text: At a management level, our Program is led by our CISO, who reports to the Company's Chief Digital and Technology Officer. Our CISO has expertise in cybersecurity risk management through, among other things, over 30 years of information security experience, prior CISO and security leadership positions at other public companies, and certain technology and information security matters certifications. Additionally, we have a formal data privacy management committee made up of privacy professionals, operational experts and specialist legal counsel which is overseen by our Chief Legal Officer.


text: We have a Data Incident Response Plan ("the Plan") which provides for controls and procedures in connection with cybersecurity events including escalation procedures as summarized below. Under the Plan, we have established a Data Incident Response Team (the "Response Team"), a cross-functional group comprised of certain members of senior management, including our Chief Legal Officer and CISO. The Plan provides that the Response Team is responsible for assessing, investigating and responding to any cybersecurity event elevated for its consideration by our CISO.

companyName: YUM BRANDS INC

ticker: YUM

secItem: Item 1C


text: In addition, under the Plan, we have established a cross-functional management group comprised of our Chief Legal Officer, Chief Financial Officer, Chief Digital and Technology Officer, Vice President Internal Audit, Chief Compliance Officer, Senior Vice President Finance & Corporate Controller and CISO. The Plan provides that any cybersecurity incident that is elevated for the review of the Response Team will also be reviewed by this group to determine whether any such incident is material for securities laws purposes and whether public disclosure is required or advisable in connection therewith, following any necessary consultation with the Company's senior management, Disclosure Committee, Audit Committee and/or Board of Directors.

stage1Category: Risk Management Process

stage1Method: majority


text: Our CISO and Chief Digital and Technology Officer advise the Audit Committee at least four times a year, and the Board of Directors regularly, on our management and oversight of information security risks and data protection risks. The Audit Committee also receives periodic updates on data privacy from members of management within our data privacy group in addition to the regular updates from our CISO. The Audit Committee provides a summary to the full Board at each regular Board meeting of the information security risk review together with any other risk related subjects discussed at the Audit Committee meeting.

stage1Category: Board Governance

stage1Method: unanimous


text: Urban One has implemented a structured approach to assessing, identifying, and managing cybersecurity risks. This framework includes ongoing monitoring of threats, the implementation of security controls, and proactive adaptation to evolving risks. Our cybersecurity strategy is designed to safeguard corporate assets, data, and critical systems while ensuring operational resilience.

companyName: URBAN ONE, INC.

ticker: UONE


text: Our cybersecurity risk management process includes: • Continuous enterprise-wide risk monitoring to assess and respond to emerging cyber threats. Our enterprise risk management assesses the characteristics and circumstances of the evolving business environment and seeks to identify both the potential impacts to our company of a particular risk and the speed with which the risk may manifest; • The deployment of technical security controls, including encryption, endpoint detection and response, and network security protections across our enterprise; • Enterprise-wide employee security awareness programs, including social engineering and phishing simulations and mandatory training; • Collaboration with external cybersecurity experts for penetration testing, vulnerability management, and incident response support; and • Security evaluations for vendors and other third-party service providers to help mitigate supply chain risks. These evaluations include reviewing our service provider and vendor management programs and the related agreements to require prompt notification of cyber incidents, outages and software vulnerabilities to facilitate timely assessment and disclosure of third-party cyber risks. Generally, we require our third-party providers to abide by confidentiality and security processes, particularly for third-party data-processing activities. Our evaluations also include inquiries about the vendor's or service provider's cybersecurity history, including any breaches or other incidents. Our third-party security evaluations are limited by their disclosures; therefore, a risk-based approach is used in making vendor and contractual decisions based on those disclosures and the totality of the circumstances, such as whether the third party will have access to personal information or our network. Through these measures, Urban One is committed to maintaining a strong cybersecurity posture and protecting against potential security threats.


text: Cybersecurity threats have the potential to impact our operations, financial condition, and reputation. While we have not experienced any material cybersecurity incidents during the reporting period (See Note 21 - Subsequent Events), we recognize that such incidents could result in: • Disruption of operations, impacting revenue and productivity; • Unauthorized access to or theft of sensitive data, potentially leading to regulatory and legal implications; and • Reputational harm, affecting customer trust and investor confidence.

stage1Category: Strategy Integration


text: Urban One employs continuous threat monitoring, security awareness initiatives, and incident response protocols to mitigate these risks. Our security team remains focused on maintaining a proactive and adaptive security strategy to minimize the likelihood and impact of cybersecurity incidents.


text: The Board of Directors provides oversight of Urban One's cybersecurity risk management efforts. The Board receives updates from the Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") on key cybersecurity risks, threat trends, and mitigation strategies. These updates are based on internal security monitoring and reporting, as well as insights from our managed security service provider ("MSSP").


text: The Board remains committed to ensuring cybersecurity remains a priority for the organization and that the appropriate resources and governance structures are in place to manage cyber risks effectively.


text: Urban One's cybersecurity program is led by the CIO and CISO, who are responsible for cybersecurity strategy, risk management, and incident response. The CISO collaborates closely with the CIO, IT leadership, and business stakeholders to align security initiatives with the Company's broader strategic objectives.

stage1Category: Management Role


text: AFG continues to integrate assessing cybersecurity threat risks associated with its use of third-party service providers, generally at the initial engagement or renewal of the relationship. When conducting these assessments, AFG's Enterprise Information Security Group ("EISG") considers the risk profile of the vendor or supplier assesses security controls with the third parties and engages in contractual review to ensure appropriate security controls are in place.

companyName: AMERICAN FINANCIAL GROUP INC

ticker: AFG

stage1Category: Third-Party Risk


text: Our CIO has more than twenty-five years of experience advancing technology, digital transformation, and cybersecurity, including in the financial services industry. Prior to joining Urban One, he served as a Senior Vice President for Capital One Financial Corporation. During his tenure at Capital One, he supported the company's digital transformation and built the capabilities required to move its global enterprise to the cloud across technology divisions and platforms. Additionally, he has led strategic technology innovations and cybersecurity programs as an executive at several other leading Fortune 500 companies.


text: Our CISO has more than twenty-five years of experience in cybersecurity, risk management, and technology leadership across financial services and global enterprises. Before joining Urban One, he served as Chief Information Security Officer at Farm Credit Financial Partners, Inc., leading enterprise-wide security initiatives. He has also held key leadership roles at Rabobank International, where he progressed through various IT, security operations, and risk management positions. Additionally, he led cybersecurity and risk management programs at United Technologies Corporation, where he focused on analytics-driven security solutions to enhance organizational resilience. He holds dual master's degrees in Information Security & Assurance and IT Management and also has an Executive MBA from the University of Connecticut Urban One's executive leadership team remains engaged in cybersecurity initiatives and regularly reviews the effectiveness of security controls, policies, and incident response capabilities to ensure alignment with evolving threats and business needs.


text: For additional information on the risks we face related to cyber and information security threats, please see our related risk factor in Item 1A. Risk Factors.

stage1Category: None/Other


text: Cybersecurity Risk Management and Strategy PriceSmart has developed, implemented, and maintained a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical technology systems, data and information. We have implemented processes and protocols designed to monitor, identify, mitigate and prevent material risks associated with cybersecurity threats and incidents relevant to internal networks, business applications, customer-facing applications, customer payment systems, and business operations. Cybersecurity represents an important component of our overall cross-functional approach to risk management. Our cybersecurity practices are integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks identified for oversight by the Board through our annual ERM assessment.

companyName: PRICESMART INC

ticker: PSMT


text: Our cybersecurity risk management program utilizes information and guidance derived from industry-recognized frameworks, including the International Organization for Standardization (ISO) 27001 Framework and the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 (CSF), specifically the NIST 800-53 and NIST 811-171 publications. While we have based our cybersecurity risk management program on these frameworks, we have not obtained these specific certifications to date. Our cybersecurity risk management program is overseen by our Chief Information Officer ("CIO") and/or our First Vice President of Information Security ("FVPIS") and reviewed annually.


text: Our cybersecurity risk management program includes but is not limited to the following: • risk assessments performed both internally and by external vendors to assist in the identification of material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise Information Technology (IT) environment; • contracting with and use of third-party service providers, where deemed necessary, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees; • adoption of a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a risk management process for selecting and working with key service providers, suppliers, and vendors that takes into account our assessment of their criticality to our operations and their respective risk profiles.


text: We continuously monitor, assess, and strategically invest to improve the effectiveness and resiliency of our information security systems to keep abreast of the dynamic and complex cybersecurity landscape.


text: We use third-party vendors to review and test our IT systems and utilize our internal team of experienced personnel to evaluate and assess the efficacy of cybersecurity systems and to make recommendations and identify opportunities for improvements to our cybersecurity risk management program. We report the results of these assessments to our Audit Committee regularly and to our Board of Directors at least annually.


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary. We regularly test and update these frameworks to ensure timely and accurate identification, resolution, and reporting of cybersecurity incidents.


text: AFG describes whether and how risks from identified cybersecurity threats are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition in its risk factor disclosures at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference in this Item 1C.


text: We have not identified and are not aware of any risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information about the cybersecurity risks we face, see "Item 1A — Risk Factors — Any failure by us to maintain the security of the information we hold relating to our Company, Members, employees and vendors, could damage our reputation with them, could disrupt our operations, could cause us to incur substantial additional costs and to become subject to litigation and could materially adversely affect our operating results."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The Audit Committee receives quarterly reports from our CIO and/or our FVPIS regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential. The CIO and FVPIS report quarterly to the Audit Committee and Board regarding cybersecurity risks and the status of our cyber risk management program. Our CIO and/or FVPIS also periodically make presentations to Board members on cybersecurity topics as part of the Board's continuing education on topics that impact our company.


text: Our Cybersecurity team also provides reports to the Board's Digital Transformation Committee. The Digital Transformation Committee is charged with oversight of the Company's omni-channel development and digital transformation to enhance membership and stockholder value. In this capacity, the Digital Transformation Committee oversees the Company's design and implementation of various IT systems, with emphasis on maintaining a secure digital environment.


text: Our Cybersecurity team informs executive management about ongoing efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means. This may include briefings from internal security personnel; sharing publicly or privately available threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and forwarding alerts and reports produced by network monitoring and security tools we deploy.


text: Our CIO and FVPIS collectively have over eight decades of IT and cybersecurity experience, including five decades in senior-level leadership roles. Our FVPIS spent over three decades in federal law enforcement working in cyber related roles.


text: Cybersecurity Risk Management and Strategy PriceSmart has developed, implemented, and maintained a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical technology systems, data, and information. We have implemented processes and protocols designed to monitor, identify, mitigate, and prevent material risks associated with cybersecurity threats and incidents relevant to internal networks, business applications, customer-facing applications, customer payment systems, and business operations. Cybersecurity represents an important component of our overall cross-functional approach to risk management. Our cybersecurity practices are integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks identified for oversight by the Board through our annual ERM assessment.


text: Our cybersecurity risk management program utilizes information and guidance derived from industry-recognized frameworks, including the International Organization for Standardization (ISO) 27001 Framework and the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 (CSF), specifically the NIST 800-53 and NIST 811-171 publications. While we have based our cybersecurity risk management program on these frameworks, we have not obtained these specific certifications to date. Our cybersecurity risk management program is overseen by our Chief Information Officer ("CIO"), our First Vice President Information Security ("FVPIS") and our Senior Vice President Information Technology Shared Services ("SVPITSS") and reviewed annually.


text: Our cybersecurity risk management program includes but is not limited to the following: • risk assessments performed both internally and by external vendors to assist in the identification of material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise Information Technology (IT) environment; • contracting with and use of third-party service providers, where deemed necessary, to assess, test, or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees; • adoption of a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a risk management process for selecting and working with key service providers, suppliers, and vendors that utilizes our internal assessment of their criticality to our operations and their respective risk profiles.


text: We are required to comply with the UK General Data Protection Regulation (GDPR) relating to the security of personally identifiable information that we process. A data breach can result in non-compliance with the GDPR, leading to fines or litigation.

companyName: LUXFER HOLDINGS PLC

ticker: LXFR


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The Audit Committee receives quarterly reports from our CIO, FVPIS, and/or our SVPITSS regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential. The CIO, FVPIS, and SVPSS report quarterly to the Audit Committee and Board regarding cybersecurity risks and the status of our cyber risk management program. Our CIO, FVPIS, and/or our SVPITSS also periodically make presentations to Board members on cybersecurity topics as part of the Board's continuing education on topics that impact our company.


text: Our CIO, FVPIS, and SVPITSS collectively have over eight decades of IT and cybersecurity experience, including five decades in senior-level leadership roles. Our FVPIS spent over three decades in federal law enforcement working in cyber related roles.


text: Risk Management and Strategy AFG recognizes the importance of assessing, identifying and managing material risks associated with cybersecurity threats as defined by the Securities and Exchange Commission. Like all businesses, AFG is a target for "cyberattacks," "ransomware," "phishing," "hacking" and similar illegal or unauthorized intrusions into computer systems and networks. Such events can result in significant disruptions to information technology systems, the theft of information and financial assets and reputational harm. AFG could also incur significant expenses associated with investigating and remediating any such event.


text: As discussed below, AFG's enterprise risk management ("ERM") process considers cybersecurity threat risks alongside other company risks as part of the overall risk assessment process.


text: AFG has adopted the National Institute of Standards and Technology ("NIST") framework which provides a comprehensive method for developing a flexible, repeatable, performance-based and cost-effective approach to identifying and managing cybersecurity risks. The Company uses the framework to assess and improve its security posture.


text: AFG utilizes a variety of techniques to provide for the availability of critical data and systems, maintain regulatory compliance, manage its material risks from cybersecurity threats and to protect against, detect, and respond to cybersecurity incidents including, but not limited to, the following: • Conducts regular phishing testing of all employees and all members of the Board of Directors; • Utilizes full-desk encryption on all Company laptops and desktops; • Maintains a defense in depth security control strategy that is tested against high risk threats such as ransomware and other trending attack vectors; • Performs annual security awareness training and other routinely scheduled educational programming for employees; • Validates compliance with internal data security controls through the use of security monitoring utilities and internal and external audits; • Performs self-assessments measured against industry-leading cybersecurity frameworks for standards, guidelines and best practices, including the NIST cybersecurity framework; • Regularly scans external websites and internal applications; • Engages an external third-party to conduct an annual penetration test consisting of advanced adversarial attacks against company systems and from which findings are investigated, ranked by risk level and tracked through appropriate mediation levels; • Utilizes user protections including stringent password requirements, two-factor authentication, and timed logoffs; • Conducts regular network and endpoint monitoring; • Performs regular tabletop exercises, utilizing a third-party data security firm as a facilitator, to simulate a response to a cybersecurity incident where the Company uses the findings to improve its processes and technologies; and • Purchases information security risk insurance from a third-party insurer that provides protection against the potential losses arising from a cybersecurity incident.


text: AFG's Audit Committee is responsible for the oversight of risks from cybersecurity threats. At least annually, the full Board of Directors receives and at least quarterly, the Audit Committee receives an overview from the Chief Information Security Officer ("CISO") or another senior member of the EISG of the Company's cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards predetermined risk-mitigation-related goals, incident response planning and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, materials including a cybersecurity scorecard and other information indicating current and emerging material cybersecurity threat risks and describing the Company's ability to mitigate those risks are provided. Members of the Board also regularly receive educational materials and engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to AFG's cybersecurity risk management and strategy programs.


text: AFG has designed its ERM program to reinforce the way the Company operates its business and reflects its culture, organizational structure and risks. The AFG Enterprise Risk Committee ("ERC"), consisting of AFG's Chief Administrative Officer and Chief Human Resources Officer, AFG's Chief Financial Officer, AFG's General Counsel and Great American Insurance Company's President, oversees the ERM process including risk identification, risk impact and mitigation strategies. Each member of the ERC directly reports to AFG's Co-CEOs. On a day-to-day basis, the Company's ERM process is overseen by an AFG Enterprise Risk Officer, who regularly meets with senior leaders, including the CISO, representing key areas throughout the organization. Cybersecurity risk has been identified as a significant risk monitored under the ERM program. In addition, Ms. Murray, one of AFG's independent Directors, completed the National Association of Corporate Directors' Cyber-Risk Oversight Program and received the CERT Certificate in Cybersecurity Oversight issued by the Software Engineering Institute at Carnegie Mellon University.


text: AFG has also adopted a Security Incident Response Plan ("SIRP") that is designed to provide a management framework across Company functions for a coordinated assessment and response to potential security incidents. The AFG CISO leads and facilitates the SIRP team, which also includes AFG's Chief Administrative Officer and Chief Human Resources Officer, AFG's Chief Financial Officer, AFG's Chief Information Officer, AFG's General Counsel and Great American Insurance Group's President and its General Counsel.


text: The SIRP provides for the interaction and coordination of executive, strategic and tactical teams, depending on the severity level of the incident, aimed at facilitating coordination across multiple units and departments of the Company. The incident response plan is reviewed, updated and tested at least annually. The SIRP covers the major phases of incident response process, including preparation; detection and analysis; containment and investigation; where required, notification to federal or state regulators; eradication and recovery; and incident closure and post-incident analysis.


text: AFG's cybersecurity program is directed by its EISG leadership team that is headed by the AFG CISO and three divisional vice presidents that report to the CISO. This leadership group has collectively over 70 years of cybersecurity work experience, over 90 years of Information Technology ("IT") experience and over 20 years of IT audit experience. This experience involved various roles related to managing information security; developing cybersecurity strategy; implementing and monitoring effective cybersecurity controls and penetration testing. These individuals hold many industry-standard certifications including but not limited to Certified Information Systems Security Professional, Information Systems Security Management Professional, G2700 certification, GIAC Security Leadership Certification, Certified in Risk and Information Systems Control, Certified Information Security Manager, ITL certification and others. The CISO also holds a master's degree in information security. All members of this leadership team are active in their local cybersecurity communities and national conferences. They speak at local universities, local conferences, national conferences, and have conducted training sessions at international conferences like Black Hat, an internationally recognized cybersecurity event series providing the most technical and relevant information security research. Their work has also been used in various best practice case studies by industry leading consulting and research firms.


text: Risk Management and Strategy AFG recognizes the importance of assessing, identifying and managing material risks associated with cybersecurity threats as defined by the Securities and Exchange Commission. Like all businesses, AFG is a target for "cyber-attacks," "ransomware," "phishing," "hacking" and similar illegal or unauthorized intrusions into computer systems and networks. Such events can result in significant disruptions to information technology systems, the theft of information and financial assets and reputational harm. AFG could also incur significant expenses associated with investigating and remediating any such event.


text: AFG has adopted the National Institute of Standards and Technology ("NIST") Cybersecurity framework which provides a comprehensive method for developing a flexible, repeatable, performance-based and cost-effective approach to identifying and managing cybersecurity risks. The Company uses the framework to assess and improve its security posture.


text: AFG continues to integrate assessing cybersecurity threat risks associated with its use of third-party service providers, generally at the initial engagement or renewal of the relationship. When conducting these assessments, AFG's Enterprise Information Security Group ("EISG") considers the risk profile of the vendor or supplier, assesses security controls with the third parties and engages in contractual review to ensure appropriate security controls are in place.


text: AFG describes whether and how risks from identified cybersecurity threats are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition in its risk factor disclosures in Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference in this Item 1C.


text: Like others in the insurance industry, AFG experiences cyber-attacks and other attempts to gain unauthorized access to its systems on a regular basis and anticipates continuing to be subject to such attempts. Over the last three years, AFG has not experienced any material adverse events and has not paid any penalties or settlements related to an information security breach.


text: AFG has designed its ERM program to reinforce the way the Company operates its business and reflects its culture, organizational structure and risks. The AFG Enterprise Risk Committee ("ERC"), consisting of AFG's Chief Administrative Officer and Chief Human Resources Officer, AFG's Chief Financial Officer, AFG's General Counsel and Great American's President, oversees the ERM process including risk identification, risk impact and mitigation strategies. Each member of the ERC directly reports to AFG's Co-CEOs. On a day-to-day basis, the Company's ERM process is overseen by an AFG Enterprise Risk Officer, who regularly meets with senior leaders, including the CISO, representing key areas throughout the organization. Cybersecurity risk has been identified as a significant risk monitored under the ERM program. In addition, Ms. Murray, one of AFG's independent Directors, completed the National Association of Corporate Directors' Cyber-Risk Oversight Program and received the CERT Certificate in Cybersecurity Oversight issued by the Software Engineering Institute at Carnegie Mellon University.


text: AFG has also adopted a Security Incident Response Plan ("SIRP") that is designed to provide a management framework across Company functions for a coordinated assessment and response to potential security incidents. The AFG CISO leads and facilitates the SIRP team, which also includes AFG's Chief Administrative Officer and Chief Human Resources Officer, AFG's Chief Financial Officer, AFG's Chief Information Officer, AFG's General Counsel and Great American's President and its General Counsel.


text: We also involve external cybersecurity experts to assess our cybersecurity program, risk management, and relevant internal controls. In addition to our cybersecurity programs and policies, the Company also purchases a cybersecurity risk insurance policy to limit its exposure to cybersecurity incidents.

companyName: C. H. ROBINSON WORLDWIDE, INC.

ticker: CHRW


text: AFG's cybersecurity program is directed by its EISG leadership team that is headed by the AFG CISO and three divisional officers who report to the CISO. This leadership group has collectively over 70 years of cybersecurity work experience, over 90 years of Information Technology ("IT") experience and over 20 years of IT audit experience. This experience involved various roles related to managing information security; developing cybersecurity strategy; implementing and monitoring effective cybersecurity controls and penetration testing. These individuals hold many industry-standard certifications including but not limited to Certified Information Systems Security Professional, Information Systems Security Management Professional, G2700 certification, GIAC Security Leadership Certification, Certified in Risk and Information Systems Control, Certified Information Security Manager, ITL certification and others. The CISO also holds a master's degree in information security. All members of this leadership team are active in their local cybersecurity communities and national conferences. They speak at local universities, local conferences, national conferences, and have conducted training sessions at international conferences like Black Hat, an internationally recognized cybersecurity event series providing the most technical and relevant information security research. Their work has also been used in various best practice case studies by industry leading consulting and research firms.


text: Cybersecurity Risk Management and Strategy To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threats alongside other company risks as part of our overall risk assessment process. In addition, we perform an external, specific cybersecurity risk assessment every eighteen months. Included in our management of cybersecurity risk is our annual review of our Incident Response Plan/Policy, involving employees from all responsibility levels of the company. Our Chief Financial and Administrative Officer has primary responsibility for overseeing our information systems and information technology resources, including risks from cybersecurity threats. To assist our Chief Financial and Administrative Officer in discharging these responsibilities, we have a standing management committee to address information technology and cybersecurity risk matters comprised of our Chief Financial and Administrative Officer, the principal of a third-party, managed security service provider (an "MSSP"), our Vice President of Risk Management, our Chief Accounting Officer, our Senior Vice President of Human Resources and certain other members of our information technology staff and property management. This committee meets on a quarterly basis, with additional meetings held as-needed throughout the year, to: • monitor emerging data protection laws and implement changes to our processes designed to comply with these laws; • identify and assess material risks from cybersecurity threats; • provide guidance on our cybersecurity strategy development and implementation; • ensure that regular risk assessments and appropriate mitigation strategies are in place; • ensure the performance of regular vulnerability and penetration testing and remediation of findings; • oversee the implementation and management of cybersecurity-related tools such as security information and event management systems; and • review relevant service organization controls reports for the MSSP that serves as our Security Operation Center; and • require training and security awareness programs for our employees.

companyName: Piedmont Realty Trust, Inc.

ticker: PDM


text: Our Vice President of Risk Management monitors and tests these initiatives on a periodic basis. Additionally, our Chief Financial and Administrative Officer partners with the MSSP and our information technology staff throughout the organization to manage material risks from cybersecurity threats, as well as to provide managerial and operational support for our information systems and information technology resources on a daily basis.


text: Index to Financial Statements We also maintain an incident response plan to coordinate the actions we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response plan is tested annually, with tabletop exercises to assess the validity of the plan and to make necessary modifications, as needed, on a bi-annual basis.


text: We utilize external risk advisory and accounting firms to perform an audit focusing on entity-level, application and information technology general computer controls annually, as well as the full cybersecurity risk assessment mentioned above. Audit results and the risk assessments are reviewed by our Chief Financial and Administrative Officer, the principal of the MSSP, and our Vice President of Risk Management. Any exceptions are addressed with a remediation plan and implemented with appropriate resources. Audit results, risk assessments and remediation plans are discussed with the Audit Committee of the board of directors, who has responsibility for cybersecurity risk oversight, each quarter until all points are fully resolved.


text: We also identify and oversee cybersecurity risk from third-party service providers through our vendor management policy, which requires increasing levels of due diligence and required insurance coverages in proportion to each provider's access to our information systems.


text: Although we have never experienced a material information security breach nor have we incurred any expenses related to such a breach, we take a proactive approach to managing information security risk. Our process for managing existing and new service providers evaluates the degree to which such service providers will interface with our systems. This process dictates minimum insurance requirements and increased security documentation and protocols as interaction with our systems increases. We also have an information security training and compliance program which includes cybersecurity updates, notices, reminders, and simulated cyber-attacks emailed to all employees bi-weekly and that all employees are required to participate in at least annually. Further, we have a documented business continuity plan that is updated and tested on an annual basis and we carry an information security risk insurance policy.


text: See "We face risks related to the occurrence of cyber incidents, or a deficiency in our cybersecurity, which could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results" included as part of the risk factors described in Item 1A of this Annual Report on Form 10-K for additional information on the potential impact any cybersecurity incident may have on our business, results of operations, financial condition and cash flows.


text: Cybersecurity Governance The Audit Committee of the board of directors oversees cybersecurity risk and is comprised of three independent members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. The chair of our Audit Committee holds a Certificate in Cybersecurity Oversight from the National Association of Corporate Directors and has previous work experience at a large retailer with point-of-sale cybersecurity exposure. The Audit Committee receives quarterly updates summarizing on-going information technology and cybersecurity initiatives from our Chief Financial and Administrative Officer and reviews the results of our annual risk assessment and regular cyber risk assessment upon completion. Any significant issues identified are reported to the Audit Committee of the board of directors on a quarterly basis. As described above, our management team is responsible for the day-to-day assessment and management of material risks from cybersecurity threats through our Chief Financial and Administrative Officer, our standing management committee on information technology and cybersecurity risk matters and the MSSP. This group would be notified through our Incident Response Plan/Policy and appropriate actions undertaken in accordance with the plan document if a cyber attack were to occur.


text: Our Vice President of Risk Management is a Certificated Information Systems Auditor (CISA) and a Certified Internal Auditor (CIA) and holds a Certificate in Risk Management Assurance (CRMA). Personnel from the MSSP hold several certifications, including but not limited to: Certified Information Systems Security Professional ("CISSP"); ITIL Foundations; Fortinet Certified Network Security Administration and Professional; Microsoft Certified IT Professional, Technology Specialist, Solutions Associate; and Citrix Certified Administrator/Citrix Presentation Server 4.0. The external risk advisory and accounting firms that we use to perform our audits and assessments described above utilize personnel qualified as one or more of the following to perform our audits and assessments: Certified Information Systems Auditor (CISA), CISSP, Certified Information Security Manager (CISM), and Certified Information Technology Professional (CITP).


text: Cybersecurity Risk Management and Strategy To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threats alongside other company risks as part of our overall risk assessment process. In addition, we perform an external, specific cybersecurity risk assessment every eighteen months. Included in our management of cybersecurity risk is our bi-annual review of our Incident Response Plan/Policy, involving employees from all responsibility levels of the company. Our Chief Financial Officer has primary responsibility for overseeing our information systems and information technology resources, including risks from cybersecurity threats. To assist our Chief Financial Officer in discharging these responsibilities, we have a standing management committee to address information technology and cybersecurity risk matters comprised of our Chief Financial Officer, the principal of a third-party, managed security service provider (an "MSSP"), our Vice President of Risk Management, our Chief Accounting Officer, our Senior Vice President of Human Resources and certain other members of our information technology staff and property management. The members of this committee meet on a quarterly basis, with additional full or sub-committee meetings held as-needed throughout the year, to: • monitor emerging data protection laws and implement changes to our processes designed to comply with these laws; • identify and assess material risks from cybersecurity threats; • provide guidance on our cybersecurity strategy development and implementation; • ensure that regular risk assessments and appropriate mitigation strategies are in place; • ensure the performance of regular vulnerability and penetration testing and remediation of findings; • oversee the implementation and management of cybersecurity-related tools such as security information and event management systems; • review relevant service organization controls reports for the MSSP that serves as our Security Operation Center; and • require training and security awareness programs for our employees.


text: Our Vice President of Risk Management monitors and tests these initiatives on a periodic basis. Additionally, our Chief Financial Officer partners with the MSSP and our information technology staff throughout the organization to manage material risks from cybersecurity threats, as well as to provide managerial and operational support for our information systems and information technology resources on a daily basis.


text: Index to Financial Statements We also maintain an Incident Response Plan/Policy to coordinate the actions we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The Incident Response Plan/Policy is tested with tabletop exercises to assess the validity of the plan and to make necessary modifications, as needed, on a bi-annual basis. We utilize a third party Security Information and Event Management ("SIEM") service to collect, analyze, and correlate security logs and events from various sources across the Piedmont corporate and property networks to detect and respond to cyber threats in real-time. This service coordinates with the IT support team to contain threats and reduce impact. Verified cybersecurity incidents, should they occur, are reported to IT management and trigger response protocols detailed in the Incident Response Plan/Policy.


text: We utilize external risk advisory and accounting firms to perform an audit focusing on entity-level, application and information technology general computer controls annually, as well as the full cybersecurity risk assessment mentioned above. Audit results and the risk assessments are reviewed by our Chief Financial Officer, the principal of the MSSP, and our Vice President of Risk Management. Any exceptions are addressed with a remediation plan and implemented with appropriate resources. Audit results, risk assessments and remediation plans are discussed with the Audit Committee of the board of directors, who has responsibility for cybersecurity risk oversight, each quarter until all points are fully resolved.


text: We also identify and oversee cybersecurity risk from third-party service providers through our vendor management policy, overseen by our internal risk management and information technology functional areas, which requires increasing levels of due diligence and required insurance coverages in proportion to each provider's access to our information systems.


text: Although we have never experienced a material information security breach nor have we incurred any expenses related to such a breach, we take a proactive approach to managing information security risk. Our process for managing existing and new service providers evaluates the degree to which such service providers will interface with our systems. This process dictates minimum insurance requirements and increased security documentation and protocols as interaction with our systems increases. We also have a cybersecurity awareness training program which includes annual required online training, periodic updates, notices, and reminders, and bi-weekly simulated phishing attacks with required remedial training for failures. Further, we have a documented business continuity plan that is updated and tested on an annual basis and we carry an information security risk insurance policy.


text: Cybersecurity Governance The Audit Committee of the board of directors oversees cybersecurity risk and is comprised of three independent members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. The chair of our Audit Committee holds a Certificate in Cybersecurity Oversight from the National Association of Corporate Directors and has previous work experience at a large retailer with point-of-sale cybersecurity exposure. The Audit Committee receives quarterly updates summarizing on-going information technology and cybersecurity initiatives from our Chief Financial Officer and reviews the results of our annual risk assessment and regular cyber risk assessment upon completion. Any significant issues identified are reported to the Audit Committee of the board of directors on a quarterly basis. As described above, our management team is responsible for the day-to-day assessment and management of material risks from cybersecurity threats through our Chief Financial Officer, our standing management committee on information technology and cybersecurity risk matters and the MSSP. This group would be notified through our Incident Response Plan/Policy and appropriate actions undertaken in accordance with the plan document if a cyber-attack were to occur.


text: Our Vice President of Risk Management is a Certificated Information Systems Auditor (CISA) and a Certified Internal Auditor (CIA) and holds a Certificate in Risk Management Assurance (CRMA). Personnel from the MSSP hold several certifications, including but not limited to: Certified Information Systems Security Professional ("CISSP"); ITIL Foundations; Fortinet Certified Network Security Administration and Professional; and Microsoft Certified IT Professional, Technology Specialist, Solutions Associate. The external risk advisory and accounting firms that we use to perform our audits and assessments described above utilize personnel qualified as one or more of the following to perform our audits and assessments: Certified Information Systems Auditor (CISA), CISSP, Certified Information Security Manager (CISM), and Certified Information Technology Professional (CITP).


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity framework intended to assess, identify, and manage risks from threats to the security of our information, systems, products, and network using a risk-based approach. The framework is informed in part by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, NIST 800-53 and International Organization for Standardization 27001 ("ISO 27001") Framework, although this does not imply that we meet all technical standards, specifications, or requirements under the NIST or ISO 27001.

companyName: SONIDA SENIOR LIVING, INC.

ticker: SNDA


text: Our key cybersecurity processes include the following: • Risk-based controls for information systems and information on our networks: We seek to maintain an information technology infrastructure that implements physical, administrative and technical controls that are calibrated based on risk and designed to protect the confidentiality, integrity and availability of our information systems and information stored on our networks, including customer information, personal information, intellectual property and proprietary information. • Cybersecurity incident response plan and testing: We have a cybersecurity incident response plan and dedicated team to respond to cybersecurity incidents. When a cybersecurity incident occurs or we identify a vulnerability, we have a strategic partner (a Managed Security Service Provider ("MSSP")) that is responsible for leading the initial assessment of priority and severity. Our cybersecurity team assists in responding to incidents depending on severity levels and seeks to improve our cybersecurity incident management plan through periodic tabletops or simulations at the enterprise level. • Training: We provide security awareness training to help our employees understand their information protection and cybersecurity responsibilities at the Company. We also provide additional role-based training to some employees based on customer requirements, regulatory obligations, and industry risks. • Supplier risk assessments: We have implemented a third-party risk management process that includes expectations regarding information and cybersecurity. That process, among other things, provides for us to perform cybersecurity assessments on certain suppliers based on an assessment of their risk profile and a related rating process. We also seek contractual commitments from key suppliers to appropriately secure and maintain their information technology systems and protect our information that is processed on their systems. • Third-party assessments of the Company: We have engaged third-party cybersecurity companies to periodically assess our cybersecurity posture and to assist in identifying and remediating risks from cybersecurity threats.


text: We also consider cybersecurity, along with other risks to us, within our enterprise risk management framework. The enterprise risk management framework includes internal reporting at the enterprise level, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. In the last fiscal year, we have not identified risks from known cybersecurity threats, including any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, cash flow or financial condition.


text: Cybersecurity Governance The Audit Committee of our Board of Directors is responsible for board-level oversight of risks from cybersecurity threats, and the Audit Committee reports back to the full Board of Directors about this and other areas within its responsibility. As part of its oversight role, the Audit Committee receives reporting about the Company's practices, programs, notable threats or incidents and other developments related to cybersecurity throughout the year, including through periodic updates, from our Chief Technology Officer.


text: Our Chief Technology Officer reports to our Chief Executive Officer and leads the Company's overall cybersecurity function, including the assessment and management of cybersecurity risks. The Chief Technology Officer has over 25 years of experience in managing and leading information technology or cybersecurity teams and participates in various cybersecurity organizations. The Chief Technology Officer collaborates with operation vice presidents and department vice presidents to identify and analyze cybersecurity risks to us; considers industry trends; implements controls, as appropriate and feasible, to mitigate these risks; and enables business leaders to make risk-based business decisions that implicate cybersecurity considerations. The Chief Technology Officer meets with senior leadership to review and discuss our cybersecurity program, including emerging cyber risks, threats, and industry trends. The Chief Technology Officer also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including by collaborating with external security personnel and internal business stakeholders, and incorporating threat intelligence and other information obtained from governmental, public, or private sources to inform our cybersecurity technologies and processes.


text: Cybersecurity Risk Management and Strategy Our global reach and the ever-evolving threat landscape makes data security and privacy a critical priority for us. Our Director of Cybersecurity and Technology Risk Management and their global cybersecurity team reports to our Chief Technology Officer and together, they are responsible for our network security, cybersecurity risk management processes, and business continuity. This team partners with leaders from all of our global regions to align our cybersecurity risk management processes and strategic goals with our business priorities and to ultimately mitigate cybersecurity risk at C.H. Robinson.


text: Our global cybersecurity team has experience and expertise supporting mitigation of the potential cybersecurity threats facing our organization and vulnerabilities facing our technology infrastructure and potential cybersecurity threats. Our Director of Cybersecurity and Technology Risk Management has over a decade of experience leading cyber security oversight, and others on our global cybersecurity team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional, CompTIA, Offensive Security Certified Professional, Certificate of Cloud Security Knowledge, Global Information Assurance Certification ("GIAC"), Certified Incident Handler certifications. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete cybersecurity trainings at least once a year and have access to more frequent cybersecurity trainings. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings. Program performance is reported to and monitored by senior leadership and the Audit Committee on a quarterly basis.


text: The Company maintains an Enterprise Risk Management ("ERM") program, which includes processes for key risk identification, mitigation efforts, and day-to-day management of risks, including cybersecurity risks. The ERM program is administered by our Internal Audit department and involves our global cybersecurity team, which possesses significant knowledge and expertise in the area of cybersecurity risks.


text: Our global cybersecurity team ensures the cybersecurity risks identified from the ERM program are incorporated into our overall cybersecurity program. Programs to address key cybersecurity risks have been put into place including layered coverage with focus areas and practices designed to address network and endpoint security, application security, and security operations. We also employ automated detection and event correlation techniques and alerting as well as integrate cyber threat intelligence into our processes. Our security operations center serves as the front line of these alerts and investigates and remediates threats as necessary. Although it is difficult to determine the potential impacts from a cybersecurity incident, we may experience negative impacts such as reputational harm, inability to retain existing customers or attract new customers, exposure to legal claims and government action, among others. Previous attacks on our operating systems have not had a material financial impact on our operations, but we cannot guarantee future attacks will have little to no impact on our business. Furthermore, given the interconnected nature of the supply chain and our significant presence in the industry, we believe we may be an attractive target for such attacks. The impact of a cybersecurity incident may have a material adverse impact on our financial condition, results of operations, availability of our systems, and growth prospects, which makes cybersecurity risk management of critical importance to our organization.


text: Although we have internally developed the majority of our line of business applications, we also rely on technology provided by third parties. We have processes in place to oversee and identify risks from cybersecurity threats associated with the use of third-party technology including third-party risk management, process and partner intake risk assessments, and dedicated procurement functions. These processes help mitigate the risks associated with utilizing external technology platforms and help prevent disruptions to our business operations.


text: We have processes and programs in place to meet our global compliance obligations and work with our employees and teams across the globe to ensure security and data protection principles are integrated into the way we do business every day. We utilize a set of controls that integrate guidance from the EU's General Data Protection Regulations and align with the U.S. National Institute of Standards and Technology's ("NIST") framework. We undergo a regular independent assessment of our operational and strategic maturity across NIST controls and summary performance is shared with senior leadership including our board of directors. In addition, we submit to independent assessments by external parties, including System and Organizational Controls ("SOC") 2 Type 2 audits, covering customer-facing and line-of-business applications to ensure all safeguards function as they should. These functions are also supported by internal compliance teams who perform additional layers of testing prior to SOC 2 Type 2 procedures.


text: Our Technology Continuity program follows industry standards for disaster recovery practices, including close alignment with ISO 27031:2011 and the Disaster Recovery Institute International's Professional Practices. Our program includes multiple components that act as an additional line of defense—among them are regular functional recovery and tabletop exercises; cybersecurity exercises; protected backups for critical data; recovery time objectives; and recovery point objectives including achievability metrics, application criticality tiering, program audit and maintenance, awareness and training, business impact analysis, and risk evaluation and controls.


text: Cybersecurity Governance The Board of Directors is tasked with oversight of the Company's cybersecurity, information governance, and privacy programs. The Audit Committee oversees our ERM program and receives semi-annual ERM updates, which include cyber-related risk items. In addition, our Audit Committee receives quarterly reports on cybersecurity from our Chief Technology Officer and our Director of Cybersecurity and Technology Risk Management. Our Director of Cybersecurity and Technology Risk Management and their global cybersecurity team has experience and expertise supporting mitigation of the potential cybersecurity threats facing our organization and vulnerabilities facing our technology infrastructure and potential cybersecurity threats.


text: We have also established a cross-functional project team of subject matter experts from across the organization to quickly analyze, mitigate, and remediate potential cybersecurity incidents or vulnerabilities and comply with cybersecurity related reporting requirements. The details of any such cybersecurity incidents or threats are included in the quarterly reports to the Audit Committee.


text: Cybersecurity Risk Management and Strategy Our global reach and the ever-evolving threat landscape makes data security and privacy a critical priority for us. Our Chief Information Security Officer and their global cybersecurity team reports to our Chief Technology Officer and together, they are responsible for our network security, cybersecurity risk management processes, and business continuity. This team partners with leaders from all our global regions to align our cybersecurity risk management processes and strategic goals with our business priorities and ultimately mitigate cybersecurity risk at C.H. Robinson.


text: Our global cybersecurity team has experience and expertise with potential cybersecurity threats and supporting mitigation of the potential cybersecurity threats facing our organization and vulnerabilities facing our technology infrastructure. Our Director of Cybersecurity and Technology Risk Management has over a decade of experience leading cyber security oversight, and others on our global cybersecurity team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional, CompTIA, Offensive Security Certified Professional, Certificate of Cloud Security Knowledge, Global Information Assurance Certification, Certified Incident Handler certifications. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete cybersecurity trainings at least once a year and have access to more frequent cybersecurity trainings. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings. Program performance is reported to and monitored by senior leadership and the Audit Committee on a quarterly basis.


text: Our information technology ("IT") function manages IT operations and continually evolves our systems to meet the constantly changing digital environment. We enhanced our workstation, server, email security, and network monitoring with managed detection and response and alerting capabilities. We perform periodic cybersecurity risk assessments to identify, assess, and prioritize potential risks to information, data assets, and infrastructure. The Company addresses identified risks and develops and implements controls to mitigate issues. The Company engages third parties in connection with its cybersecurity processes as appropriate. The Company has established processes to identify risks from cybersecurity threats associated with its third-party service providers.

companyName: STONERIDGE INC

ticker: SRI


text: We make every effort to comply with the GDPR and implement best practices including annual review of our Data Protection Policy. We also train employees to maintain secure systems, and access control measures, and regularly monitor and test our networks to protect data, payment information, and personally identifiable information.


text: Our global cybersecurity team helps ensure the cybersecurity risks identified from the ERM program are incorporated into our overall cybersecurity program. Programs to address key cybersecurity risks have been put into place including layered coverage with focus areas and practices designed to address network and endpoint security, application security, and security operations. We also employ automated detection and event correlation techniques and alerting as well as integrate cyber threat intelligence into our processes. Our security operations center serves as the front line of these alerts and investigates and remediates threats as necessary. We also perform regular vulnerability assessments and penetration tests. Although it is difficult to determine the potential impacts from a cybersecurity incident, we may experience negative impacts such as reputational harm, inability to retain existing customers or attract new customers, exposure to legal claims and government action, among others. Previous attacks on our operating systems have not had a material financial impact on our operations, but we cannot guarantee future attacks will have little to no impact on our business. Furthermore, given the interconnected nature of the supply chain and our significant presence in the industry, we believe we may be an attractive target for such attacks. The impact of a cybersecurity incident may have a material adverse impact on our financial condition, results of operations, availability of our systems, and growth prospects, which makes cybersecurity risk management of critical importance to our organization.


text: We also involve external cybersecurity experts to assess our cybersecurity program, risk management, and relevant internal controls. In addition to our cybersecurity programs and policies, the Company also purchases a cybersecurity risk insurance policy to limit its exposure to cybersecurity incidents.


text: We have processes and programs in place to meet our global compliance obligations and work with our employees and teams across the globe to ensure security and data protection principles are integrated into the way we do business every day. We utilize a set of controls that integrate guidance from the EU's General Data Protection Regulations and align with the U.S. National Institute of Standards and Technology's ("NIST") framework. We undergo a regular independent assessment of our operational and strategic maturity across NIST controls and summary performance is shared with senior leadership including our board of directors. In addition, we submit to independent assessments by external parties, including System and Organizational Controls ("SOC") 2 Type 2 audits, covering customer-facing and line-of-business applications to ensure all safeguards function as they should. These functions are also supported by internal compliance teams that perform additional layers of testing prior to SOC 2 Type 2 procedures.


text: Our Technology Continuity program follows industry standards for disaster recovery practices, including close alignment with ISO 27031:2011 and the Disaster Recovery Institute International's Professional Practices. Our program includes multiple components that act as an additional line of defense—among them are regular functional recovery and tabletop exercises; cybersecurity exercises; protected backups for critical data; recovery time objectives; and recovery point objectives, including achievability metrics, application criticality tiering, program audit and maintenance, awareness and training, business impact analysis, and risk evaluation and controls.


text: Cybersecurity Governance The Board of Directors is tasked with oversight of the Company's cybersecurity, information governance, and privacy programs. The Audit Committee oversees our ERM program and receives semi-annual ERM updates, which include cyber-related risk items. In addition, our Audit Committee receives quarterly reports on cybersecurity from our Chief Technology Officer and our Director of Cybersecurity and Technology Risk Management. Our Director of Cybersecurity and Technology Risk Management and their global cybersecurity team has experience and expertise with potential cybersecurity threats and supporting mitigation of the potential cybersecurity threats facing our organization and vulnerabilities facing our technology infrastructure.


text: Cybersecurity Risk Management and Strategy The Company has processes in place to identify, assess, and monitor material risks from cybersecurity threats, which are part of the Company's overall cybersecurity risk management strategy and have been embedded in the information systems operating procedures and internal controls.


text: The Company has established a cybersecurity policy which requires mandatory compliance of all Company directors, officers, employees, interns, consultants, and contractors. The Company has also established cybersecurity and information security awareness training programs. Employees with access to the Company's network receive annual training on topics such as phishing, malware, and other cybersecurity risks. Training is administered and tracked through online learning modules.


text: We work to continually evolve our systems to meet the constantly changing digital environment and continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. There have been no risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. The nature of potential cybersecurity risks and threats are uncertain, and any future incidents, outages or breaches could have a material adverse effect on the Company's business, financial conditions or results of operations. For more information about the cybersecurity risks we face, refer to the Risk Factors in section "Information Technology and Cybersecurity Risks" in Part I, Item 1A, "Risk Factors".


text: Cybersecurity Governance The Company's Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. The Audit Committee of the Board of Directors is responsible for board-level oversight of cybersecurity risk, and the Audit Committee regularly reports risks and compliance actions to the Board. As part of its' oversight role, the Audit Committee receives reporting about the Company's strategy, programs, incidents and threats, and other developments and action items related to cybersecurity regularly throughout the year, including through periodic updates from the Chief Information Officer ("CIO").


text: Our cybersecurity program is managed by our Director of Global IT Architecture and Cybersecurity (the "Cybersecurity Director"), and our CIO, who reports directly to our Chief Executive Officer. Our CIO and Cybersecurity Director each have over 30 years of experience leading numerous business and technology initiatives and global cross-functional projects to improve the Company's business systems, infrastructure, and processes, including extensive experience assessing and managing cybersecurity programs and risk. Our CIO and the IT function monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the processes described above, including the operation of the Company's incident response plans, which include appropriate escalation to the executive team and the Audit Committee. As discussed above, the CIO reports at least semiannually to the Audit Committee about cybersecurity threat risks, among other cybersecurity related matters.


text: Our information technology ("IT") function manages IT operations and continually evolves our systems to meet the constantly changing digital environment. We enhanced our workstation, server, email security, and network monitoring with managed extended detection and response and alerting capabilities. We perform periodic cybersecurity risk assessments to identify, assess, and prioritize potential risks to information, data assets, and infrastructure. The Company addresses identified risks and develops and implements controls to mitigate issues. The Company engages third parties in connection with its cybersecurity processes as appropriate. The Company has established processes to identify risks from cybersecurity threats associated with its third-party service providers.


text: Cybersecurity Governance The Company's Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. The Audit Committee of the Board of Directors is responsible for board-level oversight of cybersecurity risk, and the Audit Committee regularly reports risks and compliance actions to the Board. As part of its oversight role, the Audit Committee receives reporting about the Company's strategy, programs, incidents and threats, and other developments and action items related to cybersecurity regularly throughout the year, including through periodic updates from the Chief Information Officer ("CIO").


text: Members of the Board and Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, mergers and acquisitions, and other relevant matters.

companyName: JUNIPER NETWORKS INC


text: Risk Management and Strategy Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats; effective management of security risks; and resiliency against incidents. Our cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, employee training, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. We implement risk-based controls to protect our information, the information of our customers, suppliers and other third parties, our information systems, our business operations, and our products and related services. We have adopted security-control principles based on the National Institute of Standards and Technology (the "NIST") Cybersecurity Framework.

companyName: SONIC AUTOMOTIVE INC

ticker: SAH


text: We leverage technology for our business advantage and have invested in internal and external business applications. Our regular operations involve handling sensitive data, including proprietary business information, intellectual property, and personally identifiable information of our customers, suppliers, and employees. To ensure the safety of this data, the Vice President of Information Security provides oversight and establishes central, standardized frameworks for identifying and tracking cyber-related business and compliance risks across the Company. Any risks from cybersecurity threats to our products and services are communicated to our general counsel and senior management and if deemed material, are further reviewed by the Audit Committee of our Board of Directors. We also periodically engage third-party consultants to help us assess, enhance, implement and monitor our cybersecurity risk management programs and respond to any incidents.


text: We have experienced, and may in the future experience, whether directly or through our supply chain or other channels, cybersecurity incidents. While prior incidents have not materially affected our business strategy, results of operations or financial condition, and although our processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cyber incident would not materially affect our business strategy, results of operations or financial condition. See "General Risk Factors" in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: Our Board of Directors is responsible for overseeing enterprise risk and has delegated the responsibility for the oversight of cybersecurity and information technology risks, and the Company's preparedness for these risks, to the Audit Committee. Our Vice President of Information Security provides periodic updates to the Audit Committee in order to assist the Audit Committee in understanding the implications of cybersecurity risks. The Audit Committee meets regularly to ensure a shared understanding of cybersecurity risks, to review new regulations or laws, and to provide guidance on complex risk issues.


text: Our Information Security team has gained their expertise in information technology ("IT") and cybersecurity through a combination of education, relevant degrees, certifications and prior work experience. As part of the cybersecurity process, their respective teams inform them about the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: The Information Security team has adopted the NIST Cybersecurity Framework as a reference to manage cybersecurity risks. This framework enables the team to implement a comprehensive statement of activities and responsibilities that cover data, information architecture, risk communications, emerging technology, third-party risk, IT operations, and regulation. By following industry best practices, the team has established a recognized baseline for engaging external firms to audit and test the resiliency of the cybersecurity program.


text: Our CISO oversees our cybersecurity risk management program in partnership with our CIO and other business leaders, including our General Counsel. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above.


text: We have experienced, and may in the future experience, whether directly or through our supply chain or other channels, cybersecurity incidents. Specifically, on June 19, 2024, CDK, a third-party provider of certain information systems, notified us that CDK had suspended certain systems used by us in response to a cybersecurity incident impacting CDK. As a result, we experienced disruptions to our dealer management system (the "DMS"), our customer relationship management system (the "CRM") and other systems that support sales, inventory and accounting functions (collectively with the DMS and CRM the "Affected Systems"). On June 26, 2024, CDK began restoring access to certain of the Affected Systems. We performed internal risk assessments and data validation procedures on the Affected Systems, and beginning June 30, 2024, we resumed processing transactions in the DMS. As of July 31, 2024, we regained access to all of the Affected Systems, including the CRM and inventory management applications. As a result of the CDK outage, our business and results of operations during the second and third fiscal quarters of 2024 were adversely affected. Although we have been working with CDK and other information technology vendors and taking steps to strengthen our systems infrastructure, and our processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that another cyber incident would not materially affect our business strategy, results of operations or financial condition. See "General Risk Factors" in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.

stage1Category: Incident Disclosure


text: The Information Security team has adopted the NIST Cybersecurity Framework as a reference to manage cybersecurity risks. This framework enables the team to implement a comprehensive statement of activities and responsibilities that cover data, information architecture, risk communications, emerging technology, third-party risk, IT operations, and regulation. By following industry best practices, the team has established a recognized baseline for engaging external firms to audit and test the resiliency of the cybersecurity program. SONIC AUTOMOTIVE, INC.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, internal operational risks; system security risks; data protection; risks to proprietary business information; intellectual property theft; fraud; extortion; harm to employees, partners, or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage such material risks.


text: To aide in identifying and assessing material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity risks alongside other significant company risks as part of our overall risk assessment process. As part of this process, the Company gathers input from subject matter specialists, as necessary, to gather insights to help in identifying and assessing material cybersecurity threat risks, as well as potential severity and mitigation measures. We also have a cybersecurity specific risk assessment process, which helps identify potential cybersecurity risks. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to inform our professionals' risk identification and assessment.


text: We manage these known risks by using internal security controls designed to align with standards set by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO"), and the Center for Internet Security ("CIS"), and by engaging third party experts to perform penetration tests to attempt to infiltrate our information systems, as such term is defined in Item 106(a) of Regulation S-K. These penetration tests are focused on specific objectives to assist us in managing our cybersecurity threat risks. Our maturity in these controls varies by control type and by business.


text: We also conduct the following activities at various intervals during the year, which vary in maturity across our business: • monitor emerging data protection laws and implement changes from time-to-time to our processes designed to comply; • undertake regular reviews of our customer facing policies and statements related to cybersecurity; • through policy, practice, and contract (as applicable) require employees, who provide services on our behalf, to treat customer information and data with care; • leverage the NIST incident handling framework to help us prepare, detect, analyze, contain, eradicate, respond, and recover when there is an actual or potential cybersecurity incident; • run exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • run exercises to simulate a response to a cybersecurity incident to provide training to our cyber incident response team; • run annual tabletop exercises to train our executives and increase their cybersecurity awareness; • conduct a variety of information security and privacy trainings, including new employee training, job-specific security training, specialized training for IT and security personnel, and phishing simulations. • hold an annual Cybersecurity Awareness Month programming, which is available for all employees during which we provide seminars, presentations, and employee engagement activities designed to reinforce our employee information security training and enhance the culture and knowledge of cybersecurity risks among our employees; • carry information security risk insurance to help defray potential losses that might arise from a cybersecurity incident.


text: Our cybersecurity incident response plan was developed to respond to the threat of security breaches, the threat of cyberattacks, and to protect and preserve the confidentiality, integrity, and continued availability of information owned by, or in the care of, the Company. Our incident response plan coordinates the activities that we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate material cybersecurity incidents to our global crisis management plan, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: Our processes also address cybersecurity threat risks associated with our use of third party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits.


text: We regularly engage with assessors, consultants, auditors, and other third parties, including by regularly having third parties, including independent Qualified Security Assessors review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.


text: In our risk factors, we describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. See our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Board has oversight responsibility for the Company's Enterprise Risk Management framework. The Board as a whole and through the various Board committees oversees the Company's management of material enterprise level risk, focusing on four areas of risk: strategic, compliance, operational, and financial. To fulfill its oversight responsibility, the Board also regularly reviews, consults, and discusses with management on strategic direction, challenges, and risks faced by the Company.


text: As part of our entire Board's operational risk management responsibilities, it has oversight of risks from cybersecurity threats. The Audit Committee has been designated with the responsibility to regularly review the Company's processes and procedures around managing cybersecurity threat risks and cybersecurity incidents. As discussed below, members of management report to the Audit Committee which reports to the entire Board about cybersecurity threat risks, among other cybersecurity related matters, at least annually.


text: In support of the Board's oversight of the Company's cybersecurity risk management program, the Audit Committee receives (i) quarterly updates or reports delivered directly from our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") and (ii) three reports delivered as part of the Company's enterprise risk management update to the Audit Committee. These reports may be supplemented, as needed, by the CIO, CISO, and other executives at the Company. These reports include a variety of cybersecurity topics, such as threat risk management updates, the results of exercises and response readiness assessments, our incident response plan, and steps management has taken to respond to such threat risks. In such sessions, the Audit Committee receives materials including a cybersecurity scorecard and other materials indicating current and emerging material cybersecurity threat risks, and describing the Company's ability to mitigate those risks, and discusses such matters with our CIO and CISO.


text: Our CIO has developed expertise in cybersecurity and compliance, enterprise architecture and road mapping, data and analytics, digital transformation and customer service through her 39 years of experience in the information technology space. She earned her computer science degree from Temple University and currently teaches in the Masters in Information Systems program at University of San Francisco. Our CISO has worked in cybersecurity for 25 years, including thirteen years as a CISO or deputy CISO. He is currently a Certified Information Systems Security Professional and holds an Information Systems Security Architecture Professional sub-certification (CISSP-ISSAP). He also holds a masters of science degree in computer science, with an information security specialization from James Madison University.


text: To aid in identifying and assessing material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity risks alongside other significant company risks as part of our overall risk assessment process. As part of this process, the Company gathers input from subject matter specialists, as necessary, to gather insights to help in identifying and assessing material cybersecurity threat risks, as well as potential severity and mitigation measures. We also have a cybersecurity specific risk assessment process, which helps identify potential cybersecurity risks. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to inform our professionals' risk identification and assessment.


text: We manage these known risks by using internal security controls incorporating principles from standards set by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO"), and the Center for Internet Security ("CIS"), and by engaging third party experts to perform penetration tests to attempt to infiltrate our information systems, as such term is defined in Item 106(a) of Regulation S-K. These penetration tests are focused on specific objectives to assist us in managing our cybersecurity threat risks. Our maturity in these controls varies by control type and by business.


text: We also conduct the following activities at various intervals during the year, which vary in maturity across our business: • monitor emerging data protection laws and implement changes from time-to-time to our processes designed to comply; • undertake regular reviews of our customer facing policies and statements related to cybersecurity; • through policy, practice, and contract (as applicable) require employees, who provide services on our behalf, to treat customer information and data with care; • leverage the NIST incident handling framework to help us prepare, detect, analyze, contain, eradicate, respond, and recover when there is an actual or potential cybersecurity incident; • run exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • run exercises to simulate a response to a cybersecurity incident to provide training to our cyber incident response team; • run tabletop exercises to train our executives and increase their cybersecurity awareness; • conduct a variety of information security and privacy trainings, including new employee training, job-specific security training, specialized training for IT and security personnel, and phishing simulations. • hold an annual Cybersecurity Awareness Month programming, which is available for all employees during which we provide seminars, presentations, and employee engagement activities designed to reinforce our employee information security training and enhance the culture and knowledge of cybersecurity risks among our employees; • carry information security risk insurance to help defray potential losses that might arise from a cybersecurity incident.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits.


text: Members of the Board and Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, mergers and acquisitions, and other relevant matters.


text: Our CISO oversees our cybersecurity risk management program in partnership with our CIO and other business leaders, including our General Counsel. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above.


text: Our CIO has developed expertise in cybersecurity and compliance, enterprise architecture and road mapping, data and analytics, digital transformation and customer service through her 40 years of experience in the information technology space. She earned her computer science degree from Temple University and currently teaches in the Masters in Information Systems program at University of San Francisco. Our CISO has worked in cybersecurity for 26 years, including thirteen years as a CISO or deputy CISO. He is currently a Certified Information Systems Security Professional and holds an Information Systems Security Architecture Professional sub-certification (CISSP-ISSAP). He also holds a masters of science degree in computer science, with an information security specialization from James Madison University.


text: The Company's Board of Trustees recognizes the critical importance of maintaining the trust and confidence of the Company's customers, business partners, employees and other stakeholders. The Board, in coordination with the Audit Committee, is actively involved in the oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cyber risk management program is fully integrated into the Company's broader ERM program and includes cybersecurity policies, standards, processes and practices that are based on recognized frameworks and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, company-wide cyber risk program that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: EPR PROPERTIES

ticker: EPR