text: Management is responsible for identifying, assessing and managing material cybersecurity risks on a day-to-day basis. The Company's Global Cybersecurity Steering Committee, comprised of the CTO, CISO and representatives from internal audit, legal, finance, privacy and human resources, is responsible for overseeing the Company's cybersecurity controls and generally meets on a quarterly basis. The Company's global cybersecurity organization, led by the CISO, is responsible for developing and implementing cybersecurity policies and procedures and identifying potential risks across the Company and works closely with dedicated cybersecurity personnel at the Company's business units. The Company's CTO has been in his senior leadership role since 2020. He has held similar positions prior to joining News Corp, has over 30 years of experience in various cybersecurity and information technology infrastructure and risk management roles and holds an advanced degree in information systems. The Company's CISO has been in his senior leadership role since 2021 and has over two decades of industry experience in cybersecurity and other technology-related roles, including as the Director of Cyber and Telecom Policy in the White House, where he advised senior administration officials on cybersecurity, technology and telecommunications policy issues. As part of the Company's cybersecurity program, described above, the CISO is informed about and monitors the Company's prevention, detection, response, mitigation and remediation efforts related to cybersecurity threats through regular communication and reporting from the Company's cybersecurity team. The CISO works closely with representatives from the Company's legal group, including to oversee compliance with legal, regulatory and contractual security requirements. The CISO provides regular updates to the CTO and the Global Cybersecurity Steering Committee and to other members of executive management, as appropriate. The Company's reporting framework also includes its incident response policy and plan and other policies and processes which set forth specific procedures for internal and external reporting in the event of a cybersecurity incident, including notification to the Audit Committee, or the Board of Directors, as appropriate.


text: Our program includes a number of safeguards. These safeguards include processes for endpoint security (such as anti-malware and endpoint detection and response tools), network security (such as firewalls, intrusion detection systems, and filtering), and vulnerability management (such as vulnerability scans and patch management). Applicable personnel are provided cybersecurity awareness training and receive periodic awareness through ad hoc communications on security topics, including how to report suspicious activity or potential incidents. However, vulnerabilities or threats identified through our cybersecurity program may take time to remediate or mitigate.

companyName: Keenova Therapeutics plc

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: Risk Management and Strategy As a high-profile global media and information services company with a wide array of digital products and services, the Company is subject to risks associated with cybersecurity threats. The Company has developed and implemented a cybersecurity program designed to manage these threats, including the assessment, identification and management of cybersecurity risks, and related protection, response, mitigation and recovery efforts. The program is overseen and monitored by a dedicated internal global cybersecurity organization, led by the Company's Chief Information Security Officer ("CISO"), who reports directly to the Company's Chief Technology Officer ("CTO"), and supported by designated business information security officers at the Company's business units. The Company's cybersecurity program is informed in part by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and leverages a defense-in-depth approach to managing cybersecurity risk. The governance, principles and framework for the program are set forth in the Company's Global Cybersecurity Governance Principles Framework and are complemented by a set of global cybersecurity policies designed to promote secure cyber and data practices among Company personnel. The Company reinforces a culture of secure behavior through annual cybersecurity and privacy awareness trainings, quarterly phishing exercises and regular delivery of other security awareness content via an online training system, steering committees, newsletters, departmental meetings and periodic campaigns, as well as specialized secure development training for product development teams. In addition, the Company employs various technical measures and processes to address the cybersecurity threats it faces, which may include reporting, monitoring and alert tools, identity and access management, multi-factor authentication, encryption, endpoint detection and response, email, application and cloud security tools, vulnerability scanning tools, threat intelligence monitoring and application resilience measures, as well as threat modeling, architecture design reviews and code reviews performed by its product security team.

companyName: NEWS CORP

ticker: NWSA


text: The Company maintains a cybersecurity incident response policy and plan, which in conjunction with the above measures, are designed to facilitate detection, analysis, containment, remediation and recovery from cybersecurity incidents and set forth processes to manage, escalate and, as appropriate, report such incidents based on their potential impact to the Company. The Company also undertakes disaster recovery and business continuity planning and maintains certain system redundancies to limit the impact of cybersecurity incidents and other disruptions, but there can be no assurance that these efforts will be successful. The Company conducts periodic testing and assessments of its cybersecurity program, both through internal security personnel and third-party firms. The Company engages consultants and other independent third parties to periodically perform internal and external penetration testing, security audits, incident response readiness exercises and assessments of the Company's cybersecurity risk management practices, including an evaluation of the Company's cybersecurity program based on the NIST Cybersecurity Framework approximately every two years. The Company may also consult with external legal counsel, third-party experts and other advisors in connection with incident response and recovery efforts and forensic investigations.


text: The Company's processes for identifying, assessing and managing cybersecurity risk are integrated into the Company's overall risk management process. The Company's internal audit group monitors the Company's risk profile and conducts regular enterprise-wide integrated risk assessments, with input from corporate and business unit management and personnel, to identify and assist the Board of Directors and senior executives in managing key existing and emerging risks for the Company and its businesses, including cybersecurity risk. The risk assessment process culminates in semi-annual reports to the Audit Committee and the Board of Directors. In addition to its own systems and technology, the Company relies on third-party service providers for certain software, technology and cloud-based systems and services that support a variety of critical business operations. The Company has policies and processes designed to identify, assess and manage cybersecurity risk relating to these third-party service providers. When contracting with these providers, the procurement function works closely with the compliance, cybersecurity, privacy and legal teams to conduct diligence and help appropriately manage risk, including cybersecurity risk, throughout the life cycle of the contract. The Company and its business units have developed, and seek to incorporate, standard contractual security requirements into their service provider agreements. The Company also performs cybersecurity assessments of third-party service providers where it deems appropriate given the nature of the engagement and the data and systems expected to be accessed.


text: Although the Company dedicates significant resources and efforts to protect against cybersecurity risks, the Company has experienced, and expects to continue to be subject to, cybersecurity threats. To date, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, the Company continues to face cybersecurity risks such as those described in "Item 1A. Risk Factors" in this Annual Report on Form 10-K, and there can be no assurance that cybersecurity threats or incidents will not have a material adverse effect on the Company in the future. While the Company maintains cyber risk insurance, such insurance may not be sufficient to cover all losses from cybersecurity incidents.


text: News Corp's Board of Directors oversees the Company's processes for identifying, assessing and managing significant risks facing the Company, and each of the Board's standing committees assists the Board within the areas delegated to that committee. The Board of Directors has delegated to the Audit Committee primary responsibility for overseeing risks related to cybersecurity, including reviewing with management the Company's major cyber-related risk exposures and the steps that have been taken to monitor and control such exposures. The Audit Committee generally receives reports at least quarterly from the CTO and CISO on the Company's cybersecurity program covering various topics, including incident reporting, a review of the global cyber risk-map, updates on the cybersecurity program and initiatives, employee training, technology solutions and other practices designed to minimize the risks associated with cybersecurity threats, and updates the Board of Directors as appropriate.

stage1Category: Board Governance


text: In the event of a potential or actual cybersecurity incident, we maintain an incident response program. Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We maintain a Cybersecurity Incident Response Plan ("IRP") and business continuity and disaster recovery plans in the event of a significant cybersecurity incident or disruption. The IRP is tested using tabletop exercises.

stage1Method: majority


text: Management is responsible for identifying, assessing and managing material cybersecurity risks on a day-to-day basis. The Company's Global Cybersecurity Steering Committee, comprised of the CTO, CISO and representatives from internal audit, legal, finance, privacy and human resources, is responsible for overseeing the Company's cybersecurity controls and generally meets on a quarterly basis. The Company's global cybersecurity organization, led by the CISO, is responsible for developing and implementing cybersecurity policies and procedures and identifying potential risks across the Company and works closely with dedicated cybersecurity personnel at the Company's business units. The Company's CTO assumed his position in June 2025 after serving in various leadership and technology roles at the Company's subsidiary News Corp Australia since 2012, including as CTO from 2020. He has extensive experience in information technology infrastructure and risk management, digital media and the management of digital networks. The Company's CISO has been in his position since December 2024 after serving in various leadership and information security roles at the Company since 2021. He has over two decades of industry experience in cybersecurity, information governance and risk management at large media and technology companies. As part of the Company's cybersecurity program, described above, the CISO is informed about and monitors the Company's prevention, detection, response, mitigation and remediation efforts related to cybersecurity threats through regular communication and reporting from the Company's cybersecurity team. The CISO works closely with representatives from the Company's legal group, including to oversee compliance with legal, regulatory and contractual security requirements. The CISO provides regular updates to the CTO and the Global Cybersecurity Steering Committee and to other members of executive management, as appropriate. The Company's reporting framework also includes its incident response policy and plan and other policies and processes which set forth specific procedures for internal and external reporting in the event of a cybersecurity incident, including notification to the Audit Committee or the Board of Directors, as appropriate.

stage1Category: Management Role


text: Cybersecurity risk management and strategy Our cybersecurity risk management program is managed by our Chief Information Officer ("CIO") who reports to our Chief Financial Officer and provides regular updates to the Board. Our CIO establishes our overall Information Technology ("IT") security strategy, oversees our information, cyber, and technology security and manages our IT department, which includes our Cybersecurity team. His responsibilities include developing, implementing, and enforcing security policies to protect critical data. The head of our Cybersecurity team, our Director of Information Security, who reports to our CIO, runs the day-to-day management of our cybersecurity risks. Our IT department overall assists in implementing cybersecurity strategies and policies under the direction of the Cybersecurity team, as applicable.

companyName: PBF Holding Co LLC


text: Our cybersecurity risk management program aligns with the National Institute of Standards and Technology Cyber Security Framework, which establishes five areas of focus: identify, protect, detect, respond and recover. Our cybersecurity risk management program is designed to manage industry-specific threats, as well as threats arising from the overall evolving cybersecurity landscape and consists of two principal areas of focus: (i) enterprise systems, which consists of all business systems used in our daily operations and (ii) operational technology, which consists of all process control, supervisory control and data acquisition systems. Key elements of our cybersecurity management program include: • identifying, monitoring and mitigating the cybersecurity risks to our systems, assets, data and capabilities; • a critical response process for cybersecurity incidents, including the process for detection, investigation, containment and remediation of any such incidents; • establishment of disaster recovery plans; • testing, at least bi-annually, of select critical systems for disaster recovery and periodic walk-throughs of procedures for disaster recovery; • identity access policies that aim to identify and monitor for potential cyber intrusions; • periodic security tests, including monthly internal vulnerability scans, weekly external vulnerability scans, monthly phishing campaigns and recurring penetration testing by third-party cybersecurity firms; • table-top exercises, at least quarterly, for incident response preparedness for the Cybersecurity team and Information Technology department; and • annual drills for potential threats on various aspects of our technology assets based on the then-existing IT threat landscape for our industry. Pursuant to our incident response plan, the Cybersecurity team has defined roles in responding to all cybersecurity incidents to provide an efficient and organized approach to handling cybersecurity threats, with the CIO receiving all reports and status updates regarding cybersecurity threats. The incident response plan provides a documented framework for when and how the CIO informs and updates our Board, the executive officers and other internal parties and when external parties are notified or consulted about a cybersecurity threat and the status thereof.


text: We also utilize third-party cybersecurity vendors to assist us with various aspects of our cybersecurity risk management program. For example, in order to support our cybersecurity incident response procedures, we have retained several third-party cybersecurity firms to monitor the IT threat landscape for our industry. As part of our efforts to manage the risk of cybersecurity threats associated with the use of third parties, we monitor and evaluate the cybersecurity risk profiles of third-party technology providers and consider such risk profiles when selecting third-party technology providers. Any third-party service provider that is granted access to our network is required to comply with our policies regarding information technology and cybersecurity. We also engage several third-party cybersecurity firms to perform independent assessments of the effectiveness of our cybersecurity risk management program and assist us in the continued review of our cybersecurity risk management program in order to reflect the evolving landscape of cybersecurity.


text: To date, there have been no significant risks from cybersecurity threats, including as a result of any significant cybersecurity breaches or attacks that have materially affected our business, results of operations or financial condition. However, if we were to be subject to a material successful cyber intrusion, it could result in remediation or service restoration costs, increased cybersecurity protection costs, lost revenues, litigation or regulatory actions by governmental authorities, increased insurance premiums, reputational damage and damage to our competitiveness, financial condition, results of operations and cash flows. See "Item 1A. Risk Factors-Risks Relating to Our Business and Industry-A cyber-attack on, or other failure of, our technology infrastructure could affect our business and assets, and have a material adverse effect on our financial condition, results of operations and cash flows."


text: Cybersecurity governance Our CIO has 30 years of experience in highly regulated industries managing information security in complex, matrixed environments, seven of which are in his current role with the Company. He has created and maintained enterprise-level information security programs for our Company and other US and international companies in the refining industry.


text: The CIO, along with the head of our Cybersecurity team, periodically reports, no less than quarterly, to our Board and our executive officers regarding the state of our cybersecurity risk management program, including information on the status of ongoing efforts to manage and mitigate cybersecurity risks, as well as recent cybersecurity trends and events and any updates to cybersecurity matters.


text: 1.Comprehensive Risk Assessments: We conduct regular and comprehensive assessments to identify potential cybersecurity risks to our organization. These assessments encompass internal systems, networks, applications, and data repositories, as well as external threats and vulnerabilities within the broader digital ecosystem.

companyName: NewtekOne, Inc.

ticker: NEWT


text: Cybersecurity risk management and strategy Our cybersecurity risk management program is managed by our current Chief Information Officer ("CIO") who reports to our Chief Financial Officer and provides regular updates to the Board. Our CIO establishes our overall Information Technology ("IT") security strategy, oversees our information, cyber, and technology security and manages our IT department, which includes our Cybersecurity team. His responsibilities include developing, implementing, and enforcing security policies to protect critical data. The head of our Cybersecurity team, our Director of Information Security, who reports to our CIO, runs the day-to-day management of our cybersecurity risks. Our IT department overall assists in implementing cybersecurity strategies and policies under the direction of the Cybersecurity team, as applicable.


text: To date, there have been no significant threats, including as a result of any significant cybersecurity breaches or attacks, that have materially affected our business, results of operations or financial condition. However, if we were to be subject to a material successful cyber intrusion, it could result in remediation or service restoration costs, increased cybersecurity protection costs, lost revenues, litigation or regulatory actions by governmental authorities, increased insurance premiums, reputational damage and damage to our competitiveness, financial condition, results of operations and cash flows. See "Item 1A. Risk Factors-Risks Relating to Our Business and Industry-A cyber-attack on, or other failure of, our technology infrastructure could affect our business and assets, and have a material adverse effect on our financial condition, results of operations and cash flows."


text: Cybersecurity governance Our CIO assumed his position effective June 1, 2024, following the retirement of his predecessor. He previously served as the head of our Cybersecurity team. Our CIO has 28 years of experience in highly regulated industries managing information security in complex, matrixed environments. He has created and maintained enterprise-level information security programs for our Company and other US and international companies in the refining industry.


text: Our CIO, along with the head of our Cybersecurity team, periodically reports, no less than quarterly, to our Board and our executive officers regarding the state of our cybersecurity risk management program, including information on the status of ongoing efforts to manage and mitigate cybersecurity risks, as well as recent cybersecurity trends and events and any updates to cybersecurity matters.


text: The Audit Committee reviews our disclosures with respect to cybersecurity and information technology risks. The Audit Committee also reviews with management guidelines and policies to govern the process by which risk assessment and risk management is undertaken, including but not limited to cybersecurity and information technology risks. As part of the Company's enterprise-wide risk management program, our Internal Audit team also reports to our Audit Committee regarding assessments of our cybersecurity and information technology risks, at least annually, based on regular updates by our CIO regarding such risks. Our Internal Audit team periodically reports to our executive officers and the Audit Committee regarding such risks.


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and performing additional risk screenings and procedures, as appropriate. We have established a third-party risk management program that includes a formal vendor and cloud security policy and processes to conduct diligence on applicable vendors, including thorough questionnaires and additional documentation. Cybersecurity controls language may be included in third-party service provider contracts, and if applicable, this language is designed to be tailored to the use case and sensitivity of any data or business processes involved.

stage1Category: Third-Party Risk


text: We recognize the critical importance of maintaining the trust and confidence of our business partners, such as CROs, clinical trial investigators, patients, employees, subcontractors and other vendors. We are committed to protecting the confidentiality, integrity and availability of our business operations and systems, and its board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an essential element of our overall approach to risk management. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents should they occur.

companyName: INTENSITY THERAPEUTICS, INC.

ticker: INTS


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity, such as unauthorized access, cybersecurity attacks, phishing, and other security incidents, including perpetration by hackers and unintentional damage or disruption to hardware and software systems, loss of data, phony invoices, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we, together with our contracted third-party cybersecurity advisors, maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring of internal and external threats to ensure the confidentiality and integrity of its information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. As discussed in more detail under "Cybersecurity Governance" below, our board of directors provides oversight of our cybersecurity risk management and strategy processes, which are led by management.


text: We, with assistance from our contracted third-party cybersecurity advisors, identifies, protects, and responds to our cybersecurity risks and incidents, through the following activities: • monitoring emerging data protection laws and implementing changes to processes that are designed to comply with such laws; • requiring employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employing technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, double verification software, and access controls; • performing backups of local hard drives and our financial systems in the cloud and on physical media that are stored off-site in locked locations; • providing mandatory training for our employees regarding cybersecurity threats; and • carrying information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our processes also address cybersecurity threat risks associated with our selection and oversight of third-party service providers, including our suppliers and manufacturers or those who have access to patient and employee data or our systems. We generally require those third parties that could introduce significant cybersecurity risk to agree by contract to manage their cybersecurity risks in specified ways.


text: We do not have any in-house servers or systems. An integral part of our cybersecurity is the security built into this third-party software operated by large corporations such as Microsoft. Our control system, therefore, includes the review of annual Service Organization Controls reports in order to annually assess the controls of these software systems. To date, we have not experienced any material cybersecurity incidents.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for the board of directors and management. Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare the Company to address cybersecurity risks.


text: Our board of directors provides direct oversight over cybersecurity risk and receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Executive Officer with the assistance of contracted third-party cybersecurity advisors. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including incident response processes.


text: We depend on both our own systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners to conduct key operations across our enterprise.

stage1Category: None/Other


text: Cybersecurity Program We have worked to develop our cybersecurity program to protect the confidentiality, integrity, and availability of systems and data. We have implemented administrative, technical, and physical safeguards that we believe are appropriate to the size and complexity of our business and the nature and scope of our activities. We evolve our cyber defenses to help minimize impacts from cyber threats to safeguard our assets and data.


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by a team that includes our Chief Information Security Officer ("CISO"), who reports to our VP of Information Systems. The CISO is supported by a SOC team, an Incident Response Manager, a Governance Risk and Compliance Manager, and cybersecurity architects. These individuals and groups are responsible for the day-to-day management of our cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and are regularly engaged to help ensure our cybersecurity program functions effectively in the face of evolving cybersecurity threats. The individuals involved generally have significant experience in cybersecurity and related information technology, including responding to incidents and developing security policies, with our three most senior leaders having an average of 25 years of experience in cybersecurity. In addition to the day-to-day management of these risks, we hold a monthly meeting of an Information Risk Committee, which is comprised of representatives from our legal, human resources, compliance, and information technology departments. On a quarterly basis, we also hold a meeting of our Executive IT Steering Committee, which is comprised of members of the executive leadership, so that they can receive regular briefings on cybersecurity matters, including threats, events, and program enhancements.


text: Our full Board of Directors provides oversight for our cybersecurity program. At least annually, the CISO and the VP of Information Technology report to the Board of Directors on information technology, cybersecurity and information security-related matters, including relevant business activities, key risks and mitigation efforts, prior incidents, results of assessments and monitoring, and the potential impact on the Company's business.


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management processes are integrated into our overall business risk management program. As part of our risk management program, we identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity. As part of risk management processes, we maintain cybersecurity insurance that provides coverage for certain costs related to cybersecurity-related incidents. However, the amount or type of coverage may not be sufficient to address costs for handling an incident, or future changes may occur to insurance coverage.


text: As of December 29, 2023, we are not aware of any risks from cybersecurity threats, including from previous cybersecurity incidents, that materially impacted the Company's strategy, operations, or financial condition in the last three years. However, we have been the target of previous cyber attacks and anticipate we will continue to face risks of incidents through various types of attacks, including those using sophisticated techniques and evolving technologies such as artificial intelligence. Although we make efforts to maintain the security of our systems and data, we are subject to the risk of a cybersecurity incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third-party vendors, will prevent breakdowns or incidents to our or our third-party vendors' systems that could adversely affect our business. For further discussion, see the risk factor captioned "Our business depends on the continued effectiveness and availability of our information technology infrastructure, and failures of this infrastructure could harm our operations" included within Item 1A. Risk Factors of this Annual Report.

stage1Category: Strategy Integration


text: Our program includes a number of safeguards. These safeguards include processes for endpoint security (such as anti-malware and endpoint detection and response tools), network security (such as firewalls, intrusion detection systems, and filtering), and vulnerability management (such as vulnerability scans and patch management). Applicable personnel are provided cybersecurity awareness training and receive periodic awareness through ad hoc communications on security topics, including how to report suspicious activity or potential incidents. However, vulnerabilities or threats identified through our cybersecurity program may take time to remediate or mitigate.


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and performing additional risk screenings and procedures, as appropriate. We have established a third-party risk management program that includes a formal vendor and cloud security policy and processes to conduct diligence on applicable vendors, including the use of questionnaires and obtaining additional security documentation. Cybersecurity controls language may be included in third-party service provider contracts, and if applicable, this language is designed to be tailored to the use case and sensitivity of any data or business processes involved.


text: We recognize the potential risks associated with the deployment and use of AI systems. We provide training for employees on AI use cases, opportunities, and risk management practices.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats To assess, identify, and manage potential cybersecurity threats, our Security Operations Center ("SOC") team works in conjunction with a third-party managed security service provider to monitor systems and threats, including those on systems managed by third-parties, such as cloud platforms.


text: In the event of a potential or actual cybersecurity incident, we maintain an incident response program. Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We maintain a Cybersecurity Incident Response Plan ("IRP") and business continuity and disaster recovery plans in the event of a significant cybersecurity incident or disruption. The IRP is tested using tabletop exercises.


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by a team that includes our Chief Information Security Officer ("CISO"), who reports to our Vice President ("VP") of Information Systems. The CISO is supported by a SOC team, an Incident Response Manager, a Governance Risk and Compliance Manager, and cybersecurity architects. These individuals and groups are responsible for the day-to-day management of our cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and are regularly engaged to help ensure our cybersecurity program functions effectively in the face of evolving cybersecurity threats. The individuals involved generally have significant experience in cybersecurity and related information technology, including responding to incidents and developing security policies, with our three most senior leaders having an average of 25 years of experience in cybersecurity. In addition to the day-to-day management of these risks, we hold a monthly meeting of an Information Risk Committee, which is comprised of representatives from our legal, human resources, compliance, and information technology departments. On a quarterly basis, we also hold a meeting of our Executive Information Technology ("IT") Steering Committee, which is comprised of members of the executive leadership, so that they can receive regular briefings on cybersecurity matters, including threats, events, and program enhancements.


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management processes are integrated into our overall business risk management program. As part of our risk management program, we identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity, including AI. As part of risk management processes, we maintain cybersecurity insurance that provides coverage for certain costs related to cybersecurity-related incidents. However, the amount or type of coverage may not be sufficient to address costs for handling an incident, or future changes may occur to insurance coverage.


text: As of December 27, 2024, we are not aware of any risks from cybersecurity threats, including from previous cybersecurity incidents, that materially impacted the Company's strategy, operations, or financial condition for the past year. However, we have been the target of previous cyber attacks and anticipate we will continue to face risks of incidents through various types of attacks, including those using sophisticated techniques and evolving technologies such as artificial intelligence. Although we make efforts to maintain the security of our systems and data, we are subject to the risk of a cybersecurity incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third-party vendors, will prevent breakdowns or incidents to our or our third-party vendors' systems that could adversely affect our business. For further discussion, see the risk factor captioned "Our business depends on the continued effectiveness and availability of our information technology infrastructure, and failures of this infrastructure could harm our operations" included within Item 1A. Risk Factors of this Annual Report.


text: We have developed, implemented, and integrated a cybersecurity program, or the Cybersecurity Program, to protect our information systems by using physical, technical, and administrative safeguards. This includes assessing, identifying, monitoring, reporting, managing and remediating cybersecurity threats. The Cybersecurity Program aims to prevent data ex-filtration, manipulation, and destruction, as well as system and transactional disruption. The Cybersecurity Program utilizes a threat-centric and risk-based approach to identify and assess cybersecurity threats that could affect our business and information systems based on the National Institute of Standards and Technology Cybersecurity Framework, or the NIST Framework.

companyName: Sila Realty Trust, Inc.

ticker: SILA


text: We also use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and various supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers which includes, depending on the vendor, nature of the services provided, and sensitivity of the Information Systems and Data at issue: different levels of assessment designed to help identify cybersecurity risks associated with the vendor, security questionnaires, review of security assessments, and imposition of contractual obligations related to cybersecurity.

companyName: PagerDuty, Inc.

ticker: PD


text: Our Cybersecurity Program includes the following processes: • Quarterly control reviews, annual policy reviews and annual investments in our security infrastructure; • Periodic testing of our information systems to assess our vulnerability to cyber risk, which includes targeted penetration testing and vulnerability scanning; • Testing and audits of our IT-related internal controls over financial reporting, excluding cybersecurity controls, by our internal auditors; • Conducting a comprehensive information security and training program for our employees, including mandatory computer-based training, regular internal communications, and ongoing end-user testing to measure the effectiveness of our information security program. As part of this commitment, we require our employees to acknowledge our Information Security policy each year. In addition, we have an established schedule and process for regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees; • Annually assess the Cybersecurity Program against the NIST Framework; • Maintaining business continuity, contingency and recovery plans to quickly react to cybersecurity incidents; • Conducting security assessments of all third-party service providers with access to personal, confidential or proprietary information before engagement and maintaining ongoing monitoring by reviewing system and organization controls reports, relevant cyber attestations, and other independent cyber ratings; • Retaining a third-party cybersecurity provider for emergency incident response services in the event of a serious information security breach; and • Maintaining cybersecurity risk insurance that could help defray the costs of an information security breach as a backstop to the Cybersecurity Program.


text: Through our incident response plan, we have designated a cybersecurity management committee, or the Cybersecurity Management Committee, composed of our executive officers and management representatives. Led by Our Vice President of Information Technology & Corporate Facilities, our Cybersecurity Management Committee is responsible for the management of the Cybersecurity Program and for the day-to-day investigation of and response to potential information security-related incidents. Pursuant to our incident response plan, incidents meeting specified severity levels are required to be escalated to the Cybersecurity Management Committee for review and response. The goals of the incident response plan are to prevent, detect and react to information security incidents, determine their scope and risk, respond appropriately to the incident, communicate the results and risk to relevant stakeholders, and reduce the likelihood of the incident from reoccurring.


text: Our Vice President of Information Technology & Corporate Facilities has served in this role since 2018, and has more than 25 years of experience in various roles involving managing information security, technology infrastructure and IT operations.


text: Our Board plays a role in overseeing risks associated with cybersecurity threats and has delegated to the Audit Committee primary oversight of the Cybersecurity Program. Our executive officers report on our Cybersecurity Program to both the Board and the Audit Committee at least four times per year (including as part of our discussions regarding enterprise risk management). In addition, quarterly reports to the Audit Committee include our internal auditor's reviews of our information security programs and controls. As part of the incident response plan discussed above, in the event we experience a cybersecurity incident that could materially affect us, including our business strategy, results of operations or financial condition, our executive officers (who are also a part of the Cybersecurity Management Committee) will review the incident with the Audit Committee to consider whether and to what extent disclosure is required under Item 1.05 of Form 8-K.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business strategy, results of operations or financial conditions. See "Risk Factors – General Risk Factors - Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results" in Part I, Item 1A of this Annual Report on Form 10-K for a discussion of these risks. To date, we have not experienced a material cybersecurity incident.


text: We have developed, implemented, and integrated a cybersecurity program, or the Cybersecurity Program, into our broader risk management structure to protect our information systems by using physical, technical, and administrative safeguards. This includes assessing, identifying, monitoring, reporting, managing and remediating cybersecurity threats. The Cybersecurity Program aims to prevent data ex-filtration, manipulation, and destruction, as well as system and transactional disruption. The Cybersecurity Program utilizes a threat-centric and risk-based approach to identify and assess cybersecurity threats that could affect our business and information systems based on the National Institute of Standards and Technology Cybersecurity Framework, or the NIST Framework.


text: Our Cybersecurity Program includes the following processes: • Annual control reviews, annual policy reviews and annual investments in our security infrastructure; • Periodic testing of our information systems to assess our vulnerability to cyber risk, which includes targeted penetration testing and vulnerability scanning; • Collaborating with our internal audit team to evaluate the effectiveness of our information technology security program and communicating results to our executive officers; • Conducting a comprehensive information security and training program for our employees, including mandatory computer-based training, regular internal communications, and ongoing end-user testing to measure the effectiveness of our information security program. As part of this commitment, we require our employees to acknowledge our Information Security policy each year. In addition, we have an established schedule and process for regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees; • Annually assess the Cybersecurity Program against the NIST Framework; • Maintaining business continuity, contingency and recovery plans to quickly react to cybersecurity incidents; • Conducting security assessments of all third-party service providers with access to personal, confidential or proprietary information before engagement and maintaining ongoing monitoring by reviewing system and organization controls reports, relevant cyber attestations, and other independent cyber ratings; • Retaining a third-party cybersecurity provider for emergency incident response services in the event of a serious information security breach; and • Maintaining cybersecurity risk insurance that could help defray the costs of an information security breach as a backstop to the Cybersecurity Program.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Through our incident response plan, we have designated a cybersecurity management team, or the Cybersecurity Management Team, composed of our executive officers and management representatives. Led by our Vice President of Information Technology & Corporate Facilities, our Cybersecurity Management Team is responsible for the management of the Cybersecurity Program and for the day-to-day investigation of and response to potential information security-related incidents. Pursuant to our incident response plan, incidents meeting specified severity levels are required to be escalated to the Cybersecurity Management Team for review and response. The goals of the incident response plan are to prevent, detect and react to information security incidents, determine their scope and risk, respond appropriately to the incident, communicate the results and risk to relevant stakeholders, and reduce the likelihood of the incident from reoccurring.


text: Our Vice President of Information Technology & Corporate Facilities has served in this role since 2018. In this role, he manages and oversees the Company's network and information systems. Additionally, he works with the executive officers, management representatives and third-party experts to maintain the Company's Cybersecurity Program. Our Vice President of Information Technology & Corporate Facilities possesses extensive experience in technology and cybersecurity gained over his career spanning more than 25 years, including service as the executive director of Business Applications as well as a senior implementer and business consultant.


text: The Board plays a role in overseeing risks associated with cybersecurity threats and has delegated to the Audit Committee primary oversight of the Cybersecurity Program. Our executive officers report on our Cybersecurity Program to the Audit Committee at least four times per year (including as part of our discussions regarding enterprise risk management). Our quarterly updates to the Audit Committee include a discussion of our information security programs and controls, including our internal auditor's review and our internal monitoring of cybersecurity risks. As part of the incident response plan discussed above, in the event we experience a cybersecurity incident that could materially affect us, including our business strategy, results of operations or financial condition, our executive officers (who are also a part of the Cybersecurity Management Team) will review the incident with the Audit Committee to consider whether and to what extent disclosure is required under Item 1.05 of Form 8-K.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic, or competitive in nature, customer data, and the personal information of our employees (collectively, "Information Systems and Data").


text: Our Chief Information Security Officer ("CISO"), along with the information security, engineering, and legal functions at the Company, help identify, assess, and manage the Company's cybersecurity threats and risks. They work to identify and assess risks from cybersecurity threats by monitoring and evaluating the threat environment using various methods including manual and automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating our and our industry's risk profile, conducting audits and threat assessments, conducting vulnerability assessments, and external threat intelligence.


text: Depending on the environment, system, and data, we implement and maintain certain technical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response procedures, vulnerability management process, disaster recovery/business continuity plans, encryption, network security controls, user access controls including multifactor authentication and role-based access, data segregation, asset management, systems monitoring, vendor risk management program, employee training, penetration testing, cybersecurity insurance, and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes, including by prioritizing our risk management processes and mitigating cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, professional services firms, cybersecurity consultants, managed cybersecurity service providers, penetration testing firms, and as needed, forensics investigators.


text: Our board of directors oversees the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Technology Officer ("CTO"), CISO, and Chief Information Officer ("CIO"), who have decades of experience in cybersecurity and information technology. Our CTO has extensive experience in computer science, and our CISO has extensive experience in computer security and enterprise data.


text: Company management, including the CTO, CISO, and CIO, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Management is also responsible for approving budgets for spending on cybersecurity, helping prepare for cybersecurity incidents, and approving cybersecurity processes.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including to the CISO, CTO, and CIO, as appropriate. The CTO, CISO, and CIO work with the Company's incident response team to help the Company mitigate and remediate such cybersecurity incidents. In addition, the Company's incident response and vulnerability management processes include updates to the audit committee of the board of directors as appropriate.


text: The audit committee receives periodic reports from the CTO and/or CISO concerning the company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to the Company's cybersecurity threats, risk and mitigation. The audit committee will keep the full board of directors apprised of the company's cybersecurity risk processes and significant developments related to cybersecurity.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, including protected health information and the systems that store and transmit such data. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Oscar Health, Inc.

ticker: OSCR


text: We use the ISO 27001 standard as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications or requirements.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, and conduct tabletop exercises to validate our cybersecurity incident response processes; • the use of various technology and process-based methods, such as network isolation, intrusion detection systems, vulnerability assessments, penetration testing, use of threat intelligence, content filtering, endpoint security (including anti-malware and detection response capabilities), email security mechanisms, and access control mechanisms; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management and diligence process for vendors and service providers.


text: While we have implemented processes to maintain our cybersecurity risk management program, there can be no assurance that our program, including our controls, procedures and processes, will be fully complied with or that it will be fully effective in protecting the confidentiality, integrity and availability of our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to our Business—If we or our partners or other third parties with whom we collaborate fail to protect confidential information and/or sustain a data security incident, we could suffer increased costs, material financial penalties, exposure to significant liability, adverse regulatory consequences, and reputational harm, which would materially adversely affect our business, results of operations, and financial condition."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: Sprinklr, Inc.

ticker: CXM


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity risks. The Committee oversees management of our cybersecurity risks, including reviewing and discussing with management our major cybersecurity risk exposures and the steps management has taken to monitor and control such exposures.


text: Management provides quarterly reports on our cybersecurity risks to the Committee. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents. The Committee reports to the full Board regarding its activities, including those related to cybersecurity. Our management team, including our Chief Technology Officer and Chief Information Security Officer (CISO), is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Technology Officer, the Company's co-founder and former CEO, has extensive experience in computer science and technology, including as a visiting scholar at Stanford University. This experience has enhanced his expertise in cybersecurity governance and risk management. Our CISO is a Certified Information Systems Security Professional and his experience includes over 20 years of working in the cybersecurity field in various industries, including data analytics, identity verification software, and financial services industries, and 15 years leading teams and programs.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from the Health Information Sharing and Analysis Center and other governmental, public or private sources; and alerts and reports produced by security tools deployed in the IT environment.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I, Item 1A "Risk Factors—Risks Related to our Business—If we or our partners or other third parties with whom we collaborate fail to protect confidential information and/or sustain a data security incident, we could suffer increased costs, material financial penalties, exposure to significant liability, adverse regulatory consequences, and reputational harm, which would materially adversely affect our business, results of operations, and financial condition."


text: Cybersecurity Risk Management and Strategy Cybersecurity represents a critical component of our overall approach to risk management. We generally approach cybersecurity threats through a cross-functional, multilayered approach, with the specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to us; (ii) preserving the confidentiality, security, and availability of the information that we collect and store to use in our business; (iii) protecting our intellectual property; (iv) maintaining the confidence of our tenants, customers, clients, and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when applicable. Additionally, we maintain a cyber insurance policy that covers loss of data and associated recovery, loss of revenue due to business interruptions from a cybersecurity event, loss of transferred funds from events such as fraud and social engineering, and loss of funds from computer fraud and extortion.

companyName: AH Realty Trust, Inc.

ticker: AHRT


text: Processes for Assessing Cybersecurity Threats We manage cybersecurity threats by employing a comprehensive process that is integral to our overall risk management framework. Our risk management approach is designed to be aligned with the Committee of Sponsoring Organizations of the Treadway Commission (COSO) 2017 Enterprise Risk Management ("ERM") framework. This system includes a risk assessment process specifically designed to identify information technology ("IT") and cybersecurity risks that could be material to our organization.


text: i. Integration into the COSO-Based Enterprise Risk Management Framework Our overall risk management system provides a structured and consistent approach to risk identification, assessment, and response, including those related to cybersecurity. The integration of cyber risks into our ERM framework underscores our commitment to upholding a robust governance structure that emphasizes the protection of our information systems. We also have in the past year engaged a third-party consultant to conduct a detailed risk assessment workshop utilizing the Center for Internet Security (CIS) framework v8. Additionally, our internal audit department performs periodic assessments of the design and operating effectiveness of our cybersecurity controls.


text: ii. Engagement with Third Parties We maintain strategic partnerships with third-party assessors, consultants, and auditors to enhance our defense mechanisms. This includes the use of third parties for penetration testing and log evaluation, and network monitoring to assist in rapid identification and mitigation of any suspicious network access to ensure the effective detection and mitigation of cybersecurity threats. The results of such tests and assessments are reported to our audit committee and our board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by the tests and assessments.


text: iii. Oversight of Third-Party Service Providers Our vendor risk assessment program is designed to identify, evaluate, and manage risks associated with third-party service providers. As a part of this program, we regularly review third-party attestation reports, such as SOC 1 and SOC 2, for key service providers to validate the effectiveness of their cybersecurity policies and controls. This ensures alignment with our standards for cybersecurity.


text: Additionally, we require all vendors with whom we have a direct contract or agreement, with limited exceptions, to comply with the Vendor Code of Business Conduct. Vendors are required to maintain the confidentiality of information entrusted to them by us. Additionally, the Vendor Code of Business Conduct provides instructions for vendors to report violations confidentially.


text: Impact of Cybersecurity Threats Cybersecurity threats have the potential to negatively impact us due to the use of information technology within our business, and by our suppliers, business partners, and tenants. See "Risk Factors—Risks Related to Our Business—A cybersecurity incident or other technology disruptions could negatively impact our business, our relationships, and our reputation." of Item 1A above for a discussion of cybersecurity risks and the potential impact on us.


text: Our board of directors, including through delegation to our audit committee, exercises oversight over cybersecurity risks and controls. Our audit committee and board of directors regularly receive updates (including, in the case of our audit committee, quarterly updates) from our Chief Financial Officer and other members of management regarding the status of cybersecurity initiatives and the effectiveness of our internal control system related to information security. In connection with such updates, our board of directors and audit committee discuss our approach to cybersecurity risk management with management. Additionally, the audit committee periodically receives presentations from third-party cybersecurity experts to remain informed of developments in cyber risk and mitigation. Our board of directors and audit committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed.


text: Management's Role Management plays a critical role in cybersecurity risk assessment and management. The key roles and responsibilities are summarized as follows: i. Management Responsibilities Key management personnel, tasked with cybersecurity risk management, are equipped with expertise that encompasses extensive experience in cybersecurity, academic credentials, and professional certifications. Specific cybersecurity expertise and certifications held by management include bachelor's degrees in technology and network security, industry certifications (CompTIA A+, CompTIA Network+, CompTIA Security+, Microsoft Certified Professional, Cisco Certified Network Associate), and public sector (military) experience in network security. Management personnel hone their skills to meet new demands through continuing professional development. Additionally, all employees are subject to ongoing cybersecurity training.


text: Members of management report to our Chief Financial Officer who is the member of management that is principally responsible for overseeing our cybersecurity risk management program. Our Chief Financial Officer holds an undergraduate and graduate degree in economics and has over 14 years of experience with managing risks at the Company and in environments similar to the Company's, including risks arising from cybersecurity threats. Additionally, our Director of IT has served in various roles in information technology and information security for over 23 years. Our Director of IT holds an undergraduate degree in information technology and has attained the following professional certifications: CompTIA Network+, CompTIA Security+, Microsoft Certified Professional, Cisco Certified Network Associate, and Department of Defense Information Assurance Technical, Level II. Further, our Director of Corporate Business Systems holds a Bachelor of Science degree in Construction Science and Management and has over 8 years of experience with software implementations, technology innovation, and corporate business systems.


text: The management team ensures the implementation of robust monitoring protocols for preventing, detecting, mitigating, and remediating cybersecurity threats. We use a 'defense in layers' approach which constitutes a cybersecurity strategy that involves the use of multiple types of securities measures, each designed to protect against a different vector of attack. As noted above, management is supported by third-party monitoring, next-generation hardware, and automated logging analysis. We utilize third parties for penetration testing and log evaluation, which provides 24/7 network monitoring to assist in rapid identification and mitigation of any suspicious network access. We maintain an Incident Response Plan, based on guidance within the National Institute of Standards and Technology's Computer Security Incident Handling Guide, which provides an escalation policy for identified security incidents. Our escalation policy details specific escalation processes by which senior leadership (Director of IT, Chief Financial Officer, and Chief Executive Officer) are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: iii. Reporting to the Board There is a structured reporting mechanism in place through which our Chief Financial Officer regularly updates our audit committee on cybersecurity risk management efforts, thus facilitating informed oversight by the board. Further, our Chief Financial Officer and IT personnel monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents in real time, and report such incidents to our audit committee and/or board of directors when appropriate.


text: Our board of directors, including through delegation to our audit committee, exercises oversight over cybersecurity risks and controls. Our audit committee and board of directors regularly receive updates (including, in the case of our audit committee, quarterly updates) from our Chief Financial Officer, Senior Director of Information Technology, and other members of management regarding the status of cybersecurity initiatives and the effectiveness of our internal control system related to information security. In connection with such updates, our board of directors and audit committee discuss our approach to cybersecurity risk management with management. Additionally, the audit committee periodically receives presentations from third-party cybersecurity experts to remain informed of developments in cyber risk and mitigation. Our board of directors and audit committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed.


text: Members of management report to our Chief Financial Officer who is the member of management that is principally responsible for overseeing our cybersecurity risk management program. Our Chief Financial Officer holds an undergraduate and graduate degree in economics and has over 15 years of experience with managing risks at the Company and in environments similar to the Company's, including risks arising from cybersecurity threats. Additionally, our Senior Director of IT has served in various roles in information technology and information security for over 24 years. Our Senior Director of IT holds an undergraduate degree in information technology and has attained the following professional certifications: CompTIA Network+, CompTIA Security+, and Microsoft Certified Professional. Further, our Director of Corporate Business Systems holds a Bachelor of Science degree in Construction Science and Management and has over 9 years of experience with software implementations, technology innovation, and corporate business systems.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including our CISO, Chief Compliance Officer and General Counsel. Our CISO, who reports to our General Counsel and has the primary responsibility for our cybersecurity risk assessment and management processes, has over a decade of experience as CISO for public companies, as well as in U.S. government security compliance, architecture and design, and systems and standards development.


text: The management team ensures the implementation of robust monitoring protocols for preventing, detecting, mitigating, and remediating cybersecurity threats. We use a 'defense in layers' approach which constitutes a cybersecurity strategy that involves the use of multiple types of securities measures, each designed to protect against a different vector of attack. As noted above, management is supported by third-party monitoring, next-generation hardware, and automated logging analysis. We utilize third parties for penetration testing and log evaluation, which provides 24/7 network monitoring to assist in rapid identification and mitigation of any suspicious network access. We maintain an Incident Response Plan, based on guidance within the National Institute of Standards and Technology's Computer Security Incident Handling Guide, which provides an escalation policy for identified security incidents. Our escalation policy details specific escalation processes by which senior leadership (Senior Director of IT, Chief Financial Officer, and Chief Executive Officer) are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and customer data ("Information Systems and Data").


text: Our information security and enterprise risk management function, led by our Chief Information Security Officer ("CISO") and Chief Compliance Officer ("CCO"), helps identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's information security risk register. The information security function helps to identify, assess, and mitigate risks from cybersecurity threats by monitoring and evaluating the relevant threat environment and the Company's security risk posture using various methods including, for example deploying manual and automated tools in certain environments and systems, subscribing to reports and services that identify certain cybersecurity threats, analyzing reports of certain cybersecurity threats and actors, conducting manual and automated scans of certain environments, evaluating our industry's risk profile, evaluating certain threats reported to us, coordinating with law enforcement concerning certain threats, conducting internal audits and threat assessments in certain environments and systems, conducting vulnerability assessments in certain environments and systems, and engaging third parties to assist with tabletop incident response exercises.


text: Depending on the results of the assessments and the sensitivity of the respective environments and systems, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, incident response plan, vulnerability management standard, disaster recovery and business continuity plans, risk assessments, encryption of certain data, segregation of certain data, network security and access controls in certain environments, asset management, systems monitoring in certain systems, vendor risk management program, employee training, penetration testing, and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. Cybersecurity risk is identified in our risk register, and our information security function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example professional services firms (including legal counsel), cybersecurity management consultants, cybersecurity software providers, penetration testing firms, and forensic investigators. We also use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and supply chain resources. We have a vendor management standard and underlying processes to manage cybersecurity risks associated with our use of these providers. The processes include risk assessments, security documentation reviews, and review of security questionnaires for certain vendors and security audits of certain vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under "Part I. Item 1A. Risk Factors" in this Form 10-K, including "If we or the third parties upon which we rely experience a cybersecurity breach or other security incident or unauthorized parties otherwise obtain access to our customers' data, our data or our Unified-CXM platform, our Unified-CXM platform may be perceived as not being secure, our reputation may be harmed, demand for our Unified-CXM platform may be reduced and we may incur significant liabilities."


text: Our CISO is responsible for hiring appropriate personnel, managing the security budget, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, providing security and security-related risk guidance to leadership relating to product management, development, and operations, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our incident response and crisis communications plans are designed to escalate certain cybersecurity incidents to members of the crisis management team depending on the circumstances, which includes our CISO, Chief Compliance Officer, General Counsel, corporate communications team and executive leadership as needed. This group works with our incident response team to help triage, contain, remediate, and recover from cybersecurity incidents of which they are notified. In addition, our incident response and crisis management plans include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from the CISO concerning any significant cybersecurity threats and risks and the processes we have implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Our information security and enterprise risk management function, led by the roles of Chief Information Security Officer ("CISO") and Chief Compliance Officer ("CCO"), helps identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's information security risk register. The information security function helps to identify, assess, and mitigate risks from cybersecurity threats by monitoring and evaluating the relevant threat environment and the Company's security risk posture using various methods including, for example deploying manual and automated tools in certain environments and systems, subscribing to reports and services that identify certain cybersecurity threats, analyzing reports of certain cybersecurity threats and actors, conducting manual and automated scans of certain environments, evaluating our industry's risk profile, evaluating certain threats reported to us, coordinating with law enforcement concerning certain threats, conducting internal audits and threat assessments in certain environments and systems, conducting vulnerability assessments in certain environments and systems, and engaging third parties to assist with tabletop incident response exercises.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under "Part I. Item 1A. Risk Factors" in this Form 10-K, including "If we or the third parties upon which we rely experience a cybersecurity breach or other security incident, any vulnerabilities are identified, or unauthorized parties otherwise obtain access to our customers' data, our data or our Unified-CXM platform, our Unified-CXM platform may be perceived as not being secure, our reputation may be harmed, demand for our Unified-CXM platform may be reduced and we may incur significant liabilities."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain roles within our management, including the roles of CISO, CCO and General Counsel ("GC"). The CISO role reports to our GC and is the role with the primary responsibility for our cybersecurity risk assessment and management processes. Our VP, Product Security, who reports to our GC and also supports the management team's cybersecurity risk assessment and management processes, has twenty years of cyber experience, as well as in product security, program development and software development. Additionally, as part of our governance of cybersecurity, if a role on the management team relevant to our cybersecurity risk assessment and management processes is or becomes vacant, another senior member of the applicable functional team is designated to support our cybersecurity risk assessment and management processes on an interim basis, as needed.


text: The CISO role is responsible for hiring appropriate personnel, managing the security budget, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, providing security and security-related risk guidance to leadership relating to product management, development, and operations, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our incident response and crisis communications plans are designed to escalate certain cybersecurity incidents to members of the crisis management team depending on the circumstances, which includes the following roles: CISO, CCO, GC, and the corporate communications team and executive leadership as needed. This group works with our incident response team to help triage, contain, remediate, and recover from cybersecurity incidents of which they are notified. In addition, our incident response and crisis management plans include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from management concerning any significant cybersecurity threats and risks and the processes we have implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk Management and Strategy Our cybersecurity risk management process is designed to identify and manage internal and external cybersecurity threats and vulnerabilities to and within our business and operations. Our cybersecurity program is integrated into our overall risk management systems, business continuity and crisis management programs, third-party risk management program, insurance risk management program, and employee compliance programs. Our cybersecurity program includes systems and processes such as, but not limited to, maintenance and monitoring of information security policies, implementation and maintenance of infrastructure security systems, programs and policies designed to promote employee awareness of cyber policies and practices (including implementing an annual process for employees to complete security awareness training in addition to new employee cybersecurity awareness training), information systems configuration management, use of third-party risk management systems, process to promote identity and information asset protection and cybersecurity threat operations with continuous monitoring. This program also includes processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers.

companyName: Evolus, Inc.

ticker: EOLS


text: We have developed an incident response plan designed to coordinate the activities that we and our third-party security service providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate any reputational damage. Additionally, as part of our overall risk management program, we maintain a global insurance portfolio with cybersecurity coverage.


text: To date, we do not believe that our business, results of operations and financial condition have been materially affected as a result of identified cybersecurity threats or incidents, including as a result of any previous cybersecurity incidents that we are aware of. However, we cannot provide assurance that we will not be materially affected in the future by such risks or any future cybersecurity incidents. For more information on our cybersecurity-related risks, please refer to the risk factor titled "We rely on our digital technology and applications and our business and operations could suffer in the event of information system failures or a cybersecurity incident" in Part I, Item 1A of this Report.


text: Our cybersecurity team is led by the SVP of IT and Operations, who reports to our Chief Financial Officer. Our SVP of IT and Operations and the cybersecurity team have over 25 years of experience managing and securing technology infrastructure. The cybersecurity team has responsibility for the planning and execution of our processes to manage cybersecurity and other information technology risks. The cybersecurity team also institutes and maintains controls for our systems, applications, and databases. Our management, with involvement and input from our Board of Directors, performs annual enterprise-wide cybersecurity assessments to identify and manage key existing and emerging risks for our company.


text: The Board of Directors receives periodic updates on our cybersecurity risks from our SVP of IT and Operations, which include risk assessments, areas of emerging risks, incidents and industry trends, and other areas of importance. These reports include updates on our progress preparing for, preventing, detecting, responding to and recovering from material cyber incidents, if any. In addition, as needed, management updates the Board of Directors regarding any material cybersecurity incidents.


text: To date, we do not believe that our business, including our business strategy,, results of operations, or financial condition have been materially affected, or are reasonably likely to be materially affected, as a result of identified cybersecurity threats or incidents, including as a result of any previous cybersecurity incidents that we are aware of. However, we cannot provide assurance that we will not be materially affected in the future by such risks or any future cybersecurity incidents. For more information on our cybersecurity-related risks, please refer to the risk factor titled "We rely on our digital technology and applications and our business and operations could suffer in the event of information system failures or a cybersecurity incident" in Part I, Item 1A of this Report.


text: Liberty Global and its subsidiaries are subject to risks from cyber-attacks that have the potential to cause significant interruptions to the operation of their businesses. The frequency of these attempted intrusions has increased in recent years and the sources, motivations and techniques of attack continue to evolve and change rapidly. Liberty Global has developed a cybersecurity program that is designed to scan for, monitor and identify risks to company confidential or non-public information, protect such information, detect threats and events and maintain an appropriate response and recovery capability to help ensure resilience against cyber-attacks and other information security incidents. We have adopted a variety of measures to monitor and address cyber-related risks and continue to implement and explore additional cybersecurity measures.

companyName: Liberty Global Ltd.

ticker: LBTYA


text: Our strategy for managing cyber-related risks is risk-based and, where appropriate, integrated within our comprehensive enterprise risk management processes. Liberty Global's Chief Security Officer (CSO), who reports directly to Liberty Global's Chief Technology Officer (CTO), leads a dedicated cybersecurity team and is responsible for the design, implementation and execution of our cyber-risk management strategy.


text: Management's Responsibilities The Company's information security program is led by our corporate Chief Information Security Officer ("CISO"), who works closely in a cross-functional capacity with key corporate and operational business stakeholders. The individuals supporting the Company's information security program demonstrate their cybersecurity expertise through qualifications such as prior work experience, possession of a cybersecurity certification, degree, or other cybersecurity experience. The CISO collaborates with these functions for the purpose of establishing processes and procedures to monitor potential cybersecurity risks, identifying cybersecurity incidents, implementing appropriate mitigation measures, reporting cybersecurity breaches, assessing materiality, and other information security incidents, and maintaining our cybersecurity program. The CISO provides regular updates on the Company's cybersecurity posture and preparedness to senior management.

companyName: Science Applications International Corp

ticker: SAIC


text: 2.Threat Intelligence Monitoring: We continuously monitor threat intelligence sources to stay abreast of emerging cyber threats and trends. This proactive approach enables us to anticipate potential risks and take preemptive measures to mitigate them.


text: Our CSO and cybersecurity team actively monitor Liberty Global's systems, regularly review its policies, compliance, regulations and best practices, perform penetration testing, conduct incident response exercises and internal ethical phishing campaigns and provide periodic training and communication across the organization to strengthen secure behavior and foster a culture of digital security. The cybersecurity team also routinely participates in industry-wide programs to further information sharing, intelligence gathering and unity of effort in responding to potential or actual attacks. Liberty Global also periodically reviews its business continuity plan to develop an effective recovery strategy that seeks to decrease incident response times, limit financial impacts and maintain customer confidence during any business interruption. Our cybersecurity team also administers a third-party risk governance program that identifies potential risks introduced through third-party relationships, such as vendors, software and hardware manufacturers or professional service providers. Liberty Global also seeks to obtain certain contractual security guarantees and assurances with these third-party relationships to help ensure the security and safety of its information. The cybersecurity team works closely with a broad range of departments, including legal, regulatory, corporate communications, audit services, information technology and operational technology functions critical to Liberty Global's operations, as well as engages external vendors to help ensure its cybersecurity program operates effectively.


text: Liberty Global's current CSO has significant experience leading cybersecurity efforts at large enterprises, having held top information security positions at a number of international large- and mega-cap companies during her career. She also holds a master of science in security risk management and is qualified as a certified information security manager with the Information Systems Audit and Control Association. Our CSO has been with the company or its subsidiaries for over five years.


text: Cybersecurity incidents detected by Liberty Global's cybersecurity team are evaluated internally based on their severity, with more serious incidents being escalated, as appropriate, to the highest levels of management, including the company's CTO, General Counsel, and, ultimately, its CEO. These members of the company's executive leadership team are provided with details of the type and severity of the attack, the company's planned response to the incident and are briefed on what information was accessed and the impact such incident has had or is expected to have on the company's operations, as well as any financial or regulatory implications resulting from the incident.


text: Our Audit Committee is responsible for oversight of our cybersecurity measures, incident response management and risks related to cybersecurity and technology as well as the steps taken by management to mitigate such risks. Liberty Global's CSO provides periodic updates to the Audit Committee on the state of Liberty Global's cybersecurity posture, new threats or threat actors that the company is monitoring or developing defenses against and any potential areas of improvement. Our CEO, CTO, CSO and General Counsel will also provide ad hoc updates to the Audit Committee and full board of directors, as appropriate, in the case of a material cybersecurity incident, providing them a full briefing of the type and scope of the incident as well as the company's current and planned mitigation efforts. The Audit Committee has several members with significant direct and indirect cybersecurity experience, including Anthony Werner, the former CTO of Comcast Cable and the company, Paul Gould and Miranda Curtis CMG. Cybersecurity and the effectiveness of our cybersecurity strategy are regular topics of discussion at meetings of our Audit Committee and board of directors.


text: Liberty Global and its subsidiaries are subject to risks from cyber-attacks that have the potential to cause significant interruptions to the operation of their businesses. The frequency of these attempted intrusions has increased in recent years and the sources, motivations and techniques of attack continue to evolve and change rapidly. We have developed a cybersecurity program that is designed to scan for, monitor and identify risks to our confidential or non-public information, protect such information, detect threats and events and maintain an appropriate response and recovery capability to help ensure resilience against cyber-attacks and other information security incidents. We have adopted a variety of measures to monitor and address cyber-related risks and continue to implement and explore additional cybersecurity measures.


text: Our strategy for managing cyber-related risks is risk-based and, where appropriate, integrated within our comprehensive enterprise risk management processes. Our Chief Security Officer (CSO), who reports directly to our Chief Technology Officer (CTO), leads a dedicated cybersecurity team and is responsible for the design, implementation and execution of our cyber-risk management strategy.