text: We regularly engage third-party assessors, consultants, and auditors to test and evaluate our controls for managing cybersecurity threats. These include third-party engagements by management and by our Internal Audit Department for (i) regular penetration testing of our cyber defenses, including an annual PCI-certified penetration test, (ii) third-party "health checks" on supporting technology, including our security incident and event management system (SIEM) and vulnerability management program, and (iii) third-party social engineering tests of the effectiveness of our employee training for detection of invasive attempts by malevolent actors. In addition, the Federal Reserve and DFI examine our control environment for managing cybersecurity risks each year.


text: Our risk governance structure includes a Third-Party Risk Management Program with first-level oversight by management's Third-Party Risk Management Committee and conforms to bank regulatory guidance. This program includes due diligence and periodic monitoring of the information security controls such providers have in place to protect our confidential data received, processed and/or stored by such providers.

companyName: 1ST SOURCE CORP

ticker: SRCE

secItem: Item 1C

stage1Category: Third-Party Risk

stage1Method: unanimous


text: The measures summarized above are intended to help ensure that 1st Source does not suffer a material adverse impact from security breaches, but, as cybersecurity risks evolve and increase in sophistication, we can provide no assurance that our financial condition or results of operations will not be adversely impacted. See "Item 1A. Risk Factors - Operational Risks - Technology Security Breaches."

stage1Category: None/Other


text: Risk Management and Strategy Our Board of Directors has delegated primary responsibility for oversight of cybersecurity risk management to the Audit, Finance & Risk Committee of the Board. The Committee receives quarterly reports from the Chief Information Security Officer (CISO) and Chief Risk Officer (CRO), respectively, and reviews them with such officers. These reports are made available to all board members concurrently. The CRO's report includes evaluation of the level of cybersecurity risks and strength of mitigating controls. All board members are invited to attend the portion of the Committee's meetings for review of reports received on risk management from management (e.g., the CRO, CISO, Chief Compliance Officer).


text: Our processes for assessing, identifying, and managing material risks from cybersecurity threats are based on examination guidance published by the Federal Financial Institution Examination Council (FFIEC), an interagency body established under the Financial Institutions Regulatory and Interest Rate Control Act of 1978. Consistent with FFIEC guidance, 1st Source selected and adheres to the risk management framework established by the Cybersecurity Risk Institute known as the "CRI Profile." The CRI Profile is based primarily on the well-known National Institute of Standards and Technology's (NIST) "Framework for Improving Critical Infrastructure Cybersecurity" and is tailored to ensure expectations of financial institution regulators are met. Our processes are designed to meet standards for all seven CRI Profile functions – governance, identification, detection, protection, response, recovery, and supply chain dependency management. In addition, we adhere to security standards set by the PCI Security Standards Council which are designed to ensure secure payments globally.


text: Risks from cybersecurity threats, including risks identified from previous cybersecurity incidents, have required significant investments over time in maturing our Information Security Program and attracting and retaining the personnel with requisite experience and expertise. In particular, the CISO has substantial relevant expertise in the financial services industry and formal training in the areas of information security and cybersecurity risk management. We will need to continue to make meaningful investments in cybersecurity controls for continuous improvement and maturation in response to constantly evolving cybersecurity threats. Cybersecurity threats will continue to be endemic to the financial services industry for the foreseeable future.


text: Our Board and senior management oversee our processes for management of cybersecurity risks consistent with the foregoing standards. Such oversight includes regular reporting by management to the Board on the adequacy of such processes and potential material issues identified. Before escalation to the Board, issues are generally identified and assessed through our risk governance structure established under our Enterprise Risk Management Program. The risk governance structure includes three distinct components: management oversight, third-party professional assessment, and separate oversight and review by our Internal Audit Department. Management oversight is maintained through several committees that serve as forums for further assessment, remediation, and escalation. These management oversight committees include the Information Security Committee, co-chaired by the CISO and CRO, the Operational and Compliance Risk Committee, chaired by the CFO, vice chaired by the CISO and Chief Compliance Officer, the IT Steering Committee, chaired by the Chief Information Officer (CIO), the Enterprise Risk Management Committee, chaired by the CRO, the Data Governance Committee, chaired by the CIO, and the executive management committee known as the Strategic Deployment Committee, chaired by the CEO.

stage1Category: Risk Management Process

stage1Method: majority


text: Our chief technical officer, Timothy Scahill, is responsible for our cybersecurity protection. Mr. Scahill is an ISC2 Certified Information System Security Professional.

companyName: QUEST PATENT RESEARCH CORP

ticker: QPRC

stage1Category: Management Role


text: Risks from Cybersecurity Incidents We have not encountered, to our knowledge, a cybersecurity incident that has materially impaired, or is reasonably likely to materially impair, our business strategy, operations, or financial condition. The measures summarized above are intended to help ensure that 1st Source does not suffer a material adverse impact from security breaches, but, as cybersecurity risks evolve and increase in sophistication, we can provide no assurance that our financial condition or results of operations will not be adversely impacted. See "Item 1A. Risk Factors - Operational Risks - Technology Security Breaches."

stage1Category: Strategy Integration


text: Please see Item 7. "Managements's Discussion and Analysis of Financial Condition and Results of Operations - Cyber Security" for discussion regarding the cyber security policies of the Company.

companyName: Federal Realty OP LP


text: The Bancorp recognizes the importance of maintaining a cybersecurity risk management system designed to reduce the risks that cybersecurity threats pose to financial institutions. As such, the Bancorp has adopted proactive and defensive safeguards intended to better protect the Bancorp's information assets and supporting infrastructures from technology-related attacks. The Bancorp's Board of Directors and management oversee its information security and cybersecurity risk management programs. As further discussed below, the Bancorp has established various programs, policies and procedures which are designed to proactively protect information assets. However, not all incidents can be prevented. As a result, the Bancorp has also established various policies and procedures governing how to respond to security incidents, with the objective of minimizing any potential impacts. As of December 31, 2023, the Bancorp is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect Fifth Third, including its business strategies, results of operations or financial condition.

companyName: FIFTH THIRD BANCORP

ticker: FITB


text: Risk Assessment and Management The Bancorp maintains a variety of programs and policies to support the management of cybersecurity risk within the organization with a focus on prevention, detection and recovery processes. These programs and policies leverage frameworks and controls from the National Institute of Standards and Technology as well as various other regulatory requirements and industry-specific standards. The Bancorp also participates in the federally recognized Financial Services Information Sharing and Analysis Center and requires its employees and contractors to complete various education and training programs related to information security.


text: The Bancorp's Information Technology (IT) and Information Security (IS) teams have the primary responsibility for establishing appropriate policies and procedures that are responsive to cybersecurity threats and other information security risks. The Bancorp's Information Technology and Cybersecurity Risk Management (IT CSRM) team, as part of the Bancorp's Risk Management division, provides independent risk management oversight to those IT and IS teams. In addition to the Board oversight discussed below, the Bancorp's Internal Audit function independently oversees, reviews and validates these activities and reports to the Board of Directors on the effectiveness of governance, risk management and internal controls.


text: The Bancorp has established an Enterprise Risk Management Framework which informs the Bancorp's risk management programs. As part of this framework, the IT CSRM team maintains the Bancorp's IT CSRM Program, which is designed to identify, assess, manage, monitor, and report cybersecurity risks as part of the Bancorp's independent risk management function. The IT CSRM team is responsible for defining the risk management practices set forth in the IT CSRM Program. Refer to the Risk Management – Overview section of Item 7 (Management's Discussion and Analysis of Financial Condition and Results of Operations) of this Annual Report for additional information on the Bancorp's Enterprise Risk Management Framework and related risk management processes.


text: In light of the complexity and evolving nature of the cybersecurity landscape, the Bancorp periodically re-assesses the maturity of its cybersecurity programs, policies and procedures, including in some instances by engaging the assistance of external experts. The Bancorp also conducts exercises to test its incident response plans and threat assessments, some of which also involve assistance from external consultants.


text: The Bancorp also maintains a Third Party Risk Management Program to perform similar functions related to risks associated with the Bancorp's relationships with third parties. This assists the Bancorp in its management of its relationships with third parties, which includes considerations for identifying, analyzing and monitoring the cybersecurity risks that third parties may present to Fifth Third. The Bancorp also maintains a third-party incident response program to govern its response in the event of third-party cybersecurity events.


text: Board of Directors Oversight The Technology Committee of the Bancorp's Board of Directors takes primary responsibility for overseeing the Bancorp's information security programs at the Board level. The Technology Committee's primary purpose is to assist the Board of Directors in its oversight of plans and operations related to information technology, cybersecurity, data privacy and third-party technology strategy.

stage1Category: Board Governance


text: Cyber Expertise and Experience The Company relies on third party cybersecurity professionals to provide risk assessments to help assess cybersecurity risks.

companyName: SPINDLETOP OIL & GAS CO

ticker: SPND


text: The full Board of Directors receives reports from the Technology Committee and the Risk and Compliance Committee about the Bancorp's cybersecurity programs as a result of the above-described oversight. In the event of a material cybersecurity incident, the Bancorp's incident response procedures include notifications to the Technology Committee, Risk and Compliance Committee and full Board of Directors, when appropriate and necessary.


text: Management Oversight The Bancorp's Information Security Governance Committee (ISGC) is a management committee that reviews and discusses critical information security risks that impact the Bancorp, identifies solutions to address these risks and has oversight of the Bancorp's information technology and information security policies. The ISGC provides cybersecurity reports periodically to the Risk and Compliance Committee and is comprised of the Bancorp's senior information security, information technology and enterprise risk management leaders, including the Chief Information Security Officer (CISO), Chief Information Officer, Chief Technology Officer, Chief Data Officer and Chief Operational Risk Officer.


text: The Bancorp's CISO is responsible for information security policies and the coordination of information security efforts across the organization. The CISO has over 35 years of diverse experience in information technology management and cybersecurity leadership at Fifth Third and at other large, complex organizations. This prior experience includes leadership of functions for cybersecurity threat management, intelligence, risk mitigation and incident response. The CISO has a Bachelor of Science degree in Computer and Information Science and is a certified Six Sigma Black Belt. The Bancorp's CISO reports to the Chief Information Officer. The CISO also reports directly to the Technology Committee and participates in various management councils and committees. The Bancorp's IT CSRM team monitors that the CISO has appropriate authority to carry out the duties and responsibilities necessary of that position.


text: The CISO remains informed about developments in cybersecurity, including potential threats and emerging risk management techniques, reporting such information to the Chief Information Officer and Technology Committee periodically. The CISO implements and oversees processes for the regular monitoring of information systems. This includes the deployment of advanced security measures and system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions designed to mitigate the impact of any incident, and long-term strategies for remediation and prevention of future incidents.


text: The Bancorp recognizes the importance of maintaining a cybersecurity risk management system designed to reduce the risks that cybersecurity threats pose to financial institutions. As such, the Bancorp has adopted proactive and defensive safeguards intended to better protect the Bancorp's information assets and supporting infrastructures from technology-related attacks. The Bancorp's Board of Directors and management oversee its information security and cybersecurity risk management programs. As further discussed below, the Bancorp has established various programs, policies and procedures which are designed to proactively protect information assets. However, not all incidents can be prevented. As a result, the Bancorp has also established various policies and procedures governing how to respond to security incidents, with the objective of minimizing any potential impacts. As of December 31, 2024, the Bancorp is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect Fifth Third, including its business strategies, results of operations or financial condition.


text: Risk Assessment and Management The Bancorp maintains a variety of programs and policies to support the management of cybersecurity risk within the organization with a focus on prevention, detection and response processes. These programs and policies leverage frameworks and controls from the National Institute of Standards and Technology as well as various other regulatory requirements and industry-specific standards. The Bancorp also participates in the federally recognized Financial Services Information Sharing and Analysis Center and requires its employees and contractors to complete various education and training programs related to information security.


text: The Bancorp's Information Technology ("IT") and Information Security ("IS") teams have the primary responsibility for establishing appropriate policies and procedures that are responsive to cybersecurity threats and other information security risks. The Bancorp's Information Technology and Cybersecurity Risk Management ("IT CSRM") team, as part of the Bancorp's Risk Management division, provides independent risk management oversight to those IT and IS teams. In addition to the Board oversight discussed below, the Bancorp's Internal Audit function independently oversees, reviews and validates these activities and reports to the Board of Directors on the effectiveness of governance, risk management and internal controls.


text: The Bancorp has established an Enterprise Risk Management Framework which informs the Bancorp's risk management programs. As part of this framework, the IT CSRM team maintains the Bancorp's IT CSRM Program, which is designed to identify, assess, manage, monitor and report cybersecurity risks as part of the Bancorp's independent risk management function. The IT CSRM team is responsible for defining the risk management practices set forth in the IT CSRM Program. Refer to the Risk Management – Overview section of Item 7 (Management's Discussion and Analysis of Financial Condition and Results of Operations) of this Annual Report for additional information on the Bancorp's Enterprise Risk Management Framework and related risk management processes.


text: BNY Mellon's Internal Audit function serves as the third line of defense and provides an independent view on how effectively the organization as a whole manages cybersecurity risk.

companyName: ECA Marcellus Trust I

ticker: ECTM


text: The Bancorp's Risk and Compliance Committee of the Board of Directors oversees the Bancorp's Enterprise Risk Management Framework and policies, including oversight of risks related to information security. The Risk and Compliance Committee receives periodic reports from the Technology Committee and these committees meet jointly at least once per year to discuss the Company's programs and risks.


text: Management Oversight The Bancorp's Information Security Governance Committee ("ISGC") is a management committee that reviews and discusses critical information security risks that impact the Bancorp, identifies solutions to address these risks and has oversight of the Bancorp's information technology and information security policies. The ISGC provides cybersecurity reports periodically to the Risk and Compliance Committee and is comprised of the Bancorp's senior information security, information technology and enterprise risk management leaders, including the Chief Information Security Officer ("CISO"), Chief Information Officer, Chief Technology & Information Security Officer, Chief Data Officer and Chief Operational Risk Officer. The ISGC's membership enables the ISGC to be informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, if any, in accordance with the Bancorp's incident response plans.


text: The Bancorp's CISO is responsible for information security policies and the coordination of information security efforts across the organization. The CISO has over 35 years of diverse experience in information technology management and cybersecurity leadership at Fifth Third and at other large, complex organizations. This prior experience includes leadership of functions for cybersecurity threat management, intelligence, risk mitigation and incident response. The CISO has a Bachelor of Science degree in Computer and Information Science and is a certified Six Sigma Black Belt. The Bancorp's CISO reports to the Chief Technology & Information Security Officer. The CISO also reports directly to the Technology Committee and participates in various management councils and committees. The Bancorp's IT CSRM team monitors that the CISO has appropriate authority to carry out the duties and responsibilities necessary of that position.


text: The Company is committed to managing risks that may impact the Company and incorporating risk considerations into its business activities at all levels, including strategic planning, risk identification inventory and assessment, and day-to-day business decisions. The Company's Board of Directors has approved a risk management framework that establishes governance and risk management requirements for all the Company's key risk areas and risk-taking activities. The Board oversees management's performance relative to the risk management framework and risk appetite. Management is responsible for defining the various risks facing the Company, formulating risk management policies and procedures, and managing risk exposures on a day-to-day basis. The Company's Executive Risk Committee (ERC), which is chaired by the Chief Risk Officer, oversees execution of the risk management framework. The ERC is supported by management's senior operating committees, each responsible for a specified risk category. The Company's Information Security Risk Committee (ISRC), which is co-chaired by the Chief Information Security Officer (CISO) and the Chief Technology Risk Officer, is a senior operating committee under this risk governance structure and is responsible for the management of information security risk at the Company. The ISRC provides direction and oversight of the information security risk management framework and corporate control programs of the Company, including significant information security risk events, and mitigation strategies. Further, the ISRC facilitates communication across business lines to provide for effective and consistent information security risk identification and control infrastructure to mitigate and manage material information security risks. The ISRC serves as an escalation, decision making, and approval body for information security risk items, including key policies and programs, issue resolution, emerging risks, and key program adherence. The ISRC escalates matters as appropriate to executive management, the ERC, which reports to the Board's Risk Management Committee, or a relevant committee of the Board. Generally, each of the ERC and ISRC meet at least monthly.

companyName: US BANCORP \DE\

ticker: USB


text: An incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident, which is tested on a periodic basis.

companyName: FIRST NORTHERN COMMUNITY BANCORP

ticker: FNRN


text: As part of the Company's risk management framework, risk management programs and processes are in place to incorporate risk considerations into day-to-day business activities across the Company's risk categories, business lines, and functions. Risk programs may manage all or certain components of a particular risk type. The Company's cybersecurity risk program provides centralized planning and management of related and interdependent work with a focus on risks from cybersecurity threats. The Company's cybersecurity risk program is integrated into the Company's overall business and operational strategies and requires that the Company allocate appropriate resources to maintain the program.


text: The Company's processes for assessing, identifying, and managing material risks from cybersecurity threats is integrated into the Company's overall risk governance and oversight structures through its "three lines of defense" model for establishing effective checks and balances within the risk management framework. In this model, specific to cybersecurity threats, the first line of defense is Information Security Services (ISS), which is responsible for identifying and implementing cybersecurity controls in accordance with policy requirements and industry best practices, to meet regulatory requirements and to safeguard the business. The second line of defense, Cybersecurity Risk Oversight within the Company's Operational Risk Management group, provides reporting and escalation of emerging risks related to cybersecurity and other concerns to senior management, the ERC, the ISRC, other designated senior operating committees, and the Risk Management Committee of the Board of Directors. The third line of defense, the Company's internal audit function, provides independent assessment and assurance regarding the effectiveness of the Company's governance, risk management, and control processes with respect to cybersecurity threats, and provides challenge and recommendations for improvement.


text: The Company uses reporting and metrics frameworks and regular internal and external oversight to assess the health of the cybersecurity risk program. At the first level, the ISS team identifies, assesses, and manages cybersecurity risk and threats. The Company manages cybersecurity issues and findings through remediation and/or closure, with escalation processes if an issue or finding cannot be remediated within required timeframes. The Company engages external assessors, consultants, and auditors to review the Company's cybersecurity risk program against those of industry peers. The Company also uses consultants periodically to provide recommendations to improve and enhance the program. Additionally, the Company continually works to align its policies and practices with industry-accepted information security practices as provided by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), Payment Card Industry Data Security Standards (PCI DSS), and other applicable standards, laws, and regulations.


text: The Company also maintains a third-party risk management program responsible for the oversight of outsourced operations, which enables the Company to oversee and identify risks related to engaging third-party service providers, including risks from cybersecurity threats to third-party service providers. The Company conducts due diligence using a risk-based approach in selecting and monitoring third-party service providers. The Company also obtains contractual assurances from third-party service providers relating to their security responsibilities, controls, reporting, and roles and responsibilities as it pertains to cybersecurity incident response policies and notification requirements. As appropriate, the Company obtains independent reviews of the third parties' security through audit reports and testing and conducts verification and validation with third parties to confirm cybersecurity and information security risks are appropriately identified, measured, mitigated, monitored, and reported by the third party to the Company.


text: As part of its responsibility to oversee the management, business, and strategy of the Company, the Company's Board of Directors reviews and approves the Company's risk management framework annually through its Risk Management Committee and oversees the Company's risk management processes by informing itself about the Company's key risks and evaluating whether management has reasonable risk management and control processes in place to address those risks. The Board carries out its risk management oversight responsibilities primarily through its committees. Each Board committee is responsible for overseeing certain risks under its charter. The Board's Risk Management Committee, with support from its Cybersecurity and Technology Subcommittee, has primary oversight responsibility for cybersecurity risk, including risks from any cybersecurity threats. The Risk Management Committee monitors the Company's compliance with the risk management framework and risk limits established under the Company's risk appetite statement approved by the Board. The Risk Management Committee also oversees the Company's independent risk management function. The Board's Risk Management Committee has a Cybersecurity and Technology Subcommittee that provides dedicated oversight to cybersecurity risk management and cyber resiliency and certain technology matters. The Risk Management Committee and its Cybersecurity and Technology Subcommittee receive quarterly reports from management on cybersecurity issues, including cybersecurity threats. The Board's Risk Management Committee and Audit Committee also hold a joint meeting annually at which they receive a report from the Company's CISO on cybersecurity threats facing the Company and its preparedness to meet and respond to those threats. In addition, the full Board typically holds an annual cybersecurity education session, which features the perspective of an outside expert on current cybersecurity topics. The Company also typically conducts an annual executive-level cybersecurity exercise to test its cyber incident response, completeness of playbooks, and communication protocols. This exercise involves Board members, managing committee members, third-party companies, and regulators as appropriate.


text: The Company's risk management framework includes its risk appetite statement, which is approved annually by the Board's Risk Management Committee and defines acceptable levels of risk-taking and risk limits and establishes the governance and oversight activities over risk management and reporting. Management monitors and measures the Company's risk appetite using a quantitative risk scorecard, which consists of risk appetite metrics and associated limits reported to the Board's Risk Management Committee on a quarterly basis. The Company's risk appetite statement includes specific information security metrics and associated limits. These limits also inform how matters, including cybersecurity incidents or threats, are escalated to specific members of management, appropriate senior operating committee (including the ISRC and/or ERC), and/or the Board of Directors or appropriate Board committee. The Board's Risk Management Committee oversees the Company's risk profile relative to its risk appetite and compliance with risk limits.


text: The members of the Company's management that are primarily responsible for assessing and managing risks from cybersecurity threats, including monitoring risk appetite metrics and limits related to cybersecurity, include the Company's CISO, Chief Risk Officer, and Chief Information and Technology Officer.


text: The Company's CISO is primarily responsible for the implementation of defense capabilities and risk mitigation strategies. The Company's CISO, Timothy J. Held, has over 26 years of information technology and cybersecurity experience. He holds the title of Executive Vice President and Chief Information Security Officer and has been in his role since 2018, having served as the Company's Deputy CISO from 2015 to 2018 and Head of Cyber Defense, Threat Intelligence, and Incident Response from 2012 to 2018. The CISO is supported by his direct reports and their teams, many of whom hold cybersecurity-related certifications.


text: The Company's CISO reports to the Vice Chair and Chief Risk Officer, Jodi L. Richard, who has served in that position since October 2018. She served as Executive Vice President and Chief Operational Risk Officer of the Company from January 2018 until October 2018, having served as Senior Vice President and Chief Operational Risk Officer from 2014 until January 2018. Prior to that time, Ms. Richard held various senior leadership roles at HSBC from 2003 until 2014, including Executive Vice President and Head of Operational Risk and Internal Control at HSBC North America from 2008 to 2014.


text: Venkatachari Dilip, the Company's Senior Executive Vice President and Chief Information and Technology Officer, has oversight of technology-related risk management issues and controls that align to the NIST CSF. Mr. Dilip previously was an Executive Vice President from September 2018 to April 2023 and has served as Chief Information and Technology Officer since joining the Company in September 2018. From May 2014 until July 2017, he served as Vice President at McKinsey Digital where he helped banks accelerate their digital transformation. From April 2009 to September 2013, he served as CEO at Compass Labs leading an innovative marketing analytics company. From March 2006 until April 2008, he served as Director of Products at Google where he led product teams for mobile ads and Google Checkout. From March 2004 until March 2006, he served as Vice President of PayPal/eBay and on the Board of PayPal Europe, where he was responsible for Payments Services, Risk and Fraud Management. Previously, Mr. Dilip co-founded and led startup companies CashEdge and CommerceSoft from 1996 until 2003.


text: The CISO and his leadership team generally meet each business day to discuss security item triage and emerging threats and trends identified by the Threat Intelligence Team. The CISO shares pertinent information from those meetings with the Chief Risk Officer. During a cyber incident, which could involve the Company or a third-party service provider to the Company, the Company's Cyber Security Incident Response Team (CSIRT) leads the response and internal communication. CSIRT manages low and moderate severity incidents, and Enterprise Crisis Management manages high and very high severity incidents. The risk rating of an incident may change throughout the incident investigation period as new information is learned or the environment changes. Depending on severity level, CSIRT or Enterprise Crisis Management distributes incident communications to senior management, including the Chief Executive Officer, Chief Risk Officer, Board of Directors or appropriate Board committee, and if applicable, the Company's regulators.


text: ISS leadership reports prevention, detection, mitigation, and remediation activities through various working groups and committees. Certain working groups meet with the CISO monthly to review completed risk assessments, and items that require escalation are reported up using the internal committee structure and ad hoc communications if time sensitive.


text: Additionally, working group and committee meetings report up issues to Operational Risk Management, which may decide to open a formal Risk Management Issue (RMI) based on the severity of the issue or other factors and which are subject to specific governance processes. All security-related RMI remediation activities are reviewed with the Chief Risk Officer and Chief Information and Technology Officer on a bi-weekly basis.


text: During the fiscal year ended December 31, 2023, the Company has not identified any specific risks from cybersecurity threats that have materially affected, or are reasonably likely to affect, the Company's business strategy, results of operations, or financial condition, other than the risks described under "Risk Factors – Operations and Business Risk" in the 2023 Annual Report.


text: Risk Assessment and Management The Company is committed to managing risks that may impact the Company and incorporating risk considerations into its business activities at all levels, including strategic planning, risk identification inventory and assessment, and day-to-day business decisions. The Company's Board of Directors has approved a risk management framework that establishes governance and risk management requirements for all the Company's key risk areas and risk-taking activities. The Board oversees management's performance relative to the risk management framework and risk appetite. Management is responsible for defining the various risks facing the Company, formulating risk management policies and procedures, and managing risk exposures on a day-to-day basis. The Company's Executive Risk Committee (ERC), which is chaired by the Chief Risk Officer, oversees execution of the risk management framework. The ERC is supported by management's senior operating committees, each responsible for a specified risk category. The Company's Information Security Risk Committee (ISRC), which is co-chaired by the Chief Information Security Officer (CISO) and the Chief Technology Risk Officer, is a senior operating committee under this risk governance structure and is responsible for the management of information security risk at the Company. The ISRC provides direction and oversight of the information security risk management framework and corporate control programs of the Company, including significant information security risk events, and mitigation strategies. Further, the ISRC facilitates communication across business lines to provide for effective and consistent information security risk identification and control infrastructure to mitigate and manage material information security risks. The ISRC serves as an escalation, decision making, and approval body for information security risk items, including key policies and programs, issue resolution, emerging risks, and key program adherence. The ISRC escalates matters as appropriate to executive management, the ERC, which reports to the Board's Risk Management Committee, or a relevant committee of the Board. Generally, each of the ERC and ISRC meet at least monthly.


text: Our Board understands the importance of maintaining a robust and effective cybersecurity program. The Audit and Finance Committee of the Board oversees the Company's cybersecurity program as well as risk exposures and steps taken by management to monitor and mitigate cybersecurity risks. The CISO provides a quarterly update on the cybersecurity program, on an alternating basis to the Audit and Finance Committee or the full Board.

companyName: GAP INC

ticker: GAP


text: As part of the Company's risk management framework, risk management programs and processes are in place to incorporate risk considerations into day-to-day business activities across the Company's risk categories, business lines, and functions. Risk programs may manage all or certain components of a particular risk type. The Company's cybersecurity risk program provides centralized planning and management of related and interdependent work with a focus on risks from cybersecurity threats. Additionally, the Company's Information Security Awareness and Training Program educates employees and contractors on information security policies, standards, and practices to protect U.S. Bancorp's information, information systems, and processes. The Company's cybersecurity risk program is integrated into the Company's overall business and operational strategies and requires that the Company allocate appropriate resources to maintain the program.


text: The Company's processes for assessing, identifying, and managing material risks from cybersecurity threats are integrated into the Company's overall risk governance and oversight structures through its "three lines of defense" model for establishing effective checks and balances within the risk management framework. In this model, specific to cybersecurity threats, the first line of defense is Information Security Services (ISS), which is responsible for identifying and implementing cybersecurity controls in accordance with policy requirements and industry best practices, to meet regulatory requirements and to safeguard the business. The second line of defense, Cybersecurity Risk Oversight within the Company's Operational Risk Management group, provides reporting and escalation of emerging risks related to cybersecurity and other concerns to senior management, the ERC, the ISRC, other designated senior operating committees, and the Risk Management Committee of the Board of Directors. The third line of defense, the Company's internal audit function, provides independent assessment and assurance regarding the effectiveness of the Company's governance, risk management, and control processes with respect to cybersecurity threats, and provides challenges and recommendations for improvement.


text: During the fiscal year ended December 31, 2024, the Company has not identified any specific risks from cybersecurity threats that have materially affected, or are reasonably likely to affect, the Company's business strategy, results of operations, or financial condition, other than the risks described under "Risk Factors – Operations and Business Risk" in the 2024 Annual Report. The Company may not be successful in preventing or mitigating the impacts of a future cybersecurity incident that could have a material adverse effect on the Company or its business strategy, results of operations or financial condition.


text: Third Party Risks The Company also maintains a third-party risk management program responsible for the oversight of outsourced operations, which enables the Company to oversee and identify risks related to engaging third-party service providers, including risks from cybersecurity threats to third-party service providers. T he Company conducts due diligence using a risk-based approach in selecting and monitoring third-party service providers. The Company also obtains contractual assurances from third-party service providers relating to their security responsibilities, controls, reporting, and roles and responsibilities as it pertains to cybersecurity incident response policies and notification requirements. As appropriate, the Company obtains independent reviews of the third parties' security through audit reports and testing and conducts verification and validation with third parties to confirm cybersecurity and information security risks are appropriately identified, measured, mitigated, monitored, and reported by the third party to the Company.


text: Board of Directors Oversight As part of its responsibility to oversee the management, business, and strategy of the Company, the Company's Board of Directors reviews and approves the Company's risk management framework annually through its Risk Management Committee and oversees the Company's risk management processes by informing itself about the Company's key risks and evaluating whether management has reasonable risk management and control processes in place to address those risks. The Board carries out its risk management oversight responsibilities primarily through its committees. Each Board committee is responsible for overseeing certain risks under its charter. The Board's Risk Management Committee, with support from its Cybersecurity and Technology Subcommittee, has primary oversight responsibility for cybersecurity risk, including risks from any cybersecurity threats. The Risk Management Committee monitors the Company's compliance with the risk management framework and risk limits established under the Company's risk appetite statement approved by the Board. The Risk Management Committee also oversees the Company's independent risk management function. The Cybersecurity and Technology Subcommittee has oversight responsibility for cybersecurity risk management and cyber resiliency and certain technology matters. The Risk Management Committee and its Cybersecurity and Technology Subcommittee receive quarterly reports from management on cybersecurity issues, including cybersecurity threats. The Board's Risk Management Committee and Audit Committee also hold a joint meeting annually at which they receive a report from the Company's CISO on cybersecurity threats facing the Company and its preparedness to meet and respond to those threats. In addition, the full Board holds periodic cybersecurity education sessions, which may feature the perspective of an outside expert on current cybersecurity topics. The Company also typically conducts an annual executive-level crisis exercise that includes a cybersecurity component to test its resiliency response, completeness of playbooks, and communication protocols. This exercise involves Board members, Managing Committee members, third-party companies, and regulators, as appropriate.


text: Risk Management and Strategy We recognize the importance of effective cybersecurity risk management to our operations and interests. Our cybersecurity program is designed to protect our employees, our customers and our assets through the effective identification and mitigation of cyber risks. The program, led by the Senior Director, Global Information Technology ("IT") Security under the oversight of the Chief Information and Digital Officer ("CIDO"), encompasses a broad range of preventative, detective and responsive measures relevant to our business needs and designed to reduce our specific risks.

companyName: GREIF, INC

ticker: GEF


text: The Company's risk management framework includes its risk appetite statement, which is approved annually by the Board's Risk Management Committee, and defines acceptable levels of risk-taking and risk limits and establishes the governance and oversight activities over risk management and reporting. Management monitors and measures the Company's risk appetite using a quantitative risk scorecard consisting of risk appetite metrics and associated limits reported to the Board's Risk Management Committee on a quarterly basis. The Company's risk appetite statement includes specific information security metrics and associated limits. These limits also inform how matters, including cybersecurity incidents or threats, are escalated to specific members of management, appropriate senior operating committees (including the ISRC and/or ERC), and/or the Board of Directors or appropriate Board committee. The Board's Risk Management Committee oversees the Company's risk profile relative to its risk appetite and compliance with risk limits.


text: Management Oversight The members of the Company's management that are primarily responsible for assessing and managing risks from cybersecurity threats, including monitoring risk appetite metrics and limits related to cybersecurity, include the Company's CISO, Chief Risk Officer, and Chief Information and Technology Officer.


text: The Company's CISO is primarily responsible for the implementation of defense capabilities and risk mitigation strategies. T he Company's CISO, Timothy J. Held, has over 27 years of information technology and cybersecurity experience. He holds the title of Executive Vice President and Chief Information Security Officer and has been in his role since 2018, having served as the Company's Deputy CISO from 2015 to 2018 and Head of Cyber Defense, Threat Intelligence, and Incident Response from 2012 to 2018. The CISO is supported by his direct reports and their teams, many of whom hold cybersecurity-related certifications.


text: The Company's CISO reports to the Vice Chair and Chief Risk Officer, Jodi L. Richard, who has served in that position since October 2018. She served as Executive Vice President and Chief Operational Risk Officer of the Company from January 2018 until October 2018, having served as Senior Vice President and Chief Operational Risk Officer from 2014 until January 2018. Prior to that time, Ms. Richard held various senior leadership roles at HSBC from 2003 until 2014, including Executive Vice President and Head of Operational Risk and Internal Control at HSBC North America from 2008 to 2014.


text: Venkatachari Dilip, the Company's Senior Executive Vice President and Chief Information and Technology Officer, has oversight of technology-related risk management issues and controls that align to the NIST CSF. Mr. Dilip previously was an Executive Vice President from September 2018 to April 2023 and has served as Chief Information and Technology Officer since joining the Company in September 2018. From May 2014 until July 2017, he served as Vice President at McKinsey Digital where he helped banks accelerate their digital transformation. From April 2009 to September 2013, he served as CEO at Compass Labs leading an innovative marketing analytics company. From March 2006 until April 2008, he served as Director of Products at Google where he led product teams for mobile ads and Google Checkout. From March 2004 until March 2006, he served as Vice President of PayPal/eBay and on the Board of PayPal Europe, where he was responsible for Payments Services, Risk and Fraud Management. Previously, Mr. Dilip co-founded and led startup companies CashEdge and CommerceSoft from 1996 until 2003.


text: The CISO and his leadership team generally meet each business day to discuss security item triage and emerging threats and trends identified by the Threat Intelligence Team. The CISO shares pertinent information from those meetings with the Chief Risk Officer. During a cyber incident, which could involve the Company or a third-party service provider to the Company, the Company's Cyber Security Incident Response Team (CSIRT) leads the response and internal communication. CSIRT manages low and moderate severity incidents, and Enterprise Crisis Management manages high and very high severity incidents. The risk rating of an incident may change throughout the incident investigation period as new information is learned or the environment changes. Depending on severity level, CSIRT or Enterprise Crisis Management distributes incident communications to senior management, including the Chief Executive Officer, Chief Risk Officer, Board of Directors or appropriate Board committee, and if applicable, the Company's regulators.


text: ISS leadership reports prevention, detection, mitigation, and remediation activities through various working groups and committees. Certain working groups meet with the CISO monthly to review completed risk assessments, and items that require escalation are reported up using the internal committee structure and ad hoc communications if time sensitive. Additionally, working group and committee meetings report up issues to Operational Risk Management, which may decide to open a formal Risk Management Issue (RMI) based on the severity of the issue or other factors and which are subject to specific governance processes. All security-related RMI remediation activities are reviewed with the Chief Risk Officer and Chief Information and Technology Officer on a bi-weekly basis.


text: The Cybersecurity Risk Management section within our 2023 MD&A (Item 7), beginning on page 86 of this report, is incorporated herein by reference.

companyName: FIRST HORIZON CORP

ticker: FHN


text: The Cybersecurity Risk Management section within our 2024 MD&A (Item 7), beginning on page 91 of this report, is incorporated herein by reference.


text: The cybersecurity program is modeled after and assessed against the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). The NIST CSF is not a certification program and our use does not imply compliance with specific, related standards – the NIST CSF is used as a guide for designing and managing cybersecurity programs.


text: Cybersecurity Processes As noted in Item 1A. Risk Factors, FMC recognizes that the threat of cybersecurity breaches may create significant risks for the Company. Accordingly, we are committed to an ongoing and comprehensive program to protect all company data, as well as data in our supply chain, from these threats. Our cybersecurity program includes governance defined by IT policies and standards and a robust IT risk management program. FMC uses several tools and controls to manage IT risk including, but not limited to, controls for the management of privileged access, anti-malware tools, required trainings for employees including an annual training module, simulated email phishing attacks, and other email security tools to detect and prevent intrusions as well as monitor threats. FMC employees have access to formal IT policies that define and clarify expected behaviors with respect to IT resources in various areas. The Company has a Cyber Incident Response Plan, which establishes procedures to prepare for and respond to a variety of cyber incidents, and continuously engages in response planning, simulations, trainings, tabletop exercises, and other efforts to mitigate risk and prepare for a rapid response to any incidents should they occur. Additionally, our contracts with third-party providers require those organizations to notify FMC of any cyber incident that occurs when our information has been impacted. FMC frequently communicates with our third-party service providers to ensure timely notification of any matters that may impact our data security.

companyName: FMC CORP

ticker: FMC


text: Periodically, the Company has its cybersecurity programs audited by independent third parties using the NIST Cybersecurity Framework, which provides guidance to organizations on how to identify, prevent, detect, respond, and recover from cybersecurity threats. The most-recent audit was performed in 2022 over the Company's 2021 cybersecurity program. The audit results showed that FMC has a mature and robust cybersecurity program that is rated at or above peer industry benchmarks and also provided insight for areas of future improvement in risk mitigation and further program development.


text: Management Oversight in Cybersecurity Governance FMC's senior management Operating Committee, which includes the Chief Executive Officer and all Company vice presidents, is responsible for review and oversight of the Company's cybersecurity programs and risk assessment as well as the strategic direction of the program to address evolving risks. Specifically, David Kotch, Vice President and Chief Information Officer, serves as management's expert in cybersecurity management. He has held various positions within the Company's IT department, has an educational background in Information Systems, and contributes technical expertise to the Company's Operating Committee. He serves as a member of the Chemical Information Technology Center's CIO organization and the CIO Executive Summit. Mr. Kotch also belongs to various business associations, including industry and government associations, to ensure timely receipt of critical threat information as well as access resources useful in developing cost-effective security solutions to protect the Company's personnel and information. Additionally, Andrew Sandifer, Executive Vice President and Chief Financial Officer, has completed continuing professional education courses covering the role of management and the board of directors in cybersecurity governance. Members of the management team are encouraged to engage in education opportunities related to cybersecurity.


text: FMC has established a process to assess the nature, scope and timing of a cyber incident and communicate the facts of the incident to management and the board of directors and, if needed, investors. In the event of a cybersecurity incident, the incident response team, which is managed by IT personnel, is responsible for ensuring the Chief Executive Officer and Operating Committee are notified in a timely manner. For any cybersecurity incident, there will be a cross-functional review, including the IT, legal, and finance teams, to evaluate qualitative and quantitative factors related to the incident to determine if the impact of the event is material. Individuals from other departments may be involved in this review depending on the facts and circumstances of the incident. These individuals will be responsible for responding to the event and monitoring the impacts on the Company's operations, financial position, and results of operations. This team will also evaluate cyber incidents in the aggregate if related events occur. During the response and recovery related to a cyber incident, this team will meet daily or weekly depending on the severity of the event and continuously evaluate the nature, scope, and timing of the event. Members of the senior management Operating Committee, including the Chief Information Officer, Chief Financial Officer, Chief Accounting Officer, and General Counsel will be briefed as to the facts and circumstances of a cyber incident and determine if the event is considered material to the business. If such determination is made, the matter will be escalated to Board of Directors. For material incidents, the Company will provide information regarding the nature and scope of the incident to investors in compliance with SEC regulations. Throughout this process and the recovery following an incident, the Company is focused on considering the ever-changing facts and circumstances of the event and remaining as transparent with the investment community as possible.


text: During 2023, FMC did not directly experience a cybersecurity breach in any FMC system. During 2023, we did receive notification of cybersecurity breaches affecting third-party vendors, but none were material in nature for FMC.


text: Board of Directors Oversight in Cybersecurity Governance FMC's Board of Directors oversees the Company's cybersecurity program primarily through its Audit Committee, which is comprised of independent directors whose prior work experience provides them with insights as to potential cybersecurity risks and mitigation strategies. Company executives along with external and internal cybersecurity experts update the Audit Committee at least quarterly on risks related to cybersecurity and the steps taken to monitor and control risk exposure. Additionally, the results of periodic audits performed on the Company's cybersecurity programs, described above, are communicated to the Audit Committee upon completion. In addition to the routine updates provided to the Audit Committee, FMC has an established policy for communication of cybersecurity incidents with the Board of Directors and, if material, the investor community. Refer to the discussion above for further details of this policy.


text: We have a Vendor Management department that established policies and procedures to follow when utilizing external third-parties. Third-party vendors are thoroughly vetted, approved and inventoried before partnership begins. Vendor Management ensures key risk components are mitigated based on acceptable Company standards. Any third parties used in any cybersecurity processes are vetted through our vendor management process. Risks from Cybersecurity threats or previous incidents have not materially affected business strategy, results of operations, or financial condition. See cybersecurity risk factors in Item 1A. Risk Factors.

companyName: FNB CORP/PA/

ticker: FNB


text: Cybersecurity Processes As noted in Item 1A. Risk Factors, FMC recognizes that the threat of cybersecurity breaches may create significant risks for the Company. Accordingly, we are committed to an ongoing and comprehensive program to protect all company data, as well as data in our supply chain, from these threats. Our cybersecurity program includes governance defined by IT policies and standards and a robust IT risk management program. FMC uses several tools and controls to manage IT risk including, but not limited to, controls for the management of privileged access, anti-malware tools, required trainings for employees including an annual training module, simulated email phishing attacks, and other email security tools to detect and prevent intrusions as well as monitor threats. FMC employees have access to formal IT policies that define and clarify expected behaviors with respect to IT resources in various areas. The Company has a Cyber Incident Response Plan, which establishes procedures to prepare for and respond to a variety of cyber incidents, and engages in response planning, simulations, trainings, tabletop exercises, and other efforts to mitigate risk and prepare for a rapid response to any incidents should they occur. FMC performs a thorough security review prior to onboarding critical third-party providers, which includes review of third-party independent assessments in the form of SOC reports prior to contracting. SOC reports are also reviewed on an annual basis once the third-party is engaged. Additionally, our contracts with third-party providers require those organizations to notify FMC of any cyber incident that occurs when our information has been impacted.


text: Periodically, the Company has its cybersecurity programs audited by independent third parties using the NIST Cybersecurity Framework, which provides guidance to organizations on how to identify, prevent, detect, respond, and recover from cybersecurity threats.


text: Management Oversight in Cybersecurity Governance FMC's senior management Executive Committee and Leadership Team, which includes the Chief Executive Officer and all Company vice presidents, is responsible for review and oversight of the Company's cybersecurity programs and risk assessment as well as the strategic direction of the program to address evolving risks. Specifically, Jas Sidhu, Senior Director - Core IT, serves as management's expert in cybersecurity management. He has held various positions within the Company's IT department, has an educational background in Information Systems, and contributes technical expertise to the Company's leadership team. He serves as a member of the Chemical Information Technology Center's CIO organization and the SAP Chemicals Advisory Board. Mr. Sidhu also belongs to various business associations, including industry and government associations, to ensure timely receipt of critical threat information as well as access resources useful in developing cost-effective security solutions to protect the Company's personnel and information. Additionally, Andrew Sandifer, Executive Vice President and Chief Financial Officer, has completed continuing professional education courses covering the role of management and the board of directors in cybersecurity governance. Members of the management team are encouraged to engage in education opportunities related to cybersecurity.


text: FMC has established a process to assess the nature, scope and timing of a cyber incident and communicate the facts of the incident to management and the board of directors and, if needed, investors. In the event of a cybersecurity incident, the incident response team, which is managed by IT personnel, is responsible for ensuring the Chief Executive Officer and other members of the Executive Committee and Leadership Team are notified in a timely manner. For any cybersecurity incident, there will be a cross-functional review, including the IT, legal, and finance teams, to evaluate qualitative and quantitative factors related to the incident to determine if the impact of the event is material. Individuals from other departments may be involved in this review depending on the facts and circumstances of the incident. These individuals will be responsible for responding to the event and monitoring the impacts on the Company's operations, financial position, and results of operations. This team will also evaluate cyber incidents in the aggregate if related events occur. During the response and recovery related to a cyber incident, this team will meet daily or weekly depending on the severity of the event and continuously evaluate the nature, scope, and timing of the event. Members of the senior management, including the Chief Financial Officer, Chief Accounting Officer, and General Counsel, as well as the Senior Director - Core IT will be briefed as to the facts and circumstances of a cyber incident and determine if the event is considered material to the business. If such determination is made, the matter will be escalated to Board of Directors. For material incidents, the Company will provide information regarding the nature and scope of the incident to investors in compliance with SEC regulations. Throughout this process and the recovery following an incident, the Company is focused on considering the ever-changing facts and circumstances of the event and remaining as transparent with the investment community as possible.


text: During 2024, FMC did not directly experience a cybersecurity breach in any FMC system. During 2024, we did receive notification of cybersecurity breaches affecting third-party vendors, but none were material in nature for FMC.


text: Our Information Security Department uses the National Institute of Standards and Technology framework for improving critical infrastructure by measuring and evaluating the effectiveness of information and cybersecurity controls. We have various processes for risk assessment, vulnerability management, threat management, independent penetration testing, security architecture, access management, network security management, security event monitoring and security awareness.


text: Terex has experienced cyber incidents in the normal course of business; however, no prior cybersecurity incident has had a material adverse effect on Terex's business, strategy, results of operations, financial condition or reputation. For more information on the cybersecurity threats and risks we face, see Part I, Item 1A. – Risk Factors.

companyName: TEREX CORP

ticker: TEX


text: The Information Security Department reports to the Chief Information Security Officer and then directly to the Chief Risk Officer, to ensure the coordinated and consistent implementation of risk management initiatives and strategies on a day-to-day basis. Results of the information and cybersecurity efforts and recommendations are reported to the Risk Management Council no less than quarterly which is then shared with the Board Risk Committee. The Board Risk Committee is primarily responsible for overseeing risk management, including risks associated with cybersecurity and potential threats thereto. Our management is directly involved in assessing and managing cybersecurity risks. As noted, we employ a Chief Risk Officer, along with information security personnel in our Information Security Department. The Chief Risk Officer regularly reports to our Risk Management Council, which is comprised of our senior leadership. See "Risk Management" in section of MD&A for an overview of our risk management framework.


text: The Information Security Department uses the National Institute of Standards and Technology framework for improving critical infrastructure by measuring and evaluating the effectiveness of information and cybersecurity controls. We have various processes for risk assessment, vulnerability management, threat management, independent penetration testing, security architecture, access management, network security management, security event monitoring and security awareness. Certain processes involve the use of third parties. A summary of each process is below.


text: Risk Assessment Process. On an annual basis, a risk assessment and maturity analysis is performed for the FNB environment based on the NIST CSF Framework. The risk assessment takes into consideration a combination of risks related to the identification, prevention, detection, response, and recovery from cyber events. The risk assessment considers the inherent risk and controls implemented in the FNB environment and measures the residual risk to ensure it is within the FNB risk tolerance.


text: Vulnerability Management Process. Regular internal and external vulnerability scanning is conducted at varying intervals to proactively identify configuration weaknesses, missing patches and other vulnerabilities in the FNB information systems environment. Identified vulnerabilities are classified and scored based on their Common Vulnerability Scoring System or CVSS score, known exploitation or malware impacting the vulnerability, and the age in the environment. We prioritize the patching of critical and severe vulnerabilities.


text: Threat Management Process. In addition to the regular and routine vulnerability scanning, FNB relies on various threat intelligence feeds for the identification and awareness of potential threats that could impact the FNB environment. Using third party vendors to assist, threats are integrated into our monitoring solutions, email filtering, web-browsing controls, malware detection, and perimeter firewalls to proactively prevent, detect and deter threats with the capability to impact the FNB environment.


text: Independent Penetration Testing. On an annual basis, we engage with an independent third-party provider to perform various penetration tests of the environment. The penetration tests look at our customer facing applications, how we respond to social engineering activities, overall external attack surface and internal vulnerabilities. Issues identified from the penetration tests are tracked and escalated to ensure appropriate remediation occurs before closure.


text: Security Architecture. To ensure the secure configuration, design, and implementation of our internally hosted and third-party hosted systems, security architecture reviews are conducted. The architecture reviews entail a series of questions. These questions are reviewed with internal IT and third-party vendor contacts to ensure the implementation is meeting policies, is configured with strong security practices, and utilizes appropriate access controls.


text: Access Management. Utilizing a least privilege, need-to-know access methodology, access is controlled through a centralized user access management function responsible for the provisioning, transfer and deprovisioning of users' access. Access management also performs routine reviews of application and systems access to ensure access remains appropriate. For third-party hosted environments, access management works with security architecture to ensure single sign-on controls are employed or additional factors are utilized to prevent unauthorized access to these environments.


text: Network Security Management. The security of the FNB network infrastructure is maintained via • internal and perimeter firewalls with intrusion detection, • the use of some network segmentation to isolate access to certain applications and systems, • VLANs or virtual local area networks, • email filtering to identify spam, malware, and phishing messages in received email messages, • malware detection, • data loss prevention controls to prevent the theft, or mass exfiltration of data, • Virtual Private Networks (VPN) to control remote access to our network, • intrusion detection capabilities, • network access controls (NAC) to prevent unauthorized assets from connecting to the network, and • web filtering.


text: Security Event Monitoring. A centralized security monitoring team is responsible for the response to alerts generated from a consolidated log collection system. Log collection occurs from various assets and hosted environments. The monitoring tool is third-party provided SIEM, and enables threat identification, detects suspicious activity in the environment using the MITRE Att&ck framework, performs user behavior analytics, and endpoint detection and response. Alerts are investigated to ascertain whether a cyber incident is occurring or not.


text: The Information Security Department reports to the Chief Information Security Officer (CISO) and then directly to the Chief Risk Officer, to ensure the coordinated and consistent implementation of risk management initiatives and strategies on a day-to-day basis. Results of the information and cybersecurity evaluation and recommendations established by the Information Security Department are reported to the Risk Management Council no less than quarterly, and the results are then shared with the Board Risk Committee. The Board Risk Committee is primarily responsible for overseeing risk management, including risks associated with cybersecurity and potential threats thereto. In addition, the Chief Risk Officer regularly reports to our Risk Management Council, which is comprised of our senior leadership, ensuring direct involvement by our management in assessing and managing cybersecurity risk. See "Risk Management" in section of MD&A for an overview of our risk management framework.


text: We believe our management has the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats including applicable knowledge gained through industry experience, education, ongoing internal and external training and regular discussions with consultants and peers with applicable knowledge and expertise. See the following details of certain cybersecurity personnel.


text: The CISO has served FNB since 2016, and has a career over 25 years in information technology, enterprise risk and information security controls. The CISO is a Certified Information Systems Security Professional (CISSP). The CISO has a Bachelor's degree in Criminal Justice with a minor in Computer Science. The CISO is supported by several managers including the following: • Manager of Cyber Security - CISSP with over 20 years of Information Technology and Systems Engineering experience. • Manager of Security Architecture - CISSP with over 20 years experience in Information Technology networking, network security and security engineering.


text: The CISO chairs an Information Security Committee made up of other risk professionals, Information Technology and line of business leaders to maintain an understanding and balance between security and business functionality.


text: A summary of the processes involved in our process of evaluating the effectiveness of information and cybersecurity controls is below.


text: Vulnerability Management Process. Regular internal and external vulnerability scanning is conducted at varying intervals to proactively identify configuration weaknesses, missing patches and other vulnerabilities in the FNB information systems environment. Identified vulnerabilities are classified and scored based on their Common Vulnerability Scoring System, known exploitation or malware impacting the vulnerability, and the age in the environment. We prioritize the patching of critical and severe vulnerabilities.


text: Threat Management Process. In addition to regular and routine vulnerability scanning, we rely on various threat intelligence feeds for the identification and awareness of potential threats that could impact the FNB environment. With the assistance of third-party vendors, threats are integrated into our monitoring solutions, email filtering, web-browsing controls, malware detection, and perimeter firewalls to proactively prevent, detect and deter threats with the capability to impact the FNB environment.


text: Independent Penetration Testing. On an annual basis, we engage with an independent third-party provider to perform various penetration tests of the environment. The penetration tests review our customer facing applications, our response to social engineering activities, overall external attack surface and internal vulnerabilities. Issues identified from the penetration tests are tracked and escalated to ensure appropriate remediation occurs before closure.


text: Security Architecture. To ensure the secure configuration, design, and implementation of our internally hosted and third-party hosted systems, security architecture reviews are conducted. The architecture reviews entail a series of questions, the responses to which are reviewed with internal IT and third-party vendor contacts to ensure the implementation is meeting policies, is configured with strong security practices, and utilizes appropriate access controls.


text: Risk Management and Strategy We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats. Our efforts are designed to maintain the confidentiality, integrity, and availability of our information and operational technology systems and the data stored on those systems.

companyName: GRAYBAR ELECTRIC CO INC


text: Network Security Management. The security of the FNB network infrastructure is maintained via: • internal and perimeter firewalls with intrusion detection, • the use of some network segmentation to isolate access to certain applications and systems, • VLANs or virtual local area networks, • email filtering to identify spam, malware, and phishing messages in received email messages, • malware detection, • data loss prevention controls to prevent the theft, or mass exfiltration of data, • Virtual Private Networks to control remote access to our network, • intrusion detection capabilities, • network access controls to prevent unauthorized assets from connecting to the network, and • web filtering.


text: Security Awareness. Annual security training is conducted for all employees, and routine phishing tests are administered routinely. We also post articles regarding common cybersecurity schemes on our intranet for our employees' awareness.


text: We have a Vendor Managemen t department that established policies and procedures to follow when utilizing third-party vendors and ensures that key risk components are mitigated based on our standards. Third-party vendors are thoroughly vetted, approved and inventoried before partnership begins.


text: To date, we have not experienced cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition. For additional information regarding cybersecurity threats, see Item 1 of this Report, "Business – Cybersecurity" and Item 1A of this Report, "Risk Factors—5. Operational Risk—An interruption in or breach in security of our information systems, or other cybersecurity risks, could result in a loss of customer business, increased compliance and remediation costs, civil litigation or governmental regulatory action, and have an adverse effect on our results of operations, financial condition and cash flows."


text: When a cybersecurity threat or incident is identified, our policy is to review and triage the threat or incident, and to then manage it to conclusion in accordance with our cybersecurity incident response processes. When a cybersecurity incident is determined to be significant, it is addressed by management committees using processes that leverage subject-matter expertise from across the Company. Further, we may engage third-party advisors, from time to time, as part of our incident management processes. All cybersecurity incidents that are identified as reasonably having the potential to be highly significant to the Company are brought to the attention of both the Chief Enterprise Technology Officer and General Counsel by the Chief Information Security Officer as part of our cybersecurity incident response processes.

companyName: FORD MOTOR CO

ticker: F


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. As part of its enterprise risk management efforts, the Board meets with senior management, including the executive leadership team, to assess and respond to critical business risks. Critical enterprise risks are assessed by senior management annually and discussed with the Board. Once identified, each of the risks we view as most significant is assigned an executive risk owner who is responsible to oversee risk assessment, develop and implement mitigation plans, and provide regular updates to the Board (and/or Board committee assigned to the risk). Cybersecurity threats have been and continue to be identified as one of the Company's top risks, with our Chief Enterprise Technology Officer and Chief Information Security Officer assigned as the executive risk owners. The Board has delegated primary responsibility for the oversight of cybersecurity and information technology risks, and the Company's preparedness for these risks, to the Audit Committee.


text: As part of its oversight responsibilities, the Audit Committee receives regular updates on our cybersecurity practices as well as cybersecurity and information technology risks from our Chief Information Security Officer. These regular updates include topics related to cybersecurity practices, cyber risks, and risk management processes, such as updates to our cybersecurity programs and mitigation strategies, and other cybersecurity developments. In addition to these regular updates, as part of our incident response processes, the Chief Enterprise Technology Officer, in collaboration with the Chief Information Security Officer and General Counsel, provides updates on certain cybersecurity incidents to the Audit Committee and, in some cases, the Board. The Audit Committee reviews and provides input into and oversight of our cybersecurity processes, and in the event Ford determines it has experienced a material cybersecurity incident, the Audit Committee is notified about the incident in advance of filing a Current Report on Form 8-K.


text: • Security Incident and Event Monitoring • Cloud alerting and monitoring • Disaster recovery and business continuity planning and backup strategy • Incident response process • Network segmentation • Data classification labeling and data loss prevention • Privileged access management • Secure builds • Multi-factor and adaptive authentication • Physical security • Internet filtering, email spam filtering and anti-phishing • Brand protection and phishing takedown service • Database security • Data transfer and encryption Additionally, we maintain cybersecurity insurance coverage to help mitigate risk in the event of a potential breach or attack. Although we maintain insurance coverage at levels we deem appropriate for our business, it is possible that such coverage could be insufficient to cover all losses or types of claims that may arise.

companyName: 1st FRANKLIN FINANCIAL CORP


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. Moreover, we, our suppliers, and our dealers have been the target of cybersecurity incidents and such threats are continuing and evolving, which may cause cybersecurity incidents to be more difficult to detect for periods of time. Our networks and in-vehicle systems, sharing similar architectures, could also be impacted by, or a cybersecurity incident may result from, the negligence or misconduct of insiders or third parties who have access to our networks and systems. A cybersecurity incident could harm our reputation, cause customers to lose trust in our security measures, and/or subject us to regulatory actions or litigation, which may result in fines, penalties, judgments, or injunctions, and a cybersecurity incident involving us or one of our suppliers could impact our business strategy, results of operations, financial condition, or our reputation. For additional information, see "Operational information systems, security systems, vehicles, and services could be affected by cybersecurity incidents, ransomware attacks, and other disruptions and impact Ford and Ford Credit as well as their suppliers and dealers" on page 20.


text: Cybersecurity Governance and Oversight Cybersecurity risk identification, assessment, and management are integrated into our overall enterprise risk management program. As part of its enterprise risk management efforts, the Board meets with senior management, including the executive leadership team, to assess and respond to critical business risks. These critical enterprise risks are assessed by senior management annually and discussed with the Board. Then each of the top risks are validated, prioritized, and assigned risk owners who are responsible to oversee risk assessment, develop and implement mitigation plans, and provide regular updates to the Board (and/or Board committee assigned to the risk). In this way, critical business risks, including cybersecurity risk, benefit from both top-down and bottom-up risk management efforts that we believe are reasonably designed to escalate key risk and control issues to senior management and the Board.


text: As a result of this enterprise risk management process, cybersecurity threats have been and continue to be identified as one of the Company's critical business risks, with our Chief Enterprise Technology Officer and Chief Information Security Officer assigned as the executive risk owners. The Chief Enterprise Technology Officer and Chief Information Security Officer monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including through the operation of the Company's global cybersecurity incident response plans, which include provisions for escalation to the Chief Policy Officer and General Counsel, as well as the Board and its committees, as appropriate. As discussed below, the executive risk owners for cybersecurity risk report out to the Audit Committee and, in some cases, the Board, on a regular basis as part of our enterprise risk management process.


text: The Board has delegated primary responsibility for the oversight of cybersecurity and information technology risks, and the Company's preparedness for these risks, to the Audit Committee. As part of its oversight responsibilities, the Audit Committee receives regular updates on our cybersecurity practices as well as cybersecurity and information technology risks from our Chief Information Security Officer. These updates include topics related to cybersecurity practices, cyber risks, and risk management processes, such as updates to our cybersecurity programs and mitigation strategies, and other cybersecurity developments. In addition to these regular updates, as part of our incident response processes, the Chief Enterprise Technology Officer, in collaboration with the Chief Information Security Officer and Chief Policy Officer and General Counsel, provides updates on certain cybersecurity incidents to the Audit Committee and, in some cases, the Board. The Audit Committee reviews and provides input into and oversight of our cybersecurity processes, and in the event Ford determines it has experienced a material cybersecurity incident, the Audit Committee is notified about the incident in advance of filing a Current Report on Form 8-K.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For a discussion of whether and how cybersecurity incidents, ransomware attacks, and other disruptions to our operational information systems, security systems, vehicles, and services could reasonably be expected to affect the Company, including its business strategy, results of operations or financial condition, see our risk factors above in Item 1A. generally and, in particular, "Operational information systems, security systems, vehicles, and services could be affected by cybersecurity incidents, ransomware attacks, and other disruptions and impact Ford, Ford Credit, their suppliers, and dealers" on page 22.


text: Ford and Ford Credit's global cybersecurity incident response is overseen by Ford's Chief Information Security Officer. Ford's Chief Information Security Officer has served in that role for over 7 years and has over a decade of engineering and operations expertise with cybersecurity technologies and services. He was appointed in 2022 by the Ford Credit Board as Ford Credit's "Qualified Individual" under the Federal Trade Commission Safeguards Rule, and is responsible for overseeing and implementing Ford Credit's information security program and enforcing it. Ford Credit's Chief Technology Officer is Ford Credit's senior member responsible for direction and oversight of the Qualified Individual. Ford's Chief Information Security Officer also reports to Ford Motor Company's Chief Enterprise Technology Officer, who has spent over two decades managing cybersecurity risks as a leader at enterprise software and Fortune 50 companies. Ford's Chief Enterprise Technology Officer reports directly to Ford's Chief Executive Officer.

companyName: FORD MOTOR CREDIT CO LLC


text: While no organization can eliminate cybersecurity risk entirely, we devote significant resources to our security program that we believe is reasonably designed to mitigate our cybersecurity and information technology risk. Our efforts focus on protecting and enhancing the security of our information systems, software, networks, and other assets. These efforts are designed to protect against, and mitigate the effects of, among other things, cybersecurity incidents where unauthorized parties attempt to access confidential, sensitive, or personal information; potentially hold such information for ransom; destroy data; disrupt or degrade service or our operations; sabotage systems; or otherwise cause harm to Ford and Ford Credit, our customers, suppliers, or dealers, or other key stakeholders. We employ capabilities, processes, and other security measures we believe are designed to reduce and mitigate these risks, and have requirements for our suppliers to do the same. Data safeguard practices of suppliers who process Personally Identifiable Information on our behalf are reviewed annually for compliance with our policies and applicable regulations. Despite having thorough due diligence, onboarding, and cybersecurity assessment processes in place for our suppliers, there can be no assurance that we can prevent the risk of any compromise or failure in the information systems, software, networks, and other assets owned or controlled by our suppliers. When we do become aware that a supplier's cybersecurity has been compromised, we attempt to mitigate the risk to the Company, including, if appropriate and feasible, by terminating the supplier's connection to our information systems. Notwithstanding our efforts to mitigate any such risk, there can be no assurance that the compromise or failure of supplier information systems, technology assets, or cybersecurity programs would not have an adverse effect on the security of the Company's information systems.


text: In an effort to effectively prevent, detect, and respond to cybersecurity threats, we employ a multi-layered cybersecurity risk management program supervised by Ford's Chief Information Security Officer, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, architecture, and processes. The team provides cybersecurity services for Ford and its affiliates, including Ford Credit. The services provided to Ford Credit and its affiliates are governed by appropriate service agreements with Ford. Local regional teams and designated responsible individuals work with the enterprise-wide team to provide cybersecurity-related services in compliance with local requirements. The team's responsibility includes identifying, considering, and assessing potentially material cybersecurity incidents on an ongoing basis, establishing processes designed to prevent and monitor potential cybersecurity risks, implementing mitigation and remedial measures, and maintaining the cybersecurity program. To do so, the program leverages both internal and external techniques and expertise. Internally, among other things, we perform penetration tests, internal tests/code reviews, and simulations using cybersecurity professionals (often referred to as "white hackers" or a "Red Team") to assess vulnerabilities in our information systems and evaluate our cyber defense capabilities. We also perform phishing and social engineering simulations with, and provide cybersecurity training for, personnel with Company email and access to Company assets. On a monthly basis, we disseminate security awareness newsletters to employees to highlight emerging or urgent cybersecurity threats and best practices. Externally, we monitor notifications from the U.S. Computer Emergency Readiness Team ("CERT") and various Information Sharing and Analysis Centers (each an "ISAC"); review customer, media, and third-party cybersecurity reports; and offer bounties to responsible third-parties who notify us of vulnerabilities they are able to detect in our cyber defenses (commonly referred to as a "Bug Bounty"). Our capabilities, processes, and other security measures also include, without limitation: • Security Information and Event Management ("SIEM") software, which provides a threat detection, compliance, and security incident management system; • Endpoint Detection and Response ("EDR") software, which monitors for malicious activities on external-facing endpoints (e.g., Windows workstations, servers, MAC clients, and Linux endpoints); • Cloud monitoring, running on primary public and private cloud environments; and • Disaster recovery and incident response plans, including a ransomware response plan.


text: We invest in enhancing our cybersecurity capabilities and strengthening our partnerships with appropriate business partners, service partners, and government and law enforcement agencies to understand the range of cybersecurity risks in the operating environment, enhance defenses, and improve resiliency against cybersecurity threats. Additionally, Ford is a member of the Financial Services and Information Technology ISACs and both a founding member and board member of the Automotive ISAC. Ford's membership with these industry cybersecurity groups assists in the efforts to protect Ford and Ford Credit against both enterprise and in-vehicle security risks.


text: Ford and Ford Credit's global cybersecurity incident response is overseen by Ford's Chief Information Security Officer. Ford's Chief Information Security Officer has served in that role for over 6 years and has over a decade of engineering and operations expertise with cybersecurity technologies and services. He was appointed in 2022 by the Ford Credit Board as Ford Credit's "Qualified Individual" under the Federal Trade Commission Safeguards Rule, and is responsible for overseeing and implementing Ford Credit's information security program and enforcing it. Ford Credit's Chief Technology Officer is Ford Credit's senior member responsible for direction and oversight of the Qualified Individual. Ford's Chief Information Security Officer also reports to Ford Motor Company's Chief Enterprise Technology Officer, who has spent over two decades leading digital and technology organizations at both enterprise software companies and Fortune 50 enterprises. Ford's Chief Enterprise Technology Officer reports directly to Ford's Chief Executive Officer.


text: When a cybersecurity threat or incident is identified, our policy is to review and triage the threat or incident, and to then manage it to conclusion in accordance with our cybersecurity incident response processes. When a cybersecurity incident is determined to be significant, it is addressed by management committees using processes that leverage subject-matter expertise from across Ford and Ford Credit. Further, we engage third-party advisors, from time to time, as part of our incident management processes. All cybersecurity incidents that are identified as reasonably having the potential to be highly significant to Ford and Ford Credit are brought to the attention of Ford's Chief Enterprise Technology Officer and General Counsel by Ford's Chief Information Security Officer as part of the Company's cybersecurity incident response processes.


text: Cybersecurity risk management is an integral part of Ford Credit's overall enterprise risk management program. As part of its enterprise risk management efforts, the Ford Credit Board meets with senior management to assess and respond to critical business risks. Critical enterprise risks are assessed by senior management annually and discussed with the Ford Credit Board. Once identified, each of the risks viewed as most significant is assigned an executive risk owner who is responsible to oversee risk assessment, develop and implement mitigation plans, and provide regular updates to the Board (and/or Board committee assigned to the risk). Cybersecurity threats have been and continue to be identified as one of the Company's top risks, with Ford Credit's Chief Technology Officer assigned as the executive risk owner. Ford Credit's Board is responsible for the oversight of cybersecurity and information technology risks, and Ford Credit's preparedness for these risks.


text: As part of its oversight responsibilities, the Ford Credit Board receives annual cybersecurity updates from Ford's Chief Information Security Officer. The annual review includes oversight of cybersecurity practices, cyber risks, and risk management processes, such as updates to Ford Credit's cybersecurity programs and mitigation strategies, and other cybersecurity developments. In addition, Ford Credit's Compliance Committee reviews at least annually Ford Credit's cybersecurity programs, and the Ford Credit Audit Committee receives updates on Ford Credit's cybersecurity initiatives and information technology internal controls. In addition to these regular updates, as part of Ford Credit's incident response processes, Ford Credit's Chief Technology Officer, in collaboration with Ford Credit's Qualified Individual and Chief Compliance Officer, provides updates on certain cybersecurity incidents to Ford Credit's Compliance Committee and, in some cases, the Ford Credit Board of Directors. In the event Ford Credit determines it has experienced a material cybersecurity incident, Ford Credit's Audit Committee and Chief Compliance Officer are notified about the incident in advance of filing a Current Report on Form 8-K.