text: The Company implements cybersecurity policies and controls within acquired entities as part of its integration process over time, typically in a phased approach, and with time periods for full execution varying depending on multiple factors, including the size and geographic scope of the acquired entity's operations; the status of the acquired entity's security including security systems, tools and personnel; security risks within the acquired entity; and the availability and quality of any interim defenses which can be implemented to protect both the Company and the acquired entity or to prevent threats at the acquired entity from reaching the Company's systems. Cybersecurity is also part of the Company's acquisition due diligence to identify risks and interim remedial measures for prioritization and implementation near transaction closing, subject to antitrust rules. In addition to the Company's active monitoring of certain critical third-parties for cybersecurity threats and attacks, the Company also has certain critical third-parties who access its information systems subject to controls designed to mitigate risks from cyber-attacks originating within infected third-party information systems. Moreover, the Company conducts diligence of certain of its third-party service providers with attention to cybersecurity risks.


text: The Director of Global Cybersecurity and the Chief Information Officer, in coordination with the Cybersecurity Department and other appropriate personnel, are responsible for assessing and managing the Company's material risks from cybersecurity threats. Our Director of Global Cybersecurity has served in various roles in information technology and information security for over 25 years, has been in the current role with the Company for more than 10 years, and has been trained and accredited in multiple cybersecurity subjects including training with governmental agencies. Our Chief Information Officer has served in various roles in information technology and information security for over 25 years, has been in the current role with the Company for more than 10 years, and holds a Master of Business Administration degree with a concentration in information systems management.

companyName: DARLING INGREDIENTS INC.

ticker: DAR

secItem: Item 1C

stage1Category: Management Role

stage1Method: unanimous


text: The Company regularly confronts cyber risks, threats and incidents, any one of which could have a material impact on the Company, including its business strategy, results of operations or its financial condition. If the Company experiences a cybersecurity incident requiring a response, it has a Computer Incident Response Plan, which defines response protocols, resource allocations and personnel engagement depending on severity level. Executive leadership, including the CEO, would be engaged in the event of an incident at certain severity levels and the CEO would engage members of the Company's board of directors as appropriate. The Cybersecurity Department would also utilize third-party experts and consultants it has on retainer, depending on the nature of the incident.

stage1Category: Risk Management Process

stage1Method: majority


text: The Company's board of directors actively engages with senior management to understand and oversee the Company's various risks, including cybersecurity, and members of senior management regularly attend board meetings to provide periodic briefings or presentations on such risk matters. The Company provides presentations to its board of directors about cybersecurity matters, including review of cyber threats, incidents, trends and risks facing the Company; the Company's defenses against cyber-attacks including personnel, software, hardware and third-party tools and expertise; and the Company's governance, including policies, standards, benchmarks and auditing and testing, as well as remedial, preventative and proactive measures to repair or enhance the Company's cybersecurity defenses. Board engagement in these matters includes dialogue and questions, board member insights and perspectives from their industry experience and subject matter expertise and strategic suggestions and considerations for Company management to evaluate, all as part of the board's oversight of Company cybersecurity risks. The Company's Chief Information Officer and Director of Global Cybersecurity have also had discussions about various cybersecurity topics with a board member in response to requests.

stage1Category: Board Governance


text: Risk Management and Strategy The Company takes an active, multi-faceted approach to cybersecurity, including adversarial engagement, under an "assume breach" philosophy premised on the continuous and ever-evolving nature of cyber threats and threat actors. The Company utilizes a cross-functional working group comprised of a Cybersecurity Department, which is responsible for overseeing cybersecurity for the Company's information systems; and plant operational technology (OT) personnel who are responsible for the security of plant OT. This group works in a cross-functional context due to the interconnectivity of these systems, as well as to collaborate about cybersecurity matters. The Company's Cybersecurity Department is headed by the Director of Global Cybersecurity, who reports to the Company's Chief Information Officer, and includes personnel located around the world who have cybersecurity training and skills in engineering, architecture, surveillance, analytics and administration. The Cybersecurity Department is responsible for setting the Company's cybersecurity policies, standards and benchmarks for its information systems, penetration testing and overseeing repairs of technical elements that fail testing. The Cybersecurity Department also conducts threat hunting within the Company's information systems and responds to threats. The Cybersecurity Department also engages certain third-party specialists to periodically review the Company's information systems and cybersecurity defenses, as well as to provide education about current and emerging threats, techniques and countermeasures. The Cybersecurity Department has also conducted cyber-attack simulation exercises with Company executive management and other leadership personnel for cyber-attack readiness. The Company's Director of Global Cybersecurity and Chief Information Officer also collaborate with our joint venture partner concerning cybersecurity matters for the DGD Joint Venture.


text: The Cybersecurity Department uses a system based on the critical security controls set forth by the Center for Internet Security, Inc. (CIS) as a benchmark and framework for its cybersecurity defenses, and has implemented cybersecurity policies and controls designed using the CIS controls framework. The Cybersecurity Department regularly implements updates and changes to its cybersecurity program to remain current and adapt to emerging cybersecurity risks; audits the cybersecurity program typically every three years; conducts targeted vulnerability testing; and assigns pertinent Company personnel as owners for governance and compliance. The Cybersecurity Department also provides cybersecurity training to Company employees.


text: The Company's Chief Financial Officer oversees a corporate risk analysis that organizes the Company's enterprise risks, including cybersecurity, into categories to assess the potential likelihood and impact of each, and to periodically review and update with the board of directors.


text: The Company also has an internal Cybersecurity Committee comprised of leadership across multiple internal functions that meets regularly to review, with the Director of Global Cybersecurity and the Chief Information Officer, active and thwarted cybersecurity incidents, systemic threats, attack trends and techniques, counter and preventative measures and defenses being implemented to enhance security. The meetings are also conducted for: ongoing awareness among Company leadership about cybersecurity threats and incidents; discussion of strategies for continuous improvement and associated capital needs; and review of oversight, governance and reporting of cybersecurity matters.


text: The Cybersecurity Department outsources several cybersecurity defense measures to utilize the know-how and tools, including artificial intelligence, of industry leading companies. The Cybersecurity Department also proactively consults with specialists in a variety of cybersecurity disciplines to review the Company's information systems for cyber risks and to provide advice for remediating areas of concern, as well as for implementing preventative measures to improve the Company's defenses.


text: The Company implements cybersecurity policies and controls within acquired entities as part of its integration process over time, typically in a phased approach, and with time periods for full execution varying depending on multiple factors, including the size and geographic scope of the acquired entity's operations; the status of the acquired entity's security including security systems, tools and personnel; security risks within the acquired entity; and the availability and quality of any interim defenses which can be implemented to protect both the Company and the acquired entity or to prevent threats at the acquired entity from reaching the Company's systems. Cybersecurity is also part of the Company's acquisition due diligence to identify risks and interim remedial measures for prioritization and implementation near transaction closing, subject to antitrust rules. In addition to the Company's active monitoring of certain critical third parties for cybersecurity threats and attacks, the Company also has certain critical third parties who access its information systems subject to controls designed to mitigate risks from cyber-attacks originating within infected third-party information systems. Moreover, the Company conducts diligence of certain of its third-party service providers with attention to cybersecurity risks.


text: As of the date of this report, we have not identified any risks from cybersecurity threats, including those from any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. However, there can be no assurances that a cybersecurity threat or incident that could have a material impact on us has not occurred or will not occur in the future. For additional information on risks from cybersecurity threats, please see Item 1A Risk Factors.


text: The Company's board of directors actively engages with senior management to understand and oversee the Company's various risks, including cybersecurity, and members of senior management regularly attend board meetings to provide periodic briefings or presentations on such risk matters. The Company provides presentations to its board of directors about cybersecurity matters, including review of cyber threats, incidents, trends and risks facing the Company; the Company's defenses against cyber-attacks including personnel, software, hardware and third-party tools and expertise; and the Company's governance, including policies, standards, benchmarks and auditing and testing, as well as remedial, preventative and proactive measures to repair or enhance the Company's cybersecurity defenses. Board engagement in these matters includes dialogue and questions, board member insights and perspectives from their industry experience and subject matter expertise and strategic suggestions and considerations for Company management to evaluate, all as part of the board's oversight of Company cybersecurity risks. The Company's Chief Information Officer and Director of Global Cybersecurity are also available to board members to discuss questions concerning cybersecurity matters.


text: Risk Management and Strategy The Company relies on electronic information systems, networks and technologies to conduct and support its operations and other functions and activities within the Company. We rely on commercially available systems, software, tools, third-party service providers and monitoring to provide security for processing, transmission and storage of confidential information and data. We have an enterprise-grade information security management program designed to identify, protect, detect and respond to and manage reasonably foreseeable material cybersecurity threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, remediate, respond and recover from identified vulnerabilities and cybersecurity incidents.

companyName: HELEN OF TROY LTD

ticker: HELE


text: As part of the Company's cybersecurity risk management program, we follow the NIST Cybersecurity Framework ("CSF") to assess, identify and manage risks that arise from cybersecurity threats. The CSF is closely tied to the Company's enterprise risk management processes to identify and document cybersecurity threats and prioritize responses. Included in the CSF process is the identification and assessment of cybersecurity risks to systems, assets, data and resources. The Company also has a vulnerability management process in place. This vulnerability management process helps us to detect and identify threats and vulnerabilities and once identified, to remediate, respond and recover. In addition, our cybersecurity team subscribes to expert and industry standard security feeds and reports, which we use to identify new risks and new vulnerabilities in different systems and infrastructures. Our cybersecurity risk management program also includes cybersecurity awareness training for our associates and an incident response team ("IRT").


text: The Company engages third-party service providers to be able to perform 24/7 proactive monitoring, correlation and triage of logs and activity throughout our systems, networks and infrastructures. These processes are performed by cybersecurity service providers as well as automated detection. These processes include detection and response, as well as vulnerability management and remediation. The Company also has a vendor risk management process to assess risks related to technology third-party service providers where we initially assess their cybersecurity posture upon engaging their services. We annually review these vendors to update our risk assessment and to monitor for any changes that could present additional risks.


text: We also maintain a cyber incident response plan ("IRP") with the objective of (1) providing a structured and systematic incident response process for cybersecurity threats that affect any of our electronic information systems and networks, (2) timely and effectively identifying, resolving and communicating cybersecurity incidents and (3) managing internal and external communications and reporting. Under the IRP, a dedicated information security coordinator is responsible for implementing the IRP, as well as: • identifying the IRT and any appropriate sub-teams to address specific cybersecurity incidents, or categories of cybersecurity incidents; • coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to, communicate, and document identified cybersecurity incidents; • conducting post-incident reviews to gather feedback on cybersecurity incident response procedures and address any identified gaps in security measures; • providing training and conducting periodic exercises to promote associate and stakeholder preparedness and awareness of the IRP; and • reviewing the IRP at least annually, or whenever there is a material change in our business practices that may reasonably affect our cyber incident response procedures.


text: If a cybersecurity incident occurs, under the IRP, the information security coordinator or a designee is required to notify, as necessary and applicable, the IRT and senior executives and organizational leadership, including our Chief Legal Officer, our business partners or service providers and other authorities. Our Chief Legal Officer, working with senior executives, is required under the IRP, as appropriate, to notify the Audit Committee of any cybersecurity incident. As discussed below, the Audit Committee of our Board of Directors oversees risk management relating to cybersecurity.


text: We and our third-party service providers have experienced and expect to continue to experience actual or attempted cyber-attacks of our information systems and networks. We do not believe we have experienced any material system security breach that to date has had a material impact on our operations or financial condition. However, if any such event, whether actual or perceived, were to occur, it could have a material adverse effect on our business, operating results and financial condition. For more information regarding the risks we face from cybersecurity threats, see Item 1A., "Risk Factors."

stage1Category: Strategy Integration


text: Cybersecurity Governance Cybersecurity is an important part of our enterprise risk management processes and an area of focus for our Board of Directors and management. The Company has a dedicated role in the Director of Cybersecurity and IT Compliance, who reports to our Chief Information Officer ("CIO"). Our current interim CIO has significant experience in information technology across a variety of industries, including consumer goods, automotive, manufacturing and outsourcing. Our current interim CIO and Director of Cybersecurity and IT Compliance also have experience in cybersecurity, information security, policy, architecture, engineering and incident response. The CIO works with other functions within the Company to implement controls, procedures and practices to help minimize the Company's risks, as well as to introduce security by design. Our CIO provides regular updates on cybersecurity matters to our senior management.


text: The Audit Committee assists the Board of Directors in its oversight of risks related to cybersecurity and directly oversees risk management relating to cybersecurity. The Audit Committee is also responsible for assessing the steps management has taken to monitor and control these risks and exposures and evaluating guidelines and policies with respect to our risk assessment and risk management. Our Chief Legal Officer working with the CIO and other senior management is responsible for determining and coordinating reports and updates to the Audit Committee or the Board of Directors, or as requested by the Audit Committee or the Board of Directors. The Audit Committee reviews our cybersecurity program with management and reports to the Board of Directors with respect to, and its review of, the program. Cybersecurity reviews by the Audit Committee generally occur at least annually, or more frequently as determined to be necessary or advisable. The Board of Directors receives an update on the Company's risk management processes and the risk trends related to cybersecurity at least annually.


text: The CIO meets regularly with leaders of our various information technology management teams to review and discuss our cybersecurity and other information technology risks and opportunities. Our global incident response plan sets forth a detailed security incident management and reporting protocol, with escalation timelines and responsibilities.

companyName: DARDEN RESTAURANTS INC

ticker: DRI


text: Cybersecurity Governance Cybersecurity is an important part of our enterprise risk management processes and an area of focus for our Board of Directors and management. The Company has a dedicated role in the Director of Cybersecurity and IT Compliance, who reports to our Senior Vice President of Information Technology ("SVP-IT"). Our current SVP-IT has significant experience in information technology across a variety of industries, including consumer goods, automotive, manufacturing and outsourcing. Our current SVP-IT and Director of Cybersecurity and IT Compliance also have experience in cybersecurity, information security, policy, architecture, engineering and incident response. The SVP-IT works with other functions within the Company to implement controls, procedures and practices to help minimize the Company's risks, as well as to introduce security by design. Our SVP-IT provides regular updates on cybersecurity matters to our senior management.


text: The Audit Committee assists the Board of Directors in its oversight of risks related to cybersecurity and directly oversees risk management relating to cybersecurity. The Audit Committee is also responsible for assessing the steps management has taken to monitor and control these risks and exposures and evaluating guidelines and policies with respect to our risk assessment and risk management. Our Chief Legal Officer working with the SVP-IT and other senior management is responsible for determining and coordinating reports and updates to the Audit Committee or the Board of Directors, or as requested by the Audit Committee or the Board of Directors. The Audit Committee reviews our cybersecurity program with management and reports to the Board of Directors with respect to, and its review of, the program. Cybersecurity reviews by the Audit Committee generally occur at least annually, or more frequently as determined to be necessary or advisable. The Board of Directors receives an update on the Company's risk management processes and the risk trends related to cybersecurity at least annually.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Presurance Holdings, Inc.

ticker: PRHI


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess potential material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: RAMBUS INC

ticker: RMBS


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, if material risks and/or gaps are identified, we will re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer who reports to our Chief Information Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT. Personnel at all levels and departments are made aware of cybersecurity issues through trainings.


text: We engage third party assessors/consultants in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We conduct vendor risk assessments before onboarding identified third-party service providers to review each such service provider's cybersecurity practices and to assess factors such as access controls, incident response capabilities, overall cyber maturity and applicable certifications.

stage1Category: Third-Party Risk


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Form 10-K.

stage1Category: None/Other


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Cyber Risk Committee.


text: Our Chief Information Officer, Chief Information Security Officer and our Security Team, which includes Security Engineers, our Senior Manager of Cybersecurity and our Chief Information Security Officer, are primarily responsible to assess and manage our material risks from cybersecurity threats. Our Security Team has deep expertise in cybersecurity practices, including security threat evaluation, security operations, incident response, investigations, forensics, threat containment, data security vulnerability management, security policies and procedures, vulnerability scans, penetration testing, infrastructure security, network security, cloud security, identity and access management, role-based access, server and endpoint security, e-mail security, security awareness, logging, security governance and risk mitigations. Our Chief Information Security Officer has over twenty years of experience in security leadership over all aspects of cybersecurity, including security operations, security incident management and cybersecurity governance, policies and procedures, as well as deep expertise in defense in depth, zero trust security architectures and security controls for perimeter, network, endpoint, application and data security layers.


text: Our Chief Information Security Officer and our Security Team oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Information Security Officer and our Security Team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents include the following: regular penetration testing, independent security posture assessments, phishing tests (with trainings for the failed users), general cybersecurity and phishing training for all Rambus personnel and tabletop exercises to simulate threats and identify gaps.


text: In the event of a cybersecurity incident, our Chief Information Security Officer and our Security Team are equipped with a well-defined incident response plan to guide response actions. This incident response plan includes immediate actions to mitigate the impact of the incident, long-term strategies for remediation and prevention of future incidents, and provides for internal notification of the incident to functional areas, as well as senior leadership and the Cyber Risk and/or Audit Committees of our board of directors, as appropriate.


text: Our management team, including our Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats.


text: Our Chief Information Security Officer and our Security Team oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Information Security Officer and our Security Team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents include the following: regular penetration testing, independent third-party risk and security posture assessments, phishing tests (with trainings for the failed users), general cybersecurity and phishing training for all Rambus personnel and tabletop exercises to simulate threats and identify gaps.


text: Our Chief Information Security Officer also provides quarterly briefings to the Cyber Risk Committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents of interest and related responses, cybersecurity systems testing, applicable activities of third parties, and the like. Our Cyber Risk Committee provides regular updates to the board of directors on such reports.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is involved in the oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management. The Company's cybersecurity policies, standards, processes, and practices are being integrated into the Company's enterprise risk management program and are based on recognized frameworks and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: FARO TECHNOLOGIES INC


text: Risk Management and Strategy As part of our overall enterprise risk management approach, the Company's cybersecurity program framework is focused on the following key areas:


text: Governance: As discussed in more detail under the heading "Governance" below, the Board receives presentations and interacts with management on cybersecurity readiness.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We also utilize a managed security provider (the "Security Provider") to identify and assess vulnerabilities. Our Security Provider monitors our network, does vulnerability scanning, provides event logging services, and raises potential and actual threats with the Company's security operations center when appropriate.


text: Incident Response Plan: The Company has established and maintains an incident response plan that governs the Company's response to a cybersecurity incident, and such plan is evaluated on a regular basis. Potentially material cybersecurity risks and incidents are escalated to management and the Board as applicable.


text: Third-Party Risk Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. On occasion, the Company engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Board and Audit Committee, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our Board and Audit Committee oversee the Company's cybersecurity risk management. Management presents to, and discusses with, the Board the security of our systems and applications. Our Chief Digital Officer and our Information Security Director ("CDO"), provide strategic and technical leadership for the Company's cybersecurity program and lead teams across the Company that support the cybersecurity functions. Our CDO has 30 years of experience in IT, including being accountable for IT compliance and security, and previously served as Chief Information Officer for a publicly traded company for 5 years. Our Information Security Director has nearly 30 years of experience in software development and IT, and, for 17 of those years, was responsible for security, compliance and privacy. These executives regularly report to the Chief Executive Officer and Chief Financial Officer with regards to our cybersecurity program and readiness.


text: Associates must also follow established procedures for the safe storage and handling and secure disposal of customer information. Old or obsolete computer assets are subject to defined procedures and processes to ensure safe destruction of information contained on those devices. For paper-based information or documents, we dispose of paper using shred bins for destruction.

companyName: FIRST BANCSHARES INC /MS/


text: Although we experience cybersecurity incidents from time to time as part of operations, these incidents have not had, and are not reasonably likely to have, a material impact on our business strategy, results of operations or financial condition. Any breach of our security measures, or those of our third-party service providers, could result in unauthorized access to and misappropriation of our information, corruption of data or disruption of systems, operations or transactions, any of which could have a material adverse effect on our business strategy, results of operations or financial condition. See "Risk Factors" on page 24 of this Form 10-K for further discussion of the risks related to cybersecurity threats.


text: Information Technology and Cybersecurity Our business relies on the secure electronic transmission, storage and hosting of sensitive information, including personal information, financial information, intellectual property, and other sensitive information related to our customers and workforce. Given the importance of cybersecurity to our business, we maintain a comprehensive information technology and cybersecurity program to increase both the effectiveness of our systems and our preparedness for cybersecurity risks, including security monitoring for internal and external threats to bolster the confidentiality, integrity and availability of our information assets. We regularly perform evaluations of our cybersecurity program, including periodic internal and external audits, penetration tests and incident response simulations, and our information technology infrastructure and cybersecurity management system are subject to external program assessments on a regular basis. In 2017, we adopted the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) to bolster our cybersecurity management system and reduce cybersecurity risks.

companyName: INTEGRA LIFESCIENCES HOLDINGS CORP

ticker: IART


text: We engage multiple independent third-party cybersecurity services and consulting firms to review our cybersecurity program and we have entered into partnerships with entities such as the Health Information Sharing and Analysis Center, the Cybersecurity & Infrastructure Security Agency, InfraGard, the Department of Homeland Security, the Cyber Fraud Task Forces and the Center for Internet Security to complement our program and bolster our data protection and privacy efforts. To monitor and minimize the risks from cybersecurity threats associated with our use of third-party service providers, we require the completion of standardized information gathering questionnaires from service providers prior to entering any engagement for services. Further, we utilize security ratings from industry-recognized sources to provide an external analysis of such third-party service providers. We work closely with these industry-recognized sources to interpret the security ratings results in the context of the specific characteristics of our information technology and cybersecurity systems, which helps inform our assessment of the efficacy and reliability of the third-party vendors we use. We also conduct periodic internal reviews of the performance and reliability of the third-parties we have engaged for cybersecurity services.


text: Management and Board Oversight The Board has overall responsibility for the oversight of risk management at the Company, which includes overseeing our process for identifying, assessing and mitigating significant financial, operational, strategic, cybersecurity and other risks that may affect the Company. Our Chief Information Officer, or CIO, leads our cybersecurity program and our Director, Cybersecurity leads our cybersecurity team. Our CIO provides periodic reports relating to cybersecurity matters to the Board, as well as our Chief Executive Officer and other members of our senior management, as appropriate. Our executive leadership team and Board provide principal oversight and guidance of our cybersecurity risk management programs and processes. We have established a cybersecurity executive steering committee to review and discuss cybersecurity issues and review our security metrics. The committee is comprised of a cross-functional group of senior executives, including our Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief Information Officer and Director, Cybersecurity, and is responsible for the implementation and oversight of the processes and systems we use to assess and manage risk from cybersecurity threats as well as cybersecurity incidents. Our CIO and committee members have significant work experience related to cybersecurity issues or oversight and members of our cybersecurity team hold vendor-neutral and vendor-specific certifications from organizations such as the Information Systems Audit and Control Association (ISACA), the Computing Technology Industry Association (CTIA) and the International Information System Security Certification Consortium (ISC2). In addition, we require all new employees to complete cybersecurity training so they are better able to understand how to identify, protect, and preserve sensitive data and minimize risks related to cybersecurity matters. We supplement this new hire training with annual training and certification programs, which includes social engineering simulations. We continue to expand and improve our global training programs to raise employee awareness of security obligations and members of senior management regularly provide employees with communications regarding the cybersecurity environment to increase employee awareness of cybersecurity trends and emerging risks.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our monitoring capabilities, including our internal auditing procedures, internal control over financial reporting and corporate compliance programs, are designed in part to inform management about our material risks, including those related to cybersecurity risks. In the event of an incident which jeopardizes the confidentiality, integrity, or availability of our information assets, and our risk management systems, we maintain a regularly tested incident response program. Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery or data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements. Although the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the team is generally led by the CIO or another member of the cybersecurity executive steering committee and will include other information technology and legal personnel. In the event of a potentially material incident, the incident response team regularly reports to both the Company's Board and members of senior management, including the Chief Executive Officer, Chief Financial Officer and Chief Legal Officer to assist in making determinations regarding applicable SEC reporting requirements.


text: In addition, our Board receives regular reports from management on matters relating to strategic and operational initiatives, financial performance, cybersecurity and legal developments. The Company's Enterprise Risk Management program, which has been adopted by the Company to further enhance oversight of risks inherent to our business and allow members of the Board and management to gain a greater understanding of the efforts being undertaken to manage the risks confronting the Company, covers cybersecurity risks.


text: Cybersecurity Risks As of December 31, 2023, we have not had any material cybersecurity incidents. However, we face risks associated with cybersecurity incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachment to emails, phishing attempts or other scams. Although we make efforts to maintain the security and integrity of our networks and systems, and the proprietary, confidential and personal information that resides on or is transmitted through them, and we have implemented various cybersecurity policies and procedures to manage the risk of a security incident or disruption, there can be no assurance that our security efforts and measures will be effective or that attempted security incidents or disruptions would not be successful or damaging. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident. See "Risk Factors–Risks Related to Cybersecurity and Data Privacy—Cyber-attacks or other disruptions to our information technology systems could adversely affect our business" and "—Failure to comply with laws relating to the confidentiality of sensitive personal information or standards related to the transmission of electronic health data, may require us to make significant changes to our products, or incur penalties or other liabilities."


text: Information Technology and Cybersecurity Our business relies on the secure electronic transmission, storage and hosting of information, including personal information, financial information, intellectual property, and other sensitive information related to our business, customers and workforce ("sensitive information") on both our information systems and those of third-party service providers. Given the importance of cybersecurity to our business, we maintain a comprehensive information technology and cybersecurity program to increase both the effectiveness of our systems and our preparedness for cybersecurity risks, including security monitoring for internal and external threats to bolster the confidentiality, integrity and availability of our information assets. We perform evaluations of our cybersecurity program, including periodic internal and external audits, penetration tests and incident response simulations, and our information technology infrastructure and cybersecurity management system are subject to external program assessments on a regular basis. We refer to the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") to help inform our cybersecurity management system and reduce cybersecurity risks, although we do not fully implement all aspects of NIST CSF.


text: We engage multiple independent third-party cybersecurity services and consulting firms to review our cybersecurity program and we collaborate with entities such as the Health Information Sharing and Analysis Center, the Cybersecurity & Infrastructure Security Agency, InfraGard, the Department of Homeland Security, the Cyber Fraud Task Forces and the Center for Internet Security to complement our program and bolster our data protection and privacy efforts. To monitor and minimize the risks from cybersecurity threats associated with our use of third-party service providers, we require the completion of standardized information gathering questionnaires from applicable service providers prior to entering any engagement for services focused on information technology or processing sensitive information. Further, we utilize security ratings from industry-recognized sources to provide an external analysis of such third-party service providers. We work closely with these industry-recognized sources to interpret the security ratings results in the context of the specific characteristics of our information technology and cybersecurity systems, which helps inform our assessment of the efficacy and reliability of the third-party vendors we use. We also conduct periodic internal reviews of the performance and reliability of the third-parties we have engaged for cybersecurity services.


text: Management and Board Oversight The Board has responsibility for the oversight of risk management at the Company, which includes our process for identifying, assessing and mitigating significant financial, operational, strategic, cybersecurity and other risks that may affect the Company. Our Chief Information Officer, or CIO, leads our cybersecurity program and our Director, Cybersecurity leads our cybersecurity team. Our CIO provides periodic (at least semi-annual) reports relating to cybersecurity matters to the Board, as well as our Chief Executive Officer and other members of our senior management, as appropriate. Our executive leadership team and Board provide principal oversight and guidance of our cybersecurity risk management programs and processes. We have established a cybersecurity executive steering committee to review and discuss cybersecurity issues and review our security metrics. The committee is comprised of a cross-functional group of senior executives, including our Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief Information Officer and Director, Cybersecurity, and is responsible for the implementation and oversight of the processes and systems we use to assess and manage risk from cybersecurity threats as well as cybersecurity incidents. Our CIO and committee members have significant work experience related to cybersecurity issues or oversight and members of our cybersecurity team hold vendor-neutral and vendor-specific certifications from organizations such as the Information Systems Audit and Control Association ("ISACA"), the Computing Technology Industry Association ("CTIA") and the International Information System Security Certification Consortium ("ISC2"). In addition, we require new employees to complete cybersecurity training so they are better able to understand how to identify, protect, and preserve sensitive data and minimize risks related to cybersecurity matters. We supplement this new hire training with annual training and certification programs, which includes social engineering simulations. We continue to expand and improve our global training programs to raise employee awareness of security obligations and members of senior management regularly provide employees with communications regarding the cybersecurity environment to increase employee awareness of cybersecurity trends and emerging risks.


text: Cybersecurity Risk Management and Strategy We employ a multi-layered approach to protect our information systems from cybersecurity threats. We have around the clock security operations center coverage that uses an industry leading security information and event management tool to aggregate and analyze data and provide immediate alerts for any breaches. All hardware within our information systems run an industry-standard anti-virus solution, and we have an established patching program in place to keep security updates current. Penetration testing is conducted by an outside party on a continual basis, resulting in rapid discovery and remediation of any potential weaknesses. To ensure employee compliance with our processes, we require yearly cybersecurity training and conduct phish testing, including simulated phishing attempts, multiple times per month. Additional training is assigned to employees as deemed necessary to reduce the risk of cybersecurity threats. In case of a cybersecurity incident, we maintain a cybersecurity insurance policy to reduce any direct costs that could be incurred.

companyName: NN INC

ticker: NNBR


text: Cybersecurity risk management is an important priority integrated into our overall governance structure. Our Board of Directors oversees risks from cybersecurity threats and includes the involvement of the Audit Committee in the governance strategy.

companyName: CarParts.com, Inc.

ticker: PRTS


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our monitoring capabilities, including our internal auditing procedures, internal control over financial reporting and corporate compliance programs, are designed in part to inform management about our material risks, including those related to cybersecurity risks. In the event of an incident which jeopardizes the confidentiality, integrity, or availability of our information assets, and our risk management systems, we maintain a regularly tested incident response program. Pursuant to the incident response program and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery or data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements. Although the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the team is generally led by the CIO or another member of the cybersecurity executive steering committee and will include other information technology and legal personnel. For incidents that meet certain characteristics under the program, the incident response team will escalate and update both the Company's Board and members of senior management, including the Chief Executive Officer, Chief Financial Officer and Chief Legal Officer.


text: To support current needs and future growth, w e use a strategic information systems multi-year planning process that involves senior management and is integrated into our overall business planning. Information systems projects, including those for cybersecurity, are prioritized based upon strategic, financial, regulatory, risk and other business advantage criteria.


text: Cybersecurity Risks As of December 31, 2024, we have not experienced any material risks from cybersecurity threats, including from previous cybersecurity incidents, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. However, we previously have and anticipate we will continue to face risks associated with cybersecurity incidents. Although we make efforts to maintain the security and integrity of our networks and systems, and the sensitive information that resides on or is transmitted through them, and we have implemented various cybersecurity policies and procedures to manage the risk of a security incident or disruption, there can be no assurance that our security efforts and measures will be effective or that attempted security incidents or disruptions would not be successful or damaging. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident, although the amount of coverage may not be sufficient or provide applicable coverage for a given incident. See "Risk Factors–Risks Related to Cybersecurity and Data Privacy—Cyber-attacks or other disruptions to our information technology systems could adversely affect our business" and "—Failure to comply with laws relating to the confidentiality of sensitive personal information or standards related to the transmission of electronic health data, may require us to make significant changes to our products, or incur penalties or other liabilities."


text: Cybersecurity Overview We rely on proprietary and third-party information systems to process, transmit and store information and to manage or support our business processes. We store and maintain confidential financial and business information regarding us and persons with whom we do business on our information technology systems. We also collect and hold personally identifiable information of our employees in connection with their employment. In addition, we engage third-party service providers that may collect and hold personally identifiable information of our employees in connection with providing business services to us, including web hosting, accounting, payroll and benefit services.


text: Cybersecurity Governance The protection of the information technology systems on which we rely is critically important to us. The Audit Committee of the Board of Directors has oversight for the reliability and security of our information systems, including identifying material risks and cybersecurity threats arising in our business. The Audit Committee receives updates from management of the ongoing cybersecurity initiatives and events at least once per quarter. In the event of a material cybersecurity incident, management will notify the Cybersecurity Sub-Committee of the Board of Directors, which will provide oversight for the Company's response and mitigation to the incident.


text: Our Chief Financial Officer is responsible for the management of the Company's information systems and oversees the Company's information technology team ("IT Team"). The IT Team has in place documented procedures for cybersecurity response plans, which are reviewed annually or as events warrant. The IT Team utilizes third party security experts to provide continuous external penetration testing, conduct security reviews, and to provide a managed security operations center that does 24/7 monitoring as well as provide additional resources for threat and incident response activities.


text: Index to Financial Statements • periodic engagement of independent security firms and other third-party experts, where appropriate, to assess, test, and certify components of our cybersecurity program, and to otherwise assist with various aspects of our cybersecurity processes and controls; and • regular assessments of the design and operational effectiveness of the program's key processes and controls by our internal audit team assisted by external consultants.

companyName: SCANSOURCE, INC.

ticker: SCSC


text: A cybersecurity incident could interrupt our operations, result in downtime, divert our planned efforts and resources from other projects, damage our reputation and brand, damage our competitive position, subject us to liability claims or regulatory penalties under laws protecting the privacy of personal information. Although impacts of past cybersecurity incidents have been immaterial to date, the impacts of such events in the future may materially and adversely affect our business, financial condition, or results of operations.


text: Cybersecurity Risk Management and Strategy We employ a multi-layered approach to protect our information systems from cybersecurity threats. We have around the clock security operations center coverage that uses an industry leading security information and event management tool to aggregate and analyze data and provide immediate alerts of potential breaches. All hardware within our information systems run an industry-standard anti-virus solution, and we have an established patching program in place to keep security updates current. Penetration testing is conducted by an outside party on a continual basis, resulting in rapid discovery and remediation of potential weaknesses. To ensure employee compliance with our processes, we require yearly cybersecurity training and conduct phish testing, including simulated phishing attempts, multiple times per month. Additional training is assigned to employees as deemed necessary to reduce the risk of cybersecurity threats. In case of a cybersecurity incident, we maintain a cybersecurity insurance policy to reduce any direct costs that could be incurred.


text: Risk Management and Strategy Our cybersecurity risk management program is intended to protect the confidentiality, integrity, and availability of our critical IT systems and information. Our program is integrated into, and cybersecurity risks are among the risks evaluated and considered by, our broader enterprise risk management program, which is designed to identify, assess, prioritize and mitigate risks across the organization to enhance our resilience and support the achievement of our strategic objectives.


text: Our cybersecurity risk management program is led by our Vice President of Information Security ("VP"), who manages our security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents. Our program includes protocols for preventing, detecting and responding to cybersecurity incidents, and cross-functional coordination, and planning for business continuity and disaster recovery. We rely on our information security management system supported by a set of policies based upon industry frameworks, including the NIST Cybersecurity Framework. We have a Cyber Incident Response Team ("CIRT") in place to respond to, and prepare appropriate responses to cybersecurity threats or incidents. Components of our program include: • risk assessments designed to help identify and assess cybersecurity threats to our critical IT systems, information, and our broader enterprise IT environment; • monthly, mandatory cybersecurity awareness training for our employees, covering such topics such as phishing tactics, ransomware and developments in the current landscape of cyber-threats; • assessments of [and improvements to], among others, disaster recovery testing, access control, remote access, personnel security, system and communications protection, media protection, change management, data backup and recovery, audit logging, vulnerability and patch management, physical security, configuration management;


text: We also have a cybersecurity incident response plan for the CIRT to assess and manage cybersecurity incidents, which includes escalation procedures based on the nature and severity of the incident including, where appropriate, escalation to the Board.


text: As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of the May 2023 ransomware incident or any other previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information on our cybersecurity related risks, see Item IA, "Risk Factors - "Cybersecurity risk."


text: Our Board has primary responsibility for oversight of our cybersecurity and other information technology risks, including our plans to mitigate cybersecurity risks and to respond to data breaches.


text: The Board receives regular reports from our Chief Information Officer ("CIO") on cybersecurity matters. These reports include a range of topics, including our cybersecurity risk profile, the current cybersecurity and emerging threat landscape, the status of ongoing cybersecurity initiatives, incident reports, and the results of internal and external assessments of our information systems. The Audit Committee also annually reviews the adequacy and effectiveness of our information and technology security policies and the internal controls regarding information and technology security and cybersecurity, and periodically receives updates from our internal audit function on the results of our cybersecurity audits and related mitigation activities. The Chair of the Audit Committee reports to the full Board on these discussions as appropriate. In addition, Board members periodically receive presentations on cybersecurity matters from external experts as part of the Board's continuing education and overall risk oversight.


text: At the management level, our VP leads our enterprise-wide cybersecurity program, and is responsible for assessing and managing our materials risks from cybersecurity threats. In performing his role, our VP is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through the management of, and participation in, the cybersecurity risk management program and other processes described above, including the maintenance and execution of our cyber incident response plan. Our VP reports to our CIO who, in turn, reports directly to our CEO.


text: Our VP and our CIO, are both experienced cybersecurity executives. Our VP has more more than 20 years of experience building and leading cybersecurity, risk management, and information technology teams. Our CIO has nearly 30 years of experience and has held a variety of senior information technology leadership roles at multiple Fortune 500 organizations. Members of our security team also hold industry-recognized cybersecurity certifications, including the Certified Information Systems Security Professional (CISSP) certification.


text: Our cybersecurity risk management program is led by our Vice President of Information Security, who manages our security team that is principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents. Our program includes protocols for preventing, detecting and responding to cybersecurity incidents; cross-functional coordination; and planning for business continuity and disaster recovery. We rely on our information security management system supported by a set of policies based upon industry frameworks, including the NIST Cybersecurity Framework. We have a Cyber Incident Response Team ("CIRT") in place to respond to prepare appropriate responses and respond to cybersecurity threats or incidents. Components of our program include: • risk assessments designed to help identify and assess cybersecurity threats to our critical IT systems, information, and our broader enterprise IT environment; • monthly, mandatory cybersecurity awareness training for our employees, covering such topics such as phishing tactics, ransomware and developments in the current landscape of cyber-threats; • assessments of and improvements to, among others, disaster recovery testing, access control, remote access, personnel security, system and communications protection, media protection, change management, data backup and recovery, audit logging, vulnerability and patch management, physical security, configuration management; • periodic engagement of independent security firms and other third-party experts, where appropriate, to assess, test, and certify components of our cybersecurity program, and to otherwise assist with various aspects of our cybersecurity processes and controls; and • regular assessments of the design and operational effectiveness of the program's key processes and controls by our internal audit team with the assistance of external consultants.


text: Index to Financial Statements We also have a cybersecurity incident response plan for the CIRT to assess and manage cybersecurity incidents, which includes escalation procedures based on the nature and severity of the incident including, where appropriate, escalation to the Board.


text: As part of our overall risk mitigation strategy, we maintain insurance coverage that is intended to address certain aspects of cybersecurity risks; however, such insurance may not be sufficient in type or amount to cover us against claims related to cybersecurity breaches, cyberattacks and other related breaches.


text: The Board receives regular reports from our Chief Information Officer ("CIO") on cybersecurity matters. These reports include a range of topics, including our cybersecurity risk profile, the current cybersecurity and emerging threat landscape, the status of ongoing cybersecurity initiatives, incident reports, and the results of internal and external assessments of our information systems. The Audit Committee of the Board also annually reviews the adequacy and effectiveness of our information and technology security policies and the internal controls regarding information and technology security and cybersecurity, and periodically receives updates from our internal audit function on the results of our cybersecurity audits and related mitigation activities. The Chair of the Audit Committee reports to the full Board on these discussions as appropriate. In addition, Board members periodically receive presentations on cybersecurity matters from external experts as part of the Board's continuing education and overall risk oversight.


text: At the management level, our VP of Information Security leads our enterprise-wide cybersecurity program, and is responsible for assessing and managing our materials risks from cybersecurity threats. In performing his role, our VP is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through the management of, and participation in, the cybersecurity risk management program and other processes described above, including the maintenance and execution of our cyber incident response plan. Our VP reports to our CIO who, in turn, reports directly to our CEO.


text: Our CIO and our VP of Information Security are both experienced cybersecurity executives. Our CIO has nearly 30 years of experience and has held a variety of senior information technology leadership roles at multiple Fortune 500 organizations. Our VP has more more than 20 years of experience building and leading cybersecurity, risk management, and information technology teams. Members of our security team also hold industry-recognized cybersecurity certifications, including the Certified Information Systems Security Professional (CISSP) certification.


text: Risk Management and Strategy HTLF Bank's Risk Management program is designed to identify, assess, monitor and mitigate risks based on various key risk factors we face including, but not limited to financial, operational, regulatory and legal. Cybersecurity is a critical component of our risk management framework given internal dependencies on technology, the evolving digital environment and the rapid acceleration of cyber-threats. HTLF's cybersecurity risk management program is built on three lines of defense Risk Management framework. HTLF's first line of defense provides frontline business, operational and technical controls and support to securely deliver access to HTLF applications and data to HTLF users. As part of the Risk Management function, HTLF's second line of defense is primarily responsible for infrastructure defense and security controls, performing vulnerability assessments, identity access management, business continuity, third-party information security assessments, employee awareness and training programs, and security incident management. Internal Audit functions as HTLF's third line of defense and independently provides assurance, via multiple audit and testing engagements to validate the effectiveness of HTLF's cybersecurity risk management practices, while measuring against regulatory requirements and HTLF's Policies and Standards.

companyName: HEARTLAND FINANCIAL USA INC


text: HTLF's first line of defense is led by our Chief Operations Officer and our Chief Information Officer. HTLF's second line of defense is led by our Chief Risk Officer ("CRO") and includes the Security function, led by our Chief Information Security Officer ("CISO") who is primarily responsible for the cybersecurity component. The primary responsibilities of the HTLF Security function are to protect HTLF assets including networks, systems, application, data, funds, and staff, and facilitate incident response and resolution. HTLF's third line of defense is led by our Chief Audit Executive.


text: Our primary objectives for managing cybersecurity risk are to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt, exploit or misuse our information or systems. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. The NIST cybersecurity framework is a nationally recognized industry standard for mitigating organizational cybersecurity risks, which includes identifying risks, protecting assets, detecting threats, responding to incidents, and recovery from incidents. The NIST cybersecurity framework uses standards, procedures and best practices, and is integrated into the HTLF Security team's overall risk management system and processes, including oversight of third-party service providers. Management of the HTLF's third parties, including vendors and service providers, is conducted through a risk-based approach and the level of due diligence is driven from risk factors established by Enterprise Risk Management through its Third Party Risk Management Program. The process provides awareness and collaboration across all internal teams including Information Security and Business Continuity. A technical requirements review process is conducted on new or significantly changed third parties, applications, or technology to ensure that systems or third parties meet certain security baseline requirements. Further, HTLF's Security program also provides for annual mandatory training for employees regarding security awareness and understanding of how to properly use and protect the company assets, including computing resources entrusted to them, and to communicate the company's information security policies, standards, processes and practices.


text: To address evolving cybersecurity risks and corresponding regulations, the HTLF Security team uses Federal Financial Institutions Examination Council ("FFIEC") booklets and Cybersecurity and Infrastructure Agency ("CISA") guidance; identifies and defines emerging risks using third-party research and subject matter expert consultants; executes strategic cyber threat assessments; performs new product and initiative reviews; performs data management risk oversight; and conducts cyber risk reviews as part of HTLF's Third Party Risk Management process, which oversees and identifies risks, including cybersecurity threats, associated with our use of third-party service providers. The HTLF Security team conducts periodic tabletop exercises to test HTLF business units' capabilities to respond to various security incidents, including cyber-attacks.


text: Our CISO is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity governance (policies and procedures), risk assessment, defense operations, incident response, vulnerability monitoring, threat intelligence, identity access governance, information security/cyber related third-party risk management, and business continuity. Moreover, the Security function is responsible for assessing, managing and remediating material risks from cybersecurity threats. The Security management team has the technical, management and project leadership experience in mid-sized or larger banks, maintains appropriate technical certifications, and stay abreast of industry, technical and regulatory best practices and requirements.


text: If a cybersecurity event occurs, the CISO leads the HTLF Incident Response Team as part of our Incident Response Plan designed to help reduce the risks related to security incidents by providing guidelines on responding to incidents by focusing on a roadmap for coordinating personnel, policies, and procedures to ensure incidents are detected, analyzed, and handled to mitigate material risks. The CISO and CRO work with key cross functional stakeholders, including members of executive leadership and provide updates to the HTLF Risk Committee on the status and impact of the cybersecurity event, as well as review the event with the Risk Committee following its ultimate resolution in order to share root cause and lessons learned from the incident.


text: HTLF has implemented a robust corporate governance framework comprised of the HTLF Board of Directors and its committees; which in turn delegate authority to management for implementation of the risk management program including cybersecurity as an integral component. The corporate governance framework is designed to provide transparency through routine reporting as provided by the CISO to facilitate effective oversight of cybersecurity risk by the Board and executive management. The management committee layer of the corporate governance framework is supported by an Operational Risk Committee which serves as a key forum for the CISO to report quarterly updates on HTLF's cybersecurity risk profile, key metrics and risk indicators used to monitor the operating environment, emerging risks and threats as well as any cybersecurity incidents or events. In addition, the CISO has a routine reporting cadence with the Executive Risk Management Committee and the HTLF Risk Committee on the status of the cyber security management program, including trending of key risk metrics, results of risk assessments, audits and regulatory examinations.


text: HTLF has not been materially affected by any cyber security incidents to date, nor are we aware of any cyber security incident which we believe would have a material impact on us in the future. Nevertheless, like all financial institutions, we are subject to the risk that cybersecurity threats will continue to evolve and may materially impact us in the future. These factors are further detailed in the "Risk Factors" section included under Item 1A of Part I of this Annual Report on Form 10-K, including under the caption "Security breaches, cyber-attacks or other similar incidents with respect to our or our vendors' systems or network security, as well as the resulting theft or compromise of business and customer information, including personal information, could adversely affect our business or reputation, and create significant legal, regulatory or financial exposure."


text: Risk Management and Strategy Protecting the information maintained by the Company about its patients, customers, colleagues, and partners against external and internal threats is a priority for the Company. Accordingly, the Company invests in the development and implementation of cybersecurity policies, control standards, and control procedures, including a risk management and assessment program, security and event monitoring capabilities, an incident response plan, and other detection, prevention, and protection capabilities, including practices and tools to monitor and mitigate external and insider threats. The Company engages in a risk monitoring process through its Office of Information Security (OIS) within the Information Technology organization that seeks to identify the likelihood and impact of threats to its systems and data, and assesses the effectiveness of the controls in place.

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: Consistent with business requirements, components of the Company's information technology and controls are assessed by independent third parties against various frameworks and standards. With the assistance of these frameworks and standards, the Company assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and assesses those systems pursuant to the Company's cybersecurity policies, control standards, and control procedures. Mitigation of identified threats and vulnerabilities may be delayed.


text: The Company has implemented an Incident Response Plan (IR Plan), which is aligned to its overall crisis management program. The IR Plan provides a framework for responding to and managing cybersecurity incidents. The IR Plan identifies applicable requirements for incident response, outlines processes for any applicable reporting, as well as provides protocols for incident evaluation, processes for notification and internal escalation of information to the Company's senior management, and the Board and/or appropriate Board committees, as applicable. The IR Plan is reviewed, tested, and updated under the leadership of the Company's Chief Information and Technology Officer (CITO) and Chief Information Risk Officer (CIRO).


text: The Company's cybersecurity team also provides enterprise-wide cybersecurity training for employees to maintain and continuously improve the Company's mitigation against human-driven risk.


text: Engagement with External Cybersecurity Professionals The Company engages with third parties to assess the effectiveness of, and assist with, its cybersecurity risk and response systems and processes. These third parties include cybersecurity assessors, consultants, and other cybersecurity professionals who assist in the identification, verification, and validation of cybersecurity risks, as well as support associated mitigation or incident response plans when necessary.


text: Oversight of Third-Party Service Providers The Company's processes also are designed to evaluate the cybersecurity threat risks associated with its use of third-party service providers that have applicable levels of access to the Company's data or information technology systems. The Company performs due diligence on third parties that have access to its systems, data, or facilities that house such systems or data, and it monitors cybersecurity threat risks identified through such due diligence.


text: Cybersecurity Incident Impact The Company describes whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect it, including its business and operating results, financial condition, and impact on the Company's reputation and customer relationships, under the Summary of Material Risks section of this Annual Report, and under the "Risks Related to Technology and Cybersecurity" heading and subheadings thereunder in Part I, Item 1A. "Risk Factors" of this Annual Report, which disclosures are incorporated by reference herein.


text: In July 2018, the Company experienced a ransomware incident which affected certain Dx information technology systems. The incident also temporarily affected certain other information technology systems involved in conducting Company-wide operations. An investigation determined that the ransomware did not and could not transfer patient or client data outside of Company systems and that there was no theft or misuse of patient or client data. This incident did not have a material effect on the Company.

stage1Category: Incident Disclosure


text: On May 14, 2019, Retrieval-Masters Credit Bureau, Inc. d/b/a/ American Medical Collections Agency (AMCA), an external collection agency, notified the Company about a security incident AMCA experienced that may have involved certain personal information about some of the Company's patients (the AMCA Incident). The Company is involved in pending and threatened litigation related to the AMCA Incident, as well as various government and regulatory inquiries and processes. For additional information about the AMCA Incident, see Note 15 Commitments and Contingencies to the Consolidated Financial Statements "Cybersecurity" and "Risk Factors - Risks Related to Technology and Cybersecurity".


text: The Company's board of directors has oversight responsibility for the Company's enterprise risk management process and it delegates oversight responsibility for certain significant functional areas of risk management to the board's committees. The Audit Committee of the board of directors is responsible for oversight and review of the Company's cybersecurity and other information technology risks, controls, and procedures, including the potential impact of such risks on the Company's business, financial results, operations, and reputation, as well as the Company's plans to mitigate cybersecurity risks and to respond to cybersecurity incidents.


text: The CIRO and CITO routinely present cybersecurity reports to the Audit Committee at its regularly scheduled meetings. These reports may address cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program, prior incidents, and the emerging cyber threat landscape. In addition, the full Board receives briefings from the CIRO and CITO on at least an annual basis.


text: Management is responsible for day-to-day assessment and oversight of cybersecurity risks. At the senior management level, the CITO is responsible for overseeing the Company's information technology systems, technology capabilities, and cybersecurity practices. The CITO has more than 30 years of experience working in information technology-related roles and is a member of the Company's executive leadership team and reports to the Chief Executive Officer. Prior to joining the Company, the CITO held various chief information officer roles with global companies.


text: The CIRO, under the direction of the CITO, is responsible for overseeing the OIS. In this role, the CIRO oversees the cyber risk management function, which identifies cybersecurity threats, assesses cybersecurity risks, and supports the CITO and the Company in managing such risks. The CIRO has over 30 years of experience in information security, and prior to joining the Company held various chief information security officer roles, including seven years at a global healthcare company. The CIRO has also served on the board of directors of Health-ISAC, an organization of critical infrastructure owners and operators within the health and public health sectors.


text: The CITO and CIRO together lead efforts to design, implement and operate controls deemed appropriate for the management of Company information assets and systems. OIS manages the policies, control procedures, and control standards designed to identify, detect, protect against, respond to, and recover from cybersecurity threats and cybersecurity incidents. This group includes a cybersecurity operations team that is responsible for the information technology security monitoring and incident response activities, the latter covering the response coordination to cybersecurity incidents under the leadership and pursuant to the direction of the CIRO. OIS also oversees the Company's cybersecurity training program for employees.


text: The Company has implemented a formal cybersecurity program aligned to the Secure Controls Framework (SCF), a cybersecurity and privacy framework that consolidates and maps controls across multiple regulations, standards, and best practices. The Company's program includes the evaluation of the cybersecurity posture of third-party suppliers and vendors that have access to the Company's data or information technology systems. Consistent with business requirements, components of the Company's information technology and controls are assessed by independent third parties against various frameworks and standards. With the assistance of these frameworks and standards, the Company assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, assesses those systems pursuant to the Company's cybersecurity policies, control standards, and control procedures, and implements appropriate mitigation measures. Mitigation of identified threats and vulnerabilities may be delayed.


text: The Company has implemented an Incident Response Plan (IR Plan), which is aligned to its overall crisis management program. The IR Plan provides a framework for responding to and managing cybersecurity incidents. The IR Plan outlines incident response requirements, reporting processes, protocols for incident evaluation, and procedures for notifying and escalating information to the Company's senior management, and the Board and/or appropriate Board committees, as applicable. The IR Plan is reviewed, tested, and updated under the leadership of the Company's Chief Information and Technology Officer (CITO) and Chief Information Risk Officer (CIRO).


text: The Company's cybersecurity team also provides enterprise-wide cybersecurity training for employees to maintain and continuously improve the Company's mitigation against human-driven risk. Cybersecurity training is conducted annually, in addition to periodic simulations and exercises to test the efficacy of this training, and expanded training is required for specific roles.


text: Engagement with External Cybersecurity Professionals The Company engages with third parties to assess the effectiveness of, and assist with, its cybersecurity risk and response systems and processes. These third parties include cybersecurity assessors, consultants, and professionals who help identify, verify, and validate cybersecurity risks and support mitigation or incident response plans as needed.


text: Cybersecurity Incident Impact The Company describes whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect it, including its business and operating results, financial condition, and impact on the Company's reputation and customer relationships under the "Risks Related to Technology and Cybersecurity" heading and subheadings thereunder in Part I, Item 1A. "Risk Factors" of this Annual Report, which disclosures are incorporated by reference herein.


text: In addition, the Company has established clear lines of communication with key stakeholders, including executives, IT teams, employees, and customers, to ensure transparency and an effective response to cybersecurity incidents. Furthermore, the information security team develops and provides cybersecurity awareness training to the Company's employees and regularly communicates updates on best cybersecurity practices and improvements in the cybersecurity program.

companyName: IMAX CORP

ticker: IMAX


text: Management is responsible for day-to-day assessment and oversight of cybersecurity risks. At the senior management level, the CITO is responsible for overseeing the Company's information technology systems, technology capabilities, and cybersecurity practices. The CITO has more than 15 years of experience working in information technology-related roles and is a member of the Company's executive leadership team and reports to the Chief Executive Officer. Prior to joining the Company, the CITO held various leadership positions with global companies.


text: The CIRO, under the direction of the CITO, is responsible for overseeing the OIS. In this role, the CIRO oversees the cyber risk management function, which identifies cybersecurity threats, assesses cybersecurity risks, and supports the CITO and the Company in managing such risks. The CIRO has over 30 years of experience in information security, and prior to joining the Company held various chief information security officer roles, including seven years at a global healthcare company. The CIRO has also served on the board of directors of Health-ISAC, an organization of critical infrastructure owners and operators within the health and public health sectors. The CITO and CIRO together lead efforts to design, implement and operate controls deemed appropriate for the management of Company information assets and systems. OIS manages the policies, control procedures, and control standards designed to identify, detect, protect against, respond to, and recover from cybersecurity threats and cybersecurity incidents. This group includes a cybersecurity operations team that is responsible for the information technology security monitoring and incident response activities, the latter covering the response coordination to cybersecurity incidents under the leadership and pursuant to the direction of the CIRO. OIS also oversees the Company's cybersecurity training program for employees.


text: Risk Management and Strategy Our cybersecurity risk management efforts are an integral part of our overall risk management processes, and we are deeply committed to safeguarding our digital and information technology environment for our employees, customers and vendors. We employ a robust, global and multi-layered security strategy, known as "defense-in-depth," to assess, identify and manage cybersecurity risks and protect our cyber work environment from potential threats and vulnerabilities. These risks, threats and vulnerabilities include those that could result in significant operational disruption to the Company, such as production disruption, business downtime or loss of containment, as well as risks that could have significant reputational or compliance/regulatory impact.

companyName: Simpson Manufacturing Co., Inc.

ticker: SSD


text: The Simpson Information Security Team monitors information security risks that target both technology and manufacturing environments and identifies potential risks to Simpson's information security posture. Any identified risks are prioritized in terms of impact to Simpson's information security posture and, if critical, addressed immediately or added to Simpson's information security roadmap. To supplement our internal cybersecurity resources, we also engage external third parties to perform information security assessments, penetration tests and related services to enhance our information security program.


text: Risks Associated with Third-Party Service Providers In addition, we implement robust processes to oversee and manage risks associated with our business arrangements with third-party service providers. All new Simpson third-party business agreements are reviewed and assessed by our Information Security Team. We also perform information security program investigations on the security posture of, and assess any publicly known information security events related to, these third-party service providers. If a third party service provider with a business agreement with Simpson experiences an information security breach or incident, our Information Security Team reviews and assesses such event to understand Simpson's overall exposure to the security incident.


text: We maintain cybersecurity insurance coverage at industry standard levels as a part of our comprehensive insurance portfolio to help mitigate risk in the event an information security event occurs.


text: Risks Associated with Third-Party Service Providers In addition, we implement robust processes to oversee and manage risks associated with our business arrangements with third-party service providers. All new Simpson third-party business agreements are reviewed and assessed by our Information Security team. We also perform information security program investigations on the security posture of, and assess any publicly known information security events related to, these third-party service providers. If a third party service provider with a business agreement with Simpson experiences an information security breach or incident, our Information Security Team reviews and assesses such event to understand Simpson's overall exposure to the security incident.


text: Risks from Cybersecurity Threats Despite our security measures, our information technology and infrastructure may remain vulnerable to disruptions, including as a result of attacks by increasingly sophisticated intruders or others who attempt to cause harm to, or otherwise interfere with the normal use of our systems. We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past that have resulted in unauthorized persons gaining access to our information systems and computer networks, and we could in the future experience similar attacks. On October 11, 2023, we announced that we had experienced disruptions in our Information Technology (IT) infrastructure and applications resulting from a cybersecurity incident. We identified unauthorized activity in our IT systems and took immediate steps to stop, remediate and investigate such activity. We also notified relevant law enforcement. The incident, which caused disruption of our business operations for approximately three days, has been resolved due to steps we took to address the incident. As a result of our ability to restore our operations within three days, we were able to fulfill our backlog of orders caused by the operational disruption within one week, and therefore, we experienced no material financial impact to our business.


text: We do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incident, have materially affected or are reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats we face, see the section captioned "Risks Relating to Our Intellectual Property and Information Technology" under Part I, Item 1A "Risk Factors" above.


text: Board and Committee Oversight Although our full Board of Directors is ultimately responsible for risk oversight, our Board is assisted in discharging its risk oversight responsibility by its committees. The Audit and Finance Committee of the Board is responsible for providing oversight of our information security program and cybersecurity risks. In connection with this oversight role, the Audit and Finance Committee receives information technology updates from management at least quarterly. Cybersecurity risks facing the Company and updates on the Company's practices and progress to mitigate such risks are also the subject of management reports to the Audit and Finance Committee on a more frequent basis, as necessary or appropriate.


text: Management's Role in Assessing and Managing Risk The Company's information security efforts are led by our Senior Vice President, Information Technology ("SVP, IT") and our Director of Information Security ("IT Director"), supported by our executive management team. These efforts are designed to address information security governance and risk, product security, identification and protection of critical assets, third-party risk, security awareness, cyber defense operations and related risk management matters. Our SVP, IT and IT Director have an average of over 35 years of prior work experience in various roles involving information technology, including security, auditing compliance, systems and programming. These individuals have relevant educational and industry experience, including holding similar positions at other large companies.


text: Our SVP, IT provides relevant cybersecurity and information technology reports to the Audit and Finance Committee, and to the executive leadership team. These reports are provided at quarterly Audit and Finance Committee meetings and at our quarterly Information Technology Steering Committee ("IT Steering Committee") meetings. These reports typically include analyses of recent significant cybersecurity threats and incidents at the Company and across the industry, as well as a review of our security controls, assessments and program maturity, risk mitigation status, and a review of our third-party service providers as appropriate. Simpson's information security roadmap and posture are also reviewed quarterly with members of the executive leadership team and the Audit and Finance Committee. In accordance with our information security program, any information security event is assessed and reviewed by our IT Steering Committee.


text: The IT Steering Committee is responsible for assessing and reviewing our information security program and the Company's material risks from cybersecurity threats. Additional supervision and management is provided by our IT Leadership team, comprised of our SVP, IT; VP, IT Infrastructure and Operations; VP, IT Enterprise Applications; and International IT Director.