text: The Corporation engages with a multitude of third-party assessors, consultants, auditors and other third parties to support and maintain a robust information security practice. These partners are credentialed cybersecurity firms that assist to monitor and maintain the performance and effectiveness of our processes, procedures, and internal controls, as well as the various products and services that are deployed in our environment. The Corporation has a Third Party Risk Management program in place to monitor for any potential material risks from cybersecurity threats regarding any third-party service providers. Through our Third Party Risk Management Program we risk rate our vendors and conduct a thorough review prior to the execution of any agreement and then on an ongoing risk-based basis. The review consists of due diligence documents and information such as the Service Organizational Control ("SOC") Reports, Information and Data Security, Business Continuity Testing and Penetration Testing.


text: The risks from cybersecurity threats, including any previous cybersecurity incidents, have not materially affected the Corporation to date, including our business strategy, operations, or financial condition. Cybersecurity is an evolving threat that does have the potential to materially affect the Corporation, including our business strategy, operations, or financial condition. However, with our system of internal controls, cyber defense mechanisms in place and the tenure and experience of our Chief Information Security Officer ("CISO") and Information Security Analysts, we have sought to reduce the residual risk that is inherent of cybersecurity.

companyName: CHEMUNG FINANCIAL CORP

ticker: CHMG

secItem: Item 1C

stage1Category: Strategy Integration

stage1Method: unanimous


text: The CISO reports to ERC on a quarterly basis regarding the cybersecurity program and material cybersecurity risks. The quarterly report includes the following information: information security incidents, internal phishing risk, defensive coverage and response of our endpoints, and internal and external vulnerability scan results. The ERC is also apprised of training, regulation or guidance changes, and new products and services utilized by the Information Security Department. In addition to a cybersecurity risk assessment that is performed by the CISO, management is responsible for conducting a risk assessment to identify data security, information technology, and cybersecurity risk factors impacting their business line. The results are reviewed by the Risk Division and presented to ERC.

stage1Category: Risk Management Process

stage1Method: majority


text: The CISO has over 26 years of experience with information technology management, information security, compliance, audit, and process improvement. Our Information Security Analysts have a combined 22 years of experience with information security, information technology servers and information technology networks. The CISO and Information Security Analysts are active members of the following management level committees at the Bank: Information Technology Steering Committee and the Change Control Committee.

stage1Category: Management Role


text: The Program is led by our CISO, who reports directly to the Senior Risk Officer. Additionally, the CISO meets regularly and works in tandem with the Chief Information Officer and various members of Information Technology. The Information Security Department meets regularly with employees through hosted educational sessions, all-employee call presentations, Officers' meeting presentations and individual Branch network visits. Line of business leaders regularly reach out to the CISO with regards to cybersecurity risk prevention, questions, and training. The CISO has a standing agenda item for the Information Technology Steering Committee meeting as well as ERC in order to inform the committees about prevention, detection, mitigation and remediation of cybersecurity incidents. If there are any incidents that require information to be presented to the Executive Management Team or the Board, the Senior Risk Officer presents that information. The CISO reports to ERC on a quarterly basis regarding the cybersecurity program and material cybersecurity risks.


text: The Corporation regards information as one of its most valuable assets. As a result, safeguards have been implemented to protect corporate informational assets and associated technology resources have been established to maintain the integrity, availability, and privacy of confidential information of those assets. The Corporation has established an Information and Cyber Security Program ("Program") that includes standards and procedures to ensure that all information belonging to or held by the Corporation will be appropriately evaluated, classified, and protected against likely forms of unauthorized or inappropriate access, use, disclosure, modification, destruction, and denial.


text: Enterprise Risk Management embeds risk management into the oversight of cybersecurity as an integral part of the business with comprehensive internal control and assurance processes linked to key risks which are then reported to the Board of Directors ("Board"). Risk oversight, including cybersecurity is a key risk which has been delegated to the Enterprise Risk Committee of the Board ("ERC"). Cybersecurity is integrated into the Corporation's Enterprise Risk Management Policy, Enterprise Risk Management Committee Charter, Escalation Policy, Risk Appetite Statement, Information Technology Steering Meetings, and Division Risk Meetings. Employees are trained on their first day of employment with regards to cybersecurity and additional training is rolled out for all employees throughout the year.


text: The risks from cybersecurity threats, including any previous cybersecurity incidents, have not materially affected the Corporation to date, including our business strategy, operations, or financial condition. Cybersecurity is an evolving threat, and the increasing sophistication of threat actors is supported by new technologies, including artificial intelligence and machine learning, which does have the potential to materially affect the Corporation, including our business strategy, operations, or financial condition. However, with our system of internal controls, cyber defense mechanisms in place and the tenure and experience of our Chief Information Security Officer ("CISO") and Information Security Analysts, we have sought to reduce the residual risk that is inherent of cybersecurity.


text: The CISO has over 27 years of experience with information technology management, information security, compliance, audit, and process improvement. Our Information Security Analysts have a combined 23 years of experience with information security, information technology servers and information technology networks. The CISO and Information Security Analysts are active members of the following management level committees at the Bank: Information Technology Steering Committee and the Change Control Committee.


text: The Program is led by our CISO, who reports directly to the Chief Risk Officer. Additionally, the CISO meets regularly and works in tandem with the Chief Information Officer and various members of Information Technology. The Information Security Department meets regularly with employees through hosted educational sessions, all-employee call presentations, Officers' meeting presentations and individual branch network visits. Line of business leaders regularly reach out to the CISO with regards to cybersecurity risk prevention, questions, and training. The CISO has a standing agenda item for the Information Technology Steering Committee meeting as well as ERC in order to inform the committees about prevention, detection, mitigation and remediation of cybersecurity incidents. If there are any incidents that require information to be presented to the Executive Management Team or the Board, the Chief Risk Officer presents that information.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: LCI INDUSTRIES

ticker: LCII


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is aligned to the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors, which is part of our global information security policy.


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors - "Risks Related to our Business, Operations and Strategy."


text: Cybersecurity Governance The Board of Directors established its Risk Committee with specific responsibility for overseeing risks from cybersecurity threats, among other things. Our Vice President of Global Information Security provides the Risk Committee periodic reports on our cybersecurity risks and any material cybersecurity incidents. In addition, our cybersecurity team provides annual reports to our Board of Directors.

stage1Category: Board Governance


text: Our team of cybersecurity professionals is led day-to-day by our Vice President of Global Information Security who reports to our Chief Information Officer. Our Vice President of Global Information Security has a combined 20 years of experience in IT operations and cybersecurity leadership. The Vice President of Global Information Security also serves as the Chair of our Enterprise Risk and Compliance Committee where leaders from across the Company discuss cyber risk and other risk matters. The cybersecurity team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our cybersecurity team also monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: We also periodically retain outside expertise to conduct a maturity assessment of our program against industry standards and participants. Our program is informed by industry standards such as, for example, the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF"), but this does not imply that we meet all technical standards, specifications or requirements under the NIST CSF, NIST CSF 2.0 or other sources.

companyName: BEST BUY CO INC

ticker: BBY


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business strategy, results of operations or financial condition, as further described in Item 1A. Risk Factors - "Risks Related to our Business, Operations and Strategy."


text: Our team of cybersecurity professionals is led day-to-day by our Vice President of Global Information Security who reports to our Chief Information Officer. Our Vice President of Global Information Security has over 20 years of experience in IT operations and cybersecurity leadership and is a Certified Information Systems Security Professional (CISSP). The Vice President of Global Information Security also serves on our Enterprise Risk and Compliance Committee where leaders from across the Company discuss cyber risk and other risk matters. The cybersecurity team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Management of cybersecurity risks is an integral part of our overall risk management framework and is essential for safeguarding our business and data. We have developed an information security program to assess, identify and manage material risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls drawn from multiple security frameworks are developed, implemented and maintained. Our cybersecurity risk management program works to balance critical infrastructure, network, application, cloud and information security objectives with overall business objectives and risk tolerance. Specific controls that are used include endpoint threat detection and response, identity and access management, privileged access management, logging and monitoring involving the use of security information and event management, multi-factor authentication, firewalls and intrusion detection and prevention, and vulnerability and patch management.

companyName: CLEVELAND-CLIFFS INC.

ticker: CLF


text: We use threat intelligence to inform our defensive measures. We use external and internal threat intelligence sources, including information from industry vendors and government agencies. Evolving threats and risks we are also monitoring and working to protect against include artificial intelligence, ransomware and nation-state attacks.


text: We believe in continuous improvement as part of the effort to optimize security, and we work to foster that culture through various initiatives: • Cybersecurity Awareness Trainings: We educate employees on best practices for online safety and for identifying potential cybersecurity threats, including by initiating quarterly training programs for our non-represented salaried workforce. • Simulated Cyberattacks: With assistance from qualified third-party experts, we periodically conduct penetration testing and tabletop exercises to test our technical controls and incident response plans. • Security Monitoring: We monitor our information technology environment with both our internal cybersecurity resources and third-party service providers. We also have processes in place to monitor the cybersecurity practices of various third-party service providers, including certain vendors that have access to our information systems or sensitive data. • Proactive Reporting and Investigation: As part of our training initiatives, we regularly educate employees on how to report any suspicious cyber activity or potential cybersecurity issues, and we investigate reported concerns.


text: Third-party security firms are used in different capacities to provide or operate some of these programs, controls and technology systems, including cloud-based platforms and services.


text: Our Board of Directors has overall oversight responsibility for our enterprise risk management program and delegates cybersecurity risk management oversight to the Audit Committee of the Board of Directors. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Management, including the Chief Information Officer with support from our cybersecurity team, updates the Audit Committee on at least a biannual basis regarding our cybersecurity programs and material cybersecurity risks and mitigation strategies. The Audit Committee also regularly reports on discussions regarding cybersecurity risks to our full Board of Directors. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Information Officer, who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our cybersecurity team includes personnel that have obtained credentials from the International System Security Certification Consortium and the SANS Institute, such as Certified Information Systems Security Professional (CISSP) and GIAC Certified Incident Handler, as well as experienced information systems security professionals and information security managers. Additionally, our internal Information Security Committee, composed of leaders from key departments, collaborates on a cross-functional basis to identify practices that can counter threats and to monitor our cybersecurity programs and our cybersecurity incident response plans.


text: We recognize the ever-present global risk of cyberattacks from diverse threat actors, including nation-states, cybercriminals, hacktivists, insiders and organized crime. In spite of our efforts, we (or third parties we rely on) may not be able to fully, continuously and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement, but it is possible we may not implement appropriate controls if we do not recognize or we underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. Further, even events that are detected by security tools or third parties may not always be immediately understood or acted upon. While no organization is immune to attack attempts and we cannot eliminate all risks from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident, in 2023 we did not identify any material cybersecurity events that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For more information about these risks, please see Part I - Item 1A. Risk Factors - IV. Operational Risks - A disruption in or failure of our IT systems, including those related to cybersecurity, could adversely affect our business operations, reputation and financial performance.


text: We use threat intelligence to inform our defensive measures. We use external and internal threat intelligence sources, including information from industry vendors and government agencies. Evolving threats and risks we are also monitoring and working to protect against include Artificial Intelligence, ransomware and nation-state attacks.


text: We believe in continuous improvement as part of the effort to optimize security, and we work to foster that culture through various initiatives: • Cybersecurity Awareness Trainings: We educate employees on best practices for online safety and for identifying potential cybersecurity threats, including by maintaining quarterly training programs for our non-represented salaried workforce. • Simulated Cyberattacks: With assistance from qualified third-party experts, we periodically conduct penetration testing and tabletop exercises to test our technical controls and incident response plans. • Security Monitoring: We monitor our information technology environment with both our internal cybersecurity resources and third-party service providers. We also have processes in place to monitor the cybersecurity practices of various third-party service providers, including certain vendors that have access to our information systems or sensitive data. • Proactive Reporting and Investigation: As part of our training initiatives, we regularly educate employees on how to report any suspicious cyber activity or potential cybersecurity issues, and we investigate reported concerns.


text: Our Board of Directors has overall oversight responsibility for our enterprise risk management program and delegates cybersecurity risk management oversight to the Audit Committee of the Board of Directors. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Management, including the Chief Information Officer with support from our cybersecurity team, updates the Audit Committee on at least a biannual basis regarding our cybersecurity programs and material cybersecurity risks and mitigation strategies. The Audit Committee also regularly reports on discussions regarding cybersecurity risks to our full Board of Directors. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Information Officer, who has three years of experience overseeing information technology and cyber functions and who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our cybersecurity team includes personnel that have obtained credentials from the International System Security Certification Consortium and the SANS Institute, such as Certified Information Systems Security Professional (CISSP) and GIAC Certified Incident Handler, as well as experienced information systems security professionals and information security managers. Additionally, our internal Information Security Committee, composed of leaders from key departments, collaborates on a cross-functional basis to identify practices that can counter threats and to monitor our cybersecurity programs and our cybersecurity incident response plans.


text: We recognize the ever-present global risk of cyberattacks from diverse threat actors, including nation-states, cybercriminals, hacktivists, insiders and organized crime. In spite of our efforts, we (or third parties we rely on) may not be able to fully, continuously and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement, but it is possible we may not implement appropriate controls if we do not recognize or we underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. Further, even events that are detected by security tools or third parties may not always be immediately understood or acted upon. While no organization is immune to attack attempts and we cannot eliminate all risks from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident, in 2024 we did not identify any material cybersecurity events that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For further information about these risks, please see Part I - Item 1A. Risk Factors - IV. Operational Risks - A disruption in or failure of our IT systems, including those related to cybersecurity, could adversely affect our business operations, reputation and financial performance and could expose us to third-party liability.


text: Risk Management and Strategy We rely extensively on information technology, much of which is managed by third-party service providers (such as cloud data service providers), to support a variety of business processes and activities, including: complying with regulatory, legal, financial reporting and tax requirements; engaging in marketing and e-commerce activities; managing and improving the effectiveness of our operations; researching, developing, manufacturing and distributing our products; collecting and storing sensitive data and confidential information; and communicating with employees, investors, suppliers, trade customers, adult tobacco consumers and others. Recognizing the critical importance of cybersecurity in today's digital landscape, we are committed to safeguarding our information assets, protecting consumer data and maintaining the integrity and availability of our systems. Accordingly, we have implemented an extensive cybersecurity risk management framework designed to identify, assess, mitigate and prevent potential cybersecurity risks and to align with industry best practices and all applicable regulatory requirements. We evaluate our cybersecurity risk management framework against the National Institute of Standards and Technology's Cybersecurity Framework, which outlines the core components and responsibilities necessary to sustain a healthy and well-balanced cybersecurity program. We also align our security standards for infrastructure configuration with the Center for Internet Security's Benchmarks, which are prescriptive recommendations based upon the consensus of global cybersecurity experts.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: Our framework is built around the following key principles: (i) risk assessment and threat intelligence; (ii) security controls; (iii) incident response; (iv) employee awareness and training; and (v) third-party risk management. We have integrated our cybersecurity framework into our broad enterprise risk management processes, which allows us to leverage our existing enterprise-wide experience in managing risk and adapting to change in the cybersecurity threat landscape.


text: Risk Assessment and Threat Intelligence: We conduct regular risk assessments to identify potential cybersecurity vulnerabilities and threats. Our Information Technology ("IT") Risk Management function, overseen by our Chief Information Security Officer ("CISO"), leads internal self-assessments, which involve evaluating the security posture of critical systems, networks and applications as well as the potential impact of cybersecurity threats on our business operations, financial condition and reputation. IT Risk Management also conducts ongoing threat monitoring and has implemented monitoring systems, including technologies such as intrusion detection systems, security information and event management tools and threat intelligence programs.


text: We regularly engage third-party consulting services to conduct audits and assessments of the effectiveness of our cybersecurity controls and processes and identify areas for improvement based on developments in industry best practices. We also leverage third parties to evaluate our cybersecurity and risk management strategy, review policies and procedures to address new risks and maintain ongoing compliance with evolving legal and regulatory requirements. For example, we partner with leading global security providers to leverage various threat intelligence channels as input to monitor and tune our controls to prevent a cybersecurity attack.


text: Security Controls: We employ a layered approach to cybersecurity, implementing a range of technical and procedural controls to protect critical systems and data. These controls include (i) firewalls and intrusion detection and prevention systems to monitor and block unauthorized access attempts, detect and prevent malicious activity and safeguard network infrastructure, (ii) encryption, including secure protocols and multi-factor authentication, to protect information in transit and at rest and (iii) secure network architecture that segregates critical systems from the public internet, limiting exposure to potential threats. We also conduct regular security patching to manage emerging cyber threats.


text: Incident Response: We have established an incident response plan and playbooks, which include procedures designed to respond to and recover from cybersecurity incidents. These procedures, which our IT Risk Management function reviews on an ongoing basis both internally and with third-party consultants, provide detailed descriptions of the roles and responsibilities of key stakeholders and the procedures for communication and coordination during an incident. The procedures also provide guidelines for escalating information to senior management, our Disclosure Controls Committee, our Audit Committee, which, as discussed below, has been delegated responsibility for our Board's cybersecurity risk oversight function, and our full Board and for providing timely public disclosure, when necessary.


text: To maintain incident readiness and resilience, we conduct periodic disaster recovery exercises and cybersecurity incident management exercises led by our IT Risk Management function. These exercises involve simulating various scenarios and testing our response strategies, allowing us to identify vulnerabilities, refine procedures and enhance our overall crisis management and recovery capabilities. We believe regular practice and evaluation allows us to minimize the impact of potential disruptions and safeguard our operations, data and reputation.


text: Employee Awareness and Training: We recognize that employees play a critical role in maintaining a strong cybersecurity posture. Our Information Governance Policy sets forth the requirements for employee conduct relating to company information and company-managed devices, including relevant privacy, data security and data retention policies. We believe that our Information Governance Policy is aligned with industry best practices and applicable legal and regulatory requirements. In addition to our Information Governance Policy, we conduct regular cybersecurity training programs emphasizing the importance of cybersecurity awareness. These programs address relevant cybersecurity topics, such as common cybersecurity threats, phishing awareness and best practices for safeguarding sensitive information. Employees are held accountable for completing all assigned cybersecurity programs and meeting certain performance thresholds in phishing awareness exercises, and there is a range of consequences for underperformance that includes termination.


text: Third-Party Risk Management: We acknowledge the potential cybersecurity risks inherent in our relationships with third-parties. Accordingly, we have implemented a third-party risk management program to identify and oversee such risks. This program relies on key elements including risk assessment, due diligence, contractual provisions and ongoing monitoring to identify and mitigate impacts from high-risk third-parties and of specific risks. We use security risk assessment questionnaire tools to identify high-risk third-parties, allowing us to effectively assess and mitigate potential security vulnerabilities.

stage1Category: Third-Party Risk


text: Our third-party risk assessment framework evaluates the cybersecurity practices and controls of third-parties. For high-risk third-parties, we perform rigorous due diligence inquiries, reviewing documentation with respect to their security policies, incident response capabilities, data protection measures and regulatory compliance. We also review evidence of cybersecurity certifications and the results of independent audits. For high-risk third-parties with access to sensitive data or systems, we conduct more in-depth assessments. Our contracts with high-risk third-parties contain provisions related to data protection, confidentiality, incident reporting and compliance with all applicable laws and regulations. Throughout our engagements with high-risk third-parties, we maintain a monitoring program with respect to their cybersecurity posture. Leveraging tools such as security questionnaires, security ratings and external threat intelligence, we regularly review and update third-party risk assessments based on changes in the third-party's services or practices and the risk landscape.


text: Our Board devotes significant time and attention to our cybersecurity and information technology risks. Our Board executes its cybersecurity risk oversight function as a whole and by delegating responsibility to our Audit Committee. Our CISO and Chief Information Officer present to our Board annually and to our Audit Committee at least twice each year on a broad range of topics, such as recent and potential cybersecurity threats and incidents across our industry, best practices and policies, emerging trends, vulnerability assessments and management's ongoing efforts to prevent, detect and address internal and external cybersecurity threats specific to us. These briefings also include periodic third-party cybersecurity program assessments and benchmarks and updates from our cybersecurity incident management exercises. Cybersecurity risks are documented in an IT Risk Dashboard, which is shared with our Audit Committee for awareness several times each year. Our full Board also has access to these materials. Finally, we provide periodic cybersecurity training to our Audit Committee and Board to further cybersecurity awareness and risk oversight.


text: While our Board and Audit Committee oversee cybersecurity risk, senior management is responsible for actively managing cybersecurity risk, including by overseeing and executing the risk management strategies discussed above. Our Risk Oversight Committee, which is chaired by our Chief Compliance Officer and comprised of members of senior management, including our Chief Financial Officer, Chief Operating Officer, Chief Strategy and Growth Officer and General Counsel, oversees the management of key enterprise risks, including cybersecurity risks. Senior management reports annually to the Board with respect to our overall enterprise risk management processes. Our CISO presents to the Risk Oversight Committee quarterly to review the status of management's key cybersecurity risk management strategies. The Risk Oversight Committee also receives the quarterly IT Risk Dashboard.


text: Our CISO is responsible for assessing and managing cybersecurity risks and maintaining our cybersecurity program. Our CISO has over 20 years of experience, including five years as our CISO, managing technology risks across multiple industries, including financial services, technology and manufacturing. Through strategic hiring and internal development, our CISO increases the levels of skill and experience on our IT Risk Management team to stay ahead of evolving cybersecurity threats. As of the date of this filing, 94% of our IT Risk Management team has technical industry certification, and members of the IT Risk Management team have an average of 15 years of cybersecurity experience. Our CISO currently serves as an advisor to multiple industry groups. Our cybersecurity program undergoes an annual controls effectiveness assessment and bi-annual program maturity evaluation against industry peers and consistently receives assessments indicating that it is ahead of the cybersecurity programs of our peer group.


text: Risk Management and Strategy We rely extensively on information technology, much of which is managed by third-party service providers (such as cloud data service providers), to support a variety of business processes and activities, including: complying with regulatory, legal, financial reporting and tax requirements; engaging in marketing and e-commerce activities; managing and improving the effectiveness of our operations; researching, developing, manufacturing and distributing our products; collecting and storing sensitive data and confidential information; and communicating with employees, investors, suppliers, trade customers, adult tobacco consumers and others. Recognizing the critical importance of cybersecurity in today's digital landscape, we are committed to safeguarding our information assets, protecting consumer data and maintaining the integrity and availability of our systems. Accordingly, we have implemented an extensive cybersecurity risk management framework designed to identify, assess, mitigate and prevent potential cybersecurity risks and to align with industry best practices and all applicable regulatory requirements. We leverage the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and industry best practices to identify and prioritize cybersecurity risks based on their potential impacts. We also use the NIST framework and industry best practices to drive enhancements to our program that are designed to protect our assets and third-party partners. The NIST framework also helps us maintain ongoing compliance with regulatory requirements. We align our security standards for infrastructure configuration with the Center for Internet Security's Benchmarks, which are prescriptive recommendations based upon the consensus of global cybersecurity experts.


text: We regularly engage third-party consulting services to conduct audits and assessments of the effectiveness of our cybersecurity controls and processes and identify areas for improvement based on developments in industry best practices. We typically engage these services annually, though the cadence can differ based on the results of the audits and assessments. We also leverage third parties to evaluate our cybersecurity and risk management strategy, review policies and procedures to address new risks and maintain ongoing compliance with evolving legal and regulatory requirements. For example, we partner with leading global security providers to leverage various threat intelligence channels as input to monitor and tune our cybersecurity controls.


text: Security Controls: We employ a layered approach to cybersecurity, implementing a range of technical and procedural controls designed to protect critical systems and data. These controls include (i) firewalls and intrusion detection and prevention systems to monitor and block unauthorized access attempts, detect and deter malicious activity and safeguard network infrastructure, (ii) encryption, including secure protocols and multi-factor authentication, to protect information in transit and at rest and (iii) secure network architecture that segregates critical systems from the public internet, limiting exposure to potential threats. We also conduct regular security patching to manage emerging cyber threats.


text: Incident Response: We have established an incident response plan and playbooks, which include procedures designed to respond to and recover from cybersecurity incidents. These procedures, which our IT Risk Management function reviews on an ongoing basis both internally and with third-party consultants, provide detailed descriptions of the roles and responsibilities of key stakeholders and the procedures for communication and coordination during an incident. The procedures also provide guidelines for escalating information to senior management, our Disclosure Controls Committee, our Audit Committee, which, as discussed below, has been delegated cybersecurity program oversight responsibility, and our full Board and for providing timely public disclosure, when necessary.


text: To maintain incident readiness, business continuity and IT resilience, we conduct periodic disaster recovery exercises and cybersecurity incident management exercises led by our IT Risk Management function. These exercises involve simulating various scenarios and testing our response strategies, allowing us to identify vulnerabilities, refine procedures and enhance our overall crisis management and recovery capabilities. We believe regular practice and evaluation allows us to minimize the impact of potential disruptions and safeguard our operations, data and reputation.


text: Employee Awareness and Training: We recognize that employees play a critical role in maintaining a strong cybersecurity posture. Our Information Governance Policy sets forth the requirements for employee conduct relating to company information and company-managed devices, including relevant privacy, data security and data retention policies. We believe that our Information Governance Policy is aligned with industry best practices and applicable legal and regulatory requirements. In addition to our Information Governance Policy, we conduct cybersecurity training programs emphasizing the importance of cybersecurity awareness at least annually and more frequently as necessary or advisable. These programs address relevant cybersecurity topics, such as common cybersecurity threats, phishing awareness and best practices for safeguarding sensitive information. Employees are held accountable for completing all assigned cybersecurity programs and meeting certain performance thresholds in phishing awareness exercises, and there is a range of consequences for underperformance that includes termination.


text: Third-Party Risk Management: We acknowledge the potential cybersecurity risks inherent in our relationships with third-parties. Accordingly, we have implemented a third-party risk management program to identify and oversee such risks. This program relies on key elements including risk assessment, due diligence, contractual provisions and ongoing monitoring to identify and mitigate impacts from high-risk third-parties and of specific risks. We use security risk assessment questionnaire tools to identify high-risk third-parties, which we believe allows us to effectively assess and mitigate potential security vulnerabilities.


text: Our third-party risk assessment framework evaluates the cybersecurity practices and controls of third-parties. For high-risk third-parties, we perform due diligence inquiries, reviewing documentation with respect to their security policies, incident response capabilities, data protection measures and regulatory compliance. We also review evidence of cybersecurity certifications and the results of independent audits. For high-risk third-parties with access to sensitive data or systems, we conduct more in-depth assessments. Our contracts with high-risk third-parties contain provisions related to data protection, confidentiality, incident reporting and compliance with all applicable laws and regulations. Throughout our engagements with high-risk third-parties, we maintain a monitoring program with respect to their cybersecurity posture. Leveraging tools such as security questionnaires, security ratings and external threat intelligence, we regularly review and update third-party risk assessments based on changes in the third-party's services or practices and the risk landscape.


text: Our Board devotes significant time and attention to our cybersecurity and information technology risks. Our Board executes its cybersecurity risk oversight as a whole and by delegating responsibility to our Audit Committee. Our CISO and Chief Information Officer present to our Board annually and to our Audit Committee at least twice each year on a broad range of topics, such as recent and potential cybersecurity threats and incidents across our industry, best practices and policies, emerging trends, vulnerability assessments and management's ongoing efforts to prevent, detect and address internal and external cybersecurity threats specific to us. These briefings also include reporting on periodic third-party cybersecurity program assessments and benchmarks and updates from our cybersecurity incident management exercises. Cybersecurity risks are documented in an IT Risk Dashboard, which is shared with our Audit Committee for awareness several times each year. Our full Board also has access to these materials. Finally, we provide periodic cybersecurity training to our Audit Committee and Board to further cybersecurity awareness and risk oversight.


text: Our CISO is responsible for assessing and managing cybersecurity risks and maintaining our cybersecurity program. Our CISO has over 25 years of experience, including five years as our CISO, managing technology risks across multiple industries, including financial services, technology and manufacturing. Through strategic hiring and internal development, our CISO enhances the levels of skill and experience on our IT Risk Management team to stay ahead of evolving cybersecurity threats. As of the date of this filing, 100% of our IT Risk Management team has technical industry certification, and members of the IT Risk Management team have an average of 15 years of cybersecurity experience. Our CISO currently serves as an advisor to multiple industry groups. Our cybersecurity program undergoes an annual third-party controls effectiveness assessment and bi-annual program maturity evaluation against industry peers and consistently receives assessments indicating that it is ahead of the cybersecurity programs of our peer group.


text: As of the date of this filing, we are not aware of any current cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. From time-to-time, we and our third-party service providers, suppliers and trade customers experience attempts to infiltrate and interrupt information systems. To date, we have not experienced any interruptions of these information systems as a result of infiltration attempts. For further discussion of the risks related to cybersecurity, see Risks Relating to Our Business - Information Technology and Data Privacy Risks in Item 1A.


text: We rely heavily on information technology systems to operate and manage all key aspects of our business. We also process substantial volumes of confidential business information and sensitive consumer and employee personal information, which if impacted by cyber threats could result in financial and reputational harms and regulatory sanction. We have developed and implemented, and update on an ongoing basis, a risk-based information security program designed to identify, assess and manage material risks from cybersecurity threats.


text: Cybersecurity Risk Management and Strategy Our information security program comprises administrative, technical and physical safeguards designed, under a risk-based approach, to reasonably mitigate cybersecurity risks to the confidentiality, integrity or availability of our information systems and information. These include safeguards designed to oversee service-provider relationships in a manner consistent with the risks presented by the engagement and use of the service provider.


text: The program deploys multiple layers of controls designed to identify, protect against, detect, respond to and recover from information security and cybersecurity incidents and our Cyber Security Incident Response Team, which is part of our Enterprise Information Protection ("EIP") organization, plays a core role in detecting, mitigating and remediating cybersecurity incidents. Based on the nature and severity of the incident, our response is to be guided by documented incident response plans. These plans outline steps to be followed, functional areas to be engaged, internal escalations to be pursued (which may include, as appropriate, senior management, executive management and the Board) and stakeholders to be notified.


text: Third parties also play a role in our cybersecurity. We engage third parties for advice and support in the design and implementation of certain program elements and leverage third-party tools to help identify and mitigate cybersecurity risks. Certain specific, defined components of our technology environment are assessed by third-party auditors with a view to alignment with industry standards such as, for example, the Payment Card Industry Data Security Standards.


text: We also periodically retain outside expertise to conduct a maturity assessment of our program against industry standards and participants. Our program is informed by industry standards such as, for example, the National Institute of Standards and Technology's Framework for Improving Critical Infrastructure Cybersecurity ("NIST CSF"), but this does not imply that we meet all technical standards, specifications or requirements under the NIST CSF or other sources.


text: We have combatted cybersecurity threats in the normal course of business, but prior cybersecurity incidents have not materially affected, and do not appear likely to materially affect, our operations, business strategy, results of operations or financial condition. However, our Enterprise Risk Management program has recognized that we face ongoing risks from cybersecurity threats that, if not successfully prevented or mitigated, could materially affect us, including our operations, business strategy, results of operations or financial condition. For additional information on this risk, see Item 1A, Risk Factors, of this Annual Report on Form 10-K.


text: Cybersecurity Governance Our Board, with oversight by the Audit Committee, oversees management's processes for identifying and mitigating cybersecurity risks. Executive management including our Chief Information Security Officer ("CISO"), who reports to our General Counsel & Chief Risk Officer, updates the Audit Committee on our cybersecurity posture no less frequently than quarterly and periodically update the full Board.


text: Our EIP organization, led by our CISO, is responsible for the design and implementation of our information security program. Our current CISO has been with the Company for more than eight years—serving as our CISO for nearly seven years—and has extensive cybersecurity experience through leadership and consulting roles. His current leadership team comprising seven individuals has over 130 years of combined cybersecurity experience. These and other EIP team members work closely with stakeholders across the Company to implement the program's policies, standards and processes and help ensure awareness that securing customer information and honoring our privacy promises are core employee obligations, as highlighted in our Code of Ethics and reinforced through our Valuable Information Protection training program.


text: We rely heavily on information technology systems to operate and manage all key aspects of our business. We also process substantial volumes of confidential business information and sensitive consumer and employee personal information, which if impacted by cyber threats, could result in financial and reputational harms and regulatory sanction. We have developed and implemented, and update on an ongoing basis, a risk-based information security program designed to identify, assess and manage material risks from cybersecurity threats.


text: Third parties also play a role in our cybersecurity. We engage third parties for advice and support in the design and implementation of certain program elements and leverage third-party tools to help identify and mitigate cybersecurity risks. Certain specific, defined components of our technology environment are assessed by third-party auditors with a view to align with industry standards such as, for example, the Payment Card Industry Data Security Standards.


text: We have combatted cybersecurity threats in the normal course of business, but prior cybersecurity incidents have not materially affected, and do not appear likely to materially affect, our operations, business strategy, results of operations or financial condition. However, our Enterprise Risk Management program has recognized that we face ongoing risks from cybersecurity threats that, if not successfully prevented or mitigated, could materially affect us, including our operations, business strategy, results of operations or financial condition. For additional information on such risks, see Item 1A, Risk Factors, of this Annual Report on Form 10-K.


text: Cybersecurity Governance Our Board, with oversight by the Audit Committee, oversees management's processes for identifying and mitigating cybersecurity risks. Executive management including our Chief Information Security Officer ("CISO"), who reports to our General Counsel & Chief Risk Officer, update the Audit Committee on our cybersecurity posture no less frequently than quarterly and periodically update the full Board.


text: Our EIP organization, led by our CISO, is responsible for the design and implementation of our information security program. Our current CISO has been with the Company for more than nine years—serving as our CISO for nearly eight years—and has extensive cybersecurity experience through leadership and consulting roles. His current leadership team has over 100 years of combined cybersecurity experience. These and other EIP team members work closely with stakeholders across the company to implement the program's policies, standards and processes. They also help ensure awareness that securing customer information and honoring our privacy promises are core employee obligations, as highlighted in our Code of Ethics and reinforced through our Valuable Information Protection training program.


text: The Company prioritizes and maintains a high level of commitment to responsible and secure cybersecurity practices given the critical nature of its services and the potential consequences of a successful cyber-attack on the Company and the electric grid. A successful cyber-attack could have far-reaching consequences, from compromising the integrity of sensitive data to disrupting power supply. To that end, the Company implements a robust risk management, strategy, and governance regime aimed at ensuring effective controls are in place to identify, mitigate, remediate, and communicate cyber threats at appropriate levels within the organization.

companyName: ARIZONA PUBLIC SERVICE CO


text: APS's cybersecurity group (the "Cybersecurity Group") is comprised of cybersecurity analysts, engineers, architects, and others, led by the Director of Cybersecurity, who reports to APS's Vice President, Operations Support. The Director of Cybersecurity has more than twenty years of experience in information technology and cybersecurity roles, with more than ten of those years at the Company. The Director of Cybersecurity also holds cybersecurity certifications from multiple certifying bodies and is active in utility cybersecurity professional organizations. The Cybersecurity Group has day-to-day responsibility for safeguarding the Company's critical assets and assessing, identifying, and managing material risks from cybersecurity threats.


text: In fulfilling its responsibility, the Cybersecurity Group manages formal documented internal processes such as risk management and vulnerability scanning, as well as other processes, such as assessing threat intelligence, that include outside partners. Intelligence sharing comes from industry sources such as the Electricity Information Sharing and Analysis Center, government sources, as well as commercially purchased information sources. The Cybersecurity Group also engages third parties for assessments and audits of its systems periodically and as needed. Such assessments and audits may include, among other things, pre-production evaluation of technologies, overall program assessments, and compliance program assessments including audits by our regulators.


text: Depending on the products and services provided and the potential for data exchange and technology risk, we may require vendors and service providers to pass APS's vendor risk management program, which sets forth security and data protection requirements, as a condition to doing or continuing to do business with us. For contracts with vendors that will handle or have access to certain sensitive data, APS requires contractual provisions setting forth cybersecurity controls, vulnerability management, secure development practices, and other security and data protection requirements. A subset of vendors that meet a predetermined risk profile due to strategic relationships, technology risk, or other factors is continually monitored by a third-party risk management service, and the Company annually reviews independent assessments of these vendors.


text: The Cybersecurity Group also has documented processes for identifying, responding to, and internally escalating cybersecurity incidents. Once an incident meets certain criteria, the Company's Cybersecurity Incident Command or, in the most severe cases that impact the entire Company, the Corporate Emergency Operations Center is activated and formal response procedures are followed to address the incident. The Cybersecurity Group has a formal incident response plan that details response and escalation procedures, including activation of a Cybersecurity Disclosure Committee, consisting of the Chief Financial Officer and the General Counsel, to assess an incident's materiality with input as needed from the Director of Cybersecurity, Chief Accounting Officer, Chief Information Officer, and others, including outside advisors.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factors entitled "Risks Relating to Our Operations".

companyName: Autodesk, Inc.

ticker: ADSK

stage1Category: None/Other


text: Cybersecurity risk management has been integrated into the Company's overall enterprise risk management program (the "Enterprise Risk Management Program") through policies and processes that implement a risk management framework designed to identify, manage, and monitor business unit risks throughout the organization. The Enterprise Risk Management Program is overseen by an executive committee (the "Executive Risk Committee"), which meets at least quarterly and is comprised of members holding executive leadership positions in the Company, including the Chairman and Chief Executive Officer, President, and other Executive and Senior Vice Presidents, and is chaired and sponsored by the Chief Financial Officer. Every year, as a part of the Enterprise Risk Management Program, the top risks affecting the Company are identified. For 2023, cybersecurity was identified as a top risk. The applicable subject matter experts brief the Company's Board of Directors on the status of all top enterprise risks at least once per year. Finally, the Nuclear and Operating Committee of the Company's Board of Directors provides ultimate oversight of cybersecurity risk and also receives briefings at least twice per year from the Cybersecurity Group, and notable audit findings relating to cybersecurity are aggregated and provided to the Board of Directors' Audit Committee.


text: To date, we do not believe there have been risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Pinnacle West or APS. However, there is no assurance that will continue to be the case. If a significant cybersecurity event or incident were to occur, our ability to fulfill our critical business functions and our business strategy, results of operations, and financial condition could all be materially impacted. See the risk factor entitled, "We are subject to cybersecurity risks and risks of unauthorized access to our systems that could adversely affect our business and financial condition" in Item 1A—Risk Factors for more information.


text: The Cybersecurity Group also has documented processes for identifying, responding to, and internally escalating cybersecurity incidents to management and the Board of Directors. Once an incident meets certain criteria, the Company's Cybersecurity Incident Command or, in the most severe cases that impact the entire Company, the Corporate Emergency Operations Center is activated and formal response procedures are followed to address the incident. The Cybersecurity Group has a formal incident response plan that details response and escalation procedures, including activation of a Cybersecurity Disclosure Committee, consisting of the Chief Financial Officer and the General Counsel, to assess an incident's materiality with input as needed from the Director of Cybersecurity, Chief Accounting Officer, Chief Information Officer, and others, including outside advisors.


text: We describe whether and how risks from identified cybersecurity threats have or that are reasonably likely to affect our financial position, results of operations and cash flows, under the heading "Information technology failures and cybersecurity breaches could harm our business" included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: SEKISUI HOUSE U.S., INC.


text: Cybersecurity risk management has been integrated into the Company's overall enterprise risk management program (the "Enterprise Risk Management Program") through policies and processes that implement a risk management framework designed to identify, manage, and monitor business unit risks throughout the organization. The Enterprise Risk Management Program is overseen by an executive committee (the " Executive Risk Committee "), which meets at least quarterly and is comprised of members holding executive leadership positions in the Company, including the Chairman and Chief Executive Officer, President, and other Executive and Senior Vice Presidents, and is chaired and sponsored by the Chief Financial Officer. Every year, as a part of the Enterprise Risk Management Program, risks affecting the Company are identified. For 2024, cybersecurity was identified as a risk. The applicable subject matter experts brief the Company's Board of Directors on the status of all top enterprise risks at least once per year. Finally, the Nuclear and Operating Committee of the Company's Board of Directors provides ultimate oversight of cybersecurity risk and also receives briefings at least twice per year from the Cybersecurity Group, and notable audit findings relating to cybersecurity are aggregated and provided to the Board of Directors' Audit Committee.


text: As required by Item 106 of Regulation S-K, the following sets forth information regarding our cybersecurity strategy, risk management and governance, which is overseen by Caterpillar and forms a part of Caterpillar's cybersecurity strategy, risk management and governance. A description of Caterpillar's cybersecurity strategy, risk management and governance can be found under Item 1C. Cybersecurity in Caterpillar's 2023 Annual Report on Form 10-K filed separately with the Securities and Exchange Commission.

companyName: CATERPILLAR FINANCIAL SERVICES CORP


text: Cybersecurity Strategy and Risk Management Cybersecurity is critical to advancing our overall objectives and enabling our digital efforts. As a global company, we face a wide variety of cybersecurity threats that range from common attacks such as ransomware and denial-of-service, to attacks from more advanced adversaries. Our customers, suppliers, and other partners face similar cybersecurity threats, and a cybersecurity incident impacting these entities could materially adversely affect our operations, performance and results. These cybersecurity threats and related risks make it imperative that we maintain focus on cybersecurity and systemic risks.


text: We maintain a comprehensive cybersecurity program which is integrated within Caterpillar's enterprise risk management system and encompasses the corporate information technology and operational technology environments as well as customer-facing products. Our cybersecurity program has implemented a governance structure and process to identify, assess, manage, mitigate, respond to and report on cybersecurity risks. We utilize cybersecurity policies and frameworks based on industry and government standards. Our cyber risk management program controls are based on recognized best practices and standards, including the National Institute of Standards and Technology (NIST) Cyber Security Framework and the International Organization for Standardization (ISO 27001) Information Security Management System Requirements. We partner with third parties to support and evaluate our cybersecurity program. These third-party services span areas including cybersecurity maturity assessments, incident response, penetration testing, consulting on best practices, bug bounty programs, and others. We also consume threat intelligence from several paid and non-paid sources.


text: We maintain a 24 x 7 operations center which serves as a central location for the reporting of cybersecurity matters, provides monitoring of our global cybersecurity environment, and coordinates the investigation and remediation of alerts. As cybersecurity events occur, the cybersecurity team focuses on responding to and containing the threat and minimizing impact. In the event of an incident, the cybersecurity team assesses, among other factors, safety impact, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost and potential for reputational harm, with participation from technical, legal and law enforcement support, as appropriate.


text: We have implemented a cybersecurity awareness program which covers topics such as phishing, social networking safety, password security and mobile device usage. We have mandatory training in the areas of cybersecurity, privacy, and confidential information handling. We also conduct regular phishing training and simulations for our employees and contractors. We provide extensive specialized role-based training to technical professionals in cybersecurity, secure application development, and other focus areas. We also conduct periodic tabletop exercises to validate our preparation for cyber events.


text: As a shell company with no current business or operations, our accounting systems are included in the accounting systems of our parent company, Vector Group Ltd. (Commission File No. 1- 5759). Consequently, our management team relies on the cybersecurity processes that our parent company has established to oversee and identify material risks from cybersecurity threats. Therefore, none of the committees are responsible for the oversight of risks from cybersecurity threats. See "Item 1C. Cybersecurity" of Vector Group Ltd.'s Form 10-K for the year ended December 31, 2023 for a discussion of its comprehensive cybersecurity approach.

companyName: MULTI SOFT II, INC


text: We operate a third-party cybersecurity program with the goal of minimizing disruption to the Company's business and production operations, strengthening supply chain resilience, and supporting the integrity of components and systems used in its products and services. We rely heavily on our supply chain to deliver our products and services to our customers, and a cybersecurity incident at a supplier, subcontractor or joint venture partner could materially adversely impact us. We assess third-party cybersecurity controls through a cybersecurity third-party risk assessment process. Identified deficiencies are addressed through a risk remediation process. For select suppliers, we engage third-party cybersecurity monitoring and alerting services, and seek to work directly with those suppliers to address potential deficiencies identified.


text: As of the date of this report, we do not believe that risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. That said, as discussed more fully under Item 1A. "Risk Factors—Operational Risks— Increased information technology security threats and more sophisticated computer crime pose a risk to our systems, networks, products and services" of this Form 10-K, these threats pose a risk to the security of our systems and networks and the confidentiality, availability and integrity of our data. Cybersecurity attacks could also include attacks targeting customer data or the security, integrity and/or reliability of the hardware and software installed in Caterpillar products. It is possible that our information technology systems and networks, or those managed or provided by third parties, could have vulnerabilities, which could go unnoticed for a period of time. While various procedures and controls have been and are being utilized to mitigate such risks, there can be no guarantee that the actions and controls we have implemented and are implementing, or which we cause or have caused third-party service providers to implement, will be sufficient to protect and mitigate associated risks to our systems, information or other property.


text: Caterpillar Cybersecurity Governance Caterpillar's board has oversight for risk management with a focus on the most significant risks facing Caterpillar (including its wholly owned subsidiary, Cat Financial), including strategic, operational, financial and legal compliance risks. The Caterpillar board's risk oversight process builds upon management's risk assessment and mitigation processes, which include an enterprise risk management program of which Caterpillar's cybersecurity processes are an integral component.


text: Caterpillar's board implements its risk oversight function both as a board and through delegation to board committees, which meet regularly and report back to the Caterpillar board. Caterpillar's board has delegated the oversight of specific risks to board committees that align with their functional responsibilities. Caterpillar's Audit Committee (the "Caterpillar AC") assists the Caterpillar board in overseeing the enterprise risk management program and evaluates and monitors risks related to, among other things, Caterpillar's information security program. The Caterpillar AC assesses cybersecurity and information technology risks and the controls implemented to monitor and mitigate these risks. Caterpillar's Chief Information Officer & Senior Vice President, Caterpillar IT (the "Caterpillar CIO") attends all bimonthly Caterpillar AC meetings and provides cybersecurity updates to the Caterpillar AC and Caterpillar board.


text: Caterpillar's cybersecurity program is overseen by the Caterpillar CIO, who has been a Caterpillar employee for nearly twenty-five years. Prior to her current appointment as Caterpillar's CIO in September 2020, she was the Chief Information Officer for the Caterpillar's Financial Products Division, which includes Cat Financial. Her extensive background in IT includes global leadership for large-scale systems transformations, cybersecurity, cloud and application management, global data center management, worldwide network, servers and storage, database management and end-user services. The Caterpillar CIO leads a cross-functional cybersecurity team comprised of professionals from Caterpillar's product, cybersecurity, legal and compliance organizations who focus on managing the security of Caterpillar's connected solutions. This team manages the Caterpillar's global IT systems, IT risk management, cybersecurity, global infrastructure and IT transformations.


text: Cat Financial Cybersecurity Governance Our Risk Committee provides oversight over our information security program and other matters related to cybersecurity. Our President serves as the chair of this committee, which includes among its members our Chief Risk Officer and our Chief Information Officer. Our cybersecurity program is managed by our Chief Information Security Officer, who reports on a regular basis to our Risk Committee on cybersecurity matters and who regularly collaborates with the Caterpillar cybersecurity team.


text: As required by Item 106 of Regulation S-K, the following sets forth information regarding our cybersecurity strategy, risk management and governance, which is overseen by Caterpillar and forms a part of Caterpillar's cybersecurity strategy, risk management and governance. A description of Caterpillar's cybersecurity strategy, risk management and governance can be found under Item 1C. "Cybersecurity" in Caterpillar's Annual Report on Form 10-K for the year ended December 31, 2024 filed separately with the SEC.


text: We maintain a comprehensive cybersecurity program which is integrated within Caterpillar's enterprise risk management system and encompasses the corporate information technology and operational technology environments as well as customer-facing products. Our cybersecurity program has implemented a governance structure and process to identify, assess, manage, mitigate, respond to and report on cybersecurity risks. We utilize cybersecurity policies and frameworks based on industry and government standards. Our cyber risk management program controls are based on recognized best practices and standards, including the National Institute of Standards and Technology (NIST) Cyber Security Framework and the International Organization for Standardization (ISO 27001) Information Security Management System Requirements. We partner with third parties to support and evaluate our cybersecurity program. These third-party services span areas including cybersecurity maturity assessments, incident response, penetration testing, consulting on best practices, bug bounty programs and others. We also consume threat intelligence from several paid and non-paid sources.


text: We have implemented a cybersecurity awareness program which covers topics such as phishing, social networking safety, password security and mobile device usage. We have mandatory training in the areas of cybersecurity, privacy and confidential information handling. We also conduct regular phishing training and simulations for our employees and contractors. We provide extensive specialized role-based training to technical professionals in cybersecurity, secure application development and other focus areas. We also conduct periodic tabletop exercises to validate our preparation for cyber events.


text: Caterpillar Cybersecurity Governance Caterpillar's board has oversight for risk management with a focus on the most significant risks facing Caterpillar (including its wholly-owned subsidiary, Cat Financial), including strategic, operational, financial and legal compliance risks. The Caterpillar board's risk oversight process builds upon management's risk assessment and mitigation processes, which include an enterprise risk management program of which Caterpillar's cybersecurity processes are an integral component.


text: As an externally managed company, we rely on Cantor's information systems in connection with our day-to-day operations. Consequently, we also rely on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by Cantor.

companyName: Cantor Fitzgerald Income Trust, Inc.


text: Caterpillar's cybersecurity program is overseen by the Caterpillar CIO, who has been a Caterpillar employee for nearly 25 years. Prior to her current appointment as Caterpillar's CIO in September 2020, she was the Chief Information Officer for the Caterpillar's Financial Products Division, which includes Cat Financial. Her extensive background in IT includes global leadership for large-scale systems transformations, cybersecurity, cloud and application management, global data center management, worldwide network, servers and storage, database management and end-user services. The Caterpillar CIO leads a cross-functional cybersecurity team comprised of professionals from Caterpillar's product, cybersecurity, legal and compliance organizations who focus on managing the security of Caterpillar's connected solutions. This team manages the Caterpillar's global IT systems, IT risk management, cybersecurity, global infrastructure and IT transformations.


text: Risk Management & Strategy: The Company is committed to maintaining strong and meaningful privacy and security protections for our customers' information by making available sufficient human and financial resources to protect against and monitor cybersecurity threats. These threats have increased as the use of technology has proliferated in our core business. Examples include internet banking, mobile banking, remote deposit capture, work from home accommodations, and advance function ATMs.

companyName: First Bancorp, Inc /ME/

ticker: FNLC


text: The Company has programs in place for the ongoing assessment of cybersecurity threats and risks, has data security programs designed to prevent and detect threats, attacks, incursions and breaches, and processes in place for the management, mitigation and remediation of potential, and any actual, cybersecurity and information technology risks and breaches. The Company maintains a robust vendor management program to oversee and identify material risks stemming from third-party service providers. Information technology staff regularly participates in relevant education opportunities and attends industry events that include cybersecurity matters. The Bank is a member of the Financial Services Information Sharing and Analysis Center (FS-ISAC) and is a participant in the Federal Financial Institutions Examination Council (FFFIEC) Cybersecurity Assessment Tool. Information security training is required for all employees no less than annually.


text: To assist with its information security programs, the Company engages with multiple third-party providers and specialists, including firms with personnel credentialed by internationally recognized organizations such as ISC2, the SANS Institute, and ISACA. Services provided include but are not limited to network evaluations, configuration and vulnerability assessments, penetration testing, and business continuity planning, the results of which are shared with management along with any remediation plans. In addition, an annual information systems and security audit is conducted by the Company's internal audit provider with results reported to the Audit Committee of the Board. Information security matters also fall within the scope of periodic examinations by the Bank's primary regulator, the Office of the Comptroller of the Currency (OCC).


text: Included in our mitigation strategy is a comprehensive cybersecurity insurance policy. The Board and Management recognize that cybersecurity matters, including expenditure related threats and the impact of incursions or breaches, may trigger disclosure requirements under SEC rules and regulations, and intend to remain vigilant with respect to the cybersecurity aspects of these obligations.


text: Neither the Bank nor the Company have experienced any information security breaches of its systems in the past five years. Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, despite our cybersecurity risk management processes, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us. For additional information, see Item 1A. "Risk Factors" for a discussion of cybersecurity risks that we face.


text: Air Group's management and Board consider cybersecurity to be a critical component of the Company's risk management plan. Our systems are subject to increasing and evolving cybersecurity risks. Unauthorized parties have attempted and continue to attempt to gain access to our systems and information, including through fraudulent misrepresentation and other means of deception. The systems of our suppliers, vendors, and other business partners are also at risk. The threat of cybersecurity incidents is included within our company's annual enterprise risk management (ERM) program that assesses the most significant risks to the enterprise.

companyName: ALASKA AIR GROUP, INC.

ticker: ALK


text: Because of the industry in which we operate, we are subject to extensive regulatory requirements connected to cybersecurity, including but not limited to those overseen by the FAA, TSA, and DOT. As a result, it is imperative our cybersecurity risk management is well-planned and sufficiently robust to maintain compliance with these regulations.


text: Governance: Our Board has overall oversight responsibility with respect to the Company's approach to risk management, including cybersecurity risks. Although the Board has the ultimate responsibility for risk oversight, operational responsibility for cybersecurity matters is delegated to the Chief Information Officer (CIO) who oversees all technology needs of the Company, including the assessment and management of material risks from cybersecurity threats. The CIO has over thirty years experience in bank operations including network security and cybersecurity matters. The Bank employs a full-time Cybersecurity Analyst (CA) who brings over twenty-five years of information technology and network security experience to the role. In addition, we have various management- and Board-level committees that also oversee risk to the extent it relates to the committee's responsibilities and provides reports to the Board in its respective area of responsibility. Information security matters are a standing topic for the Management-only Technology Steering Committee (TSC) where membership includes the CIO, CA and other senior level managers, and the Management-Board level Enterprise Risk Management (ERM) Committee where membership includes the CIO, senior level managers, and a represent from the Board. Minutes from each ERM session are reported to the Audit Committee of the Board, and the CIO provides information security updates at each meeting of the Board.


text: The Company has programs in place for the ongoing assessment of cybersecurity threats and risks, has data security programs designed to prevent and detect threats, attacks, incursions and breaches, and processes in place for the management, mitigation and remediation of potential, and any actual, cybersecurity and information technology risks and breaches. The Company maintains a robust vendor management program to oversee and identify material risks stemming from third-party service providers. Information technology staff regularly participates in relevant education opportunities and attends industry events that include cybersecurity matters. The Bank is a member of the Financial Services Information Sharing and Analysis Center ("FS-ISAC") and is a participant in the Federal Financial Institutions Examination Council ("FFFIEC") Cybersecurity Assessment Tool ("CAT"). The Bank has plans to move to a new cybersecurity assessment tool in 2025 as the FFIEC is sunsetting the CAT. Information security training is required for all employees no less than annually.


text: To assist with its information security programs, the Company engages with multiple third-party providers and specialists, including firms with personnel credentialed by internationally recognized organizations such as ISC2, the SANS Institute, and ISACA. Services provided include but are not limited to network evaluations, configuration and vulnerability assessments, penetration testing, and business continuity planning, the results of which are shared with management along with any remediation plans. In addition, an annual information systems and security audit is conducted by the Company's internal audit provider with results reported to the Audit Committee of the Board. Information security matters also fall within the scope of periodic examinations by the Bank's primary regulator, the Office of the Comptroller of the Currency ("OCC").


text: Governance: Our Board has overall oversight responsibility with respect to the Company's approach to risk management, including cybersecurity risks. Although the Board has the ultimate responsibility for risk oversight, operational responsibility for cybersecurity matters is delegated to the Chief Information Officer ("CIO") who oversees all technology needs of the Company, including the assessment and management of material risks from cybersecurity threats. The CIO has over thirty years experience in bank operations including network security and cybersecurity matters. The Bank employs a full-time Cybersecurity Analyst ("CA") who brings over twenty-five years of information technology and network security experience to the role. In addition, we have various management- and Board-level committees that also oversee risk to the extent it relates to the committee's responsibilities and provides reports to the Board in its respective area of responsibility. Information security matters are a standing topic for the Management-only Technology Steering Committee ("TSC") where membership includes the CIO, CA and other senior level managers, and the Management-Board level Enterprise Risk Management ("ERM") Committee where membership includes the CIO, senior level managers, and a representative from the Board. Minutes from each ERM session are reported to the Audit Committee of the Board, and the CIO provides information security updates at each meeting of the Board.


text: The Company's Chief Information Security Officer (CISO) is responsible for management of material risks from cybersecurity threats. The CISO has multiple years of experience working in information and network security management, and has in-depth knowledge of compliance requirements and standards set by various regulatory agencies. The CISO leads a team dedicated to the prevention, mitigation, detection, and remediation of any cybersecurity incidents. If a potential incident is identified, the CISO is notified and engages the cybersecurity incident response team (CyberSIRT). This team is responsible for declaring a cybersecurity incident and is comprised of individuals from multiple relevant departments. In the event the CyberSIRT declares an incident, the CISO provides overall direction for the response and mitigation of the threat. This response includes actions taken to protect our data and networks, evaluation of the potential materiality of the incident, and the communication of the incident to critical parties, including senior leadership and the Board of Directors.


text: As part of our annual review of our cybersecurity risk management, we engage third-parties for a variety of processes including external audits, vulnerability assessments, and penetration tests. These processes help ensure our overarching strategy remains effective over time.


text: The Board of Directors is responsible for overseeing management's processes to identify and mitigate risks, including cybersecurity risks. The Board's Audit Committee leads the review and discussion of cybersecurity threats with management and receives updates from the CISO each quarter. Senior management, including the CISO, are available to address questions or concerns from the Audit Committee related to our risk management plan.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our organization. For additional discussion related to the Company's consideration of cybersecurity risks and their potential impact on our business strategy, results of operations, or financial condition, please refer to Part I, Item 1A. "Risk Factors" in this document.


text: Air Group's management and Board consider cybersecurity to be a critical component of the Company's risk management plan. Our systems are subject to increasing and evolving cybersecurity risks. Unauthorized parties have attempted and continue to attempt to gain access to our systems and information, including through fraudulent misrepresentation and other means of deception. The systems of our suppliers, vendors, and other business partners are also at risk. The threat of cybersecurity incidents is included within our company's annual Enterprise Risk Management (ERM) program that assesses the most significant risks to the enterprise.


text: Because of the industry in which we operate, we are subject to extensive cybersecurity regulation, including but not limited to those regulations overseen by the FAA, TSA, and DOT. As a result, it is imperative our cybersecurity risk management is well-planned and sufficiently robust to maintain compliance with these regulations.


text: The Company's Chief Information Security Officer (CISO) is responsible for management of material risks from cybersecurity threats. The CISO has multiple years of experience working in information and network security management, and has in-depth knowledge of compliance requirements and standards set by various regulatory agencies. The CISO leads a team dedicated to the prevention, mitigation, detection, and remediation of any cybersecurity incidents. If a potential incident is identified, the CISO is notified and engages the cybersecurity incident response team (CyberSIRT). This team is responsible for declaring a cybersecurity incident and comprises individuals from multiple relevant departments. In the event the CyberSIRT declares an incident, the CISO provides overall direction for the response and mitigation of the threat. This response includes actions taken to protect our data and networks, evaluation of the potential materiality of the incident, and the communication of the incident to critical parties, including senior leadership and the Board of Directors.


text: The Board of Directors of Alaska Air Group is responsible for overseeing management's processes to identify and mitigate risks, including cybersecurity risks. The Board's Audit Committee leads the review and discussion of cybersecurity threats with management and receives updates from the CISO each quarter. Senior management, including the CISO, are available to address questions or concerns from the Audit Committee related to our risk management plan.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our organization. For additional discussion related to the Company's consideration of cybersecurity risks and their potential impact on our business strategy, results of operations, or financial condition, please refer to Part I, Item 1A. "Risk Factors" in this document.


text: Our information technology networks, those of our operators and managers, and those of third parties on whom we rely, are important enablers to our ability to perform day-to-day operations of our business. Our business operations depend on the secure collection, storage, transmission and other processing of proprietary, confidential or sensitive data.

companyName: WELLTOWER INC.

ticker: WELL


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats. Our cybersecurity program includes several safeguards such as access controls, multi-factor authentication, continuous monitoring and alerting systems for internal and external threats and penetration testing. Additionally, we conduct regular evaluation of our cybersecurity program, encompassing internal reviews and third-party assessments to ensure its effectiveness and resilience.


text: The Board of Directors (the "Board") retains ultimate oversight of cybersecurity risk, which it manages through our enterprise risk management program. The Board has delegated primary responsibility of overseeing cybersecurity risks to the Audit Committee. The Audit Committee's responsibilities include reviewing cybersecurity strategies with management, assessing processes and controls pertaining to the management of our information technology operations and their effectiveness, and seeking to confirm that management's response to potential cybersecurity incidents is timely and effective. At least annually, the Audit Committee receives a cybersecurity report from management. This report may cover a variety of relevant topics, potentially including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations related to our operators, managers and third parties. The scope and focus of each report are determined based on current priorities and emerging issues in cybersecurity. The Audit Committee and management also report to the Board at least annually on data protection and cybersecurity matters.


text: Management and Cybersecurity Working Group Reporting to the Chief Operating Officer, our Chief Technology Officer, with extensive cybersecurity knowledge and skills from over 20 years of relevant work experience at Welltower and elsewhere, leads the team responsible for developing and implementing our information security program across our business. This team comprises individuals with relevant educational and technical experience, many having held similar positions with responsibility for various aspects of cybersecurity at large organizations. This team works closely with the Legal department to oversee compliance and regulatory and contractual security requirements. The Chief Technology Officer also leads our Cyber Security Working Group, which is comprised of a cross-functional team including Internal Audit, Legal, Information Technology, Risk Management and Accounting leaders. These individuals meet regularly and are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents. The Chief Technology Officer is responsible for reporting on cybersecurity and information technology to the Audit Committee.


text: Information Security Program The information security team provides regular reports to the Chief Technology Officer and other relevant teams on various cybersecurity threats, assessments and findings. In addition to our internal cybersecurity capabilities, we also periodically engage assessors, consultants, auditors or other third parties to provide consultation and advice to assist with assessing, identifying and managing cybersecurity risks. Our management team identifies and assesses information security risks using industry practices informed by the National Institute of Standards and Technology ("NIST"), including the NIST Cybersecurity Framework.


text: To ensure that cybersecurity is an organization-wide effort, we provide mandatory cybersecurity training at least annually for all employees with network access, including training designed to simulate and help prevent phishing and other social engineering attacks. We also employ systems and processes designed to oversee, identify and reduce the potential impact of a security incident at a third-party vendor, service provider or otherwise implicating the third-party technology and systems we use. Additionally, we maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our cybersecurity and information technology infrastructure.


text: Incident Response The Cybersecurity Working Group maintains and oversees an incident response plan that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to cybersecurity incidents. The incident response plan sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The objectives of the incident response plan are to reduce the number of systems and users affected by security incidents, reduce the time a threat actor spends within our network, reduce the damage caused by the breach and reduce the time required to restore normal operations. The incident response plan also specifies the use of third-party experts for legal advice, consulting and cyber incident response.


text: Material Cybersecurity Risks, Threats and Incidents While we employ several measures to prevent, detect and mitigate cybersecurity threats, there is no guarantee such efforts will be successful. We also rely on information technology and other third-party vendors to support our business, including securely processing personal, confidential, financial, sensitive or proprietary and other types of information. Despite our efforts to improve our ability, and the ability of relevant third parties', to protect against cyber threats, we may not be able to protect all information, systems, products and services. While we are not aware of any cybersecurity incidents that have materially affected us to date, there can be no guarantee that we will not be the subject of future attacks, threats or incidents, that may have a material impact on our business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Form 10-K under the heading "Cybersecurity incidents could disrupt our business and result in the loss of confidential information and legal liability," which should be read in conjunction with the foregoing information.