk Management and Strategy The Company's process for assessing, identifying, evaluating and managing cybersecurity risks as part of its broader ERM program includes: • Risk Identification and Prioritization: The Company employs various methods to assess and identify cybersecurity risks, which methods may, from time to time, include tabletop exercises to test our preparedness and incident response process, business unit assessments, control gap analyses, threat modeling, impact analyses, internal audits, external audits, penetration tests, and engaging third parties to conduct analyses of our information security program. This process includes evaluating the likelihood and impact of potential cybersecurity incidents. • Continuous Risk Monitoring: The Company actively monitors cybersecurity risks including third-party risk from vendors and suppliers. Significant fluctuations in the prevalence or impact of such risks are reported to the Risk Committee on a quarterly basis. • Mitigation Strategies: While continuous backups to a warm failover site are performed, the Company's Incident Management and Information Security Plan is designed to identify and respond to security incidents and threats in a timely manner to minimize the loss or compromise of information assets and to facilitate incident resolution. In general, our incident response process follows the framework established by the National Institute of Standards and Technology ("NIST") and focuses on four phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident remediation. We also conduct mandatory annual cybersecurity training for all employees.


text: We have established a Cyber Incident Response Team ("CIRT") to provide an efficient, effective, and orderly response to technology related incidents and our Cybersecurity Incident Response Plan contains protocols for communication within this team and reporting to executive management and the Audit Committee.

companyName: SM Energy Co

ticker: SM


text: Role of the Board and Management in Cybersecurity Risk Oversight The Board's Risk Committee provides oversight of cybersecurity and privacy risks, including overseeing management's efforts to monitor and mitigate those risks and reviewing with management any significant privacy and cybersecurity incidents and the effectiveness of the Incident Management and Information Security Plan. The CIO and IT Management continuously address key management personnel on relevant cybersecurity issues, which can span a wide range of topics, including but not limited to recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, and the current threat environment.


text: The Company has appointed our CIO to establish, implement, and carryout our cybersecurity risk management policies and processes, including the Incident Management and Information Security Plan, and to facilitate the communication of such matters to the Risk Committee and the Board. Our CIO and other IT senior members of management responsible for our cybersecurity program have extensive experience assessing and managing cybersecurity risks. Our CIO and Security Team have over 30 years of experience in information technology and cybersecurity positions.


text: Periodic audits are performed by our Internal Audit team as part of the Company's compliance with the Information Security Plan and the overall ERM framework.


text: Chief Risk Officer The ERM structure is further bolstered by the support of a dedicated Chief Risk Officer, who provides specialized expertise and oversight in the broader domain of risk management.


text: The Company understands the critical importance of developing, implementing, and maintaining robust cybersecurity measures to protect our information systems and ensure the confidentiality, integrity, and availability of our data that is created, collected, stored, and used to operate our business.


text: The Company assesses cybersecurity risks, along with other key risks through its comprehensive Enterprise Risk Management ("ERM") framework. This framework mandates the compilation of a quarterly risk packet, which includes the results of KPIs for the designated risks and determinations as to where the results fell within the predefined tolerance threshold. All key risks are identified at the company level, which is governed by the Risk Committee of the Board and encompasses the broad spectrum of risks, including cybersecurity risks and threats, which are integral to the Company's strategic objectives.


text: Cybersecurity risks and threats are managed by a dedicated team within the Information Technology ("IT") Department, as well as a Security Operations Center ("SOC") managed by a third-party provider, under the leadership of the Chief Information Officer ("CIO"). This team collaborates with various departments across the Company, including legal, compliance, and human resources, to ensure a comprehensive approach to cybersecurity.


text: The Risk Committee is tasked with developing and overseeing risk management processes and systems of internal controls. These are intended to ensure that management and the Company's Board of Directors have identified, and evaluated key enterprise risks and implemented mitigating controls. This includes the groups Incident Management and Information Security Plan, which assesses, identifies, and manages cybersecurity risks. The Committee reports to and receives direction from the Board as part of its oversight function.


text: Risk Management and Strategy The Company's process for assessing, identifying, evaluating and managing cybersecurity risks as part of its broader ERM program includes: • Risk Identification and Prioritization: The Company employs various methods to assess and identify cybersecurity risks, which methods may, from time to time, include tabletop exercises to test our preparedness and incident response process, business unit assessments, control gap analyses, threat modeling, impact analyses, internal audits, external audits, penetration tests, and engaging third parties to conduct analyses of our information security program. This process includes evaluating the likelihood and impact of potential cybersecurity incidents. The company engages third parties in connection with risk management processes. • Continuous Risk Monitoring: The Company actively monitors cybersecurity risks including third-party risk from vendors and suppliers. Significant fluctuations in the prevalence or impact of such risks are reported to the Risk Committee on a quarterly basis. • Mitigation Strategies: While continuous backups to a warm failover site are performed, the Company's Incident Management and Information Security Plan is designed to identify and respond to security incidents and threats in a timely manner to minimize the loss or compromise of information assets and to facilitate incident resolution. In general, our incident response process follows the framework established by the National Institute of Standards and Technology ("NIST") and focuses on four phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident remediation. We also conduct mandatory annual cybersecurity training for all employees.


text: Cybersecurity Risks and Business Impact To date, the Company has not been subject to cyberattacks that, individually or in the aggregate, have been material to our operations or financial condition. We do not believe that risks from cybersecurity threats are reasonably likely to materially affect our strategy, results of operations or financial condition over the long term. See the discussion of cybersecurity risk in Item 1A, "Risk Factors."


text: Role of the Board and Management in Cybersecurity Risk Oversight The Board's Risk Committee provides oversight of cybersecurity and privacy risks, including overseeing management's efforts to monitor and mitigate those risks and reviewing with management any significant privacy and cybersecurity incidents and the effectiveness of the Incident Management and Information Security Plan. The CIO and IT Management inform key management personnel on relevant cybersecurity issues, which can span a wide range of topics, including but not limited to recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, and the current threat environment.


text: Periodic audits are performed by our Internal Audit team as part of the Company's compliance with the Incident Management and Information Security Plan and the overall ERM framework.


text: Risk Management and Strategy Risk Assessment. We have incorporated policies and procedures aimed at securing and protecting company records and operations. At a minimum, our cybersecurity programs are benchmarked against and aligned to the Center for Internet Security (CIS) Version 8 framework a universally accepted and recognized controls standard published in 2021 to guide annual risk assessments and ongoing control monitoring activities. External experts are also utilized for both annual and periodic risk assessments, as needed, to ensure broad and in-depth evaluations of the transforming cybersecurity environment.

companyName: FULL HOUSE RESORTS INC

ticker: FLL


text: Incident Response and Recovery Planning. We have established comprehensive incident response and recovery plans and continue to regularly test and evaluate the effectiveness of these plans, while also providing necessary training tools and guidance for company personnel. All of these items are incorporated into our overall risk management program.


text: Third-Party Risk Management. As part of our risk identification efforts and overall cybersecurity risk management framework, we have processes in place to assess and manage third-party service provider cybersecurity risks. Such processes include initial and periodic reviews of independent attestation reports, as well as additional evaluation and due diligence that are dependent on our classification of data stored or processed by the third-party provider.


text: Qualifications. We view cybersecurity as a shared responsibility. To that end, the members of our Cybersecurity Committee represent a range of functions from across our company, including our property information technology directors, Corporate Controller, Vice President of Internal Audit and Compliance, Corporate Secretary and General Counsel, and the Western Director of Finance. This group has primary responsibility for assessing and managing material cybersecurity risks. The combined experience of this group consists of approximately 14 decades of direct information technology leadership experience, in addition to multiple degrees and specialized training and certifications in the information technology and cybersecurity field.


text: External Assessments. We engage independent third parties to conduct infrastructure and application security assessments and penetration testing. These third parties also help us assess our internal preparedness.


text: Management's Role. Our Cybersecurity Committee members and external experts meet quarterly, at a minimum, with the primary purpose of identifying emerging company risks and related solutions, and evaluating the progress of previously-identified risk mitigation activities.


text: Board Oversight. Our Board, with direct oversight by the Audit Committee and senior management, ultimately presides over our management of cybersecurity risk. The Board routinely receives reports from the Cybersecurity Committee, via the Audit Committee, about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information system security vulnerabilities.


text: There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Further, although we have not experienced any recent material cybersecurity incidents, we face a number of cybersecurity risks in connection with our business. Other casino companies have reported large-scale cybersecurity incidents. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. See Part I, Item 1A. " Risk Factors – Risks Related to Technology " for additional discussion.


text: Risk Management and Strategy Risk Assessment. We have incorporated policies and procedures aimed at securing and protecting company records and operations. At a minimum, our cybersecurity programs are benchmarked against and aligned to the Center for Internet Security (CIS) Version 8 framework a universally accepted and recognized controls standard published in 2021 to guide periodic risk assessments and ongoing control monitoring activities. External experts are also utilized for cybersecurity evaluations, as needed, to ensure broad and in-depth evaluations of the transforming cybersecurity environment.


text: Qualifications. We view cybersecurity as a shared responsibility. To that end, the members of our Cybersecurity Committee represent a range of functions from across our company, including our property information technology directors, Corporate Controller, Vice President of Internal Audit and Compliance, Corporate Secretary and General Counsel, and the Western Director of Finance. This group has primary responsibility for assessing and managing material cybersecurity risks. The combined experience of this group consists of approximately 14 decades of direct information technology leadership experience, in addition to multiple degrees and specialized training and certifications in the information technology and cybersecurity field. External Assessments. We engage independent third parties to conduct external vulnerability and penetration testing.


text: Risk Management and Strategy We have established processes for assessing, identifying, and managing material risks associated with cybersecurity threats, as defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.


text: By prioritizing cybersecurity at the highest level of our leadership, we assess cybersecurity risk, allocate resources and maintain a culture of cybersecurity awareness throughout Chart. Chart ties cybersecurity or being cyber safe to our key theme of safety, as an industrial manufacturer. Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through third-party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other programs: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, encourage proactive vulnerability reporting, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.


text: We have implemented preparation for incident response, incident response and breach management processes which have four stages: 1) preparation for cybersecurity incidents, 2) detection and analysis of cybersecurity incidents, 3) containment, eradication and recovery, and 4) post-incident analysis. Such incident responses are overseen by leaders from our information security, compliance and legal teams. Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact.


text: As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. In past years, our Information Security Management System has continued to work a Plan of Action and Milestones (POAM) tied to the United States Cybersecurity Maturity Model Certification (CMMC) program, formerly the National Institute of Standards and Technology (NIST) Cybersecurity Framework, while looking for synergies across other standards, such as the Information Assurance Technical Framework (IATF), or as required for specific product lines or customers. Furthermore, we benchmark externally against other industrial manufacturers within the B2B (Business to Business) manufacturing industry, and even to a vertical level to determine Chart's risk profile through cybersecurity insurance tools that rank companies and bring them together within forums for cyber intelligence sharing and best practices.


text: Our risk management program also assesses third-party risks to identify and mitigate risks from vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers and potential fourth-party risks when handling and/or processing our employee, business or customer data. In addition, we strive to have the appropriate cybersecurity clauses in our agreements and where necessary we have Data Processing Agreements (DPAs) put in place for privacy of data.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Data privacy and data security considerations could impact our business" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. The Board receives updates on a regular basis from senior management, including leaders from our information security, compliance and legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity, and data privacy incidents (if any) and status of key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our information security, compliance and legal teams. Such individuals have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including our incident response plan, and report to the Audit Committee on any appropriate items.


text: During 2024, we realized our objective of having no material cybersecurity incidents. Furthermore, we have not experienced any material information security breaches and have not incurred material expenses from cybersecurity incidents, including those arising at third parties, during any of the last three years.


text: We have incident response and breach management processes which occur in stages starting with preparation for cybersecurity incidents followed by detection and analysis of cybersecurity incidents, containment, eradication and recovery, and post-incident analysis. Such incident responses are overseen by leaders from our information security, compliance and legal teams. Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact.


text: As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. In past years, our Information Security Management System has continued to work a Plan of Action and Milestones ("POAM") tied to the United States Cybersecurity Maturity Model Certification ("CMMC") program, formerly the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, while looking for synergies across other standards, such as the Information Assurance Technical Framework ("IATF"), or as required for specific product lines or customers. Furthermore, we benchmark externally against other industrial manufacturers within the B2B (Business to Business) manufacturing industry, and even to a vertical level to determine Chart's risk profile through cybersecurity insurance tools that rank companies and bring them together within forums for cyber intelligence sharing and best practices.


text: Our risk management program also assesses third-party risks to identify and mitigate risks from vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers and potential fourth-party risks when handling and/or processing our employee, business or customer data. In addition, we strive to have the appropriate cybersecurity clauses in our agreements and where necessary we have Data Processing Agreements ("DPAs") put in place for privacy of data.


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our information security, compliance and legal teams. The Board of Directors and Chart senior management recognize cybersecurity as a company-wide risk, and the c hief information officer/chief information security officer ("CIO/CISO"), as a member of the Chart senior management, works to organize these functional teams given the individual's experience and background of over 25 years within various IT roles, including the build out of the cybersecurity capability within Chart and at prior companies. Individuals that oversee cybersecurity risk management have an average of over 20 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including our incident response plan, and report to the Audit Committee on any appropriate items.


text: The Company utilizes an affiliated company of Pacific Trail ("IT Provider"), which is a provider of financial services to numerous affiliates of Pacific Trail, which operate in the real estate and financial services industries for its accounting, accounts payable, treasury and related Information Technology ("IT") and data processing functions. The Company's financial systems and related controls, procedures, risk management, and including IT systems is integrated with that of the affiliated companies (together the "Affiliated Group").


text: Cybersecurity and cybersecurity risk management are important aspects of operations and a focus area for the Affiliated Group. Cybersecurity risks are evaluated on an ongoing basis by the Affiliated Group and its IT Provider, both internally and with the assistance of external firms.


text: The Company engages a national technology firm in an effort to maintain and continually update its cybersecurity posture and keep current with evolving cybersecurity risks. The IT Provider's cybersecurity program is examined on a regular basis, and new procedures and tools are adopted on an ongoing basis to address the changing cybersecurity landscape. The IT Provider's technology team tests the effectiveness of its tools with periodic exercises, including Penetration (PEN) tests. Risk is assessed to identify and manage risks that could affect its ability to provide reliable processing to the Affiliated Group. This process requires IT Provider to identify significant risks based upon the following: (a) management's internal knowledge of and perceived risks to the IT environment, (b) significant changes to the internal and the third-party vendor IT environments, (c) input received annually from its consultants and external auditors based on its auditor's review of the IT operating environment, (d) management's review of Service Organization Controls (SOC) reports received from vendors housing critical applications, (e) regulatory requirements or operating standards that may directly impact the IT environment, and (f) identification of threats and the evaluation of the probability and likelihood of threats. For any significant risks identified, IT Provider's management is responsible for implementing appropriate measures to monitor and manage these risks, including implementing or revising control procedures, conducting specific consulting projects, and updating systems and processes to ensure compliance,.


text: The management of IT Provider is responsible for directing and controlling operations and for establishing, communicating, and monitoring policies and procedures. The key members of management are the President, (who has over 20 years' experience in his current position) and is responsible for overseeing delivery of the services, and the Chief Information Officer ("CIO") (who has over 10 years' experience in his current position) and is responsible for overseeing the IT environment that supports the services. Importance is placed on maintaining sound internal controls and promoting integrity and the ethical values of the Affiliated Group in all personnel. Organizational values and behavioral standards are communicated to all personnel through policy statements and the Employee Handbook. Additionally, the President and CIO are in daily contact with personnel at all levels and reinforce the Affiliated Group's policies, procedures, and organizational values.


text: The IT Provider reports to the President and upper level management of the Affiliated Group as part of the risk management process in which IT Provider management identifies significant risks through discussions with Affiliated Group management and develops responses and mitigating actions to address such risks.


text: The Company engages a national technology firm in an effort to maintain and continually update its cybersecurity posture and keep current with evolving cybersecurity risks. The IT Provider's cybersecurity program is examined on a regular basis, and new procedures and tools are adopted on an ongoing basis to address the changing cybersecurity landscape. The IT Provider's technology team tests the effectiveness of its tools with periodic exercises, including Penetration (PEN) tests. Risk is assessed to identify and manage risks that could affect its ability to provide reliable processing to the Affiliated Group. This process requires IT Provider to identify significant risks based upon the following:


text: (a) management's internal knowledge of and perceived risks to the IT environment, (b) significant changes to the internal and the third-party vendor IT environments, (c) input received annually from its consultants and external auditors based on its auditor's review of the IT operating environment, (d) management's review of Service Organization Controls (SOC) reports received from vendors housing critical applications, (e) regulatory requirements or operating standards that may directly impact the IT environment, and (f) identification of threats and the evaluation of the probability and likelihood of threats. For any significant risks identified, IT Provider's management is responsible for implementing appropriate measures to monitor and manage these risks, including implementing or revising control procedures, conducting specific consulting projects, and updating systems and processes to ensure compliance.


text: As many security threats involve email and social engineering, the IT Provider has a multifaceted security training program for Affiliated Group employees. Cybersecurity training classes are administered at least annually. Testing and assessment of employees' ability to thwart attacks are performed throughout the year, with training being targeted at areas of users' weakness.


text: The Company does not believe that any risks from cybersecurity threats to date, including as a result of any previous cybersecurity incidents of which the Company is aware, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial conditions, however, there can be no assurance in that regard. (table of contents)


text: Risk Management and Strategy We believe that mitigating cybersecurity risks is the responsibility of every employee. We take a preventative approach with respect to cybersecurity threats by building a resilient cybersecurity culture and strong IT infrastructure. Our processes for assessing, identifying, and managing material risks from cybersecurity threats include: • monitoring the threat landscape and taking measures to enhance our cybersecurity program to adapt to new and developing risks; • ongoing training, testing, and utilizing other forms of social engineering awareness and education for our employees; • using cybersecurity systems and tools to monitor endpoints and environment logs in a centralized security information and event management system with capabilities for reporting and alerting on known threats and anomalous behaviors; • assessing the cybersecurity practices and external ratings and assessments of certain of our third-party technology and data vendors and service providers, and maintaining preventative controls and monitoring systems related to these partners; • creating and testing various incident response plans to hypothetical cybersecurity attacks in order to quickly assess and respond to potential and actual threats; • utilizing third-party experts to perform penetration testing and scanning of our systems for vulnerabilities; • obtaining third-party security maturity assessments, benchmarking, and security effectiveness ratings of our cybersecurity program; and • maintaining a retainer for incident response services with a trusted cybersecurity partner in order to quickly respond, investigate, contain, and recover in the event of a cybersecurity incident.


text: We have structured our cybersecurity risk management program according to the National Institute of Standards and Technology Cybersecurity Framework. We strive to employ cybersecurity best practices, including implementing new technologies to proactively monitor new threats and vulnerabilities and reduce risk; maintaining a Cybersecurity Incident Response Plan, Disaster Recovery Plan, and Business Continuity Plan; and regularly updating our response planning and protocols. We have integrated our cybersecurity processes into our overall risk management program, thereby establishing a comprehensive approach by which we determine and implement strategies designed to manage external, strategic, operational and financial risks to our business, including cybersecurity threats.


text: We utilize a wide range of protective cybersecurity technologies and tools, including, but not limited to, encryption, firewalls, endpoint detection and response, security information and event management, multi-factor authentication, and threat intelligence feeds. In addition, we use an information security risk management approach that includes monitoring security threats and trends in the industry, analyzing potential security risks that could impact the business, partnering with industry recognized security organizations, and coordinating an appropriate response should the need arise.


text: Cybersecurity threats and incidents could have a material impact on our financial condition and results of operations. A successful cyber-attack could lead to operational disruptions, financial losses, regulatory penalties, reputational damage, and legal liabilities. In some cases, the costs associated with investigating and remediating a cybersecurity incident, as well as potential litigation and regulatory fines, could result in a material impact to our financial condition and results of operations. During 2023, we did not experience any cybersecurity incidents that materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, however, there can be no assurance that the measures we have taken to address IT and cybersecurity risks will prove effective in the future. For additional discussion of the IT and cybersecurity risks facing our business, please refer to Risk Factors in Part 1, Item 1A of this report.


text: We prioritize investment in cybersecurity risk management and governance. We continually assess the adequacy of our resources and capabilities to address emerging threats, regulatory requirements, and changes in technology. As cybersecurity threats evolve, we may need to further enhance our processes and technologies, which could require additional financial resources.


text: Our Board of Directors receives regular updates on relevant IT matters affecting the Company, including cybersecurity risks and mitigation strategies. In addition to the general oversight provided by the full Board of Directors, the Audit Committee is responsible for oversight of our risk assessment and management processes, including with respect to IT and cybersecurity risks. The Audit Committee receives a quarterly cybersecurity report and regular updates from our Vice President and Chief Information Officer and our Director of Cybersecurity Risk and Business Continuity, which includes, among other information, the steps management has taken, and the specific guidelines and policies that have been established, to monitor, control, mitigate and report exposure to IT and cybersecurity risk.


text: We have established a Cyber Incident Response Team ("CIRT") to provide an efficient, effective, and orderly response to technology related incidents and our Cybersecurity Incident Response Plan contains protocols for communication within this team and reporting to executive management and the Audit Committee.


text: Security event monitoring and detection Our processes for assessing, identifying, and managing material risks from cybersecurity threats include using a wide-range of industry-leading security tools, regularly updating our technology roadmaps, and mandating cybersecurity awareness, business continuity and incident response training for all employees.

companyName: HAWTHORN BANCSHARES, INC.

ticker: HWBK


text: The Company maintains a cybersecurity insurance policy that provides coverage for potential losses arising from a cybersecurity incident. Although we maintain cybersecurity insurance, there can be no guarantee that our policy will cover all losses or all types of claims that may arise from such incidents.

companyName: PYXUS INTERNATIONAL, INC.

ticker: PYYX


text: The CIRT is led by our Vice President and Chief Information Officer and Director of Cybersecurity Risk and Business Continuity. Together, these professionals are responsible for assessing and managing cybersecurity risks and they lead a team of specialized technologists entrusted with ensuring the functionality, continuity, and security of our technology infrastructure and data. Our Vice President and Chief Information Officer is a seasoned IT professional with over 28 years of experience encompassing all facets of IT within the energy industry. His extensive background comprises managing IT service delivery, designing and administering secure solutions, establishing robust IT and Internet of Things infrastructures, and effectively managing technology-related risks. His skill set includes proficiency in threat mitigation, comprehensive risk assessment, and integration of cybersecurity strategies into business operations designed to safeguard critical assets and sensitive data. He reports to our Executive Vice President and Chief Financial Officer. Our Director of Cybersecurity Risk and Business Continuity has over 23 years of experience in the IT field with a majority of that time focused on designing, building and maintaining technology systems. His experience includes implementing security solutions and processes with a focus on adapting to the evolving cybersecurity threat landscape. He is a skilled leader and reports to our Executive Vice President and Chief Financial Officer.


text: Risk Management and Strategy We believe that mitigating cybersecurity risks is the responsibility of every employee. We take a preventative approach with respect to cybersecurity threats by building a resilient cybersecurity culture and strong IT infrastructure. Our processes for assessing, identifying, and managing material risks from cybersecurity threats include: • monitoring the threat landscape and taking measures to enhance our cybersecurity program to adapt to new and developing risks; • ongoing training, testing, and utilizing other forms of social engineering awareness and education for our employees; • using cybersecurity systems and tools to monitor endpoints and environment logs in a centralized security information and event management system with capabilities for reporting and alerting on known threats and anomalous behaviors; • assessing the cybersecurity practices and external ratings and assessments of certain of our third-party technology and data vendors and service providers, and maintaining preventative controls and monitoring systems related to these partners; • creating and testing various incident response plans to hypothetical cybersecurity attacks in order to quickly assess and respond to potential and actual threats; • engaging third-party cybersecurity experts and consultants to perform penetration testing and scanning of our systems for vulnerabilities; • obtaining third-party security maturity assessments, benchmarking, and security effectiveness ratings of our cybersecurity program; and • maintaining a retainer for incident response services with a trusted cybersecurity partner in order to quickly respond, investigate, contain, and recover in the event of a cybersecurity incident.


text: Cybersecurity threats and incidents could have a material impact on our financial condition and results of operations. A successful cyber-attack could lead to operational disruptions, financial losses, regulatory penalties, reputational damage, and legal liabilities. In some cases, the costs associated with investigating and remediating a cybersecurity incident, as well as potential litigation and regulatory fines, could result in a material impact to our financial condition and results of operations. During 2024, we did not experience any cybersecurity incidents that materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, however, there can be no assurance that the measures we have taken to address IT and cybersecurity risks will prove effective in the future. For additional discussion of the IT and cybersecurity risks facing our business, refer to Risk Factors in Part 1, Item 1A of this report.


text: The CIRT is led by our Vice President and Chief Information Officer and Director of Cybersecurity Risk and Business Continuit y. Together, these professionals are responsible for assessing and managing cybersecurity risks and they lead a team of specialized technologists entrusted with ensuring the functionality, continuity, and security of our technology infrastructure and data. Our Vice President and Chief Information Officer is a seasoned IT professional with over 29 years of experience encompassing all facets of IT within the energy industry. His extensive background comprises managing IT service delivery, designing and administering secure solutions, establishing robust IT and Internet of Things infrastructures, and effectively managing technology-related risks. His skill set includes proficiency in threat mitigation, comprehensive risk assessment, and integration of cybersecurity strategies into business operations designed to safeguard critical assets and sensitive data. He reports to our Executive Vice President and Chief Financial Officer. Our Director of Cybersecurity Risk and Business Continuity has over 24 years of experience in the IT field with a majority of that time focused on designing, building and maintaining technology systems. His experience includes implementing security solutions and processes with a focus on adapting to the evolving cybersecurity threat landscape. He is a skilled leader and reports to our Executive Vice President and Chief Financial Officer.


text: As required by Item 106 of Regulation S-K, the following sets forth certain information regarding our cybersecurity governance, strategy and risk management.

companyName: MASONITE INTERNATIONAL CORP


text: Cybersecurity Governance Our Board of Directors has ultimate oversight of the Company's privacy and cybersecurity programs and strategy, with each of the Board of Directors' Sustainability and Governance Committee and Audit Committee maintaining oversight responsibility for different elements of these programs. The Sustainability and Governance Committee and Audit Committee inform the full Board of Directors of any cybersecurity learnings or risks that were discussed at the committee level.


text: The Sustainability and Governance Committee oversees the Company's strategies and processes related to information security and technology risks, including cybersecurity. The Company's Chief Information Security Officer ("CISO"), and the Company's Chief Information Officer present a quarterly cybersecurity report to the Sustainability and Governance Committee and, at times, to the full Board of Directors. The reports include detailed updates on the Company's cybersecurity risks and threats, the status of projects to strengthen the Company's information security systems, internal and third-party assessments of the Company's cybersecurity program maturity against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, incident preparedness and the current cybersecurity environment, including current trends or recent noteworthy incidents affecting other companies. The Company has created a cybersecurity incident response plan that requires management, including the Company's CISO, to take certain mitigating actions including notification to the Company's Disclosure Committee, upon the occurrence of certain types of incidents that may be material or pose significant risk to the Company, for management. The incident response plan also contains procedures requiring, upon the determination by management that the cybersecurity incident is material, notification to the Board of Directors' Sustainability and Governance Committee and Audit Committee.


text: To assist the Company in assessing, preventing, identifying, mitigating and responding to material risks resulting from cybersecurity threats, the Company has developed a comprehensive cybersecurity risk management program led by our CISO. Our CISO is a Certified Information Systems Security Professional by the International Information System Security Certification Consortium who joined the Company in March 2018 after spending 15 years with other organizations as a cybersecurity and information technology ("IT") professional. Our CISO leads our management-level IT Risk Management Committee composed of IT functional leaders that meet quarterly to review the trending cybersecurity environment, risks and threats to the Company, the progress of cybersecurity mitigation and remediation projects and overall progress against the Company's cybersecurity strategy. The Company's senior IT leadership shares progress, findings or concerns reported by the IT Risk Management Committee with senior management to assess the impact of cybersecurity risks and threats to the Company, to assist with driving overall operational awareness, ownership and alignment broadly across the Company for a more effective cybersecurity risk management program.


text: Cybersecurity Strategy and Risk Management The Company's enterprise-wide cybersecurity strategy is advanced and reinforced by policies, processes, procedures, standards, technologies and training designed to protect the Company's IT systems, operations and sensitive business data. The Company has deployed a multiple-layer defensive model, which includes a variety of detective and protective technologies and measures to monitor and protect our critical IT systems, which include among others, intrusion detection and protection, email security, endpoint security, 24/7 third party security monitoring and proactive security testing.


text: The Company evaluates new and existing third-party service providers and suppliers through a risk assessment that includes interviews and questionnaires to assess their cybersecurity capabilities, process maturity, compliance attestations and the overall technology relationship risk. Each third-party risk assessment is conducted during the contract negotiation process, during certain contract milestones and at other periodic intervals. The final risk assessments and reports are shared with internal teams and IT leadership to assist with ongoing risk mitigation actions. The Company's cybersecurity defense strategy is regularly tested through internal and third-party penetration testing. Additionally, the Company's cybersecurity program maturity and risk profile is regularly analyzed and measured internally against generally accepted industry standards and frameworks, including the NIST Cyber Security Framework, the FAIR model and external third-party maturity assessments.


text: To strengthen the Company's cybersecurity readiness, the Company has developed a cybersecurity incident response policy and a cybersecurity incident response plan in partnership with various internal department functions and third-party IT consultants. Our cybersecurity incident response plan is based on the NIST incident response lifecycle and co-led by our CISO and director of information security. Our cybersecurity incident response plan has a designated incident response team composed of management members from select departments who each play a role within the four phases of the plan that include preparation, detection analysis, containment, eradication, recovery and post-incident activity. Each phase provides a detailed list of actions and responsibilities for each department to assist in responding to a cybersecurity incident. In the event of a cybersecurity incident, as provided in our cybersecurity incident response plan, a root-cause analysis will be conducted and based on the findings, certain new or improved processes and procedures may be implemented to continually improve the security of our IT systems and confidential data. Additionally, the Company's incident response team conducts an annual table-top exercise, utilizing the cybersecurity incident response plan and makes improvements on the response plan based on new learnings. Senior management and Board-level table-top exercises have also been conducted to further prepare and support the Company with responding to and mitigating the effects of a cybersecurity incident. The Company has further implemented a business continuity and disaster recovery plan where critical systems are backed-up daily and incrementally and stored in an encrypted format in multiple secure locations.


text: As of the date of this report, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. That said, as discussed more fully under Part I, Item 1A. "Risk Factors – Risks Related to our Operations", these potential threats pose a risk to the security of our systems and networks and the confidentiality, availability and integrity of our data. Cybersecurity attacks could also include attacks targeting customer data or the security, integrity and/or reliability of the hardware and software installed in our products. It is possible that our information technology systems and networks, or those managed or provided by third parties, could have vulnerabilities, which could go unnoticed for a period of time. While various procedures and controls have been and are being utilized to mitigate such risks, there can be no guarantee that the actions and controls we have implemented and are implementing, or which we cause or have caused third-party service providers to implement, will be sufficient to protect and mitigate associated risks to our systems, information or other property.


text: Pursuant to General Instruction G(2) to Form 10-K, the information required by this Item is incorporated herein by reference to the information under "Information Technology Risk Management" under the caption "Management's Discussion and Analysis of Financial Condition and Results of Operations" in the Company's 2023 Annual Report to Shareholders (included as Exhibit 13 hereto).


text: We recognize the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. Our board of directors is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company maintains a cybersecurity and information technology ("IT") risk management program designed to prevent, detect and respond to information security threats, which are fully integrated into the Company's ERM program.


text: Our cybersecurity and IT risk management program is based on recognized frameworks established by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, as well as the banking-specific framework from the Federal Financial Institution Examination Council's ("FFIEC's") Cybersecurity Assessment Tool. The Company's program is led by our Director of Information Technology and Information Security Officer, whose teams are responsible for leading short-term and long-term enterprise-wide cybersecurity strategy, policy, standards, monitoring, architecture and processes. Our Director of Information Technology and Information Security Officer has over fifteen years of experience in the field of cybersecurity and over a decade of experience leading cyber security oversight in the banking industry.


text: Although it is management's job to assess and manage our Company's exposure to risk, our board of directors oversees our Company's ERM, including cybersecurity and IT risks and threats, and establishes policies that govern the process. Our board conducts much of its risk oversight activities through our Audit Committee, which works closely with our Chief Risk Officer and Internal Audit Manager. The Audit Committee has primary management responsibility for oversight of operations, technology and operational risk, including information security, fraud, vendor, data protections and privacy, business continuity and cybersecurity risks. Our Audit Committee meets at least quarterly with our Chief Risk Officer, Internal Audit Manager and other members of management to assess, among other things, cyber threats or risks to align the Company for effective cybersecurity risk management and reporting. The Audit Committee receives quarterly reports from our Internal Audit Manager and Director of Information Technology and Information Security Officer on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security program, the emerging threat landscape and key metrics from cybersecurity systems and monitoring. Our Chief Risk Officer provides a presentation on ERM to the full board at least once annually. From time to time our Audit Committee also receives updates between meetings from our Chief Risk Officer, Chief Executive Officer, Chief Financial Officer and other members of management relating to risk oversight matters.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage a range of outside experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our cybersecurity and IT risk management systems. Engaging outside vendors enables us to leverage specialized knowledge and insights, ensuring our cybersecurity and IT risk management strategies and processes remain sound. Our collaboration with these third-parties includes threat assessments, consultation on security enhancements and regular audits, the results of these threat assessments and audits are reported to the Audit Committee. Strong vendor management and monitoring controls are enforced and require, at a minimum, annual due diligence on critical vendors.


text: We have implemented a comprehensive Incident Response Program to provide guidance in the event of a cybersecurity incident for contacting authorities and informing key stakeholders to ensure that any non-routine events are properly escalated. The Company participates in cybersecurity incident response exercises to test pre-planned response actions from the Company's plan and to facilitate group discussions regarding the effectiveness of the Company's cybersecurity incident response strategies and tactics. We use a third-party SEIM to provide 24x7x365 monitoring of logs, administrator and user actions, network and security appliances, and endpoint agents. Our Director of Information Technology and Information Security Officer actively engages with key vendors, industry participants, as well as the FS-ISAC, InfraGard, InspireCIO and SANS Internet Storm Center cybersecurity collaboration organizations.


text: Incident materiality The Incident Response Program is a component of the Company's Information Security policy and sets forth the severity categories and processes required to assess the impact of a cyber-related incident to the Company. The impact is categorized in one of five severity levels and is expressed in terms of financial loss, strategic objectives, customer, legal and regulatory, reputation, and service interruption. The incident response program includes timely notification of a material cybersecurity incident to the to the appropriate law enforcement, regulatory agencies, Board of Directors and other members of senior management.


text: Like other financial institutions, the Company experiences malicious cyber activity on an ongoing basis directed at its websites, computer systems, software, networks and users. This malicious activity includes attempts at unauthorized access, implantation of computer viruses or malware, and denial of service attacks. The Company also experiences large volumes of phishing and other forms of social engineering attempted for the purpose of perpetrating fraud. While, to date, malicious cyber activity, cyberattacks and other information security breaches have not had a material adverse impact on the Company, risk to its systems remains significant. See Item 1A. entitled Technology Risk "A successful cyber attack or other computer system breach could significantly harm the Company, its reputation and its customers".


text: Our management team views cybersecurity risk management as an important strategic topic. Our cybersecurity strategy utilizes the cybersecurity framework developed by the National Institute of Standards and Technology ("NIST CSF"). The NIST CSF is a voluntary framework of practices to identify, protect, detect, respond to, and recover from cybersecurity risks. Using the NIST CF does not mean that we meet any particular technical standards or certifications, but rather that we use the NIST CSF to help us identify, assess, and manage cybersecurity risks relevant to our business. Using the NIST CSF, we form our cybersecurity plans and prioritize our activities using a risk-based approach which begins with the identification and evaluation of cybersecurity risks and threats that could disrupt our operations, safety procedures and regulatory compliance. Cybersecurity risks and related mitigation efforts are prioritized based on their potential impact severity, likelihood and vulnerability. Risk mitigation strategies include the application of cybersecurity policies and procedures, implementation of technology-based tools and controls, as well as employee training, education, and awareness initiatives. Our cybersecurity risk management includes ongoing monitoring of networks and systems for potential signs of suspicious activity. We track key performance indicators and cybersecurity metrics to evaluate the effectiveness of our cybersecurity safeguards and practices.

companyName: Air Transport Services Group, Inc.


text: We rely increasingly on software applications, data transmissions and cybersecurity safeguards provided by or in conjunction with third parties to maintain our cybersecurity posture and evolve with the threat environment. We engage third party resources to assess our procedures, test safeguards, provide training and monitoring, and assess our vulnerabilities. We evaluate third party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture and data security standards.


text: ATSG management has overall responsibility for assessing and managing risks from cybersecurity threats to our operations. Management has a supervisory team that consists of the Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Vice President and Controller, and the Vice President of Information Technology, which meets regularly. The Vice President of Information Technology has primary responsibility for the execution of our cybersecurity risk management program and keeps the broader team informed about the detection, mitigation, and remediation of cybersecurity risks and incidents. The Vice President of Information Technology and the Company's other information technology and security department personnel include individuals with advanced university degrees in cybersecurity and years of technology management experience in matters such as conducting threat assessments, cyber mitigation and incident response.