text: Risk Management Strategy The Director of Information Technology, who reports to the Chief Financial Officer, has extensive information technology ("IT") and cybersecurity knowledge and skills gained from over 15 years of relevant work experience at the Company, and is responsible for leading the Company's cybersecurity and cyber risk management program which includes certain cybersecurity processes covering the Company's corporate systems. These processes include, among other items, the Company's information technology and risk management departments' use of an internal set of applications and control activities to actively monitor potential threats to its corporate IT environment and regularly conduct internal testing to identify potential vulnerabilities to the Company's corporate information technology infrastructure and systems. These activities include, but are not limited to, continuous monitoring of network and infrastructure vulnerabilities, automated patching and software updates, redundancy and back-up systems, and incident response planning and handling. The Company's employees are required to report cybersecurity events, including suspicious activity or emails, to the Company's information technology department. Should a cybersecurity event occur within its corporate systems, the Company is positioned to coordinate a swift response to mitigate impacts to its information technology infrastructure and systems. The Company has in place an incident response plan which provides guidance for leadership and employees to swiftly evaluate and respond to cybersecurity incidents. The Company also carries cybersecurity insurance to further mitigate certain potential losses from a cybersecurity incident affecting its corporate IT equipment and systems.


text: The Company's cybersecurity processes also include self-assessments using industry benchmarks as well as input from external industry consultants and ongoing communication with third-party business partners to identify cybersecurity incidents and threats that could potentially impact the Company. The Company has relationships with a number of third-party business partners to assist with cybersecurity incident containment and recovery efforts and assesses the processes and tools used by its third-party business partners to manage their cybersecurity risks. The Company uses a risk-based approach with respect to its use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of network connectivity or of data accessed, processed, or stored by such third-party service provider.

companyName: Apple Hospitality REIT, Inc.

ticker: APLE

secItem: Item 1C


text: Role of Management Helios Technologies' Information Technology organization is led by the VP, Information Technology and is responsible for administration of the cybersecurity and information security framework and risk management, including that of the Corporation and its business units, with oversight by the ESG Committee.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO

stage1Category: Management Role

stage1Method: unanimous


text: The Company's corporate IT systems are not used to process business transactions with its guests and those systems currently have no connectivity to hotel and/or third-party management and brand technology platforms. The Company's information technology and risk management departments regularly engage with its third-party management companies and brands to understand and benchmark their execution and alignment with applicable policies and industry practices for data protection and cybersecurity.


text: Management and Board Oversight The Company's Board of Directors administers cybersecurity risk oversight primarily through its Audit Committee. The Board's Audit Committee is tasked with oversight responsibility for the Company's enterprise risk management program, including those related to cybersecurity and cyber risks. The Audit Committee receives regular reports from the Chief Financial Officer on, among other things: the Company's cybersecurity risks and threats; the status of projects to strengthen the Company's information security systems; internal and third-party assessments of the Company's cybersecurity program; and the emerging cyber threat landscape. The Audit Committee also receives updates on cybersecurity incidents experienced by third-party business partners that may pose significant risk to the Company. The Audit Committee provides periodic reporting to the Board of Directors on cybersecurity matters. The Company's IT and risk management departments report directly to the Chief Financial Officer and are directed to promptly report incidents to the Chief Financial Officer in accordance with the Company's incident response plan. The Chief Financial Officer also apprises the Audit Committee of cybersecurity incidents consistent with the Company's incident response procedures for more significant incidents and in the aggregate for less significant incidents.

stage1Category: Board Governance

stage1Method: majority


text: Cybersecurity Risks The Company faces a number of cybersecurity risks in connection with its business, although such risks have not materially affected the Company, including its business strategy, results of operations or financial condition, to date. While the Company is not aware of any cybersecurity incidents that have materially affected its business as of December 31, 2024, there can be no guarantee that the Company will not be the subject of future attacks, threats or incidents, that may have a material impact on its business strategy, results of operations or financial condition. Notwithstanding the extensive approach the Company takes to address cybersecurity, it may not be successful in preventing or mitigating all cybersecurity incidents or threats. For more information about the cybersecurity risks the Company faces, see the risk factor entitled "Technology is used in operations, and any material failure, inadequacy, interruption or security failure of that technology from cyber-attacks or other events could harm the Company's business" in Item 1A- Risk Factors.

stage1Category: Strategy Integration


text: Global cybersecurity vulnerabilities and threats continue to evolve and are increasingly more sophisticated. The Company is aware of the dynamic nature of the cybersecurity threats we face and has a security program led by our Chief Information Security Officer (CISO) that strives to monitor and mitigate risks from cybersecurity threats. The CISO reports to the Chief Information Officer (CIO), provides periodic reports to the Chief Executive Officer (CEO) and Chief Financial Officer (CFO), and reports quarterly to the Audit Committee of the Board of Directors, which oversees the Company's cybersecurity risk profile, including risks from cybersecurity threats, and mitigation activities. The Company's CISO has over 35 years of security and cybersecurity experience between the military and corporate sectors. Prior to joining Benchmark, he oversaw cybersecurity for Masco Corporation, a Fortune 500 company, and La-Z-Boy Incorporated, both of which are global manufacturing organizations with similar complexities as the Company. The CISO also served as a member of the Department of Defense as a civilian in charge of cybersecurity for an Army acquisition command, overseeing the cybersecurity for approximately 320 programs of record.

companyName: BENCHMARK ELECTRONICS INC

ticker: BHE


text: The Company's CIO has been and continues to be responsible for Global IT, including overseeing cybersecurity and its digital strategy. In addition, he was responsible for cybersecurity in previous roles prior to joining the Company, including during his time at Rogers Corporation, a global high tech manufacturing company, as well as other global manufacturing companies.


text: The Company has an Enterprise Risk Management (ERM) process, with an annual risk assessment performed. A universe of key risks is updated annually, with key risks rated by and discussed with corporate and site-level executives, as well as the Audit Committee, which oversees the Company's ERM process. As a result of the annual risk assessment, the enterprise's top risks are identified, with action plans developed to address each risk. Results of the annual enterprise risk assessment are presented to and discussed with the Audit Committee at least annually. One of the key risks evaluated annually is cybersecurity. Our cybersecurity risk evaluation assesses whether, or to what extent, information assets (hardware, software, systems, laptops, data, intellectual property) might be compromised in an attack by a malicious actor, resulting in potential data leakage, data destruction, malware infiltration, or a ransomware attack. With the increasing sophistication of cyber-criminals and constantly evolving threat vectors, the Company continues to identify cybersecurity as a top risk, prompting numerous actions and measures across the Company that endeavor to mitigate and, where possible, minimize such risks.

stage1Category: Risk Management Process


text: Saia contracts with third party firms to evaluate our information security program, for continuous system monitoring and threat detection, to gather insights for identifying and assessing material cybersecurity threats, and for potential mitigation assistance. We consider cybersecurity matters when selecting and overseeing our third party service providers and we administer a standardized information gathering questionnaire to evaluate cybersecurity risk in third parties. We seek to require third parties who could pose significant cybersecurity risk to us to be contractually responsible for the risk and to agree to cybersecurity assessments in connection with new vendor engagements and annually thereafter.

companyName: SAIA INC

ticker: SAIA


text: The Company increasingly leverages and relies upon digital technologies and services to conduct our business and support our customers. These technologies and services are a blend of organic and third-party supplied solutions that encompass data storage, processing and transmissions. Our digital technologies support business processes for financial management, human capital management, customer engagement, and manufacturing services. Examples of such technologies include Enterprise Resource Planning (ERP) systems, shop floor controls, test equipment, general business applications, and our global infrastructure and networks, as well as external systems, analytics, automation and cloud services. Such digital technologies and services are subject to numerous risks including, but not limited to, ransomware or cyber-extortion, denial of service to systems, malicious code introduced through third party software products or software updates or theft of company, customer, vendor and employee data. Our operations have been, and may in the future be, subject to ransomware or cyber-extortion attacks, which could significantly disrupt our operations. Generally, such attacks involve restricting access to electronic and computer systems or the restriction or theft of vital data including customer supplied data.

stage1Category: None/Other


text: The Company has a security program that strives to implement best practices for protecting our systems with the understanding that adversaries have varying skills and competencies and may be able to exploit or evade our current protective technologies. We actively monitor our systems for cyber threats and have processes in place to detect and remediate vulnerabilities. Our approach relies on both internal and external monitoring, vulnerability assessments as well as penetration testing by third parties. We also use leading end-point detection response tools to continuously monitor our security environment. We regularly conduct a review of our data management practices to ensure the proper retention, protection and storage of data, and to apply new technology-based tools to better manage the protection of customer data. Our information security policies and practices, which includes disaster recovery, are designed to deliver resilience and comply with several regulatory requirements including DFARS/NIST 800-171 controls. For our defense customers, we are undergoing certification to the U.S. Cybersecurity Maturity Model Certification (CMMC) program and performed a CMMC self-assessment with the assistance of a qualified third-party inspector. To ensure security awareness throughout the Company, we conduct employee training on multiple topics, and also conduct simulated phishing campaign tests. Regular communications remind all employees of how to be vigilant against cyberattacks. We have also recently implemented a third-party cybersecurity risk management program that continuously monitors key suppliers and customers' cybersecurity scores.


text: The Company's protective technologies include firewall and email protection against malware and phishing campaigns, and information system access management solutions such as multifactor authentication (MFA). We augment these protective technologies with security monitoring and detection capabilities to limit the impact of cybersecurity incidents. The security monitoring and detection tools we utilize leverage Endpoint Detection and Response (EDR) and Security Incident and Event Management (SIEM) augmented with threat intelligence information from multiple sources. We have further enhanced the security posture of the Company by implementing data security technologies and measures to reduce the impact of attempts to steal or destroy data. These technologies are tested regularly by both internal resources and external experts that evaluate the technology and identify vulnerabilities for mitigation and/or remediation. Our security program leverages Company and third-party security professionals and services to achieve an appropriate level of security and resilience that is reviewed periodically by an IT steering committee that includes senior officers such as the CEO, CFO, Chief Legal Officer, CIO, CISO, Chief Operating Officer and Chief Technology Officer, and the efficacy of these programs is also reviewed quarterly with the Audit Committee of the Company's Board of Directors. We have also recently implemented a third-party cybersecurity risk management program that continuously monitors cybersecurity scores of key suppliers and customers.


text: As of the date of this filing, we are not aware of any risks from cybersecurity threats, including any previous cybersecurity incidents since the ransomware incident in the fourth quarter of fiscal 2019 described under "Our operations are subject to cyberattacks that could have a material adverse effect on our business" in Part I, Item 1A of this Report, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. This statement does not guarantee that future incidents or threats will not have a material impact or that we are not currently the subject of an undetected incident or threat that may have such an impact. Despite the systems and processes we have in place to monitor, detect, mitigate and remediate potential vulnerabilities, in the past, we have experienced cyberattacks, and attempted breaches, including phishing emails and other targeted attacks, and there can be no guarantees that such attacks will not occur in the future.


text: Cybersecurity risk management and strategy Saia maintains cybersecurity processes, technologies and controls to help us assess, identify and manage material risks from cybersecurity threats. These processes, technologies and controls are part of Saia's overall enterprise risk management process. Our cybersecurity program is based on the National Institute of Standards and Technology Cybersecurity Framework and is designed to ensure that our information systems are effective and are prepared for cybersecurity threats, including through regular oversight and mitigation of internal and external threats.


text: We regularly perform evaluations of our information security program and our information technology infrastructure, including through the use of tools and services for network and endpoint monitoring, vulnerability assessments and penetration testing, among other things. We have implemented security monitoring capabilities designed to alert us to suspicious activity and have an incident response program to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident.


text: Saia has an established cybersecurity and information security awareness training program that includes mandatory annual training and regular communications for our employees regarding cybersecurity threats and methods of mitigation. The annual cybersecurity training consists of threat avoidance when working remote, proper password construction techniques, identifying and reporting suspicious activity, social engineering and insider threats. Additionally, we have implemented a regular phishing assessment that provides feedback and additional training as needed to enhance the annual training program. Our information technology professionals also receive additional training related to their position.


text: There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factors entitled "We rely heavily on technology to operate our business and cybersecurity threats or other disruptions to our technology infrastructure could harm our business or reputation" and "We use AI in our business, and its use could result in reputational harm, competitive harm, cybersecurity risks and legal liability, which could have a material adverse effect on our results of operations" in Item 1A. Risk Factors.


text: Management is responsible for the day-to-day assessment and management of cybersecurity risks. Saia's Director of Information Security and Compliance, who reports to the Executive Vice President and Chief Information Officer, has primary oversight of our cybersecurity risk management and strategy processes. The Director of Information Security and Compliance has served in information security roles since 2001 and led the information security function for a large health care system prior to joining Saia. He has a Bachelor of Science degree in Information Technology with a Concentration in Information Assurance and Security.


text: The Director of Information Security and Compliance assesses our cybersecurity readiness through internal assessment tools as well as third-party control testing, vulnerability assessments and evaluation against industry standards. We maintain compliance structures that are designed to elevate issues relating to cybersecurity to our Director of Information Security and Compliance and to our Executive Vice President and Chief Information Officer.


text: The Board of Directors has oversight responsibility for Saia's strategic and operational risks. Although the Board has delegated oversight responsibility for certain risks to its committees, the Board has determined that oversight for cybersecurity should remain with the full Board. The Board regularly receives reports from the Executive Vice President and Chief Information Officer concerning the Company's cybersecurity risk management and strategies and related processes, technologies and controls.


text: Our business and industry has become increasingly dependent upon digital technologies, including information and operational systems and related infrastructure as well as cloud applications and services, to process and record financial and operating data; analyze seismic, drilling, completion and production information; manage production equipment; conduct reservoir modeling and reserves estimation; communicate with employees and business associates; perform compliance reporting and many other activities. We recognize the importance of developing, implementing, and maintaining effective cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. The Company has an Insider Threat and Data Loss Prevention program that is designed to protect the confidentiality, integrity and availability of such data, and we maintain processes designed to assess, identify, and manage material risks from cybersecurity threats.

companyName: CONTINENTAL RESOURCES, INC


text: The Company has a cybersecurity team with relevant subject-matter expertise that is part of the Company's Information Technology department (the "Cybersecurity Team"). This team reports to the Company's Vice President and Chief Information Officer ("CIO") and is led by the Company's Chief Information Security Officer ("CISO"), who has primary responsibility for oversight of the Company's assessment, identification, and management of cybersecurity risks. The CIO and CISO jointly determine whether a given cybersecurity matter is sufficiently important to warrant elevating it to the attention of the Company's Cybersecurity Executive Committee (defined below) and/or Board of Directors. Our CISO has received certifications relating to information security, security leadership, and forensics from the Global Information Assurance organization.


text: The Cybersecurity Team monitors the cybersecurity environment for threats and indicators of compromise. It also considers the risks attendant to the Company's business operations and strategy and develops solutions and mitigation measures for the risks identified, including risks arising in connection with third-party interactions and the integration of newly acquired assets. In addition, the Company invests in Security Awareness training to help promote employee awareness of cybersecurity.


text: The Company's internal cybersecurity efforts are supported by a team of outside consultants, assessors, and third-party vendors who assist with identifying and monitoring risks and indications of compromise.


text: The Cybersecurity Team regularly engages third-party assessors to conduct evaluations of the Company's cybersecurity risk mitigation efforts and strategy. The Company also engage s a third-party auditing firm to periodically assess our information security program. Audits are also conducted from time-to-time by other third parties, such as insurance adjusters and regulators.


text: The Cybersecurity Team engages third-party vendors to assist with managing endpoint security, managing the Company's security operations center, providing threat detection and response capabilities, monitoring certain operational technology and control system environments, and providing threat detection and vulnerability identification and remediation services. Additionally, the Company is a member of the Oil and Natural Gas Information and Analysis Center. This center provides the Company with information regarding threats to the oil and gas industry and threats reported by other industry participants. Finally, the Cybersecurity Team periodically engages with the cybersecurity-related guidance of other third parties such as law enforcement, industry trade groups and vendors.


text: The Cybersecurity Team reviews the integrity of services provided by vendors engaged to support the Company's cybersecurity efforts using the same methods as are used to evaluate the services provided by other vendors engaged to support the Company's regular business operations.


text: The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management program. Cybersecurity risks are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management approach.


text: Since the Company is private, it has no independent members of its Board of Directors. All of the Company's directors are also executive officers. The body primarily responsible for oversight of the Cybersecurity Team is the Cybersecurity Executive Committee, which is composed of the Company's President and Chief Executive Officer; Executive Vice President, Chief Culture Officer and Administrative Officer (both of whom are also members of the Company's Board of Directors); Chief Financial Officer and Executive Vice President of Strategic Planning; Senior Vice President, General Counsel and Secretary; CIO; and the Director of Corporate Security. The Cybersecurity Executive Committee meets regularly and during these meetings its members review and discuss cybersecurity information provided by the CISO, which may include: (i) metrics relevant to cybersecurity issues; (ii) summaries of changes or proposed changes to the Company's cybersecurity program; and (iii) cybersecurity risk and threat updates. Information regarding any critical cybersecurity-related matter is communicated to the Cybersecurity Executive Committee as soon as practicable.


text: In addition, the CISO periodically briefs the Company's Audit Committee regarding cybersecurity matters at a regularly scheduled committee meeting and these briefings cover the same types of information as is presented to the Cybersecurity Executive Committee. The Audit Committee is composed of the two members of the Board of Directors who are also members of the Cybersecurity Executive Committee.


text: The Company has developed a Cybersecurity Incident Response Plan (the "Response Plan"), which is based upon NASA's mission control incident response procedures to address and manage certain cybersecurity incidents. If an incident meets certain criteria, the incident response plan is invoked by the CISO and General Counsel. Once the plan is invoked, an impact assessment is conducted and a remediation plan is developed, if needed. The plan also sets forth procedures for monitoring incidents and post-incident follow-up so that any lessons learned can be discussed. Where appropriate, the post-incident follow up identifies measures that can be implemented to aid with future incident prevention and detection. Under the Response Plan any incident-related information is communicated using the channels outlined in the Response Plan.


text: As of the date of this report, though the Company and our service providers have experienced certain cybersecurity incidents, the Company does not believe any prior cybersecurity threat or incident has materially affected or are reasonably likely to materially affect the Company, including its business operations or prospects. However, the Company acknowledges that cybersecurity threats are continually evolving and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences for the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. For additional information about the risks to our business associated with cybersecurity incidents, please see "A cybersecurity incident could result in information theft, data corruption, operational disruption, and/or financial loss" under Part I, Item IA. Risk Factors.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Aimco OP L.P.


text: We use the NIST Cybersecurity Framework and CIS Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements.


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: As of December 31, 2024, cybersecurity risks have not materially affected our business strategy, results of operations, or financial condition.

companyName: Orthofix Medical Inc.

ticker: OFIX


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a team comprised of IT personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to monitor, assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan and Security Operations Center (SOC) to respond to cybersecurity incidents; and • a third-party risk management process for service providers.


text: There can be no assurance that our cybersecurity risk management program, including our controls, procedures and processes, will be fully complied with or that our program will be fully effective in protecting the confidentiality, integrity and availability of our information systems, product and network.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. These and other risks related to cybersecurity matters are described in more detail in Item 1A. Risk Factors.


text: Cybersecurity Governance Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees management's design, implementation, and enforcement of our cybersecurity risk management program.


text: Our Chief Information Officer (CIO) reports to the Chief Administrative Officer & General Counsel and leads the Company's overall cybersecurity function. The Audit Committee receives regular reports from our CIO on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents. Audit Committee members also receive periodic presentations on cybersecurity topics from our CIO, supported by our internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our CIO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment.


text: Our CIO is responsible for assessing and managing our material risks from cybersecurity threats. Our CIO has primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CIO has been publicly recognized as a cybersecurity thought leader by leading industry analysts. Our CIO has over 25 years of technical leadership and industry experience, which is inclusive of global experience in managing and leading IT and cybersecurity teams. Our cybersecurity team holds industry standard certifications and participates in routine training.


text: Cybersecurity Risk Management The Company has systems and processes for identification, assessment, and management of material risks from cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. The Company's multi-faceted approach includes deploying applications and control activities to actively monitor and mitigate potential threats to the Company's IT environment.

companyName: TREX CO INC

ticker: TREX


text: These activities include, but are not limited to, engaging an external third-party to monitor information systems security events, conducting annual security training of employees, testing employees via periodic phishing campaigns, conducting system vulnerability scanning, utilizing a patching program to remediate critical patches, and utilizing an external third-party to perform testing to identify gaps in the Company's security program. The Company also performs third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners. Additionally, for providers of software-as-a-service and other services that hold Company data, the Company reviews and assesses industry standard certifications such as System and Organization Controls (SOC) 1 or SOC 2 reports and cybersecurity preparedness questionnaires. Mitigation of risk efforts are coordinated by the Company's Director of Information Security, utilizing internal resources and third-party providers.


text: The Company has not had any cybersecurity risks that have materially affected the Company, including its business strategy, results of operations, or financial condition. Cybersecurity risks are disclosed in Part I Item 1A. Risk Factors, incorporated herein by reference.


text: Cybersecurity is an important component of our enterprise risk management program. While the full Board of Directors has primary responsibility for risk oversight, the Board of Directors utilizes its committees, as appropriate, to monitor and address the risks that may be within the scope of a particular committee's expertise or charter. The Board of Directors receives updates at quarterly board meetings on committee activities from each committee Chair.


text: Cybersecurity Governance Our cybersecurity programs, including the cross-functional management committees responsible for identifying, assessing, and mitigating cybersecurity risks and incidents, are overseen by our Vice President and Chief Information Officer. Day-to-day administration of the cybersecurity programs are led by our Director of Information Security, a direct report to the Vice President and Chief Information Officer. Our Vice President and Chief Information Officer has 27 years of technology leadership experience and a Doctor of Business Administration. Our Director of Information Security has 27 years of experience in infrastructure and security operations and a degree in Information Technology Management. Our Director of Information Security is the chair of the Company's Information Security Committee. The activities of the Information Security Committee are reviewed by the Executive Information Security Oversight Committee, which is comprised of members of our senior leadership team including our Vice President and Chief Information Officer, Senior Vice President, Chief Financial Officer, Senior Vice President, Chief Legal Officer and Secretary and Senior Vice President, Chief Human Resources Officer. The Executive Information Security Oversight Committee facilitates notification to the Audit Committee of emerging cybersecurity risks, and threats, the status of projects to strengthen the Company's information security systems, and updates on any cybersecurity incidents.


text: The Audit Committee of the Board of Directors oversees cybersecurity related risks. Members of the Audit Committee receive the above referenced notifications and updates on a quarterly basis from the Company's Chief Information Officer as the designated representative of the Executive Information Security Oversight Committee.


text: Additionally, the Company has a written Information Security Policy and a Cybersecurity Incident Response Plan that provides the above-referenced processes by which such committees are informed of and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents and material risks from cybersecurity threats.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, patient data, and data related to our clinical trials ("Information Systems and Data").

companyName: Minerva Neurosciences, Inc.

ticker: NERV


text: The Company's information security function and third-party service providers help identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's risk assessment process. The Company's information security function and third-party service providers identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: • automated tools; • subscribing to reports and services that identify cybersecurity threats; • analyzing reports of threats and actors; • conducting scans of the threat environment; • evaluating our and our industry's risk profile; • evaluating threats reported to us; • conducting audits; • conducting threat assessments for internal and external threats; • conducting vulnerability assessments to identify vulnerabilities; and • using external intelligence feeds.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: • our incident response plan; • incident detection and response processes; • a disaster recovery/business continuity plan; • encryption of certain data; • network security controls; • access controls; • asset management, tracking and disposal; • systems monitoring; • employee training; • penetration testing; • cybersecurity insurance; and • outsourced cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Company's information security function works with management, including our Chief Operating Officer ("COO") to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: • our external IT service provider; • professional services firms, including legal counsel; • cybersecurity consultants; • managed cybersecurity service providers; and • penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, contract research organizations and contract manufacturing organizations. As part of our vendor security due diligence and to manage cybersecurity risks associated with our use of certain vendors, we perform risk assessments on vendors and may include cybersecurity obligations in our contracts with them. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor due diligence involves different levels of assessment designed to help identify cybersecurity risks associated with a provider. For example, we may impose contractual obligations related to cybersecurity on the provider.

stage1Category: Third-Party Risk


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including: • If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our COO.


text: The COO is responsible for managing our information security function and overseeing our third-party information technology service providers. The COO is also responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, and approving budgets. Our outsourced Chief Technology Officer, who has over 20 years in executive-level IT and cybersecurity roles, is responsible for developing and implementing our technology environment and cybersecurity framework, helping the Company prepare for cybersecurity incidents, approving and implementing certain cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the COO and Chief Financial Officer ("CFO"). The COO and CFO work with the other members of the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company will report to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic updates from the CFO and finance department concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various updates, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Our use of information systems for collecting, using, transmitting and storing data is a vital aspect of our business operations. Information systems are inherently vulnerable to a range of cybersecurity threats that could potentially have a material impact on our strategy, financial condition, liquidity or results of operations.

companyName: ARMSTRONG WORLD INDUSTRIES INC

ticker: AWI


text: Cybersecurity Risk Management and Strategy. The Company actively maintains an enterprise risk management program. Management's role is to identify, mitigate, guide and review the efforts of our business units, consider whether the residual risks are acceptable, and approve plans to deal with serious risks. Cybersecurity is a key risk management category within our enterprise risk management program.


text: The Vice President and Chief Information Officer ("CIO"), who also serves as a member of the Company's enterprise risk council, works closely with key business leaders and functions to develop and enhance the Company's cybersecurity strategy. Our cybersecurity program is designed to safeguard against an evolving threat landscape through effective prevention, detection, response and recovery processes. Our cybersecurity risk management processes include frequent assessment of our top cyber risks and mitigations.


text: Our cybersecurity risk program is a comprehensive framework designed to safeguard our organization and stakeholders from evolving threats. Central to this approach is our commitment to threat and vulnerability management, where we proactively identify, prioritize, and address potential cybersecurity gaps to strengthen our overall security posture. We emphasize identity and access management by implementing access controls and robust authentication methods to protect user identities and secure information technology systems. Data protection and privacy is in place to ensure sensitive information is protected from exfiltration. Our cybersecurity defenses leverage systems and technologies, including firewalls, network access, endpoint protection, privileged access management, user behavior analytics, multi-factor authentication, intrusion detection systems and continuous monitoring. The purpose of these systems and technologies is to stay ahead of potential threats. To prepare for and respond to potential cybersecurity events, we conduct regular incident response exercises, ensuring our readiness and resilience. Additionally, we invest in employee training and awareness programs to promote a culture of security mindfulness and reduce risks associated with human error. Recognizing the importance of third-party relationships, we maintain a vendor risk management program that includes monitoring the cybersecurity practices of our vendors, and if applicable, performing user access reviews and evaluating System and Organization Controls reports at both inception and on an ongoing basis. Together, these efforts reflect our dedication to building a secure and compliant environment that protects our operations, data, and the trust of our stakeholders.


text: Additionally, we have implemented an enterprise risk management process, which addresses cyber risks. This process is led by our Chief Legal Officer and includes participation by the board of directors, as appropriate. Our Chief Legal Officer reports regularly on the enterprise risk management process to executive leadership and the audit committee.

companyName: Fulcrum Therapeutics, Inc.

ticker: FULC


text: Our program incorporates an Incident Response Plan to guide the evaluation, response, and escalation of cybersecurity incidents. This plan is overseen by our CIO and executed by a cross-functional Cybersecurity Incident Response Team. The incident response plan establishes clear protocols for incident identification, impact assessment, containment and resolution, with defined escalation paths based on incident severity. Cybersecurity incidents above a defined threshold of criticality are evaluated for materiality to determine reporting and disclosure requirements. To enhance our response capabilities, we conduct periodic assessments, including third-party reviews, and simulate incidents through regular tabletop exercises.


text: Our cybersecurity program's effectiveness is periodically evaluated against established quantifiable goals and other external benchmarks, including the National Institute of Standards and Technology security framework. This evaluation is carried out through internal and external risk assessments and compliance audits. We regularly engage third parties to help conduct these evaluations, assessments and audits, advise us on the effectiveness of our cybersecurity processes and assist the Company in remediating any identified vulnerabilities.


text: We do not believe that risks from cybersecurity threats, individually or in the aggregate, including any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, our strategy, financial condition, liquidity or results of operations. For additional information on how cybersecurity risk may affect our business, refer to Item 1A. Risk Factors of this Form 10-K under the heading "We rely on operating and information systems that may experience a failure, a compromise of security, or a violation of data privacy laws or regulations, which could interrupt or damage our operations and have a material adverse effect on our financial condition, liquidity or results of operations."


text: Governance. Our Board of Directors has responsibility for oversight of management's cybersecurity risk program and receives regular updates from our CIO. These updates, provided on a semi-annual basis, cover a range of topics, including the performance of our cybersecurity program against established goals and external standards, insights into the evolving cybersecurity landscape, current events and recent cybersecurity threats, and progress in enhancing the Company's cybersecurity posture. Pursuant to its charter, the Audit Committee of our Board of Directors is responsible for reviewing management's cybersecurity incident reporting process, methodology and tools. In addition, the Audit Committee is responsible for reviewing management's materiality assessments of cybersecurity incidents identified as significant by management.


text: Our CIO holds an advanced degree in Information Technology with over 20 years of experience, including senior leadership roles in technology at various companies. The CIO oversees a cybersecurity team, comprised of internal and external subject matter experts who work collaboratively to achieve our cybersecurity objectives. In addition, our CIO leads the Information Security Steering Committee, a group comprised of key information technology employees and business leaders, including our Senior Vice President, Chief Financial Officer and Senior Vice President, General Counsel and Chief Compliance Officer. This committee meets regularly to review and discuss the Company's cybersecurity strategies and developments, ensuring a comprehensive approach to managing cybersecurity risk.


text: Risk Management and Strategy We have implemented cybersecurity programs designed to maintain and protect our information technology systems and the confidentiality, integrity, and availability of our data. These programs serve to maintain compliance with applicable laws and regulations governing ethical business practices, including our relationships with suppliers, customers, and business partners.


text: We maintain formal processes for our cybersecurity program and incident response procedures, which are updated at least annually and reviewed by external legal and cybersecurity advisors. These processes include, among other things, detailed steps on how we assess cyber risks, identify threats, and determine the materiality of cyber incidents. These processes also designate certain roles within the company to execute these policies and certain leadership roles to manage material risk escalation. These processes endeavor to follow the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and are tested at least annually.


text: Our Information Security team uses automated technology, third-party partners, and direct review of system indicators to monitor and implement the prevention, detection, mitigation, and remediation of cybersecurity incidents, and to stay current with the changing threat landscape. We also leverage encryption technologies and other measures to safeguard systems. We engage third parties as part of our cyber program, including external security firms that provide security technology, conduct regular security audits, and conduct penetration testing. We also engage third parties to conduct regular drills, such as tabletop exercises, to help with our overall preparedness.


text: We also engage third-party service providers to assist with managing various other aspects of our business. We have implemented processes designed to both assess and maintain oversight of third-party service providers with regards to cybersecurity risks. These service providers are subject to due diligence reviews of their information security programs during our vendor evaluation process.


text: Our employees are responsible for complying with our data security standards and are required to complete annual training to understand the behaviors and technical requirements necessary to keep data secure. We also require that cybersecurity training be part of the onboarding process for new hires.


text: The Audit and Finance Committee has oversight over and regularly reviews our cybersecurity, including information technology ("IT") risks, controls, procedures, and plans to mitigate cybersecurity risks and respond to security incidents. The Audit and Finance Committee receives reports on at least a quarterly basis from the Chief Information Officer and the Vice President, Information Security, on, among other issues, our cyber risks and threats, the status of projects, management's strategies to strengthen our IT systems, assessments of our security program, third-party assessments and testing, our emerging threat landscape, and the review of our cybersecurity insurance policy. Pursuant to our incident response procedures, material cyber incidents will be reported to the Chair of the Audit and Finance Committee upon a determination of material status. Due to the importance of cybersecurity, the full Board of Directors also receives updates on cybersecurity matters from management at least annually.


text: Management is responsible for our company's day-to-day risk management activities. Our cybersecurity program is led by our Chief Information Officer, who is responsible for assessing and managing cybersecurity risks. He has 26 years of experience in both military and corporate leadership roles, including 13 years of experience in CIO-level leadership roles, including consulting with major firms, covering technology and security operations responsibility.


text: Our Vice President, Information Security, who reports to our Chief Information Officer, is responsible for cybersecurity program execution, risk management, and oversight of information security staff and consultants. She has 20 years of experience in IT roles, including 14 years in IT leadership roles and 6 years in cybersecurity program execution and oversight of information security.


text: Our Manager, Information Security, who reports to our Vice President, Information Security, is responsible for managing our security analyst and engineering team and is also responsible for the tactical execution of security operations. He has 25 years of experience in IT roles including 15 years of experience in security leadership. He also has the following certifications: ISC2 CISSP, EC-Council Certified Ethical Hacker ("CEH"), and numerous vendor specific certifications.


text: As cybersecurity risks arise, our Information Security team executes the incident response procedure and communicates the appropriate details to management in alignment with the escalation steps in the procedure. In addition, our Chief Information Officer, Vice President, Information Security, and Manager, Information Security, conduct monthly cybersecurity program status reviews with the Information Security team that includes key performance indicator ("KPI") tracking, risk assessment, escalation actions, and project status.


text: Cyber Risk Management and Strategy At Fulcrum Therapeutics, we recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management process in accordance with our risk profile and business that is informed by industry standards and is integrated into our enterprise risk management process.


text: We leverage the support of third-party information technology and security providers, including for periodic security testing and risk assessments, as part of our risk management process, designed to identify, assess, and manage cybersecurity risks. We conduct employee cybersecurity training and maintain an incident response and notification plan designed to assist us in identifying, responding to, and recovering from cybersecurity incidents. Further, we regularly evaluate and update our existing cybersecurity policies and procedures as appropriate to continue to align them to our risk profile.


text: We have a process to assess the security practices of certain third-party vendors, including through the use of vendor security questionnaires, as appropriate.


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third party vendors' data and systems. For more information about these risks, please refer to the section entitled "Risk Factors" in this Annual Report on Form 10-K.


text: Governance Related to Cybersecurity Risks Our Executive Director, IT & Operations, or Executive Director, who reports to the Chief Financial Officer, is responsible for the strategic leadership and direction of our cybersecurity program. With over 15 years of experience in information technology, the Executive Director works alongside individuals across other functions, such as legal and engineering, to establish and implement our cybersecurity strategy.


text: The Executive Director and our Chief Legal Officer participate in periodic discussions with other members of our management, including executive leadership, regarding implementation of our cybersecurity program, program enhancements, and relevant cyber risks or threats. Our Chief Legal Officer has received the National Association of Corporate Directors CERT Certificate in Cyber-Risk Oversight.


text: Our audit committee has oversight over cybersecurity risks. With the input of the executive team, the Executive Director provides annual presentations to the audit committee on our cyber program, including updates on security testing and assessments, cyber risks, and related cyber strategy as applicable. The management team will also update the full board of directors on matters related to cybersecurity as needed.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall risk management program/information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and clinical trial information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and enhance our practices. We engage certain external parties, including consultants, independent privacy assessors, computer security firms and risk management, peer companies, industry groups and governance experts, to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect our company from any related vulnerabilities.

companyName: Beam Therapeutics Inc.

ticker: BEAM


text: Based on an assessment using these processes, we do not believe that there are currently any risks from known cybersecurity threats that are reasonably likely to materially affect our company or our business strategy, results of operations or financial condition. For additional information, please see the risk factor titled "Our internal computer systems, or those of our third-party vendors, collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business." under Item 1A., Risk factors—General risk factors, in this Annual Report on Form 10-K.


text: The Audit Committee of our board of directors provides direct oversight over cybersecurity risk, and provides updates to the board of directors regarding such oversight. The Audit Committee receives updates quarterly from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our Vice President of Information Security, or the VP, IS, leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees and third-party service providers to address cybersecurity risks. The VP, IS's cybersecurity training includes 25 years of experience building and maintaining cybersecurity programs, and he obtained his certified information systems security professional, or CISSP, certification from the International Information System Security Certification Consortium, or ISC2, and his Cybersecurity and Infrastructure Security Agency, or CISA, certification from ISACA.


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to align with industry best practices and provide a framework for evaluating and implementing methods to assess, identify and manage material risks from cybersecurity threats and properly respond to incidents, including threats and incidents associated with the use of services provided by third-party service providers. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat (including whether the cybersecurity threat is associated with a third-party service provider), implementing cybersecurity countermeasures and mitigation strategies and informing management and our Board of material cybersecurity threats and incidents. Our cybersecurity team leads a regular cybersecurity working group meeting with representatives from across the Company's centers of excellence, as well as a quarterly cybersecurity steering committee meeting with executives from across the Company, to facilitate coordination across different functional groups within our Company and ensure broad awareness of ongoing cybersecurity initiatives and assessments. These committees also hold ad hoc meetings as necessary to address urgent threats that arise in between meetings. Our cybersecurity team also engages third-party security experts for risk assessment and system enhancements. In addition, our cybersecurity team provides training to all employees annually.

companyName: Pactiv Evergreen Inc.


text: Our Board has overall oversight responsibility for our risk management and has delegated cybersecurity risk management oversight to the Audit Committee. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and implement processes and procedures to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee also reports material cybersecurity risks to our full Board. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining our cybersecurity program. Our cybersecurity program is managed under the direction of our Senior Vice President for Business Transformation, who receives reports from our cybersecurity team, including our Chief Information Security Officer, or CISO, and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. The CISO, in coordination with senior management, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to respond promptly to any material cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications, the CISO and these teams inform senior management about, and monitor the prevention, detection, mitigation and remediation of, cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: Risk management and strategy We rely on IT networks and systems to process, transmit and store electronic information and to manage or support our business. We have implemented information security processes designed to identify, assess and manage risks from cybersecurity threats to our systems and data.

companyName: Easterly Government Properties, Inc.

ticker: DEA


text: Our CISO has 43 years of experience in a diverse array of information and security technologies and has managed various domains, with expertise in enterprise resource planning, finite scheduling, middleware technologies, network control, operational control, identity access and governance and data center management. He and our other dedicated cybersecurity personnel collectively hold numerous certifications, including in relation to forensic investigation, threat hunting and digital forensics, risk and information system controls, Google cybersecurity, information security auditors and fraud examiners. Additionally, the collective cybersecurity team members have substantial experience in information technology disciplines and prioritize remaining educated on current threats.


text: Our cybersecurity team regularly updates the Audit Committee on our cybersecurity program, material cybersecurity risks and mitigation strategies and provides quarterly cybersecurity reports that cover, among other topics, third-party assessments of the Company's cybersecurity program, developments in cybersecurity and updates to the Company's cybersecurity program and mitigation strategies.


text: In 2024, we did no t identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see the risk factor above entitled "Cybersecurity breaches and improper access to or disclosure of our data or user data, or other infiltration, hacking and phishing attacks on our systems, could harm our reputation and adversely affect our business."


text: Cyber Risk Management and Strategy We have developed and maintain processes designed to assess, identify, and manage cybersecurity risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. The scope of these processes includes risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by or maintained at third-party service providers. These processes are managed and monitored by a dedicated information technology team, which is led by our Vice President, IT, who reports to our Chief Technology Officer, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. We constantly monitor our information technology environment for abnormal behavior, conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on our key technology vendors and other third-party service providers that have access to the personal information we collect, use, store, and transmit. We also conduct periodic employee trainings on cyber and information security, among other topics. We leverage standard industry tools from a software and hardware perspective and maintain a cybersecurity risk insurance policy.

companyName: Cogent Biosciences, Inc.

ticker: COGT


text: We comply with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF and have accordingly certified our adherence to the respective DPF principles to the U.S. Department of Commerce with regard to the processing of personal data received from the EU, UK and Switzerland respectively. This includes compliance with the information security requirements of the DPF that prescribe that organizations creating, maintaining, using or disseminating personal data must take reasonable and appropriate measures to protect it from loss, misuse and unauthorized access, disclosure, alteration and destruction, taking into due account the risks involved in the processing and the nature of the personal data.


text: In addition, we consult with outside advisors and experts on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment. We have retained VeraSafe, LLC ("VeraSafe") to help review and monitor our practices and processes related to personal data and compliance with applicable data protection laws. VeraSafe acts as our Data Protection Officer pursuant to the European Union and United Kingdom General Data Protection Regulation and has served in this capacity since May 2021.


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks Related to Employee Matters and Managing Growth."


text: Governance Related to Cybersecurity Risks The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives periodic updates on cybersecurity and information technology matters and related risk exposures. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Our Vice President, IT, who reports to the Chief Technology Officer, a member of the executive team, has over 20 years of experience managing information technology and cybersecurity matters. The Vice President, IT and the Chief Technology Officer, together with our senior leadership team, are responsible for assessing and managing cybersecurity risks and they work collaboratively across our company to implement policies and procedures designed to protect our information and systems from cybersecurity threats and to respond promptly to any material cybersecurity incidents in accordance with our incident response plans. A cross-functional team is responsible for responding to cybersecurity incidents.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: NOVANTA INC

ticker: NOVT


text: We design and assess our program based on various cybersecurity frameworks, such as the National Institute of Standards and Technology ("NIST") as well as International Organization for Standardization ("ISO") 27001. We use these cybersecurity frameworks and information security standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is designed to be integrated into our overall risk management program, and shares common methodologies and governance processes across the risk management program. Key elements of our cybersecurity risk management program, include but are not limited, to the followings: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team and an external service provider principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity threats and incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity security processes; • cybersecurity awareness training for our employees, including incident response personnel and senior management, on a quarterly basis as part of the risk mitigation strategy; • quarterly testing of the effectiveness of the cybersecurity awareness training; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • a third-party risk management process for key service providers, based on our assessment of their criticality to our operations and respective risk profile, suppliers, and vendors; and • cybersecurity internal and external penetration testing.


text: We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We have not experienced any incidents that have materially affected us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance The Board of Directors (the "Board") recognizes the need for continually monitoring our information security risks and cybersecurity initiatives. The Audit Committee of our Board undertakes the primary oversight responsibility over our cybersecurity risks and information security controls. Management briefs the Audit Committee on information security matters at each quarterly meeting of the Audit Committee. In addition, management updates the Audit Committee regarding any potentially material cybersecurity incidents, if any, as well as any incidents with lesser potential impact. In addition to the role the Audit Committee plays in overseeing enterprise and cybersecurity risks, the Environmental, Social and Governance ("ESG") Committee reviews and oversees our overall cybersecurity program, including its strategy and processes, and is updated by management on the status and development of the cybersecurity programs at each of the ESG Committee's meetings.


text: Both the Audit Committee and the ESG Committee report to the full Board regarding their activities, including those related to our cybersecurity risks and program. The full Board also receives briefings from management at least once a year on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics presented by the Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO").


text: Our management team, including our IT management team, is responsible for assessing and managing our material risks from cybersecurity threats. The CISO/CIO oversees the overall cybersecurity risk management program, and the Deputy Chief Information Security Officer ("DCISO") has the primary operational responsibilities over our cybersecurity program, including supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants. The CISO, who is also our CIO, has over 23 years of experience managing global IT operations, including strategy, applications, infrastructure, information security, support and execution. The CISO/CIO holds a Master of Science degree in computer science and engineering (with a specialization in Information Assurance) and a Doctorate of Engineering Management/Systems Engineering degree. Our DCISO has served in various roles in information security for over 16 years and holds a Bachelor of Science degree in mathematics and computer science and a Master of Science degree in computer science.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: WTW's management is responsible for the day-to-day management of risks, and the board, including through its committees, is responsible for understanding and overseeing the various risks facing WTW. As a professional services firm providing advice, broking and solutions in the areas of people, risk and capital, and often involving confidential and sensitive information, cybersecurity risk management is an integral part of our enterprise risk management ('ERM') strategy.

companyName: WILLIS TOWERS WATSON PLC

ticker: WTW


text: Cybersecurity Risk Management and Strategy Increased global cybersecurity vulnerabilities, threats and more sophisticated and targeted cyber-related attacks pose an ongoing risk to the security of our information systems and networks. WTW seeks to manage cybersecurity risks consistent with its general approach to ERM. As further described below, our cybersecurity risk management program is coordinated by cross-functional teams. Technology and cyber risks that meet certain thresholds are escalated and tracked by the ERM team within the WTW Risk function.


text: WTW has been certified by ISO 27001 and identifies, categorizes and manages cyber risks according to frameworks such as SOC 2 - Type 2 and the National Institute of Standards and Technology ('NIST') Framework. Additionally, WTW undertakes vulnerability scanning, and engages third parties from time-to-time to conduct penetration testing to help WTW identify and reduce the threat of known and emerging cybersecurity risks.


text: Board Oversight and Governance WTW's board of directors has delegated the oversight of cybersecurity risks to the Risk and Operational Oversight Committee (the 'Risk Committee'), which was recently formed following the completion of the three-year term of the Operational Transformation Committee. The Risk Committee assists the board of directors in its oversight of the ERM framework, policies, and practices used by WTW to identify, assess, and manage WTW's key operational risks, including without limitation: cybersecurity, technology, information security, privacy, and artificial intelligence risk. WTW's Chief Information Security Officer ('CISO') and Global Head of Technology report to the Risk Committee on cybersecurity matters, including key risks. The Risk Committee reports to the board of directors at each formal board meeting and the board of directors discusses those reports.


text: Management Oversight and Governance Management plays an important role in assessing and managing WTW's material risks from cybersecurity threats. The CISO is responsible for designing and implementing a security program and strategy. WTW's CISO has served in various roles in information technology and information security for over 33 years, including serving as CISO of several public companies. The CISO holds undergraduate and graduate degrees in mathematics and strategic information systems and has attained the professional certification of Certified Information Systems Security Professional. The CISO reports to the Global Head of Technology. WTW's Global Head of Technology has served in various roles in information technology for over 25 years. The Global Head of Technology holds a graduate degree in business.


text: As part of the WTW cybersecurity program, cross-functional teams throughout WTW, including enterprise risk management, operational resilience, legal, compliance and information security, coordinate to monitor, consider, and, when appropriate, address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications among these teams, the CISO, the Global Head of Technology, and other members of senior management, as appropriate, are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents and escalate such threats and incidents as appropriate through the processes described in more detail below.


text: WTW's cybersecurity program is an ongoing process designed to identify, assess and manage WTW's risk exposures over the short-, intermediate- and long-term. Management's cybersecurity risk management strategy and processes include the following areas of focus: • Incident Response Planning: WTW has a global Information and Cyber Security Incident Response Plan ('ICSIRP' or 'Plan') for identifying and managing cyber and data security threats. The ICSIRP defines the roles and responsibilities of WTW stakeholders involved in responding to cyber and data security events, severity levels and incident categories, and it outlines a process for incident management, including escalation and communication procedures. • Technical Safeguards: WTW seeks to continuously improve implemented technical safeguards that are designed to protect WTW's information systems. Standards include controls for access management, cyber threat and incident management, data security, encryption, human resource security, network and device security, secure asset management, secure system development, security operations and third-party security. While WTW seeks to maintain adequate controls, they may not always be effective or at the level of maturity that the Company ultimately wishes to maintain. See Part I, Item 1A Risk Factors under the heading 'Data and cybersecurity breaches or improper disclosure of confidential company or personal data could result in material financial loss, regulatory actions, reputational harm and/or legal liability' for more information about WTW's technical controls, management, mitigation, and security practices as well as the risks related thereto. • Education and Awareness: WTW's policy requires annual, mandatory privacy and information security training for all WTW colleagues. • Third-Party Risk Management: WTW's risk management strategy includes a risk management process focused on third-party service providers and other parties with which we engage that is intended to align with the technology security key controls across the organization. • Threat Intelligence: Through its regular monitoring processes, WTW obtains intelligence on cyber threats relevant to the Company at strategic, operational and tactical levels to help inform and reassess its cybersecurity risk management priorities.


text: Material Effects of Cybersecurity Incidents Although we and our vendors regularly experience cybersecurity incidents, we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected our business strategy, results of operations or financial condition. However, there is no guarantee that a future cyber incident would not materially affect our business strategy, results of operations or financial condition. To learn more about risks from cybersecurity threats, review the risk factors included in Part I, Item 1A Risk Factors in this Annual Report on Form 10-K, as updated by WTW's subsequent SEC filings. The risks described in such filings are not the only risks facing WTW. Additional risks and uncertainties not currently known or that may currently be deemed to be immaterial also may materially adversely affect WTW's business, financial condition or results of operations.


text: Our enterprise information security program, which is designed to ensure that our information systems are adequately protected, is based on frameworks established by the National Institute of Standards and Technology and other applicable industry standards. We consider our enterprise information security program to be a key component of our overall risk management system, with program elements evaluated annually and briefings provided to management each quarter.

companyName: MKS INC

ticker: MKSI


text: As part of our enterprise information security program, we regularly assess and deploy technical safeguards designed to detect cybersecurity threats and protect our information systems from these threats. In addition, we maintain incident response and recovery plans, the effectiveness of which is tested and evaluated on a regular basis. We also provide privacy and security training, including quarterly phishing education campaigns, to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: We regularly engage assessors, consultants, auditors and other third parties to support our enterprise information security program. These engagements encompass a variety of activities, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness.


text: The information gleaned from these assessments, audits and reviews is used to enhance our enterprise information security program, including cybersecurity policies, standards, processes and practices. In addition, significant findings from these assessments are reported to management and the Audit Committee of our Board of Directors (the "Board").


text: We also have processes in place to oversee and identify risks from cybersecurity threats associated with the use of third-party service providers. Third-party service providers are subject to security risk assessments at the time of on-boarding, contract renewal, and upon detection of an increase in risk profile. We have similar processes in place to oversee and identify cybersecurity-related risks posed by our suppliers.


text: Risks from Cybersecurity Threats We and our third-party administrators, vendors and partners are subject to ongoing cybersecurity threats. While we cannot guarantee that these threats will not have an adverse impact on us, these threats did not materially affect us during the year ended December 31, 2024 and we do not believe such threats are reasonably likely to materially affect us in the future, including with respect to our business strategy, results of operations, or financial condition. For more information on risks related to cybersecurity, refer to "Risk Factors—Risks Related to Cybersecurity, Data Privacy and Intellectual Property Protection."


text: Board of Directors' Oversight of Risks from Cybersecurity Threats The Audit Committee is primarily responsible for oversight of risks from cybersecurity threats. As set forth in the Amended & Restated Audit Committee Charter, the Audit Committee oversees the steps management takes to monitor and control our data privacy and cybersecurity risk exposure. The Board delegated this responsibility to the Audit Committee in part because it includes members with significant experience and/or expertise in cybersecurity and other technology matters.


text: The Audit Committee is informed of risks from cybersecurity threats through regular reports from our CIO and CISO. Our CIO and CISO report to the Audit Committee at least quarterly. The Audit Committee actively engages with our CIO and CISO regarding these risks. Depending on the materiality of a risk, the Audit Committee, CIO or CISO may report on such risk to the full Board.


text: In addition, from time to time, the Board may constitute a special committee to focus on a particular cybersecurity matter or risk.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Management is integral to assessing and managing our material risks from cybersecurity threats. While all members of management are involved in the review of these risks, our CIO oversees and is responsible for our cybersecurity program. Our CIO is a seasoned technology leader and change agent who has served as the top technology executive for multi-billion-dollar global organizations spanning diverse industries. With over 25 years of experience, our CIO has led business and information technology transformations, implemented global digital strategies, and optimized and integrated governance, risk, and compliance frameworks, processes and technologies in complex regulatory and industry environments. We believe our CIO's knowledge, skills and experience provide significant value to our Company.


text: Our CIO and CISO provide regular reports to management regarding risks from cybersecurity threats and the prevention, detection, mitigation and remediation of cybersecurity incidents. Within our information technology organization, our CISO and other key members of our information security team provide regular reports to our CIO.


text: As discussed above, our CIO and CISO also provide regular reports regarding risks from cybersecurity threats to our Audit Committee and, depending on the materiality of a risk, the full Board. In addition, from time to time, members of management may provide reports to a special committee of the Board for cybersecurity.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, and processes are being integrated into the Company's ERM program and based on recognized frameworks and industry standards, including the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of Company and customer systems, information, and products.

companyName: CECO ENVIRONMENTAL CORP

ticker: CECO


text: The Company has engaged third-party cybersecurity service providers and leverages leading technologies and expertise to monitor, maintain, and provide 24/7 managed detection and response capabilities for coordination, escalation and remediation of alerts associated with information technology systems utilized by the Company.


text: Risk Management and Strategy The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity program as necessary based on the information provided by these assessments, audits, and reviews.


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, and third-party and independent reviews. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with the Company's Vice President of Information Technology (the "VP of IT").


text: The Company has a team of cybersecurity professionals reporting to the VP of IT, the head of the Company's cybersecurity team, dedicated to managing threats and incidents in real time and the reporting of any such incidents. The VP of IT reports to the Chief Financial and Strategy Officer. Through regular and ongoing communications, the VP of IT and the Executive Leadership Team, which includes our Chief Executive Officer, Chief Financial and Strategy Officer, and Chief Administrative and Legal Officer, manage the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and escalate any such threats and incidents to the Audit Committee when appropriate.


text: The VP of IT has served in various leadership roles in information technology and information security for over 25 years, including leading the cybersecurity programs for three public companies. The VP of IT holds undergraduate and graduate degrees in business and has attained multiple cybersecurity certifications including Certified Information Security Manager and Data Privacy.


text: Cybersecurity threats, including those as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For more information on our cybersecurity related risks, refer to "Part I, Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: Risk Management and Strategy We have established a cybersecurity program intended to protect the confidentiality, integrity and availability of our systems, data and products in a manner consistent with industry best practices and the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We are currently ISO 27001 certified for our surgery planning ecosystem and plan to continue to maintain this industry certification. We evaluate and monitor cybersecurity risk as part of our overall enterprise risk management framework. Our cybersecurity program includes a variety of processes to assess, identify and manage risks from cybersecurity threats arising from our own and third-party provided systems, including customized annual training requirements, simulation exercises, threat monitoring and detection tools (including those using artificial intelligence and machine learning), threat containment methods, risk assessments, third-party penetration testing and security requirements for our suppliers and other third parties. We assess third party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addenda to our contracts where applicable. We maintain separation of duties between our cybersecurity organization and other IT functional areas as well as established roles that define the responsibility of the cybersecurity team within our organization.

companyName: ZIMMER BIOMET HOLDINGS, INC.

ticker: ZBH


text: Under our program, cybersecurity issues are analyzed by subject matter experts, including those in information security, information technology, risk, and other areas to evaluate potential security, financial, operational, reputational and other risks, as well as to identify any potential data breaches or other cybersecurity incidents. Matters involving potential data breaches and other cybersecurity incidents are considered against applicable escalation and notification requirements. We monitor and periodically enhance our cybersecurity program, processes, techniques and procedures to combat evolving and adaptive cybersecurity threats.


text: We engage third parties to enhance and strengthen our cybersecurity program, to provide additional capabilities and support and to provide annual independent assessments and evaluations of our cybersecurity program. Third parties also provide managed services for incident response, proactive threat identification services, security architecture consulting, security remediation services, patching and external audit services.