text: We have a unified and centrally-coordinated team, led by our Vice President of IT, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at Globus in close coordination with senior leadership and other teams across Globus. Reporting to our Vice president of IT are a number of trained information security professionals. In addition to our extensive in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying and managing cybersecurity risks.


text: Our cybersecurity risks and associated mitigations are evaluated by senior leadership, including as part of our risk assessments that are reviewed by the Audit Committee and our Board of Directors. Additional information about cybersecurity threats we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "We are subject to data privacy laws and our failure to comply with them could subject us to substantial liabilities," which should be read in conjunction with the information above.

companyName: GLOBUS MEDICAL INC

ticker: GMED

secItem: Item 1C


text: The Board of Directors, which is comprised of independent directors, oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks. They receive reports regarding such risks from management, including our Vice President of IT. They also oversee the response to any significant cybersecurity incidents. Our Vice President of IT, who has extensive cybersecurity knowledge and skills gained from over 25 years of work experience, heads the team responsible for implementing and maintaining cybersecurity and data protection practices at Globus and reports directly to the Chief Operating Officer.

stage1Category: Board Governance

stage1Method: unanimous


text: Risk management and strategy We have established processes designed to identify, assess and manage material risks associated with cybersecurity threats. Our information technology, networks, and infrastructure have been and may in the future be subject to damage, disruptions, or shutdowns due to cyber-attacks, malware, employee or third-party error or malfeasance, power outages, communication or utility failures, systems failures, natural disasters or other catastrophic events. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risks, and reputational risks.

companyName: Frontier Communications Parent, Inc.

stage1Category: Risk Management Process


text: Cybersecurity risk management is embedded in the annual enterprise risk management ("ERM") process, which is jointly administered by the Chief Financial Officer and head of Internal Audit and overseen by the Board of Directors, primarily through the Audit Committee. As part of the ERM process, senior management annually, or more frequently as necessary, identifies, assesses and evaluates enterprise level risks using a range of tools and services.


text: In order to manage identified cybersecurity risks, we evaluate a range of remediation options and determine the appropriate course of action for effective monitoring, mitigation and treatment. Areas that have a higher level of likelihood and potentially higher level of impact are prioritized. Periodic monitoring, self-assessment and reporting to the Audit Committee are performed by senior management to evaluate, among other things, the effectiveness of mitigation strategies in minimizing or managing identified risks. In addition to critical risk management, we conduct regular exercises and simulations to review and continuously improve our incident response protocols, we work to upgrade our existing technology systems to enhance our overall security posture and we provide ongoing employee training around cyber risks. For example, employees are required to complete cybersecurity training and receive ongoing education which includes simulated phishing attacks and communications for recognizing evolving threats.


text: The reports include information on any attacks or potential breaches within the Company as well as security events at third-party providers when the breach or potential breach may affect the Company. This process allows the Company to involve both senior management and third-party service providers, including forensic analysts, other cyber experts, and outside counsel, as necessary in order to combat potential threats and help ensure appropriate and timely responses to threats, and mitigation and remediation of any incidents.

companyName: CHEMED CORP

ticker: CHE


text: As of the date of this report, we have not experienced any cybersecurity incidents that [we have determined] have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. We describe whether and how risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in our risk factor disclosures under the heading "We rely on network and information systems and other technology, and a disruption or failure of such networks, systems or technology as a result of cyber-attacks, malware, misappropriation of data or other malfeasance, as well as outages, accidental releases of information or similar events, may disrupt our business and materially impact our results of operations, financial condition and cash flows" in Item 1A of this Annual Report on Form 10-K.

stage1Category: Strategy Integration


text: Frontier's management is primarily responsible for governing and overseeing cybersecurity risks. Operational responsibility for ensuring the adequacy and effectiveness of the Company's cybersecurity risk management, control and governance processes is assigned to the SVP, Cyber Security (CISO). Our CISO has over 20 years of experience in IT, cyber security and data privacy and data management and reports directly to the EVP, Chief Digital and Information Officer (CDIO). Our CDIO has over 25 years of experience, having previously held senior leadership positions in technology, IT and operations at large public companies prior to joining Frontier.

stage1Category: Management Role

stage1Method: majority


text: To assist with management oversight, the CDIO chairs a security council which supports risk management by providing input into cyber security strategy and helps prioritize monitoring, mitigation and remediation across operational groups. This security council is comprised of senior leaders from a cross-functional group of departments including Legal and Regulatory, Corporate Security, Network Engineering, Internal Audit, Finance & Accounting and Risk and IT Infrastructure. In addition, we have established processes and response teams that are responsible for monitoring and making determinations regarding the materiality of cybersecurity incidents. The members of these teams have extensive expertise in evaluating the potential impact and materiality of events in the context of Frontier's business and financial position, reputational and industry risk, and legal and regulatory environment, and there are procedures in place to escalate potentially material incidents for consideration by the Audit Committee. For example, the Audit Committee was actively involved in the review, disclosure and mitigation of the reported April 2024 cyber-attack. See Item 1A "Risk Factors" for a further discussion of cybersecurity risks.


text: While material risks are generally overseen by the full Board of Directors, the Audit Committee has a key role in cybersecurity risk monitoring and oversight as set forth in its charter. In establishing Audit Committee membership, the Nominating & Corporate Governance Committee identifies directors with relevant IT, network and cyber expertise to serve on the Committee. The CDIO and CISO provide periodic reports to the Audit Committee on the Company's data privacy and information and infrastructure security programs, including cybersecurity risks. In addition, senior management reports to the Board of Directors at least annually on cybersecurity risks.


text: The Company treats cybersecurity risk seriously and is focused on maintaining and regularly updating the security of our systems, networks, technologies and data.


text: The number and sophistication of attempts to disrupt or penetrate our systems continues to grow, specifically including the rapid increase of attempts against healthcare companies that has been observed since early 2022. To combat the ever-increasing sophistication of cyberattacks, we continuously work to improve methods for detecting and preventing attacks. We have implemented policies and procedures and developed specific training for our employees, including regular updates and reminders, to help prevent and mitigate any issues that may be caused by any attacks. Further, we regularly engage independent third-party cyber experts to test for vulnerabilities in our environment. We also conduct our own internal simulations to help assess and strengthen our defenses.


text: We acknowledge that cyberattack risk may occur with our third-party technology service providers. High-profile cyberattacks have occurred at healthcare companies, credit bureaus, financial institutions, and other businesses for the purpose of acquiring the confidential information of individuals, including potential customers and patients. We take significant measures to prevent and mitigate issues caused by any such attacks, including outreach to our providers and other third-parties that we engage with, in order to ascertain any potential downstream implications of known breaches.


text: The Company has integrated our cybersecurity prevention and mitigation processes into our overall risk management system and processes. The Chief Technology Officer of Roto-Rooter and the Chief Technology Officer and Chief Information Officer of VITAS are senior executives, with decades of experience in preventing, assessing and managing cybersecurity threats in the private sector as well as government. Both Roto-Rooter and VITAS employ teams of experienced cybersecurity professionals who report to the respective Chief Technology Officer and Chief Information Officer. Both businesses have security incident response plans, pursuant to which they report on the cybersecurity status of the businesses to the Company's Chief Financial Officer and Controller and Chief Legal Officer both regularly as a matter of course, as well as in the event of any potentially material incident. Additionally, Company senior management reports to the Audit Committee on cybersecurity issues on a regular basis, multiple times a year. The Audit Committee 's reports to the board after these sessions, include the discussions of the cybersecurity risk management process.


text: To date, the increase in cyberattacks has not resulted in any material disruption of our operations or material harm to our customers or patients. However, while we have significant internal resources, policies and procedures designed to prevent or limit the effect of the possible failure, interruption or security breach of our information systems, there can be no assurance that any such failure, interruption or security breach will not occur in the future, or if they do occur, that they will be adequately addressed. Please also reference additional disclosures about cybersecurity in Item 1A Risk Factors, under both Roto-Rooter and VITAS sections.


text: Incident Response Policy The Board of Directors is responsible for overseeing the risks from cybersecurity threats. Each month, the Board is presented with the executive overview of the Cybersecurity Continuous Monitoring Review Report (" Report ") prepared by the Company's third-party chief information security officer. The Board of Directors reviews the Report each month and, if warranted, directs senior management of the Company to take necessary and appropriate actions in accordance with the IR Policy (as defined below).

companyName: NORWOOD FINANCIAL CORP

ticker: NWFL


text: Wayne Bank has adopted an Incident Response Policy (the "IR Policy") for responding to cybersecurity incidents. This IR Policy applies to both potential and actual incidents. The IR Policy should be invoked in any context where the Bank believes that an incident may have occurred. The IR Policy applies to all employees, contractors, and third parties. The objectives of the IR Policy are to ensure the protection of customer data and all organization assets from security incidents and ensure timely detection, mitigation, and communication of security incidents to appropriate parties.


text: Implementation of the IR Policy requires cross-functional efforts from across the organization. The roles/functions involved and the related responsibilities in enforcing the IR Policy are spread across the entire organization of the Bank's senior leadership and chief credit officer.


text: Once the possibility of a cybersecurity incident has been noted, employees assigned to appropriate teams do the necessary research and analysis to confirm either that there is an incident requiring additional action, or that no further action is necessary. This will typically involve some combination of Operations and Information Technology. If an incident is confirmed, an incident response team is formed, and the team takes steps to contain the incident to limit damage, eradicate the incident to restore our full control of all Bank systems and eliminate unauthorized access, and recover data and full functionality. Detection and analysis continue during this phase as necessary to ensure that this phase has been successfully executed. This phase also involves communication as needed with employees, customers, partners and service providers, legal representatives, insurance provider, law-enforcement authorities, and regulatory bodies as necessary and appropriate.


text: In the post-incident phase, the Bank analyzes the root cause of the incident, identifies any changes that need to be made to policies, procedures, training, documentation, and technology to protect against similar incidents in the future, and institutes a plan to implement them. In addition, the Bank undertakes any additional communication with the necessary parties and the public, if appropriate, and the Bank's legal representatives, insurance provider, law-enforcement authorities, and regulatory bodies as appropriate to fully address the impact of the incident, and fully documents the entire incident.


text: During the fiscal year ended December 31, 2024, the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, its business strategy, results of operations, or financial condition.


text: Risk Management and Strategy Overview the protect connection with the services we provide. The Company realizes that cyber incidents can have financial, reputational, and operational impacts that can significantly adversely affect our customers, capital, and earnings. Therefore, we integrate cybersecurity processes throughout the Company as part of our enterprise-wide governance process. Regulatory agencies are the cybersecurity are the the cybersecurity the Federal Financial Institutions Examination Council ("FFIEC"). framework offers a set of guidelines financial institutions manage and mitigate cybersecurity risks effectively. It focuses on ensuring the confidentiality, of sensitive information and systems. Compliance Department the Bank cybersecurity and the Risk Committee of our Board of Directors.

companyName: USCB FINANCIAL HOLDINGS, INC.

ticker: USCB


text: program, periodic risk assessments are performed the Company's cybersecurity risk, the maturity level of the program, the risk of cyber threats, and the effectiveness practice. The the National Institute of Standards and Technology ("NIST") Framework and the FFIEC's Cybersecurity Assessment ("Cybersecurity Assessment") Company's cybersecurity posture.


text: of rigorous procedures training initiatives for both management and staff, the institution cultivates a safe cybersecurity environment. This approach including security fortifying the institutions cybersecurity controls and fostering a resilient operational framework.


text: It is the policy of the Company and its technology service providers they can identify, malware and invasive attacks such as phishing, ransomware, malware, etc. Continuity Plan, capabilities.


text: The Company realizes that it faces a variety of risks from cyber-attacks involving destructive malware, including such as such, it is the the Company that its risk management these risks by: Establishing


text: The Cybersecurity Committee (the "Committee") of the General Partner is responsible for overseeing cyber and information security. The Committee meets at least quarterly to discuss cybersecurity risks and frequently holds more informal discussions in the interim. The Committee is subject to oversight by the board of directors of the General Partner (the "Board"). The Committee is co-chaired by the General Partner's President/Chief Operating Officer, Chief Technology Officer/Co-Head of Trading, and General Counsel/Chief Compliance Officer who oversee day-to-day implementation of cyber and information security by employees with specialized expertise and experience in such matters. The Board is kept apprised of the cybersecurity policies and procedures on a formal basis at least annually, and is kept informed on a less formal basis through participation in training and policy updates. The Committee meets at least quarterly to discuss and review testing, cybersecurity risks/events and all other relevant matters. Committee members are given the opportunity at these meetings to ask questions of all relevant personnel.

companyName: Millburn Multi-Markets Fund L.P.


text: The General Partner utilizes a combination of statistics, data and testing by third party service providers and software in order to monitor and identify cybersecurity threats. To the extent those threats require immediate attention, they are dealt with and reported to the Committee thereafter in accordance with the procedures outlined in the General Partner's incident response plan. Other threats, as well as follow ups once threats are properly dealt with, are then discussed and analyzed by the Committee. Reports on these activities are discussed with the Board on at least an annual basis, with any material issues raised promptly to the Board as well.


text: To assess the effectiveness of the General Partner's cybersecurity programs and to mitigate exposure, the General Partner has consulted with strategic partners, such as outside counsel specializing in this subject matter as well as the General Partner's cyber insurance provider. The General Partner also undertook a table top exercise designed to identify and mitigate issues and train personnel.


text: The General Partner's head of risk management (who is also mentioned above as one of the co-chairmen of the Committee) participates in all Committee meetings and, as part of the risk management function, the Committee applies principles of risk management to its information security program. As with all risks identified by the General Partner, risks are identified and evaluated, with higher risk items receiving priority attention.


text: The General Partner has undertaken efforts to mitigate cyber risks and their impact, including, but not limited to, certain implementation of firewalls, anti-virus/anti-malware, controls around remote network access, multi-factor authentication, system event monitoring and notifications and electronic surveillance, frequent backups, encryption and password protection, education and testing, supervision of third parties, limitations on access, vulnerability scanning, patch installation, physical safeguards, virus scanning, and penetration testing.


text: Employees are required to complete initial cybersecurity training upon commencement of employment and, thereafter, on an annual basis. The training is designed by a third party service provider. The General Partner carries cyber insurance. The General Partner maintains formal cybersecurity procedures that are considered during contract review with respect to third party vendors handling and having access to information.


text: The General Partner has no t identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the General Partner or the Partnership's business strategy, results of operation or financial condition. Nonetheless, there is no guarantee that a future cyber incident would not materially affect the General Partner or the Partnership's business strategy, results of operations or financial condition. Despite the various efforts the General Partner has undertaken to mitigate cyber risks and their impact, systems, networks and/or devices potentially can be breached. Such cybersecurity breaches may cause: (i) disruptions and impacts to business operations, potentially resulting in financial losses to the Partnership and limited partners; (ii) interference with the General Partner's ability to calculate the value of an investment; (iii) impediments to trading; (iv) the inability of the Partnership and its service providers to transact business; (v) violations of applicable privacy and other laws; (vi) regulatory fines, penalties, reputational damage, reimbursement or other compensation costs or additional compliance costs; and (vii) the inadvertent release of confidential information. Similar adverse consequences could result from cybersecurity breaches affecting counterparties with which the Partnership engages in transactions; governmental and other regulatory authorities; exchange and other financial market operators, banks, brokers, dealers, insurance companies and other financial institutions; and other parties. In addition, substantial costs may be incurred by these entities in order to prevent any cybersecurity breaches in the future. The nature of malicious cyber-attacks is becoming increasingly sophisticated and the Partnership cannot control the cyber systems and cybersecurity systems of counterparties or third party service providers. While, to date, we have not been subject to cyberattacks that, individually or in the aggregate, have been material to our operations or financial condition, the preventive actions we take to reduce the risks associated with cyberattacks may be insufficient to repel or mitigate the effects of a major cyberattack in the future.


text: The General Partner has written procedures and policies that govern the Partnership's general cybersecurity program. These policies and procedures include, among other things, the identification of risks, locations of information, management of third party risk and incident response, among other factors, and are designed to address real world concerns.

companyName: NESTOR PARTNERS


text: The General Partner has not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the General Partner or the Partnership's business strategy, results of operation or financial condition. Nonetheless, there is no guarantee that a future cyber incident would not materially affect the General Partner or the Partnership's business strategy, results of operations or financial condition. Despite the various efforts the General Partner has undertaken to mitigate cyber risks and their impact, systems, networks and/or devices potentially can be breached. Such cybersecurity breaches may cause: (i) disruptions and impacts to business operations, potentially resulting in financial losses to the Partnership and limited partners; (ii) interference with the General Partner's ability to calculate the value of an investment; (iii) impediments to trading; (iv) the inability of the Partnership and its service providers to transact business; (v) violations of applicable privacy and other laws; (vi) regulatory fines, penalties, reputational damage, reimbursement or other compensation costs or additional compliance costs; and (vii) the inadvertent release of confidential information. Similar adverse consequences could result from cybersecurity breaches affecting counterparties with which the Partnership engages in transactions; governmental and other regulatory authorities; exchange and other financial market operators, banks, brokers, dealers, insurance companies and other financial institutions; and other parties. In addition, substantial costs may be incurred by these entities in order to prevent any cybersecurity breaches in the future. The nature of malicious cyber-attacks is becoming increasingly sophisticated and the Partnership cannot control the cyber systems and cybersecurity systems of counterparties or third party service providers. While, to date, we have not been subject to cyberattacks that, individually or in the aggregate, have been material to our operations or financial condition, the preventive actions we take to reduce the risks associated with cyberattacks may be insufficient to repel or mitigate the effects of a major cyberattack in the future.


text: The Managing Owner has written procedures and policies that govern the Trust's general cybersecurity program. These policies and procedures include, among other things, the identification of risks, locations of information, management of third party risk and incident response, among other factors, and are designed to address real world concerns.

companyName: GLOBAL MACRO TRUST


text: The Cybersecurity Committee (the "Committee") of the Managing Owner is responsible for overseeing cyber and information security. The Committee meets at least quarterly to discuss cybersecurity risks and frequently holds more informal discussions in the interim. The Committee is subject to oversight by the board of directors of the Managing Owner (the "Board"). The Committee is co-chaired by the Managing Owner's President/Chief Operating Officer, Chief Technology Officer/Co-Head of Trading, and General Counsel/Chief Compliance Officer who oversee day-to-day implementation of cyber and information security by employees with specialized expertise and experience in such matters. The Board is kept apprised of the cybersecurity policies and procedures on a formal basis at least annually, and is kept informed on a less formal basis through participation in training and policy updates. The Committee meets at least quarterly to discuss and review testing, cybersecurity risks/events and all other relevant matters. Committee members are given the opportunity at these meetings to ask questions of all relevant personnel.


text: The Managing Owner utilizes a combination of statistics, data and testing by third party service providers and software in order to monitor and identify cybersecurity threats. To the extent those threats require immediate attention, they are dealt with and reported to the Committee thereafter in accordance with the procedures outlined in the Managing Owner's incident response plan. Other threats, as well as follow ups once threats are properly dealt with, are then discussed and analyzed by the Committee. Reports on these activities are discussed with the Board on at least an annual basis, with any material issues raised promptly to the Board as well.


text: To assess the effectiveness of the Managing Owner's cybersecurity programs and to mitigate exposure, the Managing Owner has consulted with strategic partners, such as outside counsel specializing in this subject matter as well as the Managing Owner's cyber insurance provider. The Managing Owner also undertook a table top exercise designed to identify and mitigate issues and train personnel.


text: Risk Management and Strategy We recognize the increasing significance of cybersecurity in the financial industry and the potential risks associated with cyber threats. Our processes to identify, assess and monitor material risks from cybersecurity threats are part of our overall enterprise risk management program and are integrated into our operating procedures, internal controls and information systems. Our risk management program and processes are intended to maintain an effective and comprehensive Cybersecurity Program under the direction of a dedicated Chief Information Security Officer ("CISO"). Our established Cybersecurity Program is mapped to the NIST Cybersecurity framework ("NIST CSF"), Payment Card Industry Data Security Standards ("PCI DSS"), the Center for Internet Security ("CIS") Critical Security Controls, and relevant ISO standards to maintain the confidentiality, integrity, and availability of our information systems, networks, and corporate and customer data. Highlights of the program include the following processes: A security testing schedule, which includes internal/external penetration testing; Regular vulnerability assessments; Detailed vulnerability management; 24/7 Security Operations Center Monitoring and reporting of systems and critical applications; Data loss prevention controls; File access and integrity monitoring and reporting; Threat intelligence; Third-party vendor management.

companyName: Bancorp, Inc.

ticker: TBBK


text: The Company's Security Operations Center ("SOC") functions as the central point for all cybersecurity events that occur on our information systems. The SOC provides end-to-end operations to monitor, detect, alert and respond to any unusual, suspicious or malicious activities. In 2023, we expanded the SOC's operational hours to 24 hours a day, 7 days a week, utilizing both internal and third party resources for that full coverage. We conduct risk assessments and compliance audits against the above-referenced standards and regularly benchmark and evaluate program maturity with industry leaders. We also engage both internal and external auditors and third party information security experts to examine our cybersecurity processes. Additionally, the Company undergoes the PCI certification process and obtains the related certification on an annual basis.


text: Recognizing the interconnected nature of the financial industry, we evaluate and monitor the cybersecurity practices of our third party service providers and partners using a risk-based approach. Our Third Party Oversight Department evaluates new and existing relationships based upon due diligence requirements defined by our Cybersecurity Department to understand and mitigate material risks associated with third party service providers and partners. Risk assessments and audit results in connection with our Cybersecurity Program are reported to senior management and the Board of Directors. Risk owners from our Cybersecurity Program develop risk mitigation plans to resolve any cybersecurity risks identified in risk assessments or audits.


text: We recognize that a successful cybersecurity incident could lead to disruptions in operations, financial loss, reputational damage, and potential legal and regulatory consequences. The Company has a fully implemented incident response program, and internal forensics capabilities with third party forensic experts on retainer. We also maintain business continuity and disaster recovery plans so the Company can more effectively respond to cybersecurity incidents. It is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only partially mitigate and not fully eliminate risks. Events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: Although we believe risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition during the fiscal year ended December 31, 2024, they may in the future, and we continue to closely monitor risks from cybersecurity threats. As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents that have materially affected the Company, including our business strategy, results of operations, or financial condition, in the prior fiscal period. For additional information on the impact of cybersecurity matters on us, see Item 1A, "Risk Factors—We face cybersecurity risks, which could result in a loss of customers, cause disclosure of confidential information, adversely affect our operations, cause reputational damage and create significant legal and financial exposure."


text: Management regularly evaluates and enhances its cybersecurity measures to mitigate cybersecurity risks. The Company's CISO is responsible for all aspects of the Cybersecurity Program, including managing cybersecurity functions, ensuring that cybersecurity staff are adequately skilled and trained in the activities required for their respective job functions, and overseeing corporate cybersecurity initiatives. Under the direction of the CISO, the Cybersecurity Department regularly monitors for enterprise-wide compliance with Cybersecurity Program procedures and regulatory requirements. Our CISO, in collaboration with our Chief Information Officer ("CIO"), Chief Risk Officer ("CRO"), and senior management, drives awareness, ownership and alignment of cybersecurity protocol for effective cybersecurity risk management across all lines of business and corporate functions. The CISO and CIO are responsible for leading enterprise-wide cybersecurity strategy, policy, standards and processes to effectively prevent, detect, mitigate and remediate cybersecurity threats. Our CISO has expertise in cybersecurity, information security risk management, identity and access management, security architecture, application security, vulnerability management, threat intelligence, security operations and incident management and response through prior roles leading information security functions at financial institutions. The CISO holds multiple professional certifications, including Certified Chief Information Security Officer through the International Council of Electronic Commerce Consultants, also known as the EC-Council.


text: -party Security Risk Assessment the potential impact and the this our cybersecurity roadmap and strategies to ensure a robust IT security environment is implemented at our company. We use various tools cybersecurity risk—including, not the the use Managed Endpoint Detection and Response ("EDR") software and Managed Network Detection and Response our Local Area Network ("LAN") ("SOC")

companyName: LESAKA TECHNOLOGIES INC

ticker: LSAK


text: The CISO reports to management's Enterprise Risk Management Committee and quarterly to the Board's Risk Committee regarding the Company's cyber risks and threats, the status of efforts to strengthen information security systems, assessments of the Company's Cybersecurity Program, and the emerging threat landscape. In these meetings and on an ad hoc basis senior management receives periodic reporting from the Cybersecurity Department, Operations Department and Information Technology Department on operational risks and the steps taken to monitor and control cybersecurity exposure.


text: The Board of Directors recognizes the importance of cybersecurity to safeguard confidential information and sensitive data and receives periodic training on cybersecurity risk and best practices for related oversight. To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on these topics. For example, in 2023, the Board hosted an expert to discuss developments in the cybersecurity threat landscape and evaluate the Company's cybersecurity program in the context of the global risk environment.


text: The Board has delegated responsibility for more detailed oversight of the Company's cybersecurity and information security framework to the Risk Committee of the Board. The CISO and CIO provide updates on the cybersecurity threat environment and the Company's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment to the Risk Committee quarterly and to the full Board at least annually and on an ad hoc basis. Additionally, the Risk Committee also reviews and approves the Cyber Risk Management Program Policy and Information Security Program Policy at least annually. Elevation to a full Board communication and/or interaction would occur upon the initiation of a cyber incident response, or a material compromise of business functionality, customer data or network integrity.


text: Risk Management and Strategy We execute a comprehensive cybersecurity program designed to provide structured and thorough cybersecurity risk management and governance. Our cybersecurity program is aligned with industry-wide recognized standards, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Our program prioritizes, among other things, prevention of unauthorized access; protection of sensitive information; detection, assessment, and response to cybersecurity threats; and continuous improvement of our cybersecurity measures. The Company has established comprehensive incident response and recovery plans, regularly tests and evaluates the effectiveness of those plans, and maintains cybersecurity risk insurance.

companyName: MONRO, INC.

ticker: MNRO


text: Our cybersecurity program has a set of controls and priorities with a multi-pronged approach that includes: quarterly cybersecurity awareness training for teammates, monthly phishing simulation testing and other cybersecurity awareness campaigns (e.g., articles, flyers, cybersecurity awareness month); a dedicated security operations team to monitor, analyze, and respond to security threats 24/7; security governance to manage and maintain security processes; intrusion, detection, and prevention systems; a vulnerability management program to identify and remediate security liabilities; a configuration management program to harden systems based on industry standards; industry-leading email security, endpoint detection, and response platforms; threat intelligence from multiple resources to identify and anticipate emerging threats; network and web application firewalls; multi-factor authentication; and network segmentation to isolate and safeguard critical systems and sensitive data.


text: The Company assesses cybersecurity risks on an ongoing basis, including assessing and deploying technical safeguards designed to protect its information systems from cybersecurity threats. We regularly evaluate new and emerging risks and ever-changing legal and compliance requirements and examine the effectiveness and maturity of our cyber defenses through various means, including internal audits, targeted testing, incident response exercises, maturity assessments, and industry benchmarking.


text: The Company engages with a range of external professionals, including cybersecurity experts, consultants, auditors, and legal counsel to leverage specialized knowledge, experience and insights, to help ensure our cybersecurity strategies and processes remain current. This includes: engaging third-party experts to periodically advise and train our Board and management regarding the structure and oversight of our cybersecurity program, Incident Response Plan ("IRP") and various cybersecurity-related matters;


text: retaining data security and data privacy legal counsel whose practice focuses on data breach response, information security compliance, and compliance with the data privacy laws in the various jurisdictions in which the Company operates; and utilizing specialized consultants and third-party managed service providers to assist us with projects that will improve the Company's IT infrastructure, strengthen our security posture and cybersecurity incident investigations, and improve our cyber readiness.


text: The Company has implemented processes to identify, prioritize, assess, mitigate and remediate risks associated with third-party service providers. As part of these processes, we conduct security assessments of critical third-party providers before engagement and contractually require third parties we engage to implement security programs commensurate with their risk.

stage1Category: Third-Party Risk


text: in the Southern African which is subject to various cybersecurity risks that could our business, financial condition, operations including, but not limited to, the extortion, harm to employees or customers, violation of privacy laws and other litigation and legal risk and reputational risk. ("NPS").

stage1Category: None/Other


text: Overview of Cybersecurity Risk Management Program Cybersecurity is an ongoing priority, and we remain focused on our obligation to assess, identify and manage risks from cybersecurity threats and cybersecurity incidents. We have developed and implemented a cybersecurity risk management program that employs a multitude of measures and processes that aid in these efforts. This program is designed to protect our information systems, detect cybersecurity threats and ensure our compliance with applicable privacy and cybersecurity laws.

companyName: Compass, Inc.

ticker: COMP


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and is considered an integral part of our overall risk assessment process. For example, we report, review and consider results and findings from external and internal security and privacy assessments as part of our overall risk assessment process, and we analyze how cybersecurity risks interplay with operational, financial, compliance and reputational risks.


text: As part of our cybersecurity risk management program, we undertake various activities, including, but not limited to, detective, preventative, and automated controls; user access controls; a centralized security information and management system; periodic assessments, including penetration testing; periodic trainings and simulations; and policies for the handling of personally identifiable information. We closely monitor the privacy and cybersecurity laws and regulations and conduct related reviews of our policies. We have implemented incident response plans providing for response, containment, reporting and disclosure and recovery, including providing training and remediation steps for internal threats. We also carry customary cybersecurity risk insurance.


text: In addition, we use third party service providers, when appropriate, to assess, test or otherwise assist with certain aspects of our cybersecurity risk management program. For example, we leverage external assessors such as security researchers and penetration testers to identify vulnerabilities in our information systems.


text: Further, our cybersecurity risk management program includes processes that address cybersecurity risks associated with our use of third-party services providers that have access to our information systems and/or employee, agent or agent client confidential information. For example, we perform certain due diligence before engaging third-party service providers and consider potential cybersecurity risks and exposures in our choice among providers. We also generally require our third-party service providers that could potentially introduce cybersecurity risks to our information systems or sensitive consumer personal information to contractually agree to maintain a cybersecurity risk management program aimed at mitigating those risks and be subject to external cybersecurity audits.


text: Cybersecurity Risk Management Program Assessments and Risks Associated With Cybersecurity Threats While we have assessed our cybersecurity risk management program periodically in the past, in the second half of 2023, we started to utilize a leading industry cybersecurity framework in our assessments. Specifically, we use this framework to assess our cybersecurity controls against industry best practices in the areas of: identify and protect assets, detect and respond to suspicious activity, as well as recover from cybersecurity incidents. Based on the results of our initial assessment, we have developed a multi-year plan that allows us to focus on the highest priorities. Under the plan, we are required to make additional investments to enhance our processes and practices over a period of time.


text: Additionally, as part of our continuous overall cybersecurity posture assessment, we conduct incident simulations based on recent public cybersecurity incidents, incorporating the tactics, techniques and procedures threat actors have used when targeting organizations. We leverage results from these simulations to take corrective action or otherwise augment our abilities to defend and protect our information systems.


text: While we have been subject to a number of cybersecurity threats and experienced non-material incidents in the past, they have not had a material adverse effect on our business, financial condition or results of operations. Our third party services providers have been also subject to a number of cybersecurity threats and incidents but to date, none of those threats and incidents have had a materially adverse effect on our business, financial condition or results of operations.


text: Cybersecurity Governance Our Information Security team oversees our cybersecurity risk management program, which is described in more detail above. In conjunction with the Company's in-house legal team, this team is principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity threats and incidents. Our Information Security team is segmented into six subteams and includes a dedicated Governance, Risk and Compliance subteam that is responsible for risk assessment, risk mitigation strategies, regulatory compliance, audits, internal governance and policy enforcement.


text: We have also established a Security and Privacy Committee ("Committee"), co-chaired by our Senior Vice President, Head of Engineering and General Counsel, that meets monthly. This Committee is responsible for setting cybersecurity policies, strategies, and priorities, as well as ensuring that cybersecurity initiatives are aligned with the Company's objectives. Members of the Committee may, from time to time, include representatives from security and compliance, internal audit, legal, product, engineering, finance, operations, strategy and people and culture functions. In addition to the monthly communications at the Committee level, our Information Security team collaborates with senior leadership across our organization on a regular basis as part of the Company's overall enterprise risk management program.


text: Our Chief Information Security Officer ("CISO") recently left the Company and we are in the process of recruiting a new, permanent CISO. We have engaged a temporary third-party CISO (sometimes referred to as a "Virtual CISO") to oversee the cybersecurity risk management program and assist the Information Security team. Our Virtual CISO has over 20 years of experience working in the Information Security field, and is a Certified Information Systems Security Professional. Specifically, she has experience managing and administering enterprise infrastructure, network communications, and information security. Our Virtual CISO receives regular reports from the Information Security team and will provide advice to the team with incident responses, execute any remediation plans, assist with drafting policy, and perform industry standard simulations and security assessments. The Virtual CISO reports to our Senior Vice President and Head of Engineering.


text: Our Virtual CISO will report quarterly to the Audit Committee of the Board of Directors ("the "Audit Committee"), which is responsible for overseeing the Company's cybersecurity risk management program and cybersecurity risks. As part of that report, our Virtual CISO is expected to cover topics such as (i) an overview of our overall cybersecurity strategy and posture, (ii) results and recommendations from cybersecurity risk assessments and audits, (iii) vulnerabilities in our information systems, (iv) progress towards pre-determined risk-mitigation goals, (v) identified and potential cybersecurity risks and threats, (vi) cybersecurity incidents of certain impact in accordance with the Company's cybersecurity policies, and (vii) programs related to mitigation of cybersecurity risks and potential threats, among other things. The Audit Committee reports to the full Board of Directors regarding its activities, including reports that it receives from our CISO.


text: Once hired, we expect our permanent CISO to continue strengthening our information security posture, assist with incident response and any remediation plans, and provide quarterly reports to the Audit Committee, as we transition from using a Virtual CISO.


text: Overview of the Cybersecurity Program Compass operates a cybersecurity program designed to identify, assess, and mitigate cybersecurity risks to protect our information assets, ensure business continuity, and maintain stakeholder trust. Guided by industry best practices, including the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF") and the Center for Internet Security ("CIS") Critical Controls, we focus on continuous improvement to address emerging threats and vulnerabilities. We recognize the evolving nature of cybersecurity threats and regularly enhance our security controls, processes, and policies to adapt to these risks.


text: As part of our cybersecurity program, we undertake various activities and programs, including, but not limited to: detective, preventative, corrective, and technical controls; identity and access management systems; periodic risk assessments, including penetration testing; periodic end-user training and simulations; incident response; vulnerability management; infrastructure and application security; corporate security; and policies for the handling of personally identifiable information and other restricted data.


text: We closely monitor privacy and cybersecurity laws and regulations and conduct related reviews of our policies. We have implemented incident response plans that provide for the response, containment, eradication, reporting, and disclosure of security incidents. We also carry customary cybersecurity risk insurance and have a retainer in place for third-party incident response and forensics resources.


text: Cybersecurity Risk Management Program Cybersecurity is an ongoing priority, and we have developed and implemented a cybersecurity risk management program designed to identify, assess, prioritize, and mitigate cybersecurity risks to ensure our compliance with applicable privacy and cybersecurity laws.


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program and is a crucial component of our risk assessment process. For instance, we report on, review, and consider the results and findings from external and internal security and privacy assessments as part of our risk program. Additionally, we analyze how cybersecurity risks interact with operational, financial, compliance, and reputational risks.


text: When appropriate, we also engage third-party service providers to evaluate, test, or assist with specific elements of our cybersecurity risk management program. For instance, we utilize external assessors, including security researchers and penetration testers, to identify and report vulnerabilities in our information systems.


text: Further, our cybersecurity risk management program includes a third-party risk management program to assess and manage cybersecurity risks associated with our use of third-party services providers that have access to our information systems and/or employee, agent or agent client confidential information. For example, we perform certain due diligence before engaging third-party service providers and consider potential cybersecurity risks and exposures in our choice among providers. We also generally require our third-party service providers that could potentially introduce cybersecurity risks to our information systems or sensitive consumer personal information to contractually agree to maintain a cybersecurity risk management program aimed at mitigating those risks and be subject to external cybersecurity audits.


text: Cybersecurity Risks Associated With Cybersecurity Threats While we have been subject to a number of cybersecurity threats and experienced non-material incidents in the past, as of the date of this Annual Report, they have not had a material adverse effect on our business, financial condition or results of operations. Our third-party service providers have also been subject to a number of cybersecurity threats and incidents, but to date, none of those threats and incidents have had a materially adverse effect on our business, financial condition, or results of operations.


text: Please refer to the "Risk Factors" section of this Annual Report for additional information related to the cybersecurity risks that could potentially impact our business.


text: Cybersecurity Governance Our Information Security team oversees our cybersecurity program, which is described in more detail above. In conjunction with the Company's in-house legal team, this team is principally responsible for managing our cybersecurity risk management program, our security controls, and our response to cybersecurity threats, and incidents.


text: We have also established a Security and Privacy Committee ("Committee"), co-chaired by our Senior Vice President, Head of Engineering, Chief Information Security Officer ("CISO") and General Counsel, that meets monthly. This Committee is responsible for setting cybersecurity policies, strategies, and priorities, as well as ensuring that cybersecurity initiatives are aligned with the Company's objectives. Members of the Committee may, from time to time, include representatives from information security, internal audit, legal, product, engineering, finance, operations, strategy and people and culture functions. In addition to the monthly communications at the Committee level, our Information Security team collaborates with senior leadership across our organization on a regular basis as part of the Company's overall enterprise risk management program.


text: In 2024, we hired a new Chief Information Security Officer to oversee the cybersecurity program and lead the Information Security team. Our CISO has over 17 years of experience building security teams and driving security initiatives for public, high-growth, and regulated companies. He is a Certified Information Systems Security Professional and reports to our Senior Vice President and Head of Engineering.


text: Our CISO reports quarterly to the Audit Committee of our board of directors (the "Audit Committee"), which is responsible for overseeing the Company's cybersecurity risk management program and cybersecurity risks. As part of that report, our CISO covers topics such as (i) an overview of our overall cybersecurity strategy and posture, (ii) results and recommendations from cybersecurity risk assessments and audits, (iii) vulnerabilities in our information systems, (iv) progress towards pre-determined risk-mitigation goals, (v) identified and potential cybersecurity risks and threats, (vi) cybersecurity incidents of certain impact in accordance with the Company's cybersecurity policies, and (vii) programs related to mitigation of cybersecurity risks and potential threats, among other things. The Audit Committee reports to the full board of directors regarding its activities, including reports that it receives from our CISO.


text: We have established a cybersecurity risk management process that aims to identify, assess, mitigate, monitor, and report on the IT risks and cybersecurity threats that may affect our business objectives, performance, reputation, and compliance. We conduct an overall annual cybersecurity risk assessment to identify and prioritize the IT risks that may impact our business strategy, results of operations, and financial condition. We have processes and controls that help prevent, detect, and recover from security incidents and we also perform regular security assessments to test the resilience of our IT systems and networks against potential attacks and vulnerabilities. Our employees are provided awareness training on a regular basis to help them identify, avoid, mitigate, and report cybersecurity threats.

companyName: CONSTELLIUM SE

ticker: CSTM


text: We use security assessments, penetration testing, and table-top or red teaming exercises with third parties to assess our security posture and to continuously improve our processes. We also use our Internal Audit function to conduct additional reviews and assessments. Our third-party service providers are subject to security risk assessments at the time of onboarding, on a continuous basis and upon detection of an increase in risk profile. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and to investigate security incidents that have impacted such providers, as appropriate.


text: Our Chief Information Officer/Chief Digital Officer ("CIO/CDO"), together with the Company's security team, is responsible for assessing, monitoring, and managing our cybersecurity risks. Our CIO/CDO has significant experience in IT security, information security, and cybersecurity having served in a variety of senior roles at the Company prior to serving as CIO/CDO. Our CIO/CDO also has experience with implementing various security and infrastructure transformation and improvement programs.


text: The Company has an Enterprise Risk Management ("ERM") Committee and process in place that reviews and evaluates the overall risks to the Company, including its cybersecurity risks. The ERM process has the input of senior management and other internal stakeholders, and the cybersecurity risk management process is incorporated into our ERM review. Cybersecurity risks to the Company are reviewed, evaluated, and discussed on a quarterly basis and, when necessary, on an ad-hoc basis with our Executive Committee and other members of the management team.


text: Our Board, in coordination with the Audit Committee, oversees the management of the Company's cybersecurity program and risks from cybersecurity threats. Our Audit Committee receives annual reports on cybersecurity risks resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents. The CIO/CDO also informs the Audit Committee on the prevention, detection, mitigation, and remediation of cybersecurity incidents, including significant security risks and information security vulnerabilities. The Audit committee reports any significant matters to the Board.


text: We rely on our IT systems to effectively manage and operate our business, including such processes as data collection, accounting, financial reporting, communications, supply chain, order entry and fulfillment, other business processes, and in operating our equipment. A cybersecurity incident could disrupt our business and could result in transaction errors, processing inefficiencies, limited equipment utilization, the loss of sales, customers, or intellectual property, causing our business and financial results to suffer. Although such risks have not materially affected our business, financial conditions, results of operations or reputation to date, we have, from time-to-time experienced cybersecurity incidents in the normal course of business. For more information regarding the risks we face from cybersecurity threats, please see "Item 1A. Risk Factors".


text: Cybersecurity Program As an energy transition, renewable energy and investment management company that acquires, constructs and operates renewable energy and energy efficient projects, as well as finances the construction and/or operation of these and other sustainable development projects and businesses and provides through GCM investment management services to funds within the sustainable infrastructure and renewable energy industry, cybersecurity risk management is an integral part of our overall enterprise risk management program.

companyName: Greenbacker Renewable Energy Co LLC


text: A robust cybersecurity program to protect our assets from cyber and information security threats is critical to managing risk effectively. Our cybersecurity program is designed to align with internationally recognized information security standards and best practices. Our multi-layered data protection and information security programs and practices are designed to ensure the safety, security and responsible use of the information and data our stakeholders entrust to us. The approach blends defense-in-depth and zero-trust principles. Our cybersecurity program is periodically informed and assessed by third-party assessments and advice regarding best practices from consultants, business partners and advisors and incorporates benchmarking and other data from peer companies. We have processes for evaluating (among other things) the data protection and information security infrastructure of our third-party providers (including examining any relevant records such as service organization controls reports), and we seek to manage third-party risk with procedures to onboard our third-party providers, monitor their activity during our engagement (where possible) and off-board such third-party service providers at the end of our engagement.


text: We have implemented and maintain various measures to mitigate information security challenges, including maintaining an information security program, an enterprise resilience program, a business continuity program and cyber insurance coverage, as well as regularly testing our systems to discover and address any potential vulnerabilities. The Company also conducts periodic cybersecurity awareness training for employees and provides cybersecurity updates to its employees during regularly scheduled meetings. These updates are designed to educate employees and to raise awareness of cybersecurity threats to reduce vulnerability as well as to encourage consideration of cybersecurity risks.


text: We monitor and respond to a range of cyber threats, including threats and incidents associated with the use of services provided by third-party providers. We utilize automation and artificial intelligence enabled tools to address threats. Our cybersecurity framework for handling cybersecurity threats and incidents includes steps for identifying the nature of a cybersecurity threat, assessing the severity of the threat (including advancing to key members of management where appropriate for determination of potential materiality) and implementing cybersecurity processes and procedures to address the threat.


text: Despite our efforts to identify and respond to cybersecurity threats, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. Refer to Part I —Item 1A. Risk Factors in this Annual Report, including "Cybersecurity risks could result in the loss of data, interruptions in our business and damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations," for additional discussion about cybersecurity-related risks.


text: Our Board of Directors and certain members of our senior management team have specific oversight responsibilities with respect to cybersecurity risk.


text: Our Board Risk Oversight Committee is charged with overseeing the Company's management of credit, market, liquidity, operational (including information technology and cybersecurity), compliance, reputational and strategic risks, including the annual approval and recommendation to the Board of Directors of the Company's risk appetite statement and approval of the Company's risk management framework.

companyName: Independent Bank Group, Inc.


text: Board of Directors and Committee Oversight Our Board of Directors is responsible for understanding the issues and risks that are central to our business, including cybersecurity matters. In general, our Board of Directors and senior management team coordinate to oversee our guidelines and policies with respect to risk assessment and risk management and the Audit Committee of our Board of Directors (the "Audit Committee") discusses our financial and operational risk exposures, and the steps management has taken to monitor and control such exposures. In this context, the Audit Committee would be informed of a material cybersecurity incident that could impact our financial statements.


text: Senior Management's Role in Managing Risk We have a leadership group consisting of certain members of our senior management team that is responsible for assessing and managing risk and implementing policies, procedures and strategies pertaining to security governance and data privacy, that is led and informed by our VP of Technology who develops and oversees the programs, policies and controls we have implemented across the organization to reduce and prevent logical and physical risks, including information security and cyber risks to our people, intellectual property, data and tangible property. Our VP of Technology has over 20 years of relevant experience in roles such systems controls, audit, governance, software development/design, systems implementation, IT infrastructure operations, cybersecurity, and overall management of the technology function. Most of that experience has been in the energy and financial services sector. The Company has also engaged a third-party IT expert to assist the Company's in-house IT function in managing cybersecurity risks and evaluating, monitoring, and testing the Company's cybersecurity program.


text: How Senior Management is Informed of and Monitors Incidents Certain members of our senior management team are responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risks are monitored, implementing appropriate mitigation measures and maintaining our cybersecurity program. Our cybersecurity program is under the direction of our VP of Technology (in coordination with certain members of our senior management team), who receives reports from our information technology team and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Certain members of our senior management team are notified as appropriate when the information technology team identifies an emerging risk or material issue.


text: Reporting to our Board of Directors Given the importance of information security and privacy to our stakeholders, our Board of Directors receives an annual presentation from our senior management team discussing our program for managing information security risks, including cyber and data security risks. Our senior management team receives regular reports on our cybersecurity readiness, our risk profile status, our cybersecurity program, material cybersecurity risks and mitigation strategies, third-party assessments of our cybersecurity program and other cybersecurity developments. Our senior management team reports to the Board of Directors and the Audit Committee on such topics, as needed, and at regularly scheduled meetings of the Board of Directors and Audit Committee as part of the business, legal and regulatory update portions of such meetings.


text: A robust cybersecurity program to protect our assets from cyber and information security threats is critical to managing risk effectively. Our cybersecurity program is designed with consideration of internationally recognized information security standards and best practices. Our multi-layered data protection and information security programs and practices are designed for the safety, security and responsible use of the information and data our stakeholders entrust to us. The approach blends defense-in-depth and zero-trust principles. Our cybersecurity program is informed and assessed by third-party assessments and advice regarding best practices from consultants, business partners and advisors, and it incorporates benchmarking and other data from peer companies. We have processes for evaluating (among other things) the data protection and information security infrastructure of our third-party providers (including examining any relevant records such as service organization controls reports), and we seek to manage third-party risk with procedures to onboard our third-party providers, monitor their activity during our engagement (where possible) and off-board such third-party service providers at the end of our engagement.


text: We have implemented and maintain various measures to mitigate information security challenges, including maintaining an information security program, an enterprise resilience program, a business continuity program and cyber insurance coverage, as well as regularly testing our systems to discover and address any potential vulnerabilities. The Company also conducts periodic cybersecurity awareness training for employees and provides cybersecurity updates, where appropriate, to its employees during regularly scheduled meetings. These updates are designed to educate employees and to raise awareness of cybersecurity threats to reduce vulnerability as well as to encourage consideration of cybersecurity risks.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.

companyName: Hepion Pharmaceuticals, Inc.

ticker: HEPA


text: We monitor and respond to a range of cyber threats, including any threats and incidents associated with the use of services provided by third-party providers. We utilize automation and artificial intelligence enabled tools to address threats. Our cybersecurity framework for handling cybersecurity threats and incidents includes steps for identifying the nature of a cybersecurity threat, assessing the severity of the threat (including advancing to key members of management where appropriate for determination of potential materiality) and implementing cybersecurity processes and procedures to address the threat.


text: Board of Directors and Committee Oversight Our Board of Directors is responsible for understanding the issues and risks that are central to our business, including cybersecurity matters. In general, our Board of Directors and senior management team coordinate to oversee our guidelines and policies with respect to risk assessment and risk management, and the Audit Committee of our Board of Directors (the "Audit Committee") discusses our financial and operational risk exposures and the steps management has taken to monitor and control such exposures. In this context, the Audit Committee would be informed of a material cybersecurity incident that could impact our financial statements.


text: Senior Management's Role in Managing Risk We have a leadership group consisting of certain members of our senior management team that is responsible for assessing and managing risk and implementing policies, procedures and strategies pertaining to security governance and data privacy, that is led and informed by our VP of Technology who develops and oversees the programs, policies and controls we have implemented across the organization designed to reduce and prevent logical and physical risks, including information security and cyber risks to our people, intellectual property, data and tangible property. Our VP of Technology has over 20 years of relevant experience in roles such as systems controls, audit, governance, software development/design, systems implementation, IT infrastructure operations, cybersecurity, and overall management of the technology function. Most of that experience has been in the energy and financial services sectors. The Company has also engaged a third-party IT expert to assist the Company's in-house IT function in managing cybersecurity risks and evaluating, monitoring, and testing the Company's cybersecurity program.


text: Risk Management and Strategy Our engineering security team, led by our Chief Information Security Officer, or CISO, uses a multi-pronged approach to assessing, identifying, and managing material risks from cybersecurity threats. This approach includes identifying and assessing risks through: (1) an enterprise risk management program, which is periodically refreshed and includes an identification of our top risks, including cybersecurity risks; (2) formalized security and privacy reviews designed to identify risks from many new features, software, and vendors; (3) a vulnerability management program designed to identify hardware and software vulnerabilities; (4) an internal "red team" program, which simulates cyber threats, intended to allow us to fix vulnerabilities before threat actors identify them; (5) a threat intelligence program designed to model and research our adversaries; and (6) a privacy and security incident response program designed to investigate, respond to, and remediate known incidents. These processes vary in scope and maturity across the business and are processes we work to continually improve.

companyName: Snap Inc

ticker: SNAP


text: Our risk management approach is supplemented by external and internal enterprise risk management audits, which are designed to test the effectiveness of our security controls. We conduct penetration testing on a periodic basis, and have established an external bug bounty program to allow security researchers to help identify vulnerabilities and weaknesses in our controls and configurations in our systems. We also maintain a vendor risk management program designed to identify and mitigate potential risks associated with third-party suppliers and business partners. This program includes pre-engagement diligence, use of contractual cybersecurity and notification provisions, and ongoing monitoring of vendors, as appropriate.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional service firms (including legal counsel), threat intelligence services, and cybersecurity consultants.


text: The material cybersecurity threats identified through these processes are managed by our CISO and, where appropriate, our risk and compliance committee, in consultation with management. Together, they identify responsive actions for inclusion in our annual strategic planning, or earlier resolution depending on the nature of the risk.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see "Risk Factors" in Part I, Item 1A in this Annual Report on Form 10-K.


text: Our board of directors maintains oversight of risks from cybersecurity threats by meeting with and receiving periodic updates from our CISO, via our audit committee, which is assigned oversight of cybersecurity risks. In addition, the chair of our audit committee meets with our CISO on a quarterly basis to discuss cybersecurity threats and incidents, as well as the business's approach to responding to them. Our incident response plans also provide that our board of directors and audit committee are also notified in the event of a material cybersecurity incident.


text: Our CISO, Jim Higgins, has over 30 years of experience in the technology sector, including senior leadership roles in product security, information security engineering, and cloud enterprise. Mr. Higgins assisted the Linux Foundation in starting the Open Source Security Foundation to help increase awareness and promote technical solutions to address validation of Open Source software. Mr. Higgins has worked in information security at Chevron, Eastman Kodak, and Google, and, mostly recently, spent two years as the CISO of Block, Inc. (formerly Square).


text: Our CISO also regularly meets with our CEO and other members of our management team (or their designees), including our General Counsel, Chief Financial Officer, Chief Communications Officer, and Senior Vice President of Engineering, including as part of the cybersecurity incident response process.


text: Our CISO, and where necessary our management team and risk and compliance committee, are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents, through our security incident response process. We maintain internal aliases, which employees may use to identify a cybersecurity or privacy threat or incident, for escalation, investigation, containment, and remediation. A report to the alias triggers our Security Incident Response Policy and associated plans, which has defined roles for our cross-functional incident response team. The incident response team assesses the severity and priority of incidents on a rolling basis, with escalations of cybersecurity incidents provided to our management team by our CISO and General Counsel (or their designees) and escalations of certain cybersecurity incidents as appropriate to our board of directors. If a cybersecurity incident is determined to be a material cybersecurity incident, our Security Incident Response Policy and associated plans define the process to file a report regarding the incident with the SEC.


text: Risk Management and Strategy Our engineering security team, led by our Chief Information Security Officer, or CISO, uses a multi-pronged approach to assessing, identifying, and managing material risks from cybersecurity threats. This approach includes identifying and assessing risks through: (1) an enterprise risk management program, which is periodically refreshed and includes an identification of our top risks, including cybersecurity risks; (2) formalized security and privacy reviews designed to identify risks from many new features, software, and vendors; (3) a vulnerability management program designed to identify hardware and software vulnerabilities; (4) an internal "red team" program, which simulates cyber threats, intended to allow us to fix vulnerabilities before threat actors identify them; (5) a threat intelligence program designed to model and research our adversaries; and (6) a privacy and security incident response program designed to investigate, respond to, and remediate known incidents. These processes vary in scope and maturity across the business and are processes we work to improve.


text: Our risk management approach is supplemented by external and internal enterprise risk management audits, which are designed to test the effectiveness of our controls. We conduct penetration testing or other application security testing on a periodic basis, and have established an external bug bounty program to allow security researchers to help identify vulnerabilities and weaknesses in our controls and configurations in our systems. We also maintain a vendor risk management program designed to identify and mitigate potential risks associated with third-party suppliers and business partners. This program includes pre-engagement diligence, use of contractual cybersecurity and incident notification provisions, and ongoing monitoring of vendors, as appropriate. We also conduct employee training on data protection, including cybersecurity, among other topics.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional service firms (including legal counsel), threat intelligence services, and cybersecurity consultants. The material cybersecurity threats identified through these processes are managed by our CISO and are escalated to senior management and our risk and compliance committee, in each case where appropriate. Together, they identify responsive actions for inclusion in our annual strategic planning, or earlier resolution depending on the nature of the risk.


text: Our board of directors maintains oversight of risks from cybersecurity threats by meeting with and receiving periodic updates from our CISO, via our audit committee, which is assigned oversight of cybersecurity risks. In addition, the chair of our audit committee meets with our CISO periodically to discuss cybersecurity threats and incidents, as well as the business's approach to responding to them. Our incident response plans also provide that our board of directors and audit committee will be notified in the event of certain cybersecurity incidents.


text: Our CISO also regularly meets with our CEO and other senior management, including as part of the cybersecurity incident response process.


text: Our CISO, and where appropriate our management team and risk and compliance committee, are informed about and monitor the prevention, detection, mitigation, and remediation of identified cybersecurity incidents, through our security incident response process. We maintain internal and external channels and signals to receive reports of cybersecurity or privacy threats or incidents. A reported incident triggers our Security Incident Response Policy or associated plans, which has defined roles for our cross-functional incident response team to investigate, contain, eradicate, and remediate the incident. The incident response team assesses the severity and priority of reported incidents on a rolling basis, with escalations of cybersecurity incidents provided to our management team by our CISO and General Counsel (or their designees) and escalations of certain cybersecurity incidents as appropriate to our board of directors. If a cybersecurity incident is determined to be a material cybersecurity incident, our Security Incident Response Policy and associated plans define the process to file a report regarding the incident with the SEC.


text: Mr. Higgins recently announced his intention to depart our company effective February 21, 2025 and, as a result, Eric Young, our Senior Vice President of Engineering, will act as our interim CISO while we conduct a search for a permanent replacement. Mr. Young has more than 25 years of experience working in the technology industry across a diverse range of business sectors and since June 2023 has overseen Mr. Higgins and our engineering security team, which comprises personnel with a broad range of experience in cybersecurity, information technology, and risk management. During Mr. Young's tenure at Snap, Mr. Young has been involved in our approach in assessing, identifying, and managing security incidents.


text: Cybersecurity and Risk Management The Company's cybersecurity risk management processes are integrated into the overall risk management system through reporting of cyber risks to Technology and Information Security Oversight Committee, Operational Risk Committee, Enterprise Risk Committee, and Board Risk Oversight Committee. Risk Appetite statements are approved by the Board Risk Oversight Committee and the Board, and Key Risk Indicators are monitored on an ongoing basis by the Information Security team, and the Operational Risk and Enterprise Risk Committees. The Company performs regular Information Security focused Risk Assessments at the entity level, including but not limited to assessments based on the Federal Financial Institutions Examination Council Cybersecurity Assessment Tool (FFIEC CAT) and Ransomware Self-Assessment Tool (R-SAT), and National Institute of Standards and Technology (NIST) Cybersecurity Framework.


text: Engagement of Third Parties Information Security leverages third parties for cyber security services including but not limited to managed security services, external penetration testing, and tabletop exercises.


text: Oversight and Identification of Risks Associated with Third Parties Information Security, in coordination with Third Party Risk Management, reviews new vendors at onboarding to oversee and identify potential risks and performs ongoing monitoring of emerging risks related to any third-party service providers. Third-party service provider reviews include completion of a standardized questionnaire and review of SOC reports. New technology projects are subject to a Security Architecture Review completed by Information Security. Information Security coordinates with Contract Management to perform contract reviews for security controls and notification processes. Information Security conducts annual IT Risk Assessments on Tier 1 applications, defined as those vendors of critical importance to the Company's core operations.


text: Risks from cybersecurity threats are monitored on an ongoing basis by the Information Security team, engaging the Cyber Incident Response Team, Cyber Crisis Team, the Core Team, and Extended Core Team, as needed, and escalated to the extent that incidents rise to the level of notification to the relevant risk or board committee or on an ad hoc basis.


text: Additionally, quarterly cybersecurity updates are provided to risk and board committees including, but not limited to, the following materials: Annual GLBA Report, Information Security Metrics (including Key Performance and Key Risk Indicators), Penetration Testing and Tabletop Exercise updates, Cyber Maturity Assessments/Roadmap, Annual Threat Landscape Report, and additional cybersecurity education topics.


text: Management and Assessment of Risk The Enterprise Risk Sub-Committee (ERC) (a management committee) assists executive management and the Board of Directors with providing oversight of the Bank's enterprise risk management program.


text: The ERC and Board Risk Oversight Committee work together to facilitate effective risk management and timely escalation of substantive issues, including Operational Risk (which includes information technology and cybersecurity).


text: The Chief Information Security Officer (CISO), reporting to the Chief Risk Officer, is responsible for information security and cybersecurity risk management. The CISO has over 20 years of experience in cybersecurity in Financial Services and is a Certified Information Systems Security Professional (CISSP) and holds a SysAdmin, Audit, Network and Security Global Information Assurance Certification (SANS GCIA).


text: Incident and Risk Escalation Through Cyber Incident Response Plan Information Security maintains processes for prevention, detection, and mitigation of cybersecurity incidents. The Company maintains a Cyber Incident Response Plan (CIRP) that covers response and remediation processes for managing cybersecurity incidents. The CIRP outlines the cross-functional responsibilities for the Cyber Crisis Team, the Core Team and Extended Core Team during a notification incident. The Core Team consists of the Chief Information Security Officer, Chief Legal Officer, Chief Information Officer, and Director Operational Risk Management to manage the incident. The Extended Core Team consists of other business area leaders who may need to be engaged based on the area of impact. All CIRP incidents are managed through an Incident Commander with communications being escalated to executive leadership as needed, who will then report to the Board. Key Performance Indicators and Key Risk Indicators related to monitoring and detection are presented to Technology and Information Security and Operational Risk Management Committees.


text: Incident and Risk Escalation to Board The Board Risk Oversight Committee oversees the ERC and works directly with the ERC to facilitate effective risk management and timely escalation of substantive issues from ERC and ERC's sub-committees, including Operational Risk (which includes information technology and cybersecurity). Quarterly, cybersecurity updates are provided to risk and board committees including, but not limited to, the following materials: Annual GLBA Report, Information Security Metrics (including Key Performance and Key Risk Indicators), Penetration Testing and Tabletop Exercise updates, Cyber Maturity Assessments/Roadmap, Annual Threat Landscape Report, and additional cybersecurity education topics.


text: Risk Management and Strategy As a high-profile global media and information services company with a wide array of digital products and services, the Company is subject to risks associated with cybersecurity threats. The Company has developed and implemented a cybersecurity program designed to manage these threats, including the assessment, identification and management of cybersecurity risks, and related protection, response, mitigation and recovery efforts. The program is overseen and monitored by a dedicated internal global cybersecurity organization, led by the Company's Chief Information Security Officer ("CISO"), who reports directly to the Company's Chief Technology Officer ("CTO"), and supported by designated cybersecurity risk leaders at the Company's business units. The Company's cybersecurity program is informed in part by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and leverages a defense-in-depth approach to managing cybersecurity risk. The governance, principles and framework for the program are set forth in the Company's Global Cybersecurity Governance Principles Framework and are complemented by a set of global cybersecurity policies designed to promote secure cyber and data practices among Company personnel. The Company reinforces a culture of secure behavior through annual cybersecurity and privacy awareness trainings, quarterly phishing exercises and regular delivery of other security awareness content via newsletters, departmental meetings and periodic campaigns, as well as specialized secure development training for product development teams. In addition, the Company employs various technical measures and processes to address the cybersecurity threats it faces, which may include reporting, monitoring and alert tools, multi-factor authentication, encryption, endpoint detection and response, email and cloud security tools, vulnerability scanning tools, threat intelligence monitoring and application resilience measures, as well as threat modeling, architecture design reviews and code reviews performed by its product security team.

companyName: NEWS CORP

ticker: NWSA


text: The Audit Committee reviews our disclosures with respect to cybersecurity and information technology risks. The Audit Committee also reviews with management guidelines and policies to govern the process by which risk assessment and risk management is undertaken, including but not limited to cybersecurity and information technology risks. As part of the Company's enterprise-wide risk management program, our Internal Audit team also reports to our Audit Committee regarding assessments of our cybersecurity and information technology risks, at least annually, based on regular updates by our CIO regarding such risks. Our Internal Audit team periodically reports to our executive officers and the Audit Committee regarding such risks.

companyName: PBF Holding Co LLC


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats To assess, identify, and manage potential cybersecurity threats, our Security Operations Center ("SOC") team works in conjunction with a third-party managed security service provider to monitor systems and threats, including those on systems managed by third-parties, such as cloud platforms.

companyName: Keenova Therapeutics plc


text: The Company maintains a cybersecurity incident response policy and plan, which in conjunction with the above measures, are designed to facilitate detection, analysis, containment, remediation and recovery from cybersecurity incidents and set forth processes to manage, escalate and, as appropriate, report such incidents based on their potential impact to the Company. The Company also undertakes disaster recovery and business continuity planning and maintains certain system redundancies to limit the impact of cybersecurity incidents and other disruptions, but there can be no assurance that these efforts will be successful. The Company conducts periodic testing and assessments of its cybersecurity program, both through internal security personnel and third-party firms. The Company engages consultants and other independent third parties to periodically perform internal and external penetration testing, security audits, incident response readiness exercises and assessments of the Company's cybersecurity risk management practices, including a maturity assessment of the Company's cybersecurity program based on the NIST Cybersecurity Framework approximately every two years. The Company may also consult with external legal counsel, third-party experts and other advisors in connection with incident response and recovery efforts and forensic investigations.


text: The Company's processes for identifying, assessing and managing cybersecurity risk are integrated into the Company's overall risk management process. The Company's internal audit group monitors the Company's risk profile and conducts regular enterprise-wide integrated risk assessments, with input from corporate and business unit management and personnel, to identify and assist the Board of Directors and senior executives in managing key existing and emerging risks for the Company and its businesses, including cybersecurity risk. The risk assessment process culminates in semi-annual reports to the Audit Committee and the Board of Directors. In addition to its own systems and technology, the Company relies on third-party service providers for certain software, technology and cloud-based systems and services that support a variety of critical business operations. The Company has policies and processes designed to identify, assess and manage cybersecurity risk relating to these third-party service providers. When contracting with these providers, the procurement function works closely with the compliance, cybersecurity, privacy and legal teams to conduct diligence and help appropriately manage risk, including cybersecurity risk, throughout the life cycle of the contract. The Company and its business units have developed, and seek to incorporate, standard contractual security requirements into their service provider agreements. The Company also performs cybersecurity assessments of third-party service providers where it deems appropriate given the nature of the engagement and the data and systems expected to be accessed.


text: Although the Company dedicates significant resources and efforts to protect against cybersecurity risks, the Company has experienced, and expects to continue to be subject to, cybersecurity threats. To date, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, the Company continues to face cybersecurity risks such as those described in "Item 1A. Risk Factors" in this Annual Report on Form 10-K, and there can be no assurance that cybersecurity threats or incidents will not have a material adverse effect on the Company in the future. While the Company maintains cyber risk insurance, such insurance may not be sufficient to cover all losses from cybersecurity incidents.


text: News Corp's Board of Directors oversees the Company's processes for identifying, assessing and managing significant risks facing the Company, and each of the Board's standing committees assists the Board within the areas delegated to that committee. The Board of Directors has delegated to the Audit Committee primary responsibility for overseeing risks related to cybersecurity, including reviewing with management the Company's major cyber-related risk exposures and the steps that have been taken to monitor and control such exposures. The Audit Committee generally receives reports at least quarterly from the CTO and CISO on the Company's cybersecurity program covering various topics, including incident reporting, a review of the global cyber risk-map, updates on NIST maturity assessments, employee training and technology solutions and other practices designed to minimize the risks associated with cybersecurity threats, and updates the Board of Directors as appropriate.