text: Cybersecurity Program Overview FLIAC prioritizes the security of its electronic information systems and the data residing therein. In order to respond to the risks posed by a variety of cybersecurity threats, including security breaches, cyber-attacks, and other cybersecurity incidents, FLIAC has implemented a Cybersecurity Program (the "Program") managed by our Chief Information Security Officer ("CISO") and the CISO's Information Security Team. The Program is designed to protect and preserve the confidentiality, integrity, and continued availability of the electronic information systems that we own or use, and all electronic information owned by or in the care of the Company. The Program is based on industry leading frameworks including the National Institute of Standards and Technology ("NIST") Cyber Security Framework ("CSF") and NIST 800-53. The NIST CSF provides standards, guidelines, and best practices on managing cybersecurity risk and for the organization, improvement, and assessment of the Program.

companyName: FORTITUDE LIFE INSURANCE & ANNUITY CO


secItem: Item 1C


text: The Program governs all FLIAC internal systems, as well as third parties providing service to the Company, and is based on the following five pillars: • Identify - The first pillar of the Program is to identify the organization's critical assets, vulnerabilities, and potential threats. This involves conducting a thorough quantitative and qualitative risk assessment and asset inventory based on the organization's information systems, data repositories, and network infrastructure. Additionally, it involves categorizing and classifying the importance of different assets, assessing their potential impact on the organization if compromised, and identifying applicable regulatory compliance requirements. This pillar of the Program also involves regular engagement with the broader security community and monitoring of new and emerging cyber threat information. • Protect - After identifying the assets and vulnerabilities, FLIAC applies comprehensive asset protection methods allowing for accurate risk mitigation techniques. This includes deploying a range of security controls such as firewalls, intrusion detection systems, antivirus software, encryption mechanisms, and access controls. The goal is to establish multiple layers of defense to prevent unauthorized access, data breaches, cyber-attacks, and other cybersecurity incidents. Employee awareness training (including phishing simulation exercises to train employees to recognize and report phishing attacks) and secure coding practices also fall under this component to ensure a culture of security throughout the Company. • Detect – The Program focuses on the timely detection of any suspicious activities or security breaches. This involves implementing security monitoring systems, intrusion detection systems, and log analysis tools to continuously monitor network traffic, system logs, and user behavior. Real-time alerts and security incident management processes help in identifying potential security incidents promptly. • Respond – If a security incident is detected, a response plan is triggered to minimize the impact and contain the threat. This component involves establishing an incident response team and defining incident response procedures. The team is trained to respond promptly, investigate the incident, mitigate the damage or harm, and restore normal operations. Communication plans, escalation protocols, legal considerations, regulatory requirements, (including appropriate and timely reporting and disclosure of cybersecurity incidents to regulators and affected individuals), and coordination with external entities, like regulators, law enforcement, vendors and other key stakeholders, are also part of the response process. • Recover - The final pillar of the Program focuses on recovering from a security incident and restoring normal operations. This includes activities such as system restoration, data recovery, and analyzing the incident to identify lessons learned and improve future incident response capabilities. It also involves assessing residual risks, updating security controls, and continuously monitoring and testing the Company's security posture to ensure readiness for potential future incidents.

stage1Category: Risk Management Process

stage1Method: unanimous


text: The Program governs all FLIAC internal systems, as well as third parties providing service to the Company, and is based on the following five pillars: • Identify - The first pillar of the Program is to identify the organization's critical assets, vulnerabilities, and potential threats. This involves conducting a thorough quantitative and qualitative risk assessment and asset inventory based on the organization's information systems, data repositories, and network infrastructure. Additionally, it involves categorizing and classifying the importance of different assets, assessing their potential impact on the organization if compromised, and identifying applicable regulatory compliance requirements. • Protect - After identifying the assets and vulnerabilities, FLIAC applies comprehensive asset protection methods allowing for accurate risk mitigation techniques. This includes deploying a range of security controls such as firewalls, intrusion detection systems, antivirus software, encryption mechanisms, and access controls. The goal is to establish multiple layers of defense to prevent unauthorized access, data breaches, cyber-attacks, and other cybersecurity incidents. Employee awareness training and secure coding practices also fall under this component to ensure a culture of security throughout the Company. • Detect – The Program focuses on the timely detection of any suspicious activities or security breaches. This involves implementing security monitoring systems, intrusion detection systems, and log analysis tools to continuously monitor network traffic, system logs, and user behavior. Real-time alerts and security incident management processes help in identifying potential security incidents promptly. • Respond – If a security incident is detected, a response plan is triggered to minimize the impact and contain the threat. This component involves establishing an incident response team and defining incident response procedures. The team is trained to respond promptly, investigate the incident, mitigate the damage or harm, and restore normal operations. Communication plans, legal considerations, regulatory requirements, and coordination with external entities, like regulators, law enforcement, vendors and other key stakeholders, are also part of the response process. • Recover - The final pillar of the Program focuses on recovering from a security incident and restoring normal operations. This includes activities such as system restoration, data recovery, and analyzing the incident to identify lessons learned and improve future incident response capabilities. It also involves assessing residual risks, updating security controls, and continuously monitoring and testing the Company's security posture to ensure readiness for potential future incidents.


text: Cybersecurity risk management under the Program is an integrated part of the Company's overall management of operational risk, as described further below under "Cybersecurity Risk Management Governance." The Company did not experience any material cybersecurity incidents during the period covered by this report. Nor did the Company identify any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, the Company recognizes that cybersecurity risks are constantly evolving, and the Company continuously monitors and adapts to these risks to protect its systems and data. It is possible that the Company will experience a material cybersecurity incident in the future. For more information on operational and cybersecurity risks, see "Item 1A. Risk Factors – Operational Risk" earlier in this report.

stage1Category: Strategy Integration


text: Vendor Risk Management The Program seeks to ensure that each vendor (or third-party service provider) with whom the Company does business meets the Company's standards for protecting and preserving the confidentiality, integrity, and continued availability of electronic information systems and data. The Company requires vendors to meet threshold requirements for cybersecurity controls, such as access controls, logging and monitoring, and encryption. The Company's contracts with vendors require the implementation and maintenance of such controls, and obligate vendors to promptly report all cybersecurity incidents to the Company. Based on the overall risk level associated with a particular vendor, the Company's contract with a service provider may require enhanced or heightened controls. The CISO's Information Security Team performs risk-based initial and periodic due diligence of vendors, during which the Information Security Team evaluates, assesses, and otherwise reviews vendor cybersecurity controls. The results of such reviews are reported to the CISO. Any cybersecurity incidents involving vendors will be escalated and acted upon in accordance with the Program.

stage1Category: Third-Party Risk


text: Cybersecurity Risk Management Governance The CISO is responsible for managing the Program. The CISO reports to the Company's Chief Information Officer and regularly engages with the Chief Risk Officer on matters related to the Program. Cybersecurity risks are evaluated by Company management alongside and consistent with other operational risks, with the CISO and the Information Security Team providing subject matter expertise on the identification, assessment, and tracking of cybersecurity risks under the Program. In addition, the Company regularly engages external consultants in connection with evaluating and enhancing the Program and the Company's overall management of cybersecurity threats. For example, the Company engages external consultants to assist the Company in identifying evolving technologies and threats, developing action plans, performing penetration tests, conducting exercises, and conducting periodic reviews.

stage1Category: Management Role


text: The Board of Directors (the "Board") is responsible for oversight of the Company's management of operational risks, including cybersecurity threats. The Board receives a comprehensive report at least annually from the Chief Information Officer and the CISO. The comprehensive annual report covers matters related to the Program, such as enhancements, incident reporting, performance metrics, status reports, oversight of third-party service providers, and the results of Program reviews, including exercises and response readiness assessments led by external consultants. The report also includes information about significant and emerging cybersecurity threats that may affect the Company. In addition to a comprehensive annual cybersecurity report, the Board receives periodic interim reports from the Chief Information Officer and the CISO. To the extent cybersecurity controls are related to internal controls over financial reporting, such controls are also considered in the context of Management's annual assessment of the effectiveness of internal controls over financial reporting.

stage1Category: Board Governance


text: The CISO, supported by the Information Security Team, is responsible for implementing and managing the Program. The CISO has served in various roles in information technology and information security for over 25 years and has broad and extensive experience in multiple industries including financial services, healthcare, and higher education. The CISO holds a graduate degree in IT management and has attained the professional certifications of Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Boardroom Certified Qualified Technology Expert (QTE), and is a Distinguished Fellow with the Information Systems Security Association (ISSA).

stage1Method: majority


text: Risk Assessment and Management Our approach to managing material risks from cybersecurity threats, which is informed in part by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework (though we do not imply that we meet any particular technical standards, specifications or requirements), is designed to detect, identify, respond to, recover from and protect from cybersecurity incidents.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: Our security governance function, which includes key employees who work in Information Security, Legal, and Privacy teams such as our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"), are responsible for establishing and implementing cybersecurity policies and procedures, which includes developing and updating our enterprise incident response plan ("IRP"), managing incident response, and overseeing any policy exceptions and potential compensating controls.


text: Additionally, we assess our cybersecurity maturity annually using the NIST framework and implement and maintain controls that are designed to evaluate and improve our cybersecurity program, such as vulnerability assessments and penetration tests, as needed. We also execute employee cybersecurity training and awareness programs around various key cybersecurity topics including reporting incidents, phishing, ransomware, remote working, cloud security, privileged access, and removable media.


text: Our process for assessing, identifying, and managing material risks from cybersecurity threats is integrated into our overall risk management process. We have a robust enterprise risk management ("ERM") program that plays an important role in seeking to manage and address existing and emerging risks, including cybersecurity risks, which are critical to our overall business goals and objectives. The ERM team updates our CEO and his leadership team on cybersecurity risks as well as their potential impact, likelihood, potential mitigation plan, and status.


text: Incident Response We have a dedicated Information Security team responsible for managing and coordinating incident response efforts. This team collaborates closely with other teams within the company, including teams within information technology ("IT"), Legal and Privacy, in identifying, analyzing, and responding to cybersecurity incidents, which includes tracking cybersecurity incidents to help identify any related incidents. When cybersecurity incidents are identified, our practice is to respond to and address them utilizing incident classifications and escalation protocols, in accordance with applicable governmental regulations and other legal requirements.


text: We have an IRP to prepare for and respond to cybersecurity incidents. The process is tested in annual tabletop exercises to help identify strengths and areas for improvement.


text: Engagement of Third Party Advisors We engage third party advisors, including assessors, cybersecurity consultants, and auditors to assess, validate, and enhance our cybersecurity program. We benefit from engaging third parties to provide specialized skills, knowledge, tools, and resources. These third parties also help reduce costs, increase efficiency, improve quality, mitigate risks, and review cybersecurity strategy, trends, and threat landscape.


text: Third-Party Service Provider Risk Management We have a process in place to oversee and identify risks from cybersecurity threats associated with our use of key third-party service providers during the course of engagement. The company uses an external risk management software program to identify, assess, monitor and mitigate risks associated with third-party relationships, including cybersecurity risks. Our vendor security assessment process evaluates key vendors and, where appropriate, assesses vendor's controls for IT security, privacy, business continuity, and other third-party risks. Following an evaluation, the company determines and prioritizes risks based on their potential impact, which help inform the appropriate level of additional due diligence and ongoing compliance monitoring. The third-party risk assessment is a cross-functional effort involving our end-user, Legal, Privacy, and Information Security teams.


text: Material Risks from Cybersecurity Threats The company has not identified any risks from cybersecurity threats that have materially affected us. We do not believe that risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, over the long term. Like many companies, we have experienced cybersecurity incidents, including data breaches and temporary service interruptions. However, as of the end of 2023, known cybersecurity incidents, individually or in aggregate, have not had a material impact. Nevertheless, there can be no assurance that our efforts in response to cybersecurity incidents, as well as our investments to protect our IT infrastructure and data, will shield us from significant losses, brand and reputational harm and potential liability or prevent any future interruption or breach of our systems. Such cybersecurity incidents can cause the loss of critical or sensitive information, including personal information, and could give rise to legal liability and regulatory action under data protection and privacy laws. For additional information on cybersecurity risks we face, see Part I, Item 1A. Risk Factors of this Annual Report on Form 10-K under the heading "Information system service interruptions or breaches, including significant cybersecurity incidents, could give rise to legal liability and regulatory action under data protection and privacy laws and adversely affect our business and operations."


text: Cybersecurity Governance Board Oversight of Risks from Cybersecurity Threats Our Board of Directors plays an important role in overseeing cybersecurity risks. Our Board of Directors has established an oversight structure for monitoring the effectiveness of and risks related to the cybersecurity program. Designated by the Board to oversee cybersecurity and information technology risks, the Audit Committee receives quarterly cybersecurity updates from our CISO, and the chair of the Audit Committee meets with the CISO individually on a quarterly basis. These updates often address topics such as ongoing efforts to improve our cybersecurity posture, operational metrics, incident metrics, and mitigation actions, and may include key metrics such as those related to cybersecurity maturity, risk reduction, cybersecurity program health, and audit and compliance activities. The Audit Committee updates the Board on its activities at each regularly scheduled Board meeting. Risks related to cybersecurity events are provided to the Board on an annual basis as part of an overall ERM update. In addition to this regular reporting, significant cybersecurity risks may also be escalated on an as-needed basis through the company's organizational structure in accordance with the IRP.


text: Roper deploys cybersecurity practices and tools across all of its businesses to protect data, maintain resilient operations, and limit the impact of cybercrime. We deploy a Managed Detection and Response ("MDR") solution across all of our business units and our Corporate infrastructure designed to address the detection, response, and remediation effectiveness of cybersecurity threats. This solution is intended to provide real-time visibility of the endpoint footprint across the enterprise, including patch management and vulnerabilities, device encryption, and cybersecurity threats and detections.

companyName: ROPER TECHNOLOGIES INC

ticker: ROP


text: Management's Role in Assessing and Managing Materials Risks from Cybersecurity Threats Under the IRP, cybersecurity incidents are escalated based on a defined incident severity to management as appropriate. Management, including the CIO and CISO, is involved in assessing and managing our cybersecurity risks. The CISO reports to the CIO (who in turn reports to our Chief Financial Officer, who in turn reports to the CEO), and both the CIO and CISO participate in global leadership team meetings. With over 26 years of experience, including over three years with the company, the CIO has been recognized externally for his leadership in technology innovation in the industry, and provides strategic leadership for the company's IT organization. The CISO has over 30 years of IT and cybersecurity experience in large biopharmaceutical, life sciences, financial and technology industries, including over ten years with the company, and is responsible for managing the security architecture, engineering, technology operations, monitoring, incident response, risk, governance, quality and compliance at the company.


text: The company's Information Security function is comprised of teams that engage in a range of cybersecurity activities such as security operations, security engineering, data privacy controls, validation, compliance, and audit readiness. Leaders of each team are expected to collaborate to help increase visibility of key issues and alignment with strategy. As noted above, the company's IRP includes standard processes for escalating significant cybersecurity incidents to management, including the CISO. The company's incident response team also coordinates with external legal advisors, cybersecurity forensic firms, communication specialists, and other outside advisors and experts, as appropriate.


text: Risk Assessment and Management We manage material risks from cybersecurity threats through a cross-functional and layered approach that is designed to detect, identify, respond to, recover from and protect from cybersecurity incidents and is informed by industry recognized standards.


text: Our security governance function, which includes key employees who work in Information Security, Legal, and Privacy teams, such as our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"), are responsible for establishing and implementing cybersecurity policies and procedures, which includes developing and updating our enterprise Incident Response Plan ("IRP"), managing incident response, and overseeing any policy exceptions and potential compensating controls.


text: Additionally, we assess our cybersecurity maturity annually and implement and maintain controls that are designed to evaluate and improve our cybersecurity program, such as vulnerability assessments and penetration tests, as needed. We also execute employee cybersecurity training and awareness programs around various key cybersecurity topics, including reporting incidents, phishing, ransomware, remote working, cloud security, privileged access and removable media.


text: Our process for assessing, identifying and managing material risks from cybersecurity threats is integrated into our overall risk management process. We have a robust enterprise risk management ("ERM") program that plays an important role in seeking to manage and address existing and emerging risks, including cybersecurity risks, which are critical to our overall business goals and objectives. The ERM team updates our Chief Executive Officer ("CEO") and his leadership team on cybersecurity risks as well as their potential impact, likelihood, potential mitigation plan and status.


text: Engagement of Third-Party Advisors We engage third-party advisors, including assessors and cybersecurity consultants, to assess, validate and enhance our cybersecurity program. We benefit from engaging third parties to provide specialized skills, knowledge, tools and resources. These third parties also help reduce costs, increase efficiency, improve quality, mitigate risks and review cybersecurity strategy, trends and threat landscape.


text: Incident Response We have a dedicated Information Security team responsible for managing and coordinating incident response efforts. This team collaborates closely with other teams within the company, including teams within information technology ("IT"), Legal and Privacy, in identifying, analyzing and responding to cybersecurity incidents, which includes tracking cybersecurity incidents to help identify any related incidents. When cybersecurity incidents are identified, our practice is to respond to and address them utilizing incident classifications and escalation protocols, in accordance with applicable governmental regulations and other legal requirements. Where necessary or appropriate, we also engage third-party advisors to assist in the incident response process.


text: We have an IRP to prepare for and respond to cybersecurity incidents. Our IRP processes are tested in annual tabletop exercises to help identify strengths and areas for improvement. Under the IRP, cybersecurity incidents are escalated based on a defined incident severity to management as appropriate.


text: The Cybersecurity Program includes controls designed to identify and perform diligence on third parties as they are leveraged by Roper's businesses in their respective software code development processes or for other purposes that require third-party access to critical infrastructure. The controls include, as appropriate, regularly assessing management of access controls and the cybersecurity risks posed by third parties.


text: Third-Party Service Provider Risk Management We have a process in place to oversee and identify risks from cybersecurity threats associated with our use of key third-party service providers during the course of engagement. The company uses an external risk management software program to identify, assess, monitor and mitigate risks associated with third-party relationships, including cybersecurity risks. Our vendor security assessment process evaluates key vendors and, where appropriate, assesses vendor's controls for IT security, privacy, business continuity and other third-party risks. Following an evaluation, the company determines and prioritizes risks based on their potential impact, which helps inform the appropriate level of additional due diligence and ongoing compliance monitoring. The third-party risk assessment is a cross-functional effort involving our end-user, Legal, Privacy and Information Security teams.


text: Material Risks from Cybersecurity Threats Like many companies, we face cybersecurity threats and have experienced cybersecurity incidents, including data breaches and temporary service interruptions. However, since the beginning of fiscal year 2024, the company has not identified risks from known cybersecurity threats or incidents that have materially affected us or are reasonably likely to materially affect us. Nevertheless, there can be no assurance that our efforts in response to cybersecurity incidents, as well as our investments to protect our IT infrastructure and data, will shield us from significant losses, brand and reputational harm and potential liability or prevent any future interruption or breach of our systems. Such cybersecurity incidents can cause the loss of critical or sensitive information, including personal information, and could give rise to legal liability and regulatory action under data protection and privacy laws. For additional information on cybersecurity risks we face, see Part I, Item 1A. Risk Factors of this Annual Report on Form 10-K under the heading "Information system service interruptions or breaches, including significant cybersecurity incidents, could give rise to legal liability and regulatory action under data protection and privacy laws and adversely affect our business and operations."


text: Cybersecurity Governance Board Oversight of Risks from Cybersecurity Threats Our Board of Directors plays an important role in overseeing cybersecurity risks. Our Board of Directors has established an oversight structure for monitoring the effectiveness of and risks related to the cybersecurity program. The Audit Committee has been designated by the Board to oversee cybersecurity and information technology risks. The Audit Committee receives quarterly cybersecurity updates from our CISO, and the chair of the Audit Committee meets with the CISO individually on a quarterly basis. These updates often address topics such as ongoing efforts to improve our cybersecurity posture, operational metrics, incident metrics and mitigation actions, and may include key metrics such as those related to cybersecurity maturity, risk reduction, cybersecurity program health, and audit and compliance activities. The Audit Committee updates the Board on its activities at each regularly scheduled Board meeting. Updates related to cybersecurity are provided to the Board on an annual basis as part of an overall ERM update. In addition to this regular reporting, significant cybersecurity events may also be escalated on an as-needed basis through the company's organizational structure in accordance with the IRP.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Our CISO, supported by a cross-functional team, has primary responsibility for assessing and managing our cybersecurity program and the related risks. Details of the risk management and escalation processes are discussed in "Cybersecurity Risk Management and Strategy" above. The CISO has over 30 years of IT and cybersecurity experience in large biopharmaceutical, life sciences, financial and technology industries, including over ten years with the company, and is responsible for managing the security architecture, engineering, technology operations, monitoring, incident response, risk, governance, quality and compliance at the company.


text: The company's Information Security function is comprised of teams that engage in a range of cybersecurity activities such as security operations, security engineering, data privacy controls, validation, compliance and audit readiness. Leaders of each team are expected to collaborate to help increase visibility of key issues and alignment with strategy. As noted above, the company's IRP includes standard processes for escalating significant cybersecurity incidents to management, including the CISO. The company's incident response team also coordinates with external legal advisors, cybersecurity forensic firms, communication specialists, and other outside advisors and experts, as appropriate.


text: Risk Management and Strategy We have processes in place for assessing, identifying, and managing risks from cybersecurity threats that may result in material adverse effects to the confidentiality, integrity and availability of our systems, operations and data. These processes are a part of our overall risk assessment process. Risks from cybersecurity threats include, among other things, unauthorized access, data theft, computer viruses, ransomware, malicious software and other disruptions. We have implemented systems and processes utilizing a multilayered, proactive approach to identify, evaluate, mitigate and prevent potential cybersecurity threats. Each of these layers contain multiple levels of protection and leverage industry standard framework including the National Institute of Standards and Technology (NIST) Cybersecurity Framework. At the management level, these systems and processes are overseen primarily by our Chief Information Officer (CIO) and our Cyber Security Risk Officer (CSRO).

companyName: HORTON D R INC /DE/

ticker: DHI


text: Roper performs cybersecurity risk assessments to assess compliance with mandated cybersecurity controls and to assess the likelihood and impact of specific cyberattacks. Cybersecurity risk assessments are periodically performed to assess the internal compliance with cybersecurity strategy and implementation of cybersecurity controls. Areas identified for enhancement and improvement are monitored and tracked to remediation by the Roper Cyber team, including the Vice President of Cybersecurity.


text: We have implemented processes to assess, identify, and manage risks from cybersecurity threats, including the following: • Muti-factor Authentication: We secure access to our network and systems through multi-factor authentication. • Layered Email Protection: We have adopted a layered approach to email protection. • Zero-Trust Security Model: We are working towards a zero-trust security model, utilizing group-based access controls to manage network resources. • Continuous Monitoring: We continuously monitor our systems for security anomalies, to help enable early detection of issues and facilitating a rapid response. • Regular Scans: We conduct weekly and monthly scans to identify and prioritize the mitigation of the most critical vulnerabilities. • Quarterly Penetration Testing: We engage third-party consultants to perform quarterly penetration testing, examining our environment from various perspectives, including end-user and employee use cases, to thoroughly assess system vulnerabilities. • Collaborative Evaluation and Remediation: In collaboration with our third-party consultants, we evaluate the outcomes of our testing, address and remediate any identified issues, and subsequently re-test the environment to confirm that the mitigations have effectively resolved the vulnerabilities. • Regular Assessments and Gap Analyses: Our cybersecurity team regularly meets with the third-party consultants to assess overall risk and conduct gap analyses, ensuring the effectiveness of our current cybersecurity measures. • Comprehensive Risk Assessment: Our comprehensive risk assessment includes evaluating potential security risks associated with the use of external service providers. • Incident Response Readiness: We maintain a documented incident response readiness process that details the procedures to follow in the event of a security incident. • Data Backup: We maintain comprehensive backups of all system files to facilitate data recovery during a security incident. In addition to the above-described technology controls, we have implemented mandatory training and awareness programs designed to educate our employees on cybersecurity risks. These include periodic exercises to help employees identify phishing schemes and other social engineering tactics, and we provide various methods for them to report suspicious activity that may give rise to a cybersecurity incident.


text: To date, we have not identified any risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, because the sophistication of cybersecurity threats continues to increase with rapidly evolving techniques to overcome security measures, the preventative actions we have taken and will continue to take to reduce the risks may not successfully protect our systems against a future cybersecurity incident. For more information on how cybersecurity risk could materially affect our business, please refer to Item 1A, "Risk Factors."


text: Our Board considers cybersecurity and other information technology risk as part of its risk oversight function. The members of our Board receive reports on our cybersecurity risks and risk management on at least an annual basis from our CIO and CSRO. These reports include reviewing current trends, processes and systems used to mitigate the risk of cybersecurity threats. Our internal audit department also conducts cybersecurity reviews as part of its audit procedures and presents any findings to the Board. We have protocols by which certain cybersecurity incidents would be escalated within the Company and, where appropriate, reported to the Board in a timely manner.


text: We invest a considerable amount of resources in training, tools and other resources to manage risks from cybersecurity threats. Our cybersecurity program is led by an experienced team that creates cybersecurity policies and procedures and possesses expert knowledge related to controls and safeguards related to cybersecurity. Led by our CIO, our cybersecurity team is responsible for assessing and managing risks from cybersecurity threats. The CIO receives reports on cybersecurity threats from the cybersecurity team on an ongoing basis and in conjunction with the CSRO, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CIO and CSRO work closely with our legal team to oversee compliance with legal, regulatory and contractual security requirements.


text: Our CIO has more than 35 years of experience working in information technology including roles in the commercial software development, healthcare, industrial and professional services sectors. While in those roles, our CIO has led governance, risk, and compliance technology programs and information security programs. The CIO currently reports to the CFO.


text: Our CSRO has more than 23 years of experience working in information technology and cybersecurity roles including software development, identity and access management projects, privilege account management and multi-factor authentication implementations. While in those roles, our CSRO has led projects and implementations for a variety of organizations that assess and create solutions for security concerns. The CSRO currently reports to the CIO.


text: Supporting the CIO and CSRO is a dedicated cybersecurity team that designs and monitors our cybersecurity control framework as well as implements cybersecurity control systems and solutions. Our cybersecurity team collectively holds the following degrees and certifications: Master's in Cybersecurity, Certified Information Systems Security Professional, Security+, Network+, AQS Certified Cloud Practitioner and Certified Information Systems Auditor.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: InvenTrust Properties Corp.

ticker: IVT


text: Our CIO has 36 years of experience working in information technology including roles in the commercial software development, healthcare, industrial and professional services sectors. While in those roles, our CIO has led governance, risk, and compliance technology programs and information security programs. The CIO currently reports to the CFO.


text: Our CSRO has 24 years of experience working in information technology and cybersecurity roles including software development, identity and access management projects, privilege account management and multi-factor authentication implementations. While in those roles, our CSRO has led projects and implementations for a variety of organizations that assess and create solutions for security concerns. The CSRO currently reports to the CIO.


text: Roper's Cybersecurity Program Roper maintains a global Cybersecurity Program that outlines required cybersecurity controls for all Roper businesses. Given the decentralized nature of Roper's operating model, day-to-day management and implementation of the Cybersecurity Program and deployment of the program's cybersecurity controls are managed locally by each of Roper's 27 business units. In addition, because Roper's businesses generally operate independently and maintain separate infrastructure and systems, the risk of an enterprise-wide cybersecurity incident is somewhat reduced. While cybersecurity technologies and implementation may differ based on the needs and risk profile of each individual business, Roper has also implemented cyber tools and managed services to centrally monitor certain aspects of the Cybersecurity Program.


text: The Cybersecurity Program is supervised by Roper's Vice President of Cybersecurity, who has related experience including cybersecurity, IT, Cloud, and Security Compliance. The Vice President of Cybersecurity has obtained a B.S. in Management Information Systems, a Master's in Business Administration, and a Master's in Management Information Systems. She also maintains the following industry cybersecurity certifications: CISA, CISSP, GSEC, GCED, GSA, and a Boardroom Certified Qualified Technology Expert (QTE).


text: We maintain a centralized incident response process with a forensic partner on retainer. In addition, we have cybersecurity insurance policies in place. Roper maintains a Cybersecurity Incident Response Plan ("CSIRP"), which requires each Roper business to designate a Cybersecurity Incident Response Team ("CSIRT") that is responsible for receiving, reviewing, and responding to cybersecurity incident reports and activities. Cybersecurity incidents are required to be promptly reported to Roper, and such incidents and their resolution are then closely monitored by Roper's cybersecurity team. We work on security awareness with our employees throughout the year with cybersecurity training and simulated phishing campaigns to better identify and report unusual behavior and to mitigate the likelihood and impact of possible incidents.


text: Cybersecurity Governance Our Board of Directors (the "Board") has not delegated responsibility for cybersecurity matters to a committee. Rather, the Board believes that due to the importance and continually evolving nature of cybersecurity threats, all members of the Board should participate in the oversight of these topics. As a result, management briefs the Board on cybersecurity matters during regularly scheduled Board meetings. Roper's Vice President of Audit Services also periodically briefs the Audit Committee on cybersecurity matters and related risks, as needed.


text: Roper has also established a Cyber Disclosure Committee chaired by the Vice President of Cybersecurity to track and evaluate cybersecurity incidents and to assess their potential impact on the organization. This process builds upon the CSIRP and provides a framework for Roper management to monitor potentially material cyber incidents. The Cyber Disclosure Committee reports its activities and findings, as appropriate, to the Chief Executive Officer, Chief Financial Officer, Principal Accounting Officer, and General Counsel, and, if appropriate, to the Board of Directors.


text: To date, management has not identified risks from cybersecurity incidents, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Roper, including its business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors, We rely on information and technology, including third-party cloud computing platforms, for many of our business operations which could fail and cause disruption to our business operations." above for more information. While we work to maintain our Cybersecurity Program, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks, and data or those of our third-party providers.


text: Roper's Cybersecurity Program Roper maintains a global Cybersecurity Program supervised by the Vice President of Cybersecurity that outlines required cybersecurity controls for all Roper businesses. Given the decentralized nature of Roper's operating model, day-to-day management and implementation of the Cybersecurity Program and deployment of the program's cybersecurity controls are managed locally by each of Roper's 28 business units, including localized information security management. In addition, because Roper's businesses generally operate independently and maintain separate infrastructure and systems, we believe the risk of an enterprise-wide cybersecurity incident is somewhat reduced. While cybersecurity technologies and implementation may differ based on the needs and risk profile of each individual business, Roper has also implemented cybersecurity tools and managed services to centrally monitor certain aspects of the Cybersecurity Program.


text: Roper deploys cybersecurity practices and tools across all of its businesses designed to protect data, maintain resilient operations, and limit the impact of cybercrime. We deploy a Managed Detection and Response solution across all of our business units and our Corporate infrastructure designed to address the detection, response, and remediation effectiveness for cybersecurity threats. This solution is intended to provide real-time visibility of the endpoint footprint across the enterprise, including patch management and vulnerabilities, device encryption, and cybersecurity threats and detections. Additionally, this solution is designed to provide real-time monitoring of identity-based attacks, as well as monitoring of the deep, dark and social webs for cybersecurity threats targeting Roper's businesses.


text: The Cybersecurity Program includes controls designed to oversee and identify risks from cybersecurity threats associated with third parties as they are leveraged by Roper's businesses in their respective software code development processes or for other purposes that require third-party access to critical infrastructure. The controls include, as appropriate, regularly assessing management of access controls and the cybersecurity risks posed by third parties.


text: Roper performs cybersecurity risk assessments to assess compliance with mandated cybersecurity controls and to assess the likelihood and impact of specific cyberattacks. Cybersecurity risk assessments are periodically performed to assess internal compliance with cybersecurity strategy and the implementation of cybersecurity controls, which would include the validation of cybersecurity control implementation through testing. Areas identified for enhancement and improvement are monitored and tracked to remediation by the Roper cybersecurity team, including the Vice President of Cybersecurity. Cybersecurity risk is also addressed in, and monitored by, the Company's enterprise risk management program.


text: The Company's processes to identify material risks from cybersecurity threats associated with our use of third-party service providers are included within our service provider management policy. The policy provides guidelines in performing cyber risk assessments on our critical and material third party service providers during onboarding and periodically thereafter.

companyName: VIRTUS INVESTMENT PARTNERS, INC.

ticker: VRTS


text: We maintain a centralized incident response process with a third-party forensic partner on retainer. In addition, we have cybersecurity insurance policies in place. Roper maintains a Cybersecurity Incident Response Plan ("CSIRP"), which requires each Roper business to designate a Cybersecurity Incident Response Team that is responsible for receiving, reviewing, and responding to cybersecurity incident reports and activities. Cybersecurity incidents are required to be promptly reported to the Roper cybersecurity team, who then monitors such incidents through their resolution. We work on security awareness with our employees throughout the year with annual cybersecurity training and monthly simulated phishing campaigns to better identify and report unusual behavior and to mitigate the likelihood and impact of possible cybersecurity incidents.


text: Cybersecurity Governance The Cybersecurity Program is supervised by Roper's Vice President of Cybersecurity, who has related experience including cybersecurity, IT, Cloud, and Security Compliance. The Vice President of Cybersecurity has obtained a B.S. in Management Information Systems, a Master's in Business Administration, and a Master's in Management Information Systems. She also maintains the following industry cybersecurity certifications: CISA, CISSP, GSEC, GCED, GSA, and a Boardroom Certified Qualified Technology Expert (QTE).


text: Our Board of Directors (the "Board") has not delegated responsibility for cybersecurity matters to a committee. Rather, the Board believes that due to the importance and continually evolving nature of risks from cybersecurity threats, all members of the Board should participate in the oversight of these topics. As a result, management briefs the Board on cybersecurity matters during regularly scheduled Board meetings. Roper's Vice President of Audit Services also periodically briefs the Audit Committee on cybersecurity matters and related risks, as needed. The Vice President of Audit Services also reports to the Audit Committee on matters, including cybersecurity matters, that are addressed and monitored pursuant to the Company's enterprise risk management program.


text: Roper has also established a Cyber Disclosure Committee chaired by the Vice President of Cybersecurity to track and evaluate potentially material cybersecurity incidents and to assess their potential impact on the organization. This process builds upon the CSIRP and provides a framework for Roper management to monitor potentially material cybersecurity incidents. The Cyber Disclosure Committee reports its activities and findings, as appropriate, to the Chief Executive Officer, Chief Financial Officer, Principal Accounting Officer, and General Counsel, and, if appropriate, to the Board of Directors.


text: Although we have experienced cybersecurity incidents, these incidents have not materially affected Roper, including its business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors, We rely on information and technology, including third-party cloud computing platforms and other third-party business partners, for many of our business operations which could fail and cause disruption to our business operations." above for more information. While we work to maintain our Cybersecurity Program, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all risks from cybersecurity threats or potential risks to such systems, networks, and data or those of our third-party providers.


text: Cybersecurity Strategy and Risk Management We maintain a cybersecurity and information protection program that is supported by policies and procedures designed to protect our systems and assets and the Company's sensitive or confidential business information, including that entrusted to us by our clients and business partners. Identifying and assessing cybersecurity risk is integrated into our overall enterprise risk management ("ERM") processes. Our ERM processes consider cybersecurity threat risks alongside other company risks as part of our overall management activities. Cybersecurity risks related to our business are identified and managed though a multi-faceted approach utilizing various systems, controls, and processes.


text: We maintain a layered security architecture as a key part of our infrastructure design and utilize our employees and managed third-party service providers to help ensure a secure environment and safeguard against a variety of threats including malware, systems intrusions, unauthorized access, data loss and other security risks. We have implemented various technology products and associated procedures, including, among others, the following: Firewall protection, operating system security patches, and multi-factor authentication; System security agent software, which includes encryption, malware protection, patches and virus definitions; Monitoring of computer systems for unauthorized use of or access to sensitive information; Web content filtering; Web and network vulnerability assessments and penetration testing; Monitoring emerging laws and regulations related to data protection and information security;


text: Hosting in-house production systems in geographically dispersed locations that are backed up to alternate locations; and Employee cybersecurity awareness training that includes regular phishing simulations.


text: As part of the above processes, we engage various professional services firms that use external third-party tools to assess our internal cybersecurity programs and compliance with applicable practices and standards. Our use of these third parties allows us to leverage specialized knowledge, insights and industry best practices.


text: As part of the above approach and processes, we regularly engage with assessors, consultants, auditors, and other third-parties to help identify areas for continued focus, improvement and/or compliance.

companyName: SYNOPSYS INC

ticker: SNPS


text: The assessment of cybersecurity incidents are integrated as part of the Company's business continuity and disaster recovery program ("BCDR"). Our BCDR includes an incident response protocol that provides a framework for the assessment, response, and recovery phases for any business disruption, including cybersecurity incidents. It also incorporates various event, incident and response teams that comprise the Company's information security, risk management, compliance, legal and other functions as needed in response to any cybersecurity incidents. Our incident response protocol also provides for reporting mechanisms to senior management and our Board of Directors in the event of a material cybersecurity incident.


text: We have not had a cybersecurity incident that has materially affected, or was reasonably likely to, materially affect, our business strategy, results of operations or financial condition. There are risks from cybersecurity threats that if they were to occur could materially affect our business strategy, results of operations or financial condition which are further discussed in Item 1A. "Risk Factors—Risks Related to our Industry, Business and Operations—We and our third-party service providers rely on numerous technology systems and any business interruption, security breach, or system failure could negatively impact our business and profitability" of this Annual Report on Form 10-K, which should be read in conjunction with the information in this section.


text: Cybersecurity Governance Our Board of Directors ("Board") oversees our risk management processes, including our risks from cybersecurity threats. As part of its ongoing responsibilities, the Board receives recurring reports from management on the Company's cybersecurity risk environment and regularly meets with management to review the risk landscape and discuss the steps taken by management to monitor and mitigate cyber exposures. In addition, from time to time, our Chief Technology Officer and Chief Information Security Officer ("CISO") brief the Board on the cyber-threat landscape, our information security program and other related information technology topics.


text: The Company maintains an Enterprise Risk Committee ("ERC"), comprising the Company executives who lead day-to-day risk management, and whose efforts are supplemented by specific risk-related committees or teams. The ERC is a cross- functional committee that focuses on identifying and managing operational risk throughout the organization, including cybersecurity threats. The ERC has integrated cybersecurity into key elements of the Company's ERM framework, including our BCDR planning program and service provider management policy, and personnel from our information security, risk management, compliance and legal groups are a part of the assessment and response team for cybersecurity incidents and the evaluation of third-party cybersecurity risk.


text: Our cybersecurity systems, controls and processes are overseen by our cybersecurity information technology team which is managed by our CISO. Our CISO has over 25 years of experience in the information technology and cybersecurity field and is a Certified Information Systems Security Professional.


text: Cybersecurity Strategy and Risk Management We maintain a cybersecurity and information protection program that is supported by policies and procedures designed to protect our systems and assets and the Company's sensitive or confidential business information, including that entrusted to us by our clients and business partners. Identifying and assessing cybersecurity risk is integrated into our overall enterprise risk management ("ERM") processes. Our ERM processes consider cybersecurity threat risks alongside other company risks as part of our overall management activities. Cybersecurity risks related to our business are identified and managed through a multi-faceted approach utilizing various systems, controls, and processes. Our cybersecurity systems, controls and processes are overseen by our cybersecurity information technology team which is managed by our CISO.


text: The Company's processes to identify material risks from cybersecurity threats associated with our use of third-party service providers are included within our service provider management policy. The policy provides guidelines in performing cyber risk assessments on our critical and material third party service providers during onboarding and periodically thereafter.


text: The assessment of cybersecurity incidents are integrated as part of the Company's business continuity and disaster recovery program ("BCDR"). Our BCDR includes an incident response protocol that provides a framework for the assessment, response, and recovery phases for any business disruption, including cybersecurity incidents. It also incorporates various event, incident and response teams that comprise the Company's information security, risk management, compliance, legal and other functions as needed in response to any cybersecurity incidents. Our incident response protocol also provides for reporting mechanisms to senior management and our Board of Directors ("Board") in the event of a material cybersecurity incident.


text: Cybersecurity Governance Our Board oversees our risk management processes, including our risks from cybersecurity threats. As part of its ongoing responsibilities, the Board receives recurring reports from management on the Company's cybersecurity risk environment and regularly meets with management to review the risk landscape and discuss the steps taken by management to monitor and mitigate cyber exposures. In addition, from time to time, our Chief Technology Officer and Chief Information Security Officer ("CISO") brief the Board on the cyber-threat landscape, our information security program and other related information technology topics.


text: The Company maintains an Enterprise Risk Committee ("ERC"), comprising the Company executives who lead day-to-day risk management, and whose efforts are supplemented by specific risk-related committees or teams. The ERC is a cross-functional committee that focuses on identifying and managing operational risk throughout the organization, including cybersecurity threats. The ERC has integrated cybersecurity into key elements of the Company's ERM framework, including our BCDR planning program and service provider management policy, and personnel from our information security, risk management, compliance and legal groups are a part of the assessment and response team for cybersecurity incidents and the evaluation of third-party cybersecurity risk.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks.

stage1Category: None/Other


text: We maintain a cybersecurity program and incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things: • Security and privacy reviews designed to identify risks from new features, software, suppliers and vendors; • A vulnerability management program designed to identify software vulnerabilities; • A variety of tools designed to monitor our networks, systems, and data for suspicious activity; • An internal red team program that simulates cyber threats, enhancing our ability to fix vulnerabilities before they are exploited by threat actors; • A threat intelligence program designed to model and research our adversaries; • Products and services to structure, test, and assess the rigor of our software security practices; • A variety of privacy, cybersecurity, and incident response trainings and simulations, including regular controlled penetration testing and cyber incident exercises to test the robustness of our data security protections and incident response readiness; • For suppliers and service providers, pre-engagement risk-based diligence, contractual security and notification provisions, and ongoing monitoring as appropriate; and • Maintaining cyber liability insurance that covers certain liabilities related to data breaches and related incidents.


text: Synopsys' cybersecurity program is designed to leverage multiple industry-recognized frameworks including the National Institute of Standards and Technology Cyber Security Framework (NIST CSF) and the ISO/IEC 27001 Information Security Management Framework, and are assessed regularly by our internal audit department. We track our NIST CSF implementation through periodic third-party maturity assessments that provide the basis for establishing performance goals for the coming period.


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process. As part of this process, appropriate personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.


text: Our Board is actively involved in overseeing cybersecurity risk management. At least once a year, senior management, including our Chief Information Security Officer (CISO), presents to the Board on Synopsys' cybersecurity performance and risk profile. Further, senior management and our CISO present semiannually to our Corporate Governance and Nominating Committee (CGN Committee) on Synopsys' cybersecurity risk oversight activities and cybersecurity preparedness efforts. The CGN Committee of our Board, a majority of whom are individuals with a strong background in cybersecurity and related matters, meets with members of senior management to review our information technology and data security policies and practices, and to assess current and potential threats, cybersecurity incidents and related risks. Our CISO reports directly to our executive management team and advises Synopsys on cybersecurity risks and assesses the effectiveness of information technology and data security processes. The materials presented to our Board and CGN Committee include updates on our data security posture, results of third-party assessments, progress towards pre-determined risk-mitigation related goals, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Members of the Board and the CGN Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and to discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks may also be considered during separate Board meeting discussions.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CISO. Our CISO has over 30 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy and implementing effective information and cybersecurity programs. Our CISO holds a Bachelor's of Science in Information Technology and a Master of Business Administration, and is also a Certified Information Systems Security Professional. He oversees our cybersecurity program and chairs a cross-functional committee that spans information security, IT, product security, physical security, and legal.


text: Our CISO and other members of senior management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such material cybersecurity incident.


text: We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things: • Security and privacy reviews designed to identify risks from new features, software, suppliers, and vendors; • A vulnerability management program designed to identify software vulnerabilities; • A variety of tools designed to monitor our networks, systems, and data for suspicious activity; • An internal red team program that simulates cyber threats, enhancing our ability to fix vulnerabilities before they are exploited by threat actors; • A threat intelligence program designed to model and research our adversaries; • Products and services to structure, test, and assess the rigor of our software security practices; • A variety of privacy, cybersecurity, and incident response trainings and simulations, including mandatory yearly training for all employees, additional training for all Information Technology and Information Security personnel, and regular controlled penetration testing and cyber incident exercises to test the robustness of our data security protections and incident response readiness; • For suppliers and service providers, pre-engagement risk-based diligence, contractual security and notification provisions, and ongoing monitoring as appropriate; and • Maintaining cyber liability insurance that covers certain liabilities related to data breaches and related incidents.


text: Synopsys' cybersecurity policies and procedures are intended to align with multiple industry-recognized frameworks, including the National Institute of Standards and Technology Cyber Security Framework (NIST CSF) and the ISO/International Electrotechnical Commission (IEC) 27001 Information Security Management Framework. In addition, some Synopsys products are ISO 27001 and/or SOC2 Type 2 certified. Our internal audit department regularly assesses our conformity with these frameworks. We track our NIST CSF implementation through regular third-party maturity assessments, which provide the basis for establishing performance goals for the coming period. We also closely monitor the ever-changing landscape of related laws and regulations and regularly update our policies and processes to promote continued compliance.


text: As many security threats involve email and social engineering, the IT Provider has a multifaceted security training program for Affiliated Group employees. Cybersecurity training classes are administered at least annually. Testing and assessment of employees' ability to thwart attacks are performed throughout the year, with training being targeted at areas of users' weakness.

companyName: KAANAPALI LAND LLC

ticker: KANP


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process. As part of this process, appropriate personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. As part of the above approach and processes, we regularly engage with assessors, consultants, auditors, and other third-parties to help identify areas for continued focus, improvement and/or compliance.


text: Since 2015, Synopsys is not aware of any material information security breaches and has not made any associated penalties/settlements, and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none. During the same time period, while some of our suppliers have experienced security breaches, none of these breaches have had a material impact on Synopsys.


text: In our risk factors, we describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. See our risk factor disclosures in Part I, Item 1A of this Annual Report.


text: Cybersecurity Governance Information technology and data security, particularly cybersecurity, is a top area of focus for our Board of Directors (the Board), which considers these areas as essential for the success of our company and the broader technology industry in which we operate.


text: Our Board is actively involved in overseeing cybersecurity risk management. At least once a year, senior management, including our Chief Information Security Officer (CISO), presents to the Board on Synopsys' cybersecurity performance and risk profile. Further, senior management and our CISO present semiannually to our Corporate Governance and Nominating Committee (CGN Committee) on Synopsys' cybersecurity risk oversight activities and cybersecurity preparedness efforts. The CGN Committee, a majority of whom are individuals with a strong background in cybersecurity and related matters, meets with members of senior management to review our information technology and data security policies and practices, and to assess current and potential threats, cybersecurity incidents and related risks.


text: Our CISO reports directly to our executive management team and advises Synopsys on cybersecurity risks and assesses the effectiveness of information technology and data security processes. The materials presented to our Board and CGN Committee include updates on our data security posture, results of third-party assessments, progress towards pre-determined risk-mitigation related goals, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Members of the Board and the CGN Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and to discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks may also be considered during separate Board meeting discussions.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and data related to our customers, consumers and employees. Our cybersecurity risk management program leverages the National Institute of Standards and Technology Cyber Security Framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. Our cyber security team regularly reviews enterprise risk management-level cybersecurity risks, and key cybersecurity risks are incorporated into our Enterprise Risk Management program. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include cyber security guidelines as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multi factor authentication, confidential information and the use of the Internet, social media, email and wireless devices.

companyName: Fossil Group, Inc.

ticker: FOSL


text: c) Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures. d) Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP.

companyName: ECB Bancorp, Inc. /MD/

ticker: ECBK


text: Our Chief Information Security Officer ("CISO"), our information security team, and third-party service providers help identify, assess, and manage our cybersecurity threats and risks, including through the use of our cybersecurity risk assessment program. Our CISO along with this team, as applicable, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods, including automated and manual tools, third-party threat feeds, internal audits, access control assessments, and evaluating threats reported to us by various third-party enterprise threat reporting services.


text: As part of our cybersecurity program, we regularly test our cyber defenses by performing simulations and drills at a technical level with third-party experts, internal user susceptibility testing and reviewing our operational policies and procedures. Our cyber security team monitors alerts and meets to discuss threat levels, risk ranking, trends and remediation. Further, we conduct regular external penetration tests, red team testing and maturity testing to assess our processes and procedures and the threat landscape. We conduct security assessments on additions and changes to our systems and applications including third-party service providers. In addition, our Audit Services group conducts periodic reviews of cyber security controls, procedures, and applications and monitors remediation activities. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Any material disruption of our information systems could disrupt our business and reduce our sales" and "A data security or privacy breach could damage our reputation, harm our customer relationships, expose us to litigation or government actions, and result in a material adverse effect to our business, financial condition and results of operations."


text: Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function and has delegated to our Audit Committee responsibility for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: The CISO is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Audit Committee of the Board. Our CISO has two decades of experience leading cyber security oversight with ten years in a multinational company environment. Members of the security team have cybersecurity experience and certifications, such as the Certified Information Systems Security Professional certification. We regularly conduct training and/or simulations to ensure employees are aware of current cyber threats. Additionally, tabletop exercises at a management level incorporate external advisors. All employees are required to complete cybersecurity training annually. We also require employees in certain roles to complete additional role-based, specialized cybersecurity training.


text: Our cybersecurity incident response process is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances including our CISO, our Chief Financial Officer and our General Counsel. In addition, our incident response process includes reporting to the Audit Committee for certain cybersecurity incidents.


text: The Audit Committee receives reports quarterly from our CISO concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. Our Board of Directors also receives periodic reports from our CISO or Audit Committee regarding our overall cybersecurity program.


text: As part of our cybersecurity program, we regularly test our cyber defenses by performing simulations and drills at a technical level, internal user susceptibility testing and reviewing our operational policies and procedures. Our cyber security team monitors alerts and meets to discuss threat levels, risk ranking, trends and remediation. We conduct security assessments on additions and changes to our systems and applications including third-party service providers. In addition, our Audit Services group conducts periodic reviews of cyber security controls, procedures, and applications and monitors remediation activities. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, we have experienced threats to our data and systems, including malware and computer virus attacks. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Any material disruption of our information systems could disrupt our business and reduce our sales" and "A data security or privacy breach could damage our reputation, harm our customer relationships, expose us to litigation or government actions, and result in a material adverse effect to our business, financial condition and results of operations."


text: The CISO is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Audit Committee. Our CISO has a decade of experience leading cyber security oversight. Members of the security team have cybersecurity experience and certifications, such as the Certified Information Systems Security Professional certification. We regularly conduct training and/or simulations to ensure employees are aware of current cyber threats. Additionally, periodic tabletop exercises at a management level incorporate external advisors. All employees are required to complete cybersecurity training annually. We also require employees in certain roles to complete additional role-based, specialized cybersecurity training.


text: Our cybersecurity incident response process is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances including our CISO, our Interim Chief Financial Officer and our Chief Legal Officer. In addition, our incident response process includes reporting to the Audit Committee for certain cybersecurity incidents.


text: Risk Assessments The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. The Company has integrated cybersecurity risk management into our broader enterprise risk management framework to promote a company-wide culture of cybersecurity risk awareness and management. This integration aims to ensure that cybersecurity considerations are an integral part of our decision-making processes at every level.

companyName: Cornerstone Building Brands, Inc.


text: We maintain an enterprise risk management program ("ERM") designed to assess, identify, manage and mitigate material risks, including cybersecurity risk. ERM is a Company-wide initiative that involves both the Board of Directors and the Company's management. The program is designed to (i) identify and assess risks most critical to the Company's success including through detailed analysis of the likelihood of occurrence and potential impact of each risk, (ii) assign individual executives the responsibility of managing those risks, and (iii) align those management assignments with appropriate board-level oversight.


text: Our General Counsel and Assistant General Counsel – Compliance drive the program. The executive leadership team, including our Chief Executive Officer, and the Company's management team, comprised of department leaders and subject matter experts, are responsible for identifying, assessing managing and mitigating risks. With respect to cybersecurity risk, our legal and compliance team works closely with our IT leaders to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: External experts supplement our internal expertise as necessary. Risks identified as significant risks are communicated to the Board of Directors, who ultimately oversees the program both directly and indirectly through Board Committees, such as the Audit Committee.


text: Risk management, including risks related to cybersecurity is also incorporated into the review and approval process for our project management organization ("PMO").


text: Our cybersecurity risk management program includes enterprise-wise monitoring of cyber activity to identify and analyze potential events that may have an adverse effect or impact on the Company's assets, systems, resources or reputation. This monitoring is designed to identify both external activity and routine internal activity for behavior that may be unusual or potentially malicious. Depending upon the nature and severity of the risk, cybersecurity monitoring and identification can result in automated processes to immediately block and remove undesired risks, cybersecurity team review and action, or both. The Cybersecurity Incident Response Plan provides a framework for addressing a cyber-crisis, cyber-incident and/or data breach, which could include activating crisis, or business continuity recovery plans, as appropriate. These plans are regularly reviewed and updated by our Chief Information Officer and communicated to appropriate stakeholders.


text: Third-Party Engagement Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, with the aim of modeling our cybersecurity strategies and processes after industry best practices. Our collaboration with these third parties includes managed services, team augmentation, independent audits, vulnerability management, threat and attack and consultation on security risks enhancements. Some engagements involve point in time activities with end products or reporting while others involve ongoing monitoring and management of risk across the Company.


text: Third-Party Risk Management Because we are aware of the risks associated with third-party service providers, such as suppliers, software and cloud-based service providers, and cybersecurity partners, the Company implements processes to oversee and manage these risks. We assess the risks from cybersecurity threats that impact select suppliers and third-party service providers with whom we share personal identifying and confidential information. We require third parties to maintain security controls to protect our confidential information and data and notify us of breaches that may impact our data. Third parties that interact with our information or have access to our systems may have additional security requirements depending on the levels of risk. When new third-party risks are identified, we require those impacted to implement appropriate remediations or controls. Identified risks are documented and tracked along with general ongoing monitoring of third parties external risk posture. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third party service providers.


text: Learning from Threats/Incidents During the last year we have not identified cybersecurity threats or challenges that have materially impaired our operations or financial condition. Our monthly baselines for cybersecurity are closely tracked and show a continual improvement and reduction of risk over the last three years. Similarly, incident investigations over the same period have reduced in severity and frequency. These internal metrics are consistent with our third-party risk scorecard subscriptions which similarly show a year-over-year improvement in our risk posture over the last three years. See Risk Factor, "Damage to our computer infrastructure and software systems and issues relating to the incorporation of artificial intelligence ("AI") solutions into our systems, could harm our business."


text: The Board of Directors has established robust oversight mechanisms designed to ensure effective governance in managing risks associated with cybersecurity threats due to the significance of these threats to our operational integrity. The Board of Directors have delegated to the Audit Committee oversight over cybersecurity risk.


text: Governance – Conveying Risks to the Board of Directors The Chief Information Officer ("CIO") and Chief Financial Officer ("CFO") play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide comprehensive briefings to the Audit Committee on a quarterly basis at the Audit Committee meetings. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats • Status of ongoing cybersecurity initiatives and strategies • Incident reports and learnings from cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee, CIO and CFO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks to ensure that the Board Director's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance for major initiatives. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Audit Committee or Board of Directors through the Board-approved escalation protocol.


text: Governance and Management Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Director Cyber Security under the oversight of the Chief Information Officer. With over 20 years in the field of IT and cybersecurity, the Director, Cybersecurity has significant professional experience including senior technical leadership roles along with consulting and management roles at public and private companies in the manufacturing, chemical and oil and gas sectors. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. He holds a masters in science degree from the University of Texas at Austin and professional certifications that include a CISSP and an active U.S. Government security clearance. Our Director Cyber Security oversees our cybersecurity governance programs and leads a team responsible for cybersecurity risk assessment, continuous monitoring for internal and external threats and vulnerabilities, remediation of known risks, and employee cybersecurity training.


text: Management Oversight The Director Cyber Security and Chief Information Officer are regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. Keeping senior management abreast of the cybersecurity posture and potential risks facing the Company is viewed as crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Director Cyber Security leads a team of Cybersecurity Engineers and manages vendor relationships and is responsible for implementation and oversight of processes for monitoring enterprise information systems. These processes include the deployment of advanced cybersecurity platforms which continually assess, remediate and provide regular measures and regular system audits so that identified threats and potential vulnerabilities can be addressed. In the event of a cybersecurity incident, the Director Cyber Security is equipped with our Cybersecurity Incident Response Plan. This plan includes an escalation protocol to ensure Company leaders and the Board of Directors are aware of and can oversee response plans, immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents. Processes also include escalating potentially material incidents directly to the General Counsel to ensure incidents are reported as required by applicable law and regulation. Both the Board of Directors and the Company's IT Steering committee, which is comprised of senior executives are kept updated on any material incidents, Cybersecurity initiatives and strategic roadmap.


text: The cybersecurity threat environment is volatile and dynamic, requiring a robust and dynamic framework to reduce and mitigate cybersecurity risk. Cybersecurity risk includes exposure to failures or interruptions of service or security breaches resulting from malicious technological attacks that impact the confidentiality, integrity, or availability of our or third parties' operations, systems, or data. We seek to mitigate cybersecurity risk and associated reputational and compliance risk by, among other things: maintaining privacy policies, management oversight, accountability structures, and technology design processes to protect private and personal data;

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: The Board of Directors has established robust oversight mechanisms designed to ensure effective governance in managing risks associated with cybersecurity threats due to the significance of these threats to our operational integrity. The Board of Directors has delegated to the Audit Committee oversight over cybersecurity risk.


text: Governance – Conveying Risks to the Board of Directors The Chief Information Officer ("CIO") and Chief Financial Officer ("CFO") play a pivotal role in keeping the Audit Committee apprised of cybersecurity risks. They provide comprehensive briefings to the Audit Committee on a quarterly basis at the Audit Committee meetings. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats • Status of ongoing cybersecurity initiatives and strategies • Incident reports and learnings from cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee, CIO and CFO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks to ensure that the Board Director's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance for major initiatives. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Audit Committee or Board of Directors, as appropriate, through the Board-approved escalation protocol.


text: Governance and Management Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Director Cyber Security under the oversight of the Chief Information Officer. With over 20 years in the field of IT and cybersecurity, the Director, Cyber Security has significant professional experience including senior technical leadership roles along with consulting and management roles at public and private companies in the manufacturing, chemical and oil and gas sectors. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. He holds a masters in science degree from the University of Texas at Austin and professional certifications that include a CISSP and an active U.S. Government security clearance. Our Director Cyber Security oversees our cybersecurity governance programs and leads a team responsible for cybersecurity risk assessment, continuous monitoring for internal and external threats and vulnerabilities, remediation of known risks, and employee cybersecurity training.


text: Management Oversight Our Director, Cyber Security and Chief Information Officer are regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. Keeping senior management abreast of the cybersecurity posture and potential risks facing the Company is viewed as crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Director, Cyber Security leads a team of cybersecurity engineers, manages vendor relationships, and is responsible for implementation and oversight of processes for monitoring enterprise information systems. These processes include the deployment of advanced cybersecurity platforms which continually assess, remediate and provide regular measures and regular system audits so that identified threats and potential vulnerabilities can be addressed. In the event of a cybersecurity incident, the Director Cyber Security is equipped with our Cybersecurity Incident Response Plan. This plan includes an escalation protocol to ensure Company leaders and the Board of Directors are aware of and can oversee response plans, immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents. Processes also include escalating potentially material incidents directly to the General Counsel to ensure incidents are reported as required by applicable law and regulation. Both the Board of Directors and the Company's IT Steering Committee, which is comprised of senior executives are kept updated on any material incidents, cybersecurity initiatives and the Company's cybersecurity strategic roadmap.


text: actively monitoring and mitigating cybersecurity threats and risks with a three lines of defense structure to provide oversight, governance, challenge, and testing; using a third-party cybersecurity oversight program;


text: Risk Management and Strategy Our cybersecurity risk management strategy is integrated into our enterprise risk management framework and is embedded in each of our three lines of defense. We use a combination of management expertise and Board oversight, as discussed below, as well as outside consultants to assist us in overseeing our cybersecurity risk management program. We deploy safeguards designed to protect customer information and our own corporate information and technology. We have programs and processes in place designed to mitigate known attacks, and we use both internal and external resources to scan for vulnerabilities in our applications, systems, and platforms. We implement backup and recovery systems and require the same of our third-party service providers.


text: W e use independent third-party service providers to perform penetration testing of our infrastructure to help us better understand the effectiveness of our controls, improve our defenses, and conduct assessments of our program for compliance with regulatory requirements and industry guidelines. We also engage with outside risk experts and industry groups, including other peer institutions, as needed, to help us evaluate potential future threats and trends, particularly with respect to emerging information security and fraud risks. In addition, we use a Third-Party Risk Management program to help mitigate risks with our third- and fourth-party providers; however, our ability to monitor our service providers' cybersecurity practices is limited. We generally have agreements in place with our service providers that include requirements related to cybersecurity and data privacy. We cannot guarantee, however, that such agreements will prevent a cyber incident from impacting our systems or information. Additionally, we may not be able to obtain adequate or any reimbursement from our service providers in the event we should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber incidents attributed to our service providers in relation to any data that we share with them.


text: While to date, we have not experienced a significant compromise, attack, or loss of data related to cybersecurity attacks, due to the nature of our business, we are under constant threat of an attack and could experience a significant cybersecurity event in the future. Potential risks we could face from a cybersecurity event are discussed in "Risk Factors" above.


text: Through established governance structures, including our problem and incident management process and cyber incident response plan, we have processes and procedures to help facilitate appropriate and effective oversight of cybersecurity risk. These processes and procedures enable our three lines of defense and management to review and manage cybersecurity risks, monitor threats, and provide for further escalation to executive management, our management-level Disclosure Committee, our board-level Risk Committee, or to the full Board, as appropriate.