text: Our management team, including the Executive Director of Information Security and Chief Technology Officer (CTO), are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes a cumulative 22 years of experience in assessing and managing risk throughout organizations. In addition, hold industry specific certifications such as Certified Information Systems Auditor (CISA) and Certified Data Privacy Solutions Engineer (CDPSE).


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence, other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.

companyName: Ceribell, Inc.

ticker: CBLL

secItem: Item 1C

stage1Category: Management Role

stage1Method: majority


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Offerpad Solutions Inc.

ticker: OPAD


text: We design and assess our program based on established frameworks, such as the CIS Critical Security Controls ("CIS Controls"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CIS Controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

stage1Category: Risk Management Process

stage1Method: unanimous


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team composed primarily of members of management, including our Director of IT Operations, that is principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to maintain, assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training — including phishing and malware simulations — of all of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes relevant procedures for evaluating the materiality of identified cybersecurity incidents, and reporting and responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, we cannot eliminate all risks from cybersecurity threats, or provide assurance that our operations, business strategy, results of operations, or financial condition will not be materially affected in the future by such risks or any future material cybersecurity incidents. For additional information about our cybersecurity related risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from our management-led Enterprise Risk Management Committee on our cybersecurity risks and mitigation initiatives. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The board of directors also receives briefings from senior management on our cyber risk management program.


text: Our information technology management team, along with our externally managed security operations center, is responsible for assessing and managing our risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes background in cybersecurity and information technology operations, with a focus on cybersecurity, data privacy, information technology governance, and risk management. The team is proficient in conducting vulnerability assessments, analyzing security logs, and implementing necessary security controls, with knowledge in cloud technologies and computing, database management, DevOps, and quality engineering.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We have a comprehensive approach to mitigate cybersecurity risk which primarily focuses on three key elements: • people – security awareness education and readiness-testing throughout the year for employees; • process – incorporating "cyber awareness" in our day-to-day processes which includes constant review of alerting and detection to mitigate constant cybersecurity threats, regular review of security posture and security roadmap to ensure alignment throughout the organization, physical and digital asset protection and security vulnerability remediation via preventable and detective measures; and • technology – investing in industry aligned security technology and threat intelligence capabilities.

companyName: RANGE RESOURCES CORP

ticker: RRC


text: Cybersecurity governance is supported by our information technology department which includes certified security professionals and seasoned security analysts. This department conducts extensive ongoing reviews of our security initiatives to assess the current state of our program (using a cybersecurity framework) and potential evolution based on current business risks along with detection and communication of cybersecurity threats and actions to mitigate those threats. Our Director of IT Security is responsible for assessing, monitoring and managing risks from cybersecurity threats, overseeing our overall cybersecurity risk management program which includes prevention, mitigation, detection and remediation of cybersecurity incidents and supervises a team of cybersecurity personnel. Our Director of IT Security reports to our VP – Information Technology and is responsible for reporting material incidents to our Cybersecurity Risk Management Committee ("CRMC") that includes officers charged with reporting responsibilities. Cybersecurity incidents that meet a pre-determined minimum threshold are communicated upward to executive officers to determine overall materiality and disclosure obligations. Our Director of IT Security keeps the CRMC apprised of our processes to prevent, detect, mitigate and remediate cybersecurity incidents at least annually. Our internal cybersecurity team led by our Director of IT Security has over 75 years of combined experience in information security and maintains several cybersecurity certificates.


text: We conduct security assessments, manage user access, perform vulnerability scanning and patching, oversee monitoring and carry out annual penetration testing, in addition to other critical security functions. In conjunction with our internal team, we utilize an independent third-party operations center that is focused on, but not limited to, monitoring alerts, logs, behavior analytics, vulnerability notifications and remediation guidance. Critical infrastructure is continuously monitored to ensure accessibility and appropriate security posture. We also perform reviews and risk analysis for third-party software and platforms which sets a standardized security baseline. We monitor known third-party breaches, known software vulnerabilities that may affect third-party vendors and communicate as necessary with those vendors, allowing us to increase security of our technology assets and our data. In addition, we perform an annual cybersecurity risk assessment of critical third-party systems.


text: To date, there have been no risks from cybersecurity threats because of any previous cybersecurity incidents, which have materially affected, or have been reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For more information on our cybersecurity related risks, see Item 1A. Risk Factors of this Annual Report on Form 10-K.

stage1Category: Strategy Integration


text: Cybersecurity is the responsibility of our Chief Information Security Officer ("CISO") who oversees an information security team responsible for maintaining the confidentiality, integrity, and accessibility of data within CCC while continuously monitoring for and responding to cybersecurity threats, with oversight by our EVP, Chief Product and Technology Officer who is responsible for all of our IT systems. Our CISO has 18 years of experience managing risks from security threats and developing and implementing security policies and procedures, as well as relevant degrees and certifications, including a bachelor of science in information systems and cybersecurity and being a Certified Information Security Manager and a Certified Information Systems Security Professional. Our EVP, Chief Product and Technology Officer has over three decades of experience in the technology industry and holds a bachelor of science in computer science.

companyName: CCC Intelligent Solutions Holdings Inc.

ticker: CCC


text: Our Board has tasked the Audit Committee with oversight of enterprise risk management, including cybersecurity risk management. Our CISO or EVP, Chief Product and Technology Officer briefs the Audit Committee on cybersecurity risks at each of the quarterly meetings of the Audit Committee. These briefings include assessments of cyber risks, the threat landscape, updates on incidents, and reports on our investments in cybersecurity risk mitigation and governance. The Audit Committee and/or the EVP, Chief Product and Technology Officer also regularly briefs the entire Board on cybersecurity matters.

stage1Category: Board Governance


text: Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. Our cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. We implement risk-based controls to protect our information, the information of our customers and other third parties, our information systems, our business operations, and our products and related services. We have adopted security-control principles based on the National Institute of Standards and Technology Cybersecurity Framework and contractual, industry and regulatory best practices and requirements.


text: Our written Cybersecurity Incident Response Program coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to prepare for, assess severity of, escalate information about, contain, eradicate, and recover from the incident, as well as to conduct post-incident activities, including reporting and conducting root cause analysis and remediation activities. Our incident response policies and the cybersecurity posture are subject to annual testing to evaluate our adherence to policies and compliance requirements. Policies and practices are reviewed periodically to improve processes and practice. We carry cybersecurity insurance to provide a level of financial protection should a covered incident occur.


text: Our cybersecurity and privacy program includes mandatory annual training for all employees and contractors reinforced by targeted phishing tests. The annual training includes training on how to identify potential cybersecurity and privacy risks and protect our resources and information. Additionally, we provide additional specialized security training for employees in roles relating to product development or information technology.


text: While we believe our cybersecurity and privacy program to be appropriately designed in light of the risks we have identified, we have experienced, and may in the future experience, whether directly or through our supply chain or other channels, cybersecurity incidents. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business strategy, results of operations or financial condition. See "Risk Factors—Our solutions or our third-party cloud providers have experienced in the past, and could experience in the future, data security breaches, which could adversely impact our reputation, business, and ongoing operations."


text: We operate in the transportation and logistics sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition and results of operations. We have implemented a risk-based approach aligned with industry standards to identify and assess the cybersecurity threats that could affect our business and information systems. We conduct periodic risk assessments to identify the potential impact and likelihood of various cyber scenarios, including those involving third-party service providers, and to determine the appropriate mitigation strategies and controls. We use various tools and methodologies to manage cybersecurity risk, including implementation of a business continuity process that includes a comprehensive Incident Response Protocol that is tested on a regular cadence and an information security training and awareness program. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.

companyName: Hub Group, Inc.

ticker: HUBG


text: Our business depends on the availability, reliability, and security of our information systems, networks, data and intellectual property. Any disruption, compromise or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development and competitive position. They might also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships or loss of market share. In the last three years prior to filing of this Form 10-K, we have not experienced any significant information security breach.


text: Our Board of Directors (the "Board") has direct oversight of cybersecurity risks and strategy and receives quarterly updates from our Chief Information Officer (CIO). The Board has also delegated to our Audit Committee responsibilities related to cybersecurity and other risks of our Company. Our CIO has spent over 20 years in engineering and product development roles and our VP of Information Security and Operations has spent over 25 years in infrastructure and cybersecurity roles including in the finance and insurance industries. Additionally, one of the independent directors on our Board and a member of our Audit Committee has significant experience leading technology and information systems at some of the country's leading healthcare organizations and adds to our Board substantial expertise and knowledge in information technology, privacy, data governance and cybersecurity. A cross-functional incident response team, which includes members of our management team, determines the apparent severity of reported potential incidents and operationalizes the cybersecurity incident response protocol.


text: To reduce the likelihood and severity of cybersecurity incidents, we established a comprehensive cybersecurity program designed to protect and preserve the confidentiality, integrity and availability of our technology systems and business operations more broadly. For a discussion of the risks associated with cybersecurity threats, see Item 1A. Risk Factors.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: Risk Management and Strategy Our processes for assessing, identifying, and managing material risks from cybersecurity threats include: • Ongoing Assessment—The Cybersecurity department, led by the VP, Chief Information Security Officer (CISO), and reporting to the SVP, Chief Information and Digital Officer (CIDO) is staffed with cyber professionals tasked with the day-to-day responsibility of assessing material risks from cybersecurity threats. In addition, the Cybersecurity Council, comprised of senior management, is kept apprised of the state of PSEG's cybersecurity program, including any emerging risks, and provides guidance on the strategic directions of the program. • Engagement of Nth Parties—We engage Nth parties (third parties and other business relationships, including fourth parties, etc.), such as cybersecurity service providers, risk management firms, and external legal counsel, to assess material risks from cybersecurity threats and assess our internal incident response preparedness and cyber posture, support incident response, conduct tabletop exercises, and comply with applicable laws and regulations. We also carry cybersecurity insurance that provides certain protection against losses from a cybersecurity incident. Regulatory agencies, including but not limited to the NRC and Transportation Security Administration (TSA), as well as NERC, inspect applicable components of our cybersecurity program. • Nth-Party Service Provider Management— We maintain processes to oversee and identify risks from cybersecurity threats associated with our use of Nth-party service providers. This includes a risk-based vendor management program, which incorporates robust cybersecurity contractual provisions, vendor security assessments and, if appropriate, periodic audits. • Technical Safeguards—We manage controls to protect our network perimeter, internal IT and Operational Technology (OT) environments, such as internal and external firewalls, network intrusion detection and prevention, penetration testing, vulnerability assessments, threat intelligence, endpoint security and access controls. • Training and Awareness—We provide mandatory annual cybersecurity training for all personnel with network access, and additional education for personnel with access to industrial control systems and/or customer information systems; and conduct phishing exercises with progressive consequences for failures. Employees also receive periodic cybersecurity awareness messages and each year, in recognition of Cybersecurity Awareness Month, are invited to presentations throughout October from internal and external cyber experts covering diverse cyber topics. These efforts better enable all employees to identify potential cybersecurity risks and escalate them appropriately. • Incident Response Plans—We maintain and periodically update a cyber incident response plan that addresses the life cycle of a cybersecurity incident from a technical perspective (i.e., detection, response, and recovery), and a data breach response plan (with a focus on external communication/disclosure and legal compliance); and conduct regular tabletop exercises to test plan effectiveness (both internally and through external exercises). • Mobile Security—We maintain controls to prevent loss of data through mobile device channels.


text: • Physical Security—We also maintain physical security measures to protect our OT systems, consistent with a defense in-depth and risk-tiered approach. Physical security measures may include access control systems, video surveillance, around-the-clock command center monitoring, and physical barriers (such as fencing, walls, and bollards). Additional features of PSEG's physical security program include threat intelligence, insider threat mitigation, background checks, a threat level advisory system, a business interruption management model, and active coordination with federal, state, and local law enforcement officials. See Item 1. Business. Regulatory Issues—Federal Regulation for a discussion of Critical Infrastructure Protection standards that the NERC promulgated that mitigate risk associated with both cybersecurity and physical security of PSEG's critical facilities.


text: These processes are integral to our overall risk management system/processes and inform the identification and assessment of risks and mitigations through our Enterprise Risk Management (ERM) program. The ERM team, led by the SVP, Audit, Enterprise, Risk and Compliance (AERC) considers cybersecurity risks alongside other PSEG risks, and facilitates discussion with PSEG subject matter experts to identify cybersecurity risks, evaluate their potential severity and likelihood, identify mitigations, including those identified above, and assess the impact of those mitigations on residual risk. In addition, PSEG maintains a Risk Management Committee (RMC), responsible for assessing exposure to and determining PSEG's overall risk management strategy, including with respect to cybersecurity. The RMC, supported by the ERM function, is chaired by the SVP, AERC and consists of members of senior management including the CIDO and six of the CEO's other direct reports. In discharging its responsibilities related to cybersecurity threats, the RMC has received presentations from the CISO. To date, there has been no material impact or reasonably likely material impact on our business strategy, results of operations or financial condition from cybersecurity attacks or incidents, including as a result of prior cybersecurity incidents.


text: – PSEG Board of Directors (Board) Oversight of Risks from Cybersecurity Threats: • PSEG Board—The PSEG Board has ultimate responsibility for the oversight of risk management at PSEG, overseeing PSEG's risk management program and reviewing the most significant risks facing PSEG, including cybersecurity risks. The Governance, Nominating and Sustainability Committee of the PSEG Board reviews key enterprise risks, including cybersecurity risks, and recommends to the Board the mapping of each risk to an appropriate committee or the full Board, in accordance with the allocation of risk categories reflected in the charter of each committee. Through this process, cybersecurity risk is mapped primarily to the Board's Industrial Operations Committee (IOC), and also the Audit Committee. In providing oversight of risks from cybersecurity threats, the Board is informed of cybersecurity incidents as appropriate, by way of updates from Senior Management, pursuant to PSEG's Cybersecurity Event Escalation and Incident Response Practice, as administered by the CISO. • IOC—At the PSEG Board level, the IOC holds the primary responsibility, as enumerated in its charter, of overseeing PSEG's cybersecurity program and assessing overall compliance through active, independent and critical oversight. The IOC is informed about cybersecurity risks by the CIDO and/or the CISO, during the IOC's four regularly scheduled meetings per year, which each include cybersecurity as a standing agenda item. Cybersecurity updates to the IOC include discussions on OT and IT cyber risks, cybersecurity updates from the CISO and/or CIDO, and reviews of a corporate cybersecurity scorecard and other performance indicators. The CIDO and CISO regularly attend IOC meetings. In addition, the IOC meets with the CISO in executive session with no other members of management present. To ensure the full Board is kept informed about the cybersecurity risks discussed at the IOC meetings, the cybersecurity materials provided to the IOC are available for full viewing by all members of the Board, members of the Board who are not IOC members have a courtesy invitation to each IOC meeting, and the Chair of the IOC provides a summary of IOC meetings to the full Board, typically the day after the meeting takes place. • Audit Committee—The Audit Committee has the charter responsibility of overseeing cybersecurity risks related to financial reporting and internal controls. The Audit Committee receives a cybersecurity update twice a year from the CISO, either with the full Board or the IOC in attendance. Audit Committee members have a courtesy invitation to all IOC meetings, have full access to IOC meeting materials, and receive the summary of IOC meetings from the IOC Chair as noted above. • Governance, Nominating and Sustainability Committee and Audit Committee—These committees are briefed at least annually on enterprise-level risks and emerging risks, including those related to cybersecurity, and receive regular updates on PSEG RMC activities, including those related to cybersecurity.


text: • Board of Directors, IOC, and Audit Committee—In providing oversight of risks from cybersecurity threats, the Board, IOC, and Audit Committee are informed of cybersecurity risks through frequent reports on such topics as personnel and resources to monitor and address cybersecurity threats, technological advances in cybersecurity protection, rapidly evolving cybersecurity threats that may affect us and our industry, cybersecurity incident response and applicable cybersecurity laws, regulations and standards, as well as collaboration mechanisms with intelligence and enforcement agencies and industry groups to assure timely threat awareness and response coordination. In addition, risks associated with cybersecurity incidents, or potential incidents, are escalated by senior management promptly to the Board outside of regularly scheduled meetings, if appropriate. – Management's Role in Assessing and Managing Material Cybersecurity Risks:


text: The assessment and management of material risks from cyber threats is managed by the CIDO, CISO and Cybersecurity Council, as further described below.


text: • CIDO—The CIDO has had the overall responsibility for PSEG's cybersecurity since September 2022, including the assessment and management of material risks to PSEG from cybersecurity threats. The CIDO has served in that position since August 2020 and is a direct report to the CEO. The CIDO has over 25 years of energy experience inclusive of leading technology compliance with cybersecurity regulations for nuclear, transmission, gas and corporate assets. Our CIDO's experience includes leading the secure technology design, development, and deployment strategy for grid modernization efforts, including digital customer engagement platforms, advanced metering, enterprise asset management and distribution automation functionality.


text: As noted above, the CIDO provides cybersecurity updates to the Board or its Committees, regularly attends and provides updates with the CISO to the IOC, and has met with the IOC, without other members of management present, during the IOC executive sessions.


text: The CIDO remains informed about the monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents through the CISO and other members of the cybersecurity team, as appropriate, who are tasked with these responsibilities on a day-to-day basis.


text: • CISO—The CISO has day-to-day responsibility for PSEG's cybersecurity, including the assessment and management of material risks to PSEG from cybersecurity threats, and leads the cybersecurity team. The CISO served in this role since July 2024. Our CISO has over 20 years of experience in cybersecurity and served as a VP, CISO in the manufacturing/chemicals sector prior to joining PSEG. Our CISO also started her career at the Department of Defense and led cyber teams in the financial and retail sectors. Our CISO holds an MBA in strategy, an MSE in Computer Science, a BS in Computer Science, and multiple cybersecurity certifications, including Certified Information Systems Security Professional.


text: As noted above, the CISO provides cybersecurity updates during the four regularly scheduled IOC meetings and regularly meets with the IOC, without other members of management present, during executive sessions. The CISO remains informed about the monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents through the members of the CISO's cybersecurity team, who are tasked with these responsibilities on a day-to-day basis.


text: • Cybersecurity Council—The Cybersecurity Council, chaired by the CISO, ensures that senior management, and ultimately, the Board, are given the information required to exercise proper oversight over cybersecurity risks and that escalation procedures are followed. The Cybersecurity Council meets at least six times annually to receive reports on the state of PSEG's cybersecurity program, provide guidance on the strategic direction of the program, discuss emerging cybersecurity issues, and review the cybersecurity scorecard to measure performance of key risk indicators. The Cybersecurity Council receives presentations from the CISO, members of the Cybersecurity team, other IT domain experts, cybersecurity managing counsel and external cybersecurity experts, and participates in tabletop exercises led by external consultants. In addition to the CISO, the Cybersecurity Council members include the: (i) CIDO; (ii) EVP and General Counsel; (iii) EVP and CFO; (iv) President and COO of PSE (v) President of PSEG Nuclear and Chief Nuclear Officer; (vi) SVP – Corporate Citizenship; (vii) SVP – Chief Human Resources and Diversity Officer; (viii) VP of Corporate Security and Properties; (ix) SVP – AERC; (x) Project Executive Advisor; and (xi) Vice President and Controller. PSEG's Corporate Secretary and Managing Counsel – Cybersecurity serves as counsel to the Cybersecurity Council. In providing oversight of risks from cybersecurity threats, Senior Management is informed of cybersecurity risks through updates shared during Cybersecurity Council meetings and through notifications or updates by the CISO, pursuant to PSEG's Cybersecurity Event Escalation and Incident Response Practice. For a discussion of regulatory requirements relating to cybersecurity matters, see Item 1. Business—Regulatory Issues.


text: The energy sector, including electric and natural gas utility companies, has become the subject of cyberattacks with increased frequency and we, along with other utility companies, are the target of these frequent attacks. In addition, there is a growing reliance on third party providers which are also subject to attacks and breaches. Any unexpected failure, or unauthorized access to technology systems or third parties relied upon can result in the unavailability of systems or services, which can result in a loss of operating revenues, damage to our brand and reputation, and/or an increase in operating expenses and costs to repair or replace damaged assets. See "Risk Factors – Cyber Risk Factors" for further information.

companyName: AVISTA CORP

ticker: AVA

stage1Category: None/Other


text: We consider the management of cybersecurity risk in our overall enterprise risk management program. See "Item 7. Management's Discussion and Analysis - Enterprise Risk Management" for further discussion of the program.


text: We mitigate cyber risk by maintaining an enterprise security program based on the National Institute of Standards and Technology Cyber Security Framework. This program includes trainings and exercises at all levels of the Company. Our security program incorporates enterprise business continuity which facilitates a business impact analysis of core functions for development of emergency operating and disaster recovery plans and coordinates annual testing and training exercises. In addition, there are independent third party and regulatory audits of our security program.


text: The technology department, led by the Vice President, Chief Information Officer, and Chief Security Officer, is responsible for our cybersecurity program. The Vice President, Chief Information Officer and Chief Security Officer has over 20 years of experience, including serving in similar roles leading and overseeing cybersecurity programs at other companies. This program includes maintenance of appropriate cybersecurity measures, such as firewalls, anti-virus, patching, and other zero-trust security protocols, monitoring for intrusion and security events that may include a data breach or an attack on our operations, and working with our supply chain department to ensure contracts with third party service providers include appropriate requirements for the mitigation of cybersecurity risk that might impact our business.


text: Our data breach response team is comprised of designated members of the technology department, senior management and other appropriate individuals. The team is tasked with assessing, managing and responding to material cybersecurity incidents involving either our systems or the systems of third party service providers. The data breach response team includes subject matter experts within the Company, as well as outside experts who specialize in cybersecurity response. A subset of this team is also responsible for assessing the materiality of cybersecurity incidents, reporting to the Audit Committee of the Board of Directors as appropriate, and ensuring timeline reporting of cybersecurity incidents deemed material to the Company.


text: The Environmental, Technology and Operations Committee of the Board of Directors oversees our management of cybersecurity risks. This Committee is briefed on security policy, programs and incidents on at least a quarterly basis. The Audit Committee of the Board of Directors provides oversight of required disclosures relating to cybersecurity.


text: Flywire recognizes the critical importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our and our client's data.

companyName: Flywire Corp

ticker: FLYW


text: Risk Management and Strategy Managing Material Risks and Integrated Overall Risk Management Flywire has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration is designed to ensure that cybersecurity considerations are an integral part of our decision-making processes at every level. Our security and risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Flywire engages with a range of external experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights to help ensure our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments and consultation on security enhancements.


text: Oversee Third-party Risk Flywire implements stringent processes to oversee and manage the risks associated with third-party service providers. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments by our Chief Information Security Officer (CISO) and on an ongoing basis by our security and risk management team and our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: Our Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. Our Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.


text: Board of Directors Oversight Our Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including risk management, technology and finance, which we believe equips them to oversee cybersecurity risks effectively.


text: Although risks from cyber threats have not materially affected the Trust's business strategy, results of operations or financial condition as of December 31, 2024, Invesco continues to closely monitor cyber risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. Additional information on cybersecurity risks the Trust faces is discussed in Part I, Item 1A "Risk Factors," which should be read in conjunction with the foregoing information.

companyName: Invesco CurrencyShares Japanese Yen Trust

ticker: FXY


text: Management's Role Managing Risk The CISO, General Counsel & Chief Compliance Officer (GC & CCO), Chief Operating Officer (COO) and the Chief Executive Officer (CEO) play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide comprehensive briefings to the Audit Committee on a quarterly basis. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; • Risk mitigation efforts and insurance; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee, CISO, GC & CCO, COO and CEO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of Flywire. Our Audit Committee conducts an annual review of our cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO. With over 30 years of experience in the field of cybersecurity, the CISO brings a wealth of expertise to her role. Her background includes extensive experience as an enterprise CISO and she is well-recognized within the industry. Her in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.


text: Monitor Cybersecurity Incidents The CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents and is subject to periodic testing for effectiveness of response and remediation.


text: Reporting to Management and Board of Directors Our CISO, in her capacity, regularly informs our Chief Financial Officer (CFO), GC & CCO, COO and CEO of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing Flywire. Furthermore, our CISO reports to the Board of Directors at a minimum twice a year, ensuring that they have comprehensive oversight and can provide guidance on significant cybersecurity matters, and strategic risk management decisions.


text: Like many large, global companies, CommScope relies heavily on digital technology to conduct operations and engage with our customers and business partners. As our engagements become more complex and interdependent, threats from security incidents like ransomware and data breaches increase. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management and make securing our data and the data customers and other stakeholders entrust to us a top priority. Our Board of Directors (Board), through our Audit Committee, and our management team are actively involved in the oversight of our Enterprise Risk Management (ERM) program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying and managing material risks from cybersecurity threats. We have made investments in resources to implement and maintain security measures to meet regulatory requirements and stakeholder expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. We believe that risks from prior cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that any such incidents will not materially affect us, including our business strategy, results of operations or financial condition. For additional information regarding the risks associated with cybersecurity incidents, see Item 1A. "Risk Factors."

companyName: Vistance Networks, Inc.

ticker: VISN


text: CommScope's commitment to cybersecurity begins in the boardroom. The Audit Committee is responsible for oversight of cybersecurity and is actively engaged with our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) at least quarterly, in addition to ad-hoc discussions and our periodic cyber crisis management tabletop exercises. Our CIO and CISO also present on cybersecurity to our full Board at least annually. The commitment extends through our executive leadership team (ELT), who engage continually to review our cybersecurity strategy, planning and execution.


text: At CommScope, cybersecurity risk is part of our cross-functional Enterprise Risk Management (ERM) program because of the potential for negative impacts of an incident across our business. At least annually we conduct a cybersecurity risk assessment, bringing together threat intelligence, internal assessment of our control posture and third-party opinions. The risk assessment informs our Board and management team and drives the next year's security strategy and initiatives.


text: CommScope has implemented a cybersecurity program that is dedicated to protecting our business processes, technology assets and sensitive information entrusted to us by our customers, suppliers, employees and other stakeholders. Drawing on the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and Center for Internet Security (CIS) 18 Critical Security Controls, our security program seeks to identify high-value enterprise assets and business processes and manage the cybersecurity threats facing them with layered controls. We practice a "Defense in Depth" methodology, meaning that valuable assets or business processes are generally protected with more than one layered control.


text: Our cybersecurity program is led by our CIO and our CISO. Our CIO has served in various roles in information technology and information security for over twenty years. Our CISO has over twenty years of technology and security experience and has spent more than fifteen years leading cybersecurity functions. He is also a Certified Information Systems Security Professional (CISSP).


text: Our CISO leads an in-house information security team responsible for cybersecurity risk and threat evaluation; the writing of relevant policies, control standards, and technical requirements; and the oversight and operation of security controls. The Security Operations team monitors for potential incidents via a global team operating 24 x 7 x 365 in a "follow the sun" model. We also engage outside experts where a third-party opinion or subject matter expertise provides specific value, such as with penetration testing. We use industry-leading security tools, regularly update our technology roadmaps, conduct tabletop exercises and mandate cybersecurity awareness and training for all employees.


text: We not only focus on cybersecurity threats directly facing CommScope but also those that might affect us through one of the many third parties we do business with, including suppliers and customers. Our procurement and security teams have a shared process to review the cybersecurity risk of our suppliers, performing an assessment during onboarding, requiring them to sign up for contractual security requirements, emplacing security controls and investigating third-party incidents as appropriate.


text: In the event of a significant cybersecurity incident, we have a detailed Cybersecurity Incident Response Plan (CIRP) in place for informing key stakeholders, ensuring events are properly escalated and for contacting authorities. There are many ways that CommScope might initially learn of a cybersecurity incident, and these potential incidents are escalated, according to decision criteria, to a core team of internal stakeholders comprised of leaders from our information security, legal, business and finance organizations. The core team directs the initial fact-finding and response efforts, and based on their qualitative and quantitative review, may escalate the incident to CommScope's ELT. The ELT then makes the decision on escalation to the Audit Committee or Board based on the team's assessment of materiality. Our incident response plan is regularly validated and assessed to consider the types of decisions that would need to be made in the event of a cybersecurity incident.


text: Cyber threats are considered one of the most significant risks facing financial institutions. Because the Fund has no directors, principal officers or employees, the Managing Owner is responsible for managing cybersecurity risks to the Fund. To mitigate risk from cyber threats, Invesco Ltd. ("Invesco"), the Managing Owner's parent company, has a designated Global Chief Security Officer (GCSO) who leads the global security department that is responsible for identifying, assessing, and managing cybersecurity threats across the Invesco organization. The GCSO has over 28 years of experience in the public and private sectors, specializing in security, investigations, and incident response. The global security department oversees the following groups across Invesco: Information Security, Global Privacy, Business Continuity & Crisis Management, Resilience, Corporate Security, Business Security Officers and Strategy and Projects & Governance. This converged security structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees, and critical assets safe, upholding their privacy rights, while enabling a secure and resilient business.

companyName: Invesco DB Multi-Sector Commodity Trust


text: Invesco's information security program is led by its Chief Information Security Officer (CISO) who reports directly to the GCSO and has over 25 years of experience, specializing in information security and risk management. Our manager's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity, and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect our information assets. The program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or third-party incident. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness against cyber phishing threats.


text: Important to these programs is Invesco's investment in threat-intelligence, its active engagement in industry and government security-related forums, and its utilization of external experts to challenge its program maturity, assess its controls and routinely test its capabilities.


text: Invesco's Board of Directors oversees cybersecurity risk across the entire organization and receives updates at a minimum of twice a year regarding cybersecurity, including risks and protections. The Global Operational Risk Management Committee, one of Invesco's risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. The members of this committee include Invesco's Chief Administrative Officer, Chief Risk & Audit Officer, General Counsel, Chief Financial Officer, Chief Human Resources Officer, Global Head of Compliance, and Global Operational Risk Owners which includes the GCSO. The committee reports to Invesco's Enterprise Risk Management Committee which provides updates to the Invesco Board of Directors to facilitate their oversight.


text: Although risks from cyber threats have not materially affected the Fund's business strategy, results of operations or financial condition as of December 31, 2024, Invesco continues to closely monitor cyber risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. For more information regarding the risks we face from cybersecurity threats, please see "Due to the Increased Use of Technologies, Intentional and Unintentional Cyber Attacks Pose Operational and Information Security Risks" in Item 1A. Risk Factors.


text: Cyber threats are considered one of the most significant risks facing financial institutions. Because the Trust has no directors, principal officers or employees, the Sponsor is responsible for managing cybersecurity risks to the Fund. To mitigate risk from cyber threats, Invesco Ltd. ("Invesco"), the Sponsor's parent company, has a designated Global Chief Security Officer (GCSO) who leads the global security department that is responsible for identifying, assessing, and managing cybersecurity threats across the Invesco organization. The GCSO has over 28 years of experience in the public and private sectors, specializing in security, investigations, and incident response. The global security department oversees the following groups across Invesco: Information Security, Global Privacy, Business Continuity & Crisis Management, Resilience, Corporate Security, Business Security Officers and Strategy and Projects & Governance. This converged security structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees, and critical assets safe, upholding their privacy rights, while enabling a secure and resilient business.

companyName: Invesco CurrencyShares Australian Dollar Trust

ticker: FXA


text: Invesco's Board of Directors oversees cybersecurity risk across the entire organization and receives updates at a minimum of twice a year regarding cybersecurity, including risks and protections. The Global Operational Risk Management Committee, one of Invesco's risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. The members of this Committee include Invesco's Chief Administrative Officer, Chief Risk & Audit Officer, General Counsel, Chief Financial Officer, Chief Human Resources Officer, Global Head of Compliance, and Global Operational Risk Owners which includes the GCSO. The committee reports to Invesco's Enterprise Risk Management Committee which provides updates to the Invesco Board of Directors to facilitate their oversight.


text: Although risks from cyber threats have not materially affected the Trust's business strategy, results of operations or financial condition as of December 31, 2024, Invesco continues to closely monitor cyber risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. Additional information on cybersecurity risks the Trust faces is discussed in Part I, Item 1A "Risk Factors," which should be read in conjunction with the foregoing information.


companyName: Invesco CurrencyShares Euro Trust

ticker: FXE


companyName: Invesco DB US Dollar Index Trust


companyName: Invesco DB Commodity Index Tracking Fund

ticker: DBC


text: The Company deploys multiple tools and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents, both internal and associated with the use of any third-party service provider.

companyName: QuantumScape Corp

ticker: QS


companyName: Invesco CurrencyShares Canadian Dollar Trust

ticker: FXC


text: Important to these programs is Invesco's investment in threat-intelligence, its active engage ment in industry and government security-related forums, and its utilization of external experts to challenge its program maturity, assess its controls and routinely test its capabilities.


companyName: Invesco CurrencyShares Swiss Franc Trust

ticker: FXF


text: The Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Zeta Global Holdings Corp.

ticker: ZETA


companyName: Invesco CurrencyShares British Pound Sterling Trust

ticker: FXB


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, managing and disclosing, as necessary, risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes as described below.


text: We routinely assess material risks from cybersecurity threats, including from any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. These risk assessments are designed to identify internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain safeguards intended to address and minimize identified risks and continue monitoring and testing the effectiveness of such safeguards.


text: We devote significant resources and have designated senior management to manage the cybersecurity and information security risk assessment and mitigation process. We have established an internal security committee that includes members of our information security/technology, internal audit/compliance, finance and accounting, people operations, and legal teams, to instill a thoughtful security culture across our Company. Our employees and contractors are made aware of our cybersecurity policies through mandatory trainings during onboarding and on an annual basis. We also engage and consult with third parties in connection with our risk assessment processes, including advisors, consultants and auditors. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: We have not experienced a material security breach in our systems, and, to our knowledge, there have not been any material compromises of our confidential information in our third-parties' systems, nor have we incurred any significant expenses or penalties to resolve or settle any security breach in the past three years. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors – Our Business Risks – Our ability to manage our business is highly dependent on IT systems and our website, systems, and data we maintain may be subject to intentional or inadvertent disruption, security incidents, or alleged violations of laws, regulations, or other obligations relating to data handling that could adversely impact our reputation and future sales," in this Annual Report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly, as well as through the audit committee, which has been tasked with such oversight in the audit committee charter. The audit committee of our board of directors reviews cybersecurity and information security risks and mitigation strategies; the audit committee receives periodic updates on information security and privacy, and the full board receives at least an annual update.


text: Our information security team has many years of experience implementing cybersecurity at technology and research and development companies, and together with our internal information security committee, is primarily responsible for assessing and managing our material risks from cybersecurity threats.


text: Our head of information security periodically provides briefings to our internal security committee and to the audit committee and board of directors on an annual basis regarding our Company's cybersecurity risks and activities, including, as applicable, any recent cybersecurity incidents and related responses and remediation efforts, cybersecurity systems testing, activities of third parties, policies and the like. We have internal guidelines governing our identification, assessment, communication, and escalation upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to a special executive security committee and the chair of the audit committee, among others as needed, to manage the Company's response.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.


text: We design and assess our program based on multiple cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and ISO 27001. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF, ISO 27001 and other frameworks as guides to help us identify, assess, and manage cybersecurity risks relevant to our business. Our program is assessed by third-party security auditors on a yearly basis through our SOC II Type 2 and SOX audit processes.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • the use of external service providers, where appropriate, to monitor our cybersecurity posture on a 24/7 basis in a co-managed Security Operations Center (SOC); • the design and deployment of a Defense-In-Depth layered technical security implementation leveraging best-of-breed components; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition, however, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) the oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: Our management team, including our CIO, Chief Information Security Office (CISO) and General Counsel, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO (to whom the CISO reports) regularly attends meetings of the Committee. Our management team's experience includes decades of experience working in information security, advanced education, and information security certifications. Kurt Baumgarten, CISO, has a long history of successfully leading Information Security Programs across a diverse array of organizations such as Linedata SA, Indigo Ag, and Matterport. Kurt has multiple security certifications, such as CISA, CRISC, CDPSE, CGEIT, and has earned a master's degree in information security from Norwich University as well as an MBA with a concentration in e-commerce. Dr. Jeffry Nimeroff, CIO, has a 25-year history of building technology groups and integrating Information Security programs at organizations ranging from startups like Hotsocket and Pet360 to established companies at various points in their lifecycle like CDnow, and Bertelsmann Music Group. Dr. Nimeroff has a PhD in Computer Science from the University of Pennsylvania.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: As part of our ongoing company-wide risk assessment, our management team has identified several key categories of cybersecurity risk to which we are exposed, including, (i) data security risks, (ii) malware and phishing attacks, (iii) insider and third-party risks, (iv) infrastructure and network risks and (v) regulatory and compliance risks. We identified the above risks based on an analysis of our business and a technical analysis by our information and communications technology ("ICT") consultants of our most critical business activities and associated vulnerabilities. We review our systems against specified security metrics to ensure they are satisfactory, monitor our third-party vendors and partners, participate in threat intelligence sharing, have developed mechanisms designed to detect deviations in our systems, have implemented information technology protocols to control access to our systems and information, provide security awareness trainings, and proactively patch known vulnerabilities. We are working with third-party consultants to build our cybersecurity incident detection processes, including taking the steps described above, and are also working with our vendors and partners to ensure that we are made aware of any cybersecurity incident they experience that may impact our business promptly. In addition, we maintain policies and processes to assess and manage risks relating to third-party service providers, including based on the nature of the engagement with the third party and based on the information and information systems to which the third party will have access. We maintain policies to conduct due diligence before onboarding new service providers and maintain ongoing evaluations to ensure compliance with our security standards. Our management team, along with ICT consultants and other advisors, will conduct a risk assessment on at least an annual basis in order to ensure we are appropriately managing known cybersecurity risks and discovering any potentially new risks. To date, we have not identified any material impact on our business strategy, results of operations or financial condition resulting from the cybersecurity risks described above. However, there can be no assurances that the steps we take will be sufficient to avoid a cybersecurity incident and, if an incident were to occur, our business may be materially impacted as a result of any costs associated with remediating a cybersecurity incident or resolving litigation or regulatory enforcement actions as a result such incident, or potential delays to our clinical trials or release of data as a result of an incident impacting our internal systems or those of the CROs on whom we rely to conduct our clinical trials and gather data from such trials. Furthermore, the realization of any of the risks described above could seriously harm our reputation making it more difficult to recruit patients and CROs, conduct clinical trials, obtain regulatory approvals for our current or future product candidates or generate partnering opportunities.

companyName: NewAmsterdam Pharma Co N.V.

ticker: NAMS


text: Our Audit Committee oversees the application of our ICT systems and all risks relating to cybersecurity. Cybersecurity is a standing agenda item at each of the Audit Committee's regularly scheduled meetings and the committee may engage any external advisor as needed to advise on cybersecurity matters. The Audit Committee periodically reports on such matters to the Board of Directors as part of our overall risk management and oversight framework. We have also established a management-level disclosure committee (the "Disclosure Committee"). The Disclosure Committee, which consists of employees representing our legal, finance, IT, regulatory and clinical departments, is responsible for overseeing the preparation of our public disclosure materials and assessing the materiality of events within the Company. The Disclosure Committee is also responsible for conducting our cybersecurity risk assessment and ensures constituencies from across the Company are represented in such assessment. The Disclosure Committee monitors cybersecurity incidents and risk on an ongoing basis and may engage outside consultants as needed to assess and respond to cybersecurity incidents. The Disclosure Committee reports to the Audit Committee on a variety of matters, including cybersecurity risks. In addition, our Senior Vice President of Information Technology has significant experience managing IT departments, including with regard to cybersecurity risk management and compliance. We have also engaged a third party to provide technical information technology experience to the Disclosure Committee, Audit Committee and Board of Directors.


text: Cybersecurity Program Overview As part of our overall risk management processes and procedures, we have instituted a cybersecurity program designed to identify, assess and manage material risks from cybersecurity threats, including by engaging a third-party cybersecurity service provider, which communicates directly with our management and compliance personnel. The cyber risk management program involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity program, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party cybersecurity service provider, material risks from cybersecurity threats associated with our use of such entities.

companyName: Trinity Capital Inc.

ticker: TRIN


text: Board Oversight of Cybersecurity Risks Our Board provides strategic oversight on cybersecurity matters, including material risks associated with cybersecurity threats. Our Board receives periodic updates from our Chief Compliance Officer and Chief Operating Officer, and more frequently as needed, regarding the overall state of our cybersecurity program, information on the current threat landscape, and material risks from cybersecurity threats and cybersecurity incidents.


text: Management's Role in Cybersecurity Risk Management Our management team, including our Chief Compliance Officer and Chief Operating Officer, is responsible for assessing and managing material risks from cybersecurity threats, including by engaging third-party service providers, as described above. Members of our management team possess relevant expertise in various disciplines that are key to effectively managing such risks, such as technology systems, technology leadership, technological development, cybersecurity, regulatory compliance and corporate governance. Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from third-party service providers and reliance on communications with our risk management, legal, and/or compliance personnel.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats are assessed on an ongoing basis, and how such risks could materially affect our business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, operational results, and financial condition.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and clinical trial data, or Information Systems and Data.

companyName: Taysha Gene Therapies, Inc.

ticker: TSHA


text: Our information technology team, led by our Vice President of Information Technology, helps identify, assess, and manage our cybersecurity threats and risks. Our information technology team assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example analyzing threat reports, conducting audits, and using intelligence feeds.


text: Depending on the environment, systems, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, employee training, access controls, cyber insurance, and systems monitoring.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our senior management along with our information technology team evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity software providers, managed cybersecurity service providers, and dark web monitoring services.


text: We use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations, contract manufacturing organizations, and hosting companies. We have a vendor management process to manage cybersecurity risks associated with our use of these providers which includes risk assessments and audits. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or those third parties with whom we work or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions to our operations such as our clinical trials; claims that we breached our data privacy and security laws; reputational harm; a loss of customers or sales; and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Compliance Officer and Vice President of Information Technology, both of whom have previously served in management roles at other public biotechnology companies.


text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.

companyName: CATALYST PHARMACEUTICALS, INC.

ticker: CPRX


text: Company management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Company management is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of our legal team depending on the circumstances. Our information technology team works with our incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Audit Committee of the board of directors for certain cybersecurity incidents.


text: Board Oversight Responsibilities The Board of Directors bears the ultimate responsibility for ensuring that an adequate cyber and information technology risk (IT risk) management framework is in place and functioning as intended. IT risk focuses on information and information systems, especially the most critical and vital information assets. Without reliable and properly secured information systems, business operations could be severely disrupted. Likewise, the preservation and enhancement of the Company's reputation is directly linked to the way in which both information and information systems are managed. Maintaining an adequate level of security is one of several important aspects of managing IT risk. The Board's oversight responsibility in this respect includes oversight of the Company's vendor management program and the periodic evaluation of the Company's IT risk management controls.

companyName: FARMERS & MERCHANTS BANCORP INC

ticker: FMAO


text: The Board of Directors implements its IT risk oversight obligations primarily through the Board's Enterprise Risk Management Committee (ERM Committee). The primary function of the ERM Committee is to advise the Board of Directors regarding the enterprise risk management framework of the Company and to provide oversight to assist the Board of Directors in supervising enterprise risk management activities. The ERM Committee reviews and defines risk exposure limits for each specified risk category, including IT risk, while taking into consideration strategic goals and objectives and current market conditions. The Board ERM Committee reviews and approves any necessary changes to risk exposure limits after careful consideration of any changes in market conditions or corporate strategy and adopts guidelines, through the input of the Management Risk Committee's analysis and discussion, regarding the maximum loss exposure the Bank is able and willing to assume.


text: The Management Risk Committee is comprised of various members of Senior Management, Department Leaders, Compliance, Internal Audit and Risk Management. The Management Risk Committee is responsible for loss control and day-to-day oversight of the risk management function. Management Risk Committee meetings are held monthly. Results of the monthly review of risk categories are reported to the Board of Directors Enterprise Risk Management Committee (ERM) each quarter. In addition, the Company's risk position is reported to the Board of Directors quarterly.


text: At least annually, the Board of Directors reviews and approves the risk management program and policies based on information presented throughout the year from the ERM Committee and the Management Risk Committee.


text: In addition, the Information Systems (IS) Steering Committee, which is chaired by the Company's Chief Information Officer, serves as an advisory group providing assistance and guidance to management regarding customer information security, information systems planning, systems management organization, systems performance, business continuity, information security, system related expenditures, vendor management, and related policies and procedures. The IS Steering Committee meets on a monthly basis. Formal meeting minutes serve to document decisions and recommendations by the IS Steering Committee and are reported to both the Management Risk Committee and the Board ERM Committee. Management has appointed the Chief Information Officer the responsibility for overall management of the Company's "front line" IT risk.


text: Material Impact of Cyber Risk As discussed more thoroughly below, the Company devotes significant resources to implement, maintain, monitor and regularly upgrade our systems and networks with measures such as intrusion detection and prevention and firewalls to safeguard critical business applications. The additional cost to the Company of our cyber security monitoring and protection systems and controls includes the cost of hardware and software, third party technology providers, consulting, and legal fees, in addition to the incremental cost of our personnel who focus a substantial portion of their responsibilities on cyber security. With the assistance of third-party service providers, we continue to implement security technology and establish procedures to maintain network security. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. In addition, we maintain insurance coverage that may, subject to policy terms and conditions, cover certain aspects of cyber risks, but such insurance coverage may not always be sufficient to cover all losses.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CLCO, our COO, and our IT personnel. In their time with our company, our CLCO and our COO have become increasingly involved in investigating, responding to, and mitigating cybersecurity incidents and intrusion attempts. Their in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CLCO and our COO oversee our governance programs, test our compliance with standards, remediate known risks, and oversee or lead our employee training program.


text: IT Risk and Vendor Management We rely on third-party service providers to leverage subject matter expertise and industry best practice, provide enhanced products and services, and reduce costs. Although there are benefits in entering into third-party relationships with vendors and others, there are risks associated with such activities. When entering a third-party relationship, the risks associated with that activity are not passed to the third-party but remain our responsibility. At the direction of the Board and pursuant to its ultimate oversight, management is charged with the development and maintenance of a comprehensive vendor management program. In that respect, Company management has appointed the IS Steering Committee, chaired by the Chief Information Officer, to oversee the Company's vendor management program. The vendor management program is used to identify, measure, monitor, and control the risks associated with outsourcing arrangements. While focusing on information and operational risks, outsourced relationships are reviewed through structured assessments and addressed from an end-to-end perspective. While we have implemented a vendor management program to actively manage the risks associated with the use of third-party service providers, any problems caused by third-party service providers could adversely affect our ability to deliver products and services to our customers and to conduct our business. Replacing a third-party service provider could also take a long period of time and result in increased expenses.


text: Internal and External Risk Evaluations An annual Information Technology Audit, which is facilitated by the Internal Audit Department, is conducted via a co-sourcing agreement with a third-party auditor. The objective of the IT audit is to evaluate the effectiveness and efficiency of operations, test the reliability of data and IT controls, and ensure compliance with applicable laws, regulations, guidance, and industry best practices. The audit scope addresses IT Governance, IT Management, IT Operations, and IT Security. Testing of the internal network environment and external network perimeter are included in the Results of the IT Audit and are reviewed with the IS Steering Committee and Company management. For any exceptions identified, a responsible party is assigned, and action plans are developed to address corrective measures. The final results of the IT Audit are reviewed with the Board Audit Committee. The status of unresolved audit issues along with their priority ratings is reported to both Management's IS Steering Committee and the Board Audit Committee at each meeting.


text: In addition, in accordance with Gramm-Leach-Bliley Act requirements regarding safeguarding and protecting customer information, an Information Security Risk Assessment is conducted at least annually by the Risk Department and reviewed with the Management Risk Committee, the ERM Committee, and the Board of Directors. A risk analysis is performed to evaluate current processes, identify information assets, and determine the adequacy of the safeguarding and protection of confidential customer information collected and maintained. For each information asset identified, the criticality of the asset, the threats to the defined asset, the likelihood of compromise of the asset, the business impact if an asset is compromised, and an overall risk rating for each asset are defined. The results of this assessment are reviewed with the IS Steering Committee and the Risk Committee and reported at least annually to the Board ERM Committee.


text: We maintain an information security program and governance framework that are designed to protect our information systems against risks related to cybersecurity.

companyName: STIFEL FINANCIAL CORP

ticker: SF


text: Cybersecurity Risk Management and Strategy We define information security and cybersecurity risk as the risk that the confidentiality, integrity, or availability of our information and information systems are impacted by unauthorized or unintended access, use, disclosure, disruption, modification, or destruction. Information security and cybersecurity risk are incorporated into our comprehensive Enterprise Risk Management ("ERM") program, which we use to identify, aggregate, monitor, report, and manage risks.


text: The Written Information Security Program ("WISP"), our enterprise information security and cybersecurity program, is incorporated within the ERM program and led by our Chief Information Security Officer ("CISO"). The WISP is designed to (i) ensure the security, confidentiality, integrity, and availability of our information systems and data (ii) protect against any anticipated threats or hazards to the confidentiality, integrity, or availability of such information and information systems and (iii) protect against unauthorized access to information or information systems that could result in substantial harm or inconvenience to us, our associates, or our clients. The WISP is built upon a foundation of advanced security technology, a well-trained team of experts, and is designed to operate in alignment with applicable regulatory requirements. WISP deploys multiple layers of controls to identify, protect, detect, respond to, and recover from information security and cybersecurity incidents. These controls are measured and monitored by subject matter experts and a security operations center with integrated cyber detection, response, and recovery capabilities. The WISP includes our Incident Response program, which manages information security incidents involving compromises of sensitive information, and our Security Incident Response Plan ("SIRP"), which provides a documented framework for handling high severity cybersecurity incidents and facilitates coordination across multiple parts of the Company to manage response efforts. We also routinely perform simulations and drills around security matters at both a technical and management level, and our associates receive annual cybersecurity awareness training.


text: The WISP incorporates reviews by our Internal Audit department and external third-party experts. Periodic independent third-party maturity assessments are conducted against the NIST Cyber Security Framework. Investments in threat intelligence, collaboration with peers, vulnerability management, incident response drills, and participation in industry and government forums are also part of our program.


text: Cybersecurity risks related to third parties are managed as part of our System and Services Acquisition Policy, which sets forth the procurement, risk management, and contracting framework for managing third-party relationships commensurate with their risk and complexity. Our program sets guidelines for identifying, measuring, monitoring, and reporting the risks associated with third parties through the life cycle of the relationships, which includes planning, due diligence and third-party selection, contracting, ongoing monitoring, and termination. Our program includes the identification of third parties with risks related to information security. Third parties that access, process, collect, share, create, store, transmit, or destroy our information or have access to our systems may have additional security requirements, depending on the levels of risk, such as enhanced risk assessments and monitoring, and additional contractual controls. We also conduct reassessments of our third-party risk, using a risk-based approach to determine frequency. Where appropriate, the Company seeks to incorporate contractual language with third-party service providers that address the collection, use, sharing, and retention of user data, as well as compliance with appropriate security terms.

stage1Category: Third-Party Risk


text: While we do not believe that our business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive, and, similar to other global financial services firms, we, as well as our clients, associates, regulators, service providers, and other third parties, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber attacks. We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities, as well as the broader financial services cybersecurity ecosystem. See Item 1A – Risk Factors" of this Form 10-K for additional information on cybersecurity risks.


text: Cybersecurity Governance Under our information security framework, our Board and our Risk Management Committee are primarily responsible for overseeing and governing the development, implementation, and maintenance of our WISP, with the Board designating our Risk Management Committee to provide oversight and governance of technology and cybersecurity risks. Our Board receives an update on cybersecurity at least twice a year from our CISO or their designee. Our Risk Management Committee receives reports on cybersecurity at least four times a year, with ad hoc updates as needed. In addition, our Risk Management Committee annually approves our WISP program.


text: Our Operational Risk Committee ("ORC") provides oversight and governance for our information security risk management activities, including those related to cybersecurity. This includes efforts to identify, measure, manage, monitor, and report information security risks associated with our information and information systems. The ORC escalates risks to the Risk Management Committee or our Board based on the escalation criteria provided in our information security framework. Members of management with cybersecurity oversight responsibilities are informed about cybersecurity risks and incidents through a number of channels, including periodic and annual reports, with the annual report also provided to our Risk Management Committee and the ORC. Our CISO leads the strategy, engineering, and operations of cybersecurity across the Company and is responsible for providing annual updates to our Board and the ORC on our WISP, as well as ad hoc updates on information security and cybersecurity matters. Our CISO reports directly to the Risk Management Committee. The CISO has been with the Company since 2023 and has over 28 years of information technology and cybersecurity experience.


text: Risk management and strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.


text: Managing Material Risks & Integrated Overall Risk Management We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are a part of our decision-making processes at every level. Our risk management team works closely with our Information Technology (IT) team including our IT and cybersecurity vendors to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Engage Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.